ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-08-12 18:12:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

Monitor: Grafana auth proxy session fix and nginx login bypass.

Browse Source 
Use ac_crash_sess shared session, allow password reset without auth_request,
update grafana.ini template and alert rules.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-08-07 22:16:03 +02:00
parent 9307e3d47c
commit 12545813ab
6 changed files with 84 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
declare(strict_types=1);
/**
* Grafana / Alertmanager / broadcast auth_request endpoint.
*
* nginx `internal;` blocks direct browser access. Returns 200 + X-WEBAUTH-USER when
* the shared Android Cast PHP session (ac_crash_sess) is valid, 401 otherwise.
*
* Deploy: /var/www/ac/composed/backend/public/api/grafana-auth-check.php
*/
require_once dirname(__DIR__, 4) . '/platform/shared_session.php';
platform_start_session('ac_crash_sess', '/app/androidcast_project');
$user = $_SESSION['user'] ?? null;
if (empty($user['id'])) {
http_response_code(401);
exit;
}
if (!empty($user['pending_2fa'])) {
http_response_code(401);
exit;
}
$username = (string) ($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
$grafanaUser = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
http_response_code(200);
header('X-WEBAUTH-USER: ' . $grafanaUser);
header('Content-Type: text/plain');
echo 'ok';