andreandClaude Opus 4.8
e68d357177
Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools as a submodule (platform_update, backups, git/migration tools) like the other platforms. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
4.1 KiB
PHP
64 lines
4.1 KiB
PHP
<?php
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
// Static, secret-bearing configuration. Operational settings (APP_NAME, base
|
|
// URL, email-from headers, reminder_hours, Nextcloud URL/token, logo filenames)
|
|
// live in the `system_settings` table — see config/functions_settings.php and
|
|
// views/sysadmin/system_settings.php. Only credentials and tokens stay here so
|
|
// DB dumps never expose them.
|
|
//
|
|
// Values come from the .env file (loaded by config/db.php via config/env.php
|
|
// before this file runs). The fallback in each env() call keeps the platform
|
|
// running if .env is missing — never put real production secrets as defaults.
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
// ─── Environment ──────────────────────────────────────────────────────────────
|
|
define('APP_ENV', env('APP_ENV', 'prod'));
|
|
// Email/SMS delivery — including the dev redirect/print safety net — now lives at
|
|
// id.andmore.pt (/notify). See config/functions_notify_client.php. NOTIFY_API_KEY
|
|
// (in .env) authenticates this app to the central service.
|
|
|
|
if (APP_ENV !== 'prod') {
|
|
ini_set('display_errors', '1');
|
|
ini_set('display_startup_errors', '1');
|
|
error_reporting(E_ALL);
|
|
} else {
|
|
ini_set('display_errors', '0');
|
|
error_reporting(E_ALL); // still catch everything, just don't echo it
|
|
}
|
|
|
|
require_once __DIR__ . '/error_handler.php';
|
|
|
|
// ─── Identity / Andmore ID ────────────────────────────────────────────────────
|
|
// IDENTITY_MODE: 'standalone' (default) or 'federated'. In federated mode every
|
|
// register/login syncs the user to the central andmore_id DB so users.andmore_id
|
|
// is always populated and cross-platform relationships work by canonical id.
|
|
define('IDENTITY_MODE', strtolower(env('IDENTITY_MODE', 'standalone')) === 'federated' ? 'federated' : 'standalone');
|
|
|
|
// Slug identifying this install on andmore_id.linked_platforms. Used to scope
|
|
// link tokens and resolve the satellite's display name on the central verify page.
|
|
define('PLATFORM_SLUG', (string) env('PLATFORM_SLUG', 'fitme3070'));
|
|
|
|
define('ANDMORE_ID_URL', rtrim(env('ANDMORE_ID_URL', 'https://id.andmore.pt'), '/') . '/');
|
|
|
|
// Parent domain the am_sso cookie is scoped to (e.g. .andmore.pt). Empty in
|
|
// standalone mode — federated mode requires a non-empty value.
|
|
define('SSO_COOKIE_DOMAIN', (string) env('SSO_COOKIE_DOMAIN', ''));
|
|
// Cookie name. Override per environment when prod and dev share a parent
|
|
// domain (e.g. SSO_COOKIE_NAME=am_sso_dev in dev) so the prod cookie on
|
|
// .andmore.pt doesn't clobber the dev session and vice versa.
|
|
define('SSO_COOKIE_NAME', (string) env('SSO_COOKIE_NAME', 'am_sso'));
|
|
define('SSO_SESSION_TTL_DAYS', (int) env('SSO_SESSION_TTL_DAYS', 30));
|
|
|
|
// When true (federated mode only): local login/register pages redirect to
|
|
// Andmore ID; require_login() sends unauthenticated users directly there.
|
|
define('SSO_REQUIRED', filter_var(env('SSO_REQUIRED', 'false'), FILTER_VALIDATE_BOOLEAN));
|
|
|
|
// When true (federated mode only): a register/login attempt fails with a clear
|
|
// error if the central DB is unreachable, instead of silently falling through
|
|
// and creating an orphan local row. Standalone mode ignores this.
|
|
define('IDENTITY_REQUIRE_UPSTREAM', filter_var(env('IDENTITY_REQUIRE_UPSTREAM', 'false'), FILTER_VALIDATE_BOOLEAN));
|
|
|
|
function identity_is_federated(): bool { return IDENTITY_MODE === 'federated'; }
|
|
function identity_is_standalone(): bool { return IDENTITY_MODE === 'standalone'; }
|
|
function identity_require_upstream(): bool { return identity_is_federated() && IDENTITY_REQUIRE_UPSTREAM; }
|