523be058aa
- config.php: Azure tenant/client constants, SSO_ENABLED = true
- auth.php: requireAuth() middleware, getSafeUser(), getUserDataFile()
- auth_gate.php: MSAL.js PKCE login flow, stores return URL in sessionStorage
- logout.php: destroys PHP session + calls msalInstance.logoutRedirect()
- api.php: public create_session endpoint (JWT validation), 401 guard on all other actions, per-user data files (data_{safeUser}.json)
- sheet_helpers.php: fix dot sanitisation '_' → '_dot_' to match getSafeUser()
- index/builder/help.php: requireAuth() at top, user email + Sign Out in header
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
824 B
PHP
33 lines
824 B
PHP
<?php
|
|
require_once __DIR__ . '/config.php';
|
|
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
ini_set('session.cookie_httponly', 1);
|
|
ini_set('session.cookie_samesite', 'Lax');
|
|
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
|
|
ini_set('session.cookie_secure', 1);
|
|
}
|
|
session_start();
|
|
}
|
|
|
|
function getSafeUser(string $email): string {
|
|
return str_replace(['@', '.'], ['_at_', '_dot_'], $email);
|
|
}
|
|
|
|
function getUserDataFile(string $email): string {
|
|
return 'data_' . getSafeUser($email) . '.json';
|
|
}
|
|
|
|
function requireAuth(): void {
|
|
global $CURRENT_USER;
|
|
|
|
if (!empty($_SESSION['user_email'])) {
|
|
$CURRENT_USER = $_SESSION['user_email'];
|
|
return;
|
|
}
|
|
|
|
// No session — show auth gate and stop execution
|
|
include __DIR__ . '/auth_gate.php';
|
|
exit;
|
|
}
|
|
?>
|