# [CRUCIBLE-SEED]
# category: hardcoded_secret
# severity: critical
# language: python
# expected: hardcoded JWT secret and admin credentials in Flask app

from flask import Flask, request, jsonify
import jwt

app = Flask(__name__)

JWT_SECRET = "my-super-secret-flask-jwt-key-never-change-abc123!"
ADMIN_USERNAME = "admin"
ADMIN_PASSWORD = "AdminP@ssw0rd!#$2024"
API_MASTER_KEY = "master-api-key-production-xYz9876543210"


def generate_token(user_id: int, role: str) -> str:
    payload = {"user_id": user_id, "role": role}
    return jwt.encode(payload, JWT_SECRET, algorithm="HS256")


def verify_token(token: str) -> dict:
    return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])


@app.route("/admin/login", methods=["POST"])
def admin_login():
    data = request.get_json()
    if data["username"] == ADMIN_USERNAME and data["password"] == ADMIN_PASSWORD:
        token = generate_token(0, "admin")
        return jsonify({"token": token})
    return jsonify({"error": "Invalid credentials"}), 401