mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 07:37:47 +03:00
53 lines
1.6 KiB
PHP
53 lines
1.6 KiB
PHP
<?php
|
|
/**
|
|
* Grafana auth_request endpoint — nginx calls this to validate PHP session
|
|
* before proxying to cast04:3000 (Grafana).
|
|
*
|
|
* If session is valid: HTTP 200 + X-WEBAUTH-USER header (username)
|
|
* If not authenticated: HTTP 401 (nginx redirects to /app/androidcast_project/login)
|
|
*
|
|
* Deploy to: /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php
|
|
*/
|
|
|
|
// Only allow calls from nginx itself (127.0.0.1) — block direct browser access
|
|
if (!in_array($_SERVER['REMOTE_ADDR'] ?? '', ['127.0.0.1', '::1'], true)) {
|
|
http_response_code(403);
|
|
exit;
|
|
}
|
|
|
|
// Session handling — must match the main app's session settings
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_set_cookie_params([
|
|
'path' => '/app/androidcast_project/',
|
|
'secure' => isset($_SERVER['HTTPS']),
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
session_start();
|
|
}
|
|
|
|
// Check if user is logged in — Auth.php stores array in $_SESSION['user']
|
|
// with at least { 'id' => int, 'username' => string, ... }
|
|
$user = $_SESSION['user'] ?? null;
|
|
|
|
if (empty($user) || empty($user['id'])) {
|
|
http_response_code(401);
|
|
exit;
|
|
}
|
|
|
|
// Require full login (not just 2FA pending)
|
|
if (isset($user['pending_2fa']) && $user['pending_2fa']) {
|
|
http_response_code(401);
|
|
exit;
|
|
}
|
|
|
|
$username = (string)($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
|
|
|
|
// Sanitize — Grafana username must be a valid identifier
|
|
$grafana_user = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
|
|
|
|
http_response_code(200);
|
|
header('X-WEBAUTH-USER: ' . $grafana_user);
|
|
header('Content-Type: text/plain');
|
|
echo 'ok';
|