mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-08-12 18:12:19 +03:00
6a58eb716d
Grafana auth restore + nginx proxy_cookie_path; alert-notifier branded QR; prepare-be-builder-dirs shared ccache/gradle; bump ac-scripts for Docker DLC maintenance. Co-authored-by: Cursor <cursoragent@cursor.com>
47 lines
1.3 KiB
PHP
47 lines
1.3 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Grafana / Alertmanager / broadcast auth_request endpoint.
|
|
*
|
|
* nginx `internal;` blocks direct browser access. Returns 200 + X-WEBAUTH-USER when
|
|
* the shared Android Cast PHP session (ac_crash_sess) is valid, 401 otherwise.
|
|
*
|
|
* Deploy: /var/www/ac/composed/backend/public/api/grafana-auth-check.php
|
|
*/
|
|
|
|
require_once dirname(__DIR__, 4) . '/platform/shared_session.php';
|
|
|
|
platform_start_session('ac_crash_sess', '/app/androidcast_project');
|
|
|
|
$composedSrc = dirname(__DIR__, 2) . '/src';
|
|
if (is_file($composedSrc . '/AuthRemember.php')) {
|
|
require_once $composedSrc . '/Database.php';
|
|
require_once $composedSrc . '/Rbac.php';
|
|
require_once $composedSrc . '/Auth.php';
|
|
require_once $composedSrc . '/AuthRemember.php';
|
|
require_once $composedSrc . '/AuthEmailSchema.php';
|
|
require_once $composedSrc . '/AuthFactors.php';
|
|
AuthRemember::tryRestore();
|
|
}
|
|
|
|
$user = $_SESSION['user'] ?? null;
|
|
|
|
if (empty($user['id'])) {
|
|
http_response_code(401);
|
|
exit;
|
|
}
|
|
|
|
if (!empty($user['pending_2fa'])) {
|
|
http_response_code(401);
|
|
exit;
|
|
}
|
|
|
|
$username = (string) ($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
|
|
$grafanaUser = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
|
|
|
|
http_response_code(200);
|
|
header('X-WEBAUTH-USER: ' . $grafanaUser);
|
|
header('Content-Type: text/plain');
|
|
echo 'ok';
|