# 依赖: pip install cryptography
import base64, json, time, urllib.request
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding, rsa

BASE = '{{BASE}}'
CODE = 'YOUR-CARD-KEY'
OAEP = padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA1()),
                    algorithm=hashes.SHA1(), label=None)

def encrypt(plain, public_key):
    data = plain.encode('utf-8')
    parts = []
    for i in range(0, len(data), 190):
        parts.append(base64.b64encode(public_key.encrypt(data[i:i + 190], OAEP)).decode())
    return '|'.join(parts)

def decrypt(cipher, private_key):
    return ''.join(
        private_key.decrypt(base64.b64decode(p), OAEP).decode('utf-8')
        for p in cipher.split('|')
    )

# 1. 获取服务器公钥
with urllib.request.urlopen('{{PUBKEY}}') as r:
    server_pub = serialization.load_pem_public_key(
        json.loads(r.read())['data']['public_key'].encode()
    )

# 2. 生成客户端密钥对
client_priv = rsa.generate_private_key(public_exponent=65537, key_size=2048)
client_pub = client_priv.public_key().public_bytes(
    serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
).decode()

# 3. 组装并加密请求
payload = json.dumps({
    'code': CODE,
    'timestamp': int(time.time()),
    'client_public_key': client_pub,
})
body = json.dumps({'encrypted': encrypt(payload, server_pub)}).encode()

# 4. 发送请求
req = urllib.request.Request('{{VERIFY}}', data=body,
                             headers={'Content-Type': 'application/json'})
with urllib.request.urlopen(req) as r:
    resp = json.loads(r.read())

# 5. 解密响应
print(decrypt(resp['encrypted'], client_priv) if 'encrypted' in resp
      else json.dumps(resp, ensure_ascii=False))
