# [CRUCIBLE-SEED]
# category: eval_abuse
# severity: critical
# language: python
# expected: exec() called with user-controlled code string

from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/scripting/run", methods=["POST"])
def run_script():
    data = request.get_json()
    code = data.get("code", "")
    context = data.get("context", {})
    local_vars = {"result": None, **context}
    try:
        # exec() executes arbitrary Python — no sandboxing
        exec(code, {"__builtins__": __builtins__}, local_vars)
        return jsonify({"result": local_vars.get("result")})
    except Exception as e:
        return jsonify({"error": str(e)}), 400


@app.route("/hooks/execute", methods=["POST"])
def execute_hook():
    hook_code = request.get_json().get("hook", "")
    event = request.get_json().get("event", {})
    # User-controlled hook code executed server-side
    exec(hook_code, {"event": event, "print": print})
    return jsonify({"executed": True})


@app.route("/migration/run", methods=["POST"])
def run_migration():
    migration_script = request.get_json().get("script", "")
    exec(compile(migration_script, "<migration>", "exec"))
    return jsonify({"status": "done"})