SIMON Master Console Rebuild

File viewer

guarded to /htdocs

/connlink/test1/connlink/auth.php

<?php
/**
 * /web360/connlink/auth.php
 * resolveAuth($carrier) → never returns a raw secret to the client.
 * Only reads from env:// (getenv or /web360/.env) or vault:// (stub).
 * Sheet mapping: Variable_Registry.credentialRef / scopeMap.
 */

declare(strict_types=1);

function conn_resolve_auth(array $carrier): array {
    $auth   = $carrier['auth'] ?? ['method' => 'none'];
    $method = $auth['method'] ?? 'none';

if ($method === 'none') {
        return ['method' => 'none', 'headers' => [], 'query' => []];
    }

$ref    = (string)($auth['credentialRef'] ?? '');
    $secret = conn_resolve_secret($ref);
    if ($secret === null || $secret === '') {
        return [
            'method'  => $method,
            'headers' => [],
            'query'   => [],
            'error'   => 'missing_credential:' . $ref,
        ];
    }

$headers = [];
    $query   = [];

// Placement: prefer explicit header/query from carrier config
    if (!empty($auth['header'])) {
        $headers[$auth['header']] = $secret;
    }
    if (!empty($auth['query'])) {
        $query[$auth['query']] = $secret;
    }
    // Fallback: Authorization: Bearer <secret>
    if (empty($auth['header']) && empty($auth['query'])) {
        $headers['Authorization'] = 'Bearer ' . $secret;
    }

return ['method' => $method, 'headers' => $headers, 'query' => $query];
}

/** Resolve env:// or vault:// references. Never returns raw inputs. */
function conn_resolve_secret(string $ref): ?string {
    if ($ref === '') return null;

if (strpos($ref, 'env://') === 0) {
        $name = substr($ref, 6);
        $v = getenv($name);
        if ($v !== false && $v !== '') return $v;

// Fallback: parse /web360/.env if the env var is not set at the webserver level
        $envFile = __DIR__ . '/../.env';
        if (is_readable($envFile)) {
            $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
            foreach ($lines as $line) {
                $line = trim($line);
                if ($line === '' || $line[0] === '#') continue;
                if (strpos($line, '=') === false) continue;
                [$k, $val] = array_map('trim', explode('=', $line, 2));
                if ($k === $name) return trim($val, "\"'");
            }
        }
        return null;
    }

if (strpos($ref, 'vault://') === 0) {
        // Stub — wire this to your secret manager (e.g. HashiCorp, AWS Secrets Manager)
        return null;
    }

return null;
}

Quick jump

open a path

True command center for SIMON + WEB360

File viewer

Quick jump