// Jenkins init script: security realm, admin user, inbound agent node, and a
// log recorder that targets the agent-side ring-buffer logger namespace.
import jenkins.model.Jenkins
import hudson.security.HudsonPrivateSecurityRealm
import hudson.security.FullControlOnceLoggedInAuthorizationStrategy
import hudson.slaves.DumbSlave
import hudson.slaves.JNLPLauncher
import hudson.logging.LogRecorder
import java.util.logging.Level

def instance = Jenkins.get()

// 1. Security realm with a known admin account (admin = the XSS victim).
def realm = new HudsonPrivateSecurityRealm(false)
if (realm.getUser('admin') == null) {
    realm.createAccount('admin', 'Admin12345!')
}
instance.setSecurityRealm(realm)
def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
strategy.setAllowAnonymousRead(false)
instance.setAuthorizationStrategy(strategy)

// 2. Inbound (JNLP) agent node. The attacker controls the agent PROCESS.
if (instance.getNode('agent1') == null) {
    def node = new DumbSlave('agent1', '/tmp/agent1-work', new JNLPLauncher())
    node.setNumExecutors(1)
    instance.addNode(node)
}

// 3. System log recorder targeting the logger namespace whose records the
//    controller fetches from connected agents (SlaveComputer.LogHolder
//    SLAVE_LOG_HANDLER ring buffer, attached agent-side to
//    "hudson.slaves.SlaveComputer").
def mgr = instance.getLog()
if (mgr.getLogRecorder('agentlog') == null) {
    def rec = new LogRecorder('agentlog')
    rec.getLoggers().add(new LogRecorder.Target('hudson.slaves.SlaveComputer', Level.ALL))
    mgr.getRecorders().add(rec)
    rec.save()
    rec.getLoggers().forEach { it.enable() }
}

// 4. Export the JNLP agent secret for the attacker agent process.
def secret = jenkins.slaves.JnlpAgentReceiver.SLAVE_SECRET.mac('agent1')
new File(instance.getRootDir(), 'agent1-secret.txt').text = secret

instance.save()
println('CVE_2026_84648_INIT_SETUP_COMPLETE')