magister

> **Note:** Undocumented API, may change without notice.

All API steps use `web_fetch` with header `Authorization: Bearer {token}`. Times are UTC.

> **Fallback:** If `web_fetch` returns 401, your implementation likely does not support custom headers.
> Use `curl` instead:
> ```bash
> curl -s -H "Authorization: Bearer {token}" {url}
> ```

# Obtain token

Write the following to `/tmp/magister_auth.py`:

```python
import http.cookiejar, json, os, re, secrets, urllib.parse, urllib.request

jar = http.cookiejar.CookieJar()

class Capture(urllib.request.HTTPRedirectHandler):
    token = ""
    def redirect_request(self, req, fp, code, msg, hdrs, newurl):
        p = urllib.parse.urlparse(newurl)
        if p.path.endswith("redirect_callback.html"):
            Capture.token = urllib.parse.parse_qs(p.fragment).get("access_token", [""])[0]
            return None
        return super().redirect_request(req, fp, code, msg, hdrs, newurl)

cap    = Capture()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar), cap)

qs = urllib.parse.urlencode({
    "client_id": f"M6-{os.environ['MAGISTER_HOST']}", "state": secrets.token_urlsafe(16),
    "redirect_uri": f"https://{os.environ['MAGISTER_HOST']}/oidc/redirect_callback.html",
    "response_type": "id_token token", "acr_values": f"tenant:{os.environ['MAGISTER_HOST']}",
    "nonce": secrets.token_urlsafe(16),
    "scope": "openid profile attendance.overview calendar.user grades.read",
})
resp      = opener.open(f"https://accounts.magister.net/connect/authorize?{qs}")
login_url = resp.geturl()
session_id = re.search(r"sessionId=([a-f0-9A-F-]+)", login_url).group(1)
return_url = urllib.parse.unquote(re.search(r"returnUrl=([^&]+)", login_url).group(1))

def challenge(path, extra):
    body = json.dumps({"sessionId": session_id, "returnUrl": return_url,
                       **extra}).encode()
    req  = urllib.request.Request(f"https://accounts.magister.net/challenges/{path}", data=body,
           headers=...