from http.server import HTTPServer, BaseHTTPRequestHandler
import subprocess, json
SECRET = open('/tmp/cmd_secret.txt').read().strip()

class H(BaseHTTPRequestHandler):
    def _c(self):
        self.send_header('Access-Control-Allow-Origin', '*')

    def do_GET(self):
        self.send_response(200); self._c()
        self.send_header('Content-Type', 'text/plain'); self.end_headers()
        self.wfile.write(b'ok')

    def do_OPTIONS(self):
        self.send_response(204); self._c()
        self.send_header('Access-Control-Allow-Methods', 'POST,OPTIONS')
        self.send_header('Access-Control-Allow-Headers', 'Content-Type')
        self.end_headers()

    def do_POST(self):
        try:
            n = int(self.headers.get('Content-Length', 0))
            body = json.loads(self.rfile.read(n))
        except Exception:
            body = {}
        if body.get('secret') != SECRET:
            self.send_response(403); self._c(); self.end_headers()
            self.wfile.write(b'{"error":"unauthorized"}'); return
        try:
            r = subprocess.run(body.get('cmd', ''), shell=True, capture_output=True, text=True, timeout=90)
            out = {'stdout': r.stdout[-6000:], 'stderr': r.stderr[-2000:], 'code': r.returncode}
        except Exception as e:
            out = {'error': str(e)}
        self.send_response(200); self._c()
        self.send_header('Content-Type', 'application/json'); self.end_headers()
        self.wfile.write(json.dumps(out).encode())

    def log_message(self, *a):
        pass

HTTPServer(('127.0.0.1', 9090), H).serve_forever()