ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-08-12 18:12:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

Monitor: Grafana auth proxy session fix and nginx login bypass.

Browse Source 
Use ac_crash_sess shared session, allow password reset without auth_request,
update grafana.ini template and alert rules.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-08-07 22:16:03 +02:00
parent 9307e3d47c
commit 12545813ab
6 changed files with 84 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
monitoring/artc0/grafana-auth-check.php
View File

@@ -1,52 +1,35 @@
<?php
declare(strict_types=1);
/**
* Grafana auth_request endpoint — nginx calls this to validate PHP session
* before proxying to cast04:3000 (Grafana).
* Grafana / Alertmanager / broadcast auth_request endpoint.
*
* If session is valid: HTTP 200 + X-WEBAUTH-USER header (username)
* If not authenticated: HTTP 401 (nginx redirects to /app/androidcast_project/login)
* nginx `internal;` blocks direct browser access. Returns 200 + X-WEBAUTH-USER when
* the shared Android Cast PHP session (ac_crash_sess) is valid, 401 otherwise.
*
* Deploy to: /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php
* Deploy: /var/www/ac/composed/backend/public/api/grafana-auth-check.php
*/
// Only allow calls from nginx itself (127.0.0.1) — block direct browser access
if (!in_array($_SERVER['REMOTE_ADDR'] ?? '', ['127.0.0.1', '::1'], true)) {
http_response_code(403);
exit;
}
require_once dirname(__DIR__, 4) . '/platform/shared_session.php';
// Session handling — must match the main app's session settings
if (session_status() === PHP_SESSION_NONE) {
session_set_cookie_params([
'path' => '/app/androidcast_project/',
'secure' => isset($_SERVER['HTTPS']),
'httponly' => true,
'samesite' => 'Lax',
]);
session_start();
}
platform_start_session('ac_crash_sess', '/app/androidcast_project');
// Check if user is logged in — Auth.php stores array in $_SESSION['user']
// with at least { 'id' => int, 'username' => string, ... }
$user = $_SESSION['user'] ?? null;
if (empty($user) || empty($user['id'])) {
if (empty($user['id'])) {
http_response_code(401);
exit;
}
// Require full login (not just 2FA pending)
if (isset($user['pending_2fa']) && $user['pending_2fa']) {
if (!empty($user['pending_2fa'])) {
http_response_code(401);
exit;
}
$username = (string)($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
// Sanitize — Grafana username must be a valid identifier
$grafana_user = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
$username = (string) ($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
$grafanaUser = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
http_response_code(200);
header('X-WEBAUTH-USER: ' . $grafana_user);
header('X-WEBAUTH-USER: ' . $grafanaUser);
header('Content-Type: text/plain');
echo 'ok';