add script to first connection

ezicom_login.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Small eZICOM5 login helper.
+
+Credentials are read from environment variables, command line arguments, or
+interactive prompts. They are never written to disk by this script.
+"""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import http.cookiejar
+import os
+import ssl
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+
+DEFAULT_BASE_URL = "https://zm.sufw.de:31443"
+DEFAULT_USER_AGENT = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) "
+    "Gecko/20100101 Firefox/151.0"
+)
+
+
+def load_dotenv(path: Path = Path(".env")) -> None:
+    if not path.exists():
+        return
+
+    for line in path.read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+
+        key, value = line.split("=", 1)
+        key = key.strip()
+        value = value.strip().strip("'\"")
+        if key and key not in os.environ:
+            os.environ[key] = value
+
+
+def make_opener(insecure: bool) -> urllib.request.OpenerDirector:
+    cookie_jar = http.cookiejar.CookieJar()
+    handlers: list[urllib.request.BaseHandler] = [
+        urllib.request.HTTPCookieProcessor(cookie_jar)
+    ]
+    if insecure:
+        context = ssl._create_unverified_context()
+        handlers.append(urllib.request.HTTPSHandler(context=context))
+    return urllib.request.build_opener(*handlers)
+
+
+def request(
+    opener: urllib.request.OpenerDirector,
+    url: str,
+    *,
+    method: str = "GET",
+    data: dict[str, str] | None = None,
+    headers: dict[str, str] | None = None,
+    timeout: float = 20.0,
+) -> tuple[int, str, str]:
+    body = None
+    request_headers = {
+        "User-Agent": DEFAULT_USER_AGENT,
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+    }
+    if headers:
+        request_headers.update(headers)
+    if data is not None:
+        body = urllib.parse.urlencode(data).encode("ascii")
+        request_headers["Content-Type"] = "application/x-www-form-urlencoded"
+
+    req = urllib.request.Request(
+        url,
+        data=body,
+        headers=request_headers,
+        method=method,
+    )
+    try:
+        with opener.open(req, timeout=timeout) as response:
+            raw = response.read()
+            charset = response.headers.get_content_charset() or "iso-8859-1"
+            return response.status, response.geturl(), raw.decode(charset, "replace")
+    except urllib.error.HTTPError as error:
+        raw = error.read()
+        charset = error.headers.get_content_charset() or "iso-8859-1"
+        return error.code, error.geturl(), raw.decode(charset, "replace")
+
+
+def login(
+    base_url: str,
+    username: str,
+    password: str,
+    *,
+    insecure: bool,
+    save_response: Path | None,
+) -> int:
+    base_url = base_url.rstrip("/")
+    opener = make_opener(insecure)
+
+    try:
+        initial_status, _, _ = request(opener, base_url + "/")
+    except urllib.error.URLError as error:
+        print(f"Could not open initial page: {error}", file=sys.stderr)
+        if "CERTIFICATE_VERIFY_FAILED" in str(error):
+            print("Hint: retry with --insecure or install the issuing CA.", file=sys.stderr)
+        return 2
+
+    if initial_status >= 400:
+        print(f"Initial page returned HTTP {initial_status}", file=sys.stderr)
+        return 2
+
+    try:
+        status, final_url, html = request(
+            opener,
+            base_url + "/user",
+            method="POST",
+            data={"action": "login", "uid": username, "pw0": password},
+            headers={
+                "Origin": base_url,
+                "Referer": base_url + "/",
+            },
+        )
+    except urllib.error.URLError as error:
+        print(f"Could not submit login form: {error}", file=sys.stderr)
+        if "CERTIFICATE_VERIFY_FAILED" in str(error):
+            print("Hint: retry with --insecure or install the issuing CA.", file=sys.stderr)
+        return 2
+
+    if save_response:
+        save_response.write_text(html, encoding="utf-8")
+
+    lower_html = html.lower()
+    failed = (
+        status in {401, 403}
+        or "benutzername und/oder kennwort" in lower_html
+        or "error 403" in lower_html
+        or "403 - verboten" in lower_html
+    )
+
+    if failed:
+        print(f"Login failed: HTTP {status} ({final_url})", file=sys.stderr)
+        return 1
+
+    print(f"Login looks successful: HTTP {status} ({final_url})")
+    if save_response:
+        print(f"Saved response HTML to {save_response}")
+    return 0
+
+
+def parse_args() -> argparse.Namespace:
+    load_dotenv()
+
+    parser = argparse.ArgumentParser(
+        description="Log in to the SUFW eZICOM5 web UI."
+    )
+    parser.add_argument("--base-url", default=DEFAULT_BASE_URL)
+    parser.add_argument("-u", "--username", default=os.getenv("EZICOM_USERNAME"))
+    parser.add_argument("-p", "--password", default=os.getenv("EZICOM_PASSWORD"))
+    parser.add_argument(
+        "--insecure",
+        action="store_true",
+        help="Disable TLS certificate verification if the server certificate cannot be verified.",
+    )
+    parser.add_argument(
+        "--save-response",
+        type=Path,
+        help="Optional path for saving the post-login HTML response for inspection.",
+    )
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    username = args.username or input("eZICOM username: ")
+    password = args.password or getpass.getpass("eZICOM password: ")
+    return login(
+        args.base_url,
+        username,
+        password,
+        insecure=args.insecure,
+        save_response=args.save_response,
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())