FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add AUTH_STACK so the Auth tab follows the stack in force

Browse Source 
Authentik is the likely destination and the page had Authelia and lldap wired in at every
level, so the seam goes in now: the panels and every endpoint action route off one conf value,
and a stack that cannot be driven yet says so rather than drawing controls with nothing behind.
This commit is contained in:
Gmer4Lfe
2026-08-15 15:27:50 -04:00
parent 2697b46616
commit 8157673291
6 changed files with 219 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/unraid/api/auth.php
+37
View File
@@ -93,8 +93,44 @@
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/auth.php';
// Which panel each action belongs to. AUTH_STACK decides which panels the tab draws, and this is
// the same decision applied to the endpoint — a tab left open from before a switch would otherwise
// keep writing to the stack that is no longer in force, which on this page means editing the
// directory or the rules of a system nobody is authenticating against any more.
//
// Proxies and certs are Nginx Proxy Manager's, not the identity stack's, so they are listed under
// panels every stack carries rather than gated to one.
const VV_AUTH_ACTION_PANEL = [
// GET
'npm_proxies' => 'proxies', 'npm_certs' => 'proxies',
'lldap_users' => 'users', 'lldap_groups' => 'users', 'lldap_avatar' => 'users',
'authelia_rules' => 'acl',
// POST
'npm_create' => 'proxies', 'npm_update' => 'proxies',
'npm_delete' => 'proxies', 'npm_toggle' => 'proxies',
'lldap_create_user' => 'users', 'lldap_update_user' => 'users', 'lldap_delete_user' => 'users',
'lldap_set_password' => 'users', 'lldap_set_avatar' => 'users', 'lldap_remove_avatar' => 'users',
'lldap_create_group' => 'users', 'lldap_delete_group' => 'users', 'lldap_rename_group' => 'users',
'lldap_add_to_group' => 'users', 'lldap_remove_from_group' => 'users',
'authelia_save' => 'acl',
];
function vv_auth_action_allowed(string $action): bool {
$panel = VV_AUTH_ACTION_PANEL[$action] ?? null;
// Unmapped actions are left to the existing "Unknown action" answer rather than being refused
// here, so a new action is never silently blocked by a table someone forgot to extend.
return $panel === null || vv_auth_panel_on($panel);
}
function vv_auth_action_refusal(string $action): array {
$d = vv_auth_stack_def();
return ['ok' => false, 'error' => 'AUTH_STACK is "' . vv_auth_stack() . '" (' . $d['label']
. '), which does not serve this request. Reload the Auth tab.'];
}
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
$action = $_GET['action'] ?? '';
if (!vv_auth_action_allowed($action)) { echo json_encode(vv_auth_action_refusal($action)); exit; }
// The one route here that does not answer in JSON — it streams the stored JPEG so the page can
// point an <img> at it, rather than carrying 470 KB of base64 through the user list on every
@@ -133,6 +169,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
}
$action = trim($_POST['action'] ?? '');
if (!vv_auth_action_allowed($action)) { echo json_encode(vv_auth_action_refusal($action)); exit; }
$result = match ($action) {
// NPM