<?php
/**
 * Grafana auth_request endpoint — nginx calls this to validate PHP session
 * before proxying to cast04:3000 (Grafana).
 *
 * If session is valid: HTTP 200 + X-WEBAUTH-USER header (username)
 * If not authenticated: HTTP 401 (nginx redirects to /app/androidcast_project/login)
 *
 * Deploy to: /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php
 */

// Only allow calls from nginx itself (127.0.0.1) — block direct browser access
if (!in_array($_SERVER['REMOTE_ADDR'] ?? '', ['127.0.0.1', '::1'], true)) {
    http_response_code(403);
    exit;
}

// Session handling — must match the main app's session settings
if (session_status() === PHP_SESSION_NONE) {
    session_set_cookie_params([
        'path'     => '/app/androidcast_project/',
        'secure'   => isset($_SERVER['HTTPS']),
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_start();
}

// Check if user is logged in — Auth.php stores array in $_SESSION['user']
// with at least { 'id' => int, 'username' => string, ... }
$user = $_SESSION['user'] ?? null;

if (empty($user) || empty($user['id'])) {
    http_response_code(401);
    exit;
}

// Require full login (not just 2FA pending)
if (isset($user['pending_2fa']) && $user['pending_2fa']) {
    http_response_code(401);
    exit;
}

$username = (string)($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);

// Sanitize — Grafana username must be a valid identifier
$grafana_user = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);

http_response_code(200);
header('X-WEBAUTH-USER: ' . $grafana_user);
header('Content-Type: text/plain');
echo 'ok';