<?php

// nginx (and others?) auth_request style endpoint
// returns 200 for allowed requests
// otherwise, returns 401 and sends the login page url as a header
// if request header X-Original-Uri is given, it puts it as the post-login redir

function addHeader(array $config, string $baseName, string $value): void {
    $prefix = $config['integration']['header-prefix'];
    header("$prefix-$baseName: $value");
}

function GET(array $config) {
    $session = Psso\Session::get();
    $identity = $session->getIdentity();
    if (isset($identity)) {
        // ok
        addHeader($config, 'User', $identity->user);
        addHeader($config, 'Groups', implode(',', $identity->groups));
        foreach ($identity->extras as $key => $value) {
            if ($value !== null) addHeader($config, ucfirst($key), $value);
        }
        return;
    }

    http_response_code(401);
    $login = 'https://' . $config['site']['primary-domain'] . '/login';
    if (isset($_SERVER['HTTP_X_ORIGINAL_URI'])) {
        $login .= '?next=' . urlencode($_SERVER['HTTP_X_ORIGINAL_URI']);
    }
    addHeader($config, 'Location', $login);
}