id = 7
title = "The Manager's Secret"

instructions = """
HTTP is a two-way street. While your request headers tell the server
what you want, response headers tell you what actually happened. They
carry metadata, security tokens, and sometimes hidden debugging hints.

To inspect responses, use:
  1. -i
     Show response headers + body.
  2. -I
     Headers only (skip massive responses).
  3. -v
     Full request/response debug view.
  4. -A "Your Disguise"
     Change your User-Agent (pretend to be someone else).

---

Briefing:
After dealing with the new API rules, you realize something:
the system exposes more than it should.

Recently, you overheard your colleagues gossiping about special 
discount coupons reserved only for managers. It would be great 
if you could get your hands on one.

Base URL: http://localhost:8080

Available endpoints:
  GET  /employee-portal                  : Employee portal
  GET  /staff-inventory?token=TOKEN      : Staff inventory
  GET  /manager-vault?token=TOKEN        : Manager vault

Your mission:
  1. Visit /employee-portal and find the X-Manager-Token in headers.
  2. Use that token on /staff-inventory. The response is HUGE, so
     use -I to find X-Required-Device without printing 10,000 lines.
  3. Change your User-Agent to match the required device and visit
     /manager-vault with the token.
  4. Find the X-Ultimate-Coupon in the response headers.

Submit the coupon code to enjoy your illegal discount.

---

"""
solutions = [
    """# 1. Intercept the Employee Portal
curl -i http://localhost:8080/employee-portal""",
    """# 2. Scan Staff Inventory (skip the 10,000 lines)
curl -I "http://localhost:8080/staff-inventory?token=Manager-Access-99"""",
    """# 3. Become the Boss
curl -v -A "The-Bosses-iPad" "http://localhost:8080/manager-vault?token=Manager-Access-99"
# Look for X-Ultimate-Coupon in headers!""",
]

submit_prompt = "Enter the X-Ultimate-Coupon code:"

[server]
port = 8080

[verify.input]
contains = ["ULTIMATE_99_OFF"]
error = "Incorrect. Did you impersonate the boss correctly and extract the X-Ultimate-Coupon?"