# 취약: 과도한 CORS 허용
@app.after_request
def add_cors_headers(resp):
    resp.headers["Access-Control-Allow-Origin"] = "*"
    resp.headers["Access-Control-Allow-Headers"] = "*"
    return resp

# 취약: 하드코딩 비밀
API_TOKEN = "supersecret123"
DB_PATH = "users.db"

# 초기 DB 생성 (데모용)
def init_db():
    conn = sqlite3.connect(DB_PATH)
    cur = conn.cursor()
    cur.execute("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, username TEXT, password_md5 TEXT)")
    # 데모 계정 (비밀번호: password)
    cur.execute("DELETE FROM users")
    cur.execute("INSERT INTO users (username, password_md5) VALUES ('admin', ?)", (hashlib.md5(b"password").hexdigest(),))
    conn.commit()
    conn.close()