added 'monitoring' path - ask devs why it's there

monitoring/artc0/grafana-auth-check.php

@@ -0,0 +1,52 @@
+<?php
+/**
+ * Grafana auth_request endpoint — nginx calls this to validate PHP session
+ * before proxying to cast04:3000 (Grafana).
+ *
+ * If session is valid: HTTP 200 + X-WEBAUTH-USER header (username)
+ * If not authenticated: HTTP 401 (nginx redirects to /app/androidcast_project/login)
+ *
+ * Deploy to: /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php
+ */
+
+// Only allow calls from nginx itself (127.0.0.1) — block direct browser access
+if (!in_array($_SERVER['REMOTE_ADDR'] ?? '', ['127.0.0.1', '::1'], true)) {
+    http_response_code(403);
+    exit;
+}
+
+// Session handling — must match the main app's session settings
+if (session_status() === PHP_SESSION_NONE) {
+    session_set_cookie_params([
+        'path'     => '/app/androidcast_project/',
+        'secure'   => isset($_SERVER['HTTPS']),
+        'httponly' => true,
+        'samesite' => 'Lax',
+    ]);
+    session_start();
+}
+
+// Check if user is logged in — Auth.php stores array in $_SESSION['user']
+// with at least { 'id' => int, 'username' => string, ... }
+$user = $_SESSION['user'] ?? null;
+
+if (empty($user) || empty($user['id'])) {
+    http_response_code(401);
+    exit;
+}
+
+// Require full login (not just 2FA pending)
+if (isset($user['pending_2fa']) && $user['pending_2fa']) {
+    http_response_code(401);
+    exit;
+}
+
+$username = (string)($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
+
+// Sanitize — Grafana username must be a valid identifier
+$grafana_user = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
+
+http_response_code(200);
+header('X-WEBAUTH-USER: ' . $grafana_user);
+header('Content-Type: text/plain');
+echo 'ok';