support non-redirecting domains for auth-request

2 files changed, 16 insertions, 0 deletions

diff --git a/config.ini b/config.ini
index d09ef3d..2d58b62 100644
--- a/config.ini
+++ b/config.ini
@@ -33,6 +33,12 @@ source-location = https://git.зима.net/winter/pleasant-sso/
 ;; e.g. if you want to match authelia, set it to 'Remote'
 header-prefix = X-Login
 
+;; application domains for which the auth-request integration will always return
+;; successful instead of redirecting logged-out users to the login page.
+;; intended for sites that are able to have their login links point to our
+;; login page by themselves
+no-redirect-domains[] = copyparty.example.com
+
 
 [auth]
 
diff --git a/routes/integration/auth-request.php b/routes/integration/auth-request.php
index 21c5d11..ba04988 100644
--- a/routes/integration/auth-request.php
+++ b/routes/integration/auth-request.php
@@ -23,6 +23,16 @@ function GET(array $config) {
         return;
     }
 
+    if (isset($_SERVER['HTTP_X_ORIGINAL_URI'])) {
+        $host = parse_url($_SERVER['HTTP_X_ORIGINAL_URI'], PHP_URL_HOST);
+        if (in_array(
+            $host, $config['integration']['no-redirect-domains'] ?? []
+        )) {
+            // ok, don't redirect to login page
+            return;
+        }
+    }
+
     http_response_code(401);
     $login = 'https://' . $config['site']['primary-domain'] . '/login';
     if (isset($_SERVER['HTTP_X_ORIGINAL_URI'])) {