"""Local-only synthetic document application; never deploy this fixture publicly."""
import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from urllib.parse import urlsplit, parse_qs
DOCUMENTS={'doc-a':{'owner':'a','tenant':'x','marker':'synthetic-private-A'},'doc-b':{'owner':'b','tenant':'y','marker':'synthetic-private-B'}}
class Handler(BaseHTTPRequestHandler):
    def log_message(self,*args):pass
    def do_GET(self):
        url=urlsplit(self.path); query=parse_qs(url.query); mode=query.get('mode',['fixed'])[0]
        user=self.headers.get('X-Fixture-User','anonymous');code=404;body={'error':'missing'}
        if url.path=='/.env':
            code=200 if mode in ('vulnerable','spa') else 404
            body='<html>Application fallback</html>' if mode=='spa' else 'APP_ENV=fixture\nAPI_SECRET=not-a-working-key' if mode=='vulnerable' else 'not found'
        elif url.path.startswith('/documents/'):
            doc=DOCUMENTS.get(url.path.split('/')[2]);download=url.path.endswith('/download')
            if user=='anonymous':code=401;body={'error':'login required'}
            elif doc:
                allowed=user==doc['owner'] or user=='guest' and doc['owner']=='a' or mode=='vulnerable'
                code=200 if allowed else 403;body={'marker':doc['marker'],'download':download} if allowed else {'error':'forbidden'}
        raw=(json.dumps(body) if isinstance(body,dict) else body).encode();self.send_response(code);self.send_header('Content-Type','text/html' if isinstance(body,str) and body.startswith('<html>') else 'application/json' if isinstance(body,dict) else 'text/plain');self.send_header('Content-Length',str(len(raw)));self.end_headers();self.wfile.write(raw)
if __name__=='__main__':
    server=ThreadingHTTPServer(('127.0.0.1',8769),Handler)
    print('Synthetic fixture on http://127.0.0.1:8769; Ctrl-C to stop',flush=True)
    try:server.serve_forever()
    finally:server.server_close()