60 lines
1.9 KiB
PHP
60 lines
1.9 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/db.php';
|
|
require_once __DIR__ . '/persona.php';
|
|
|
|
/**
|
|
* If MCP_API_TOKEN is set in .env and the request sends a matching Bearer token,
|
|
* establish session as MCP_ACTOR_PERSON_ID (must be an existing Head of household).
|
|
* Browser requests without Authorization are unchanged.
|
|
*/
|
|
function familyHubApplyMcpTokenAuthIfConfigured(): void {
|
|
$configured = Env::get('MCP_API_TOKEN', '');
|
|
if ($configured === '') {
|
|
return;
|
|
}
|
|
|
|
$header = familyHubAuthorizationHeader();
|
|
if ($header === null || !preg_match('/^\s*Bearer\s+(\S+)\s*$/i', $header, $matches)) {
|
|
return;
|
|
}
|
|
|
|
$presented = $matches[1];
|
|
if (!hash_equals($configured, $presented)) {
|
|
return;
|
|
}
|
|
|
|
$actorId = trim((string) Env::get('MCP_ACTOR_PERSON_ID', ''));
|
|
if ($actorId === '') {
|
|
return;
|
|
}
|
|
|
|
$people = normalizePeopleList(readJsonFile('people.json'));
|
|
$person = findPersonById($people, $actorId);
|
|
if ($person === null || ($person['role'] ?? '') !== ROLE_HEAD) {
|
|
return;
|
|
}
|
|
|
|
setSessionPerson($actorId, true);
|
|
}
|
|
|
|
function familyHubAuthorizationHeader(): ?string {
|
|
if (isset($_SERVER['HTTP_AUTHORIZATION']) && is_string($_SERVER['HTTP_AUTHORIZATION']) && $_SERVER['HTTP_AUTHORIZATION'] !== '') {
|
|
return $_SERVER['HTTP_AUTHORIZATION'];
|
|
}
|
|
if (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) && is_string($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) && $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] !== '') {
|
|
return $_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
|
|
}
|
|
if (function_exists('apache_request_headers')) {
|
|
$headers = apache_request_headers();
|
|
if (is_array($headers)) {
|
|
foreach ($headers as $name => $value) {
|
|
if (strcasecmp((string) $name, 'Authorization') === 0 && is_string($value) && $value !== '') {
|
|
return $value;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return null;
|
|
}
|