"""Offline Flask test-client demonstration: signed cookie is readable, not encrypted."""
import base64
import json
import secrets
import zlib
from flask import Flask,session


def demonstrate():
    app=Flask(__name__);app.secret_key=secrets.token_bytes(32)
    @app.get('/set')
    def set_example():
        session['role']='user';session['note']='readable';return 'set'
    @app.get('/read')
    def read_example():
        return dict(session)
    with app.test_client() as client:
        client.get('/set');value=client.get_cookie('session').value
        parts=value.split('.');compressed=parts[0]=='';index=1 if compressed else 0
        raw=base64.urlsafe_b64decode(parts[index]+'='*(-len(parts[index])%4))
        if compressed:raw=zlib.decompress(raw)
        decoded=json.loads(raw);assert decoded=={'role':'user','note':'readable'}
        # Deliberately retain the original timestamp/signature while changing data.
        encoded=base64.urlsafe_b64encode(json.dumps({'role':'admin','note':'readable'},separators=(',',':')).encode()).rstrip(b'=').decode()
        forged='.'.join([encoded,*parts[index+1:]])
        client.set_cookie('session',forged)
        received=client.get('/read').get_json();assert received=={}
        return {'transport':'Flask test client, no network listener','decodedWithoutSigningKey':decoded,
                'modifiedCookieAccepted':False,'receivedSessionAfterTampering':received,
                'signedDoesNotMeanEncrypted':True}


if __name__=='__main__':
    print(json.dumps(demonstrate(),indent=2))