sso_secret_file=$werc_root/etc/misaki_sso.secret
sso_cookie='; Path=/; HttpOnly; Secure; SameSite=Lax'
sso_domain='; Domain=thirdculture.diy'

# Sets logged_user from misaki's signed header. Only after the visitor chose to log in here (werc_sso cookie).
fn misaki_sso_auth {
	if(! ~ $#logged_user 0 || ~ $"HTTP_X_AUTH_USER '')
		ssoskip=yes
	if not if(! ~ $1 force && ! ~ `{get_cookie werc_sso} 1)
		ssoskip=yes
	if not if(! test -s $sso_secret_file)
		dprint 'misaki-sso: secret file missing/empty: '^$sso_secret_file
	if not {
		sso_u=$"HTTP_X_AUTH_USER
		sso_exp=$"HTTP_X_AUTH_EXP
		if(! echo -n $sso_u | grep -s '^[a-zA-Z0-9_-]+$')
			dprint 'misaki-sso: bad X-Auth-User: '^$"sso_u
		if not if(! echo -n $sso_exp | grep -s '^[0-9]+$')
			dprint 'misaki-sso: missing/non-numeric X-Auth-Exp ('^$"sso_exp^') - is auth_secret set in misaki?'
		if not if(! test $sso_exp -gt `{date -n})
			dprint 'misaki-sso: expired token for '^$sso_u
		if not {
			sso_want=`{echo -n 'v1:'^$sso_u^':'^$sso_exp | openssl dgst -sha256 -hmac `{cat $sso_secret_file} -binary | openssl base64 -A | tr '+/' '-_' | tr -d '='}
			if(~ $"sso_want '')
				dprint 'misaki-sso: empty HMAC - is openssl installed?'
			if not if(! ~ $"HTTP_X_AUTH_SIG $sso_want)
				dprint 'misaki-sso: signature mismatch for '^$sso_u^''
			if not {
				logged_user=$sso_u
				logged_password=()
				dprint 'misaki-sso: authenticated '^$sso_u
			}
		}
	}
}

fn sso_go {
	sso_to=$1
	shift
	echo 'Status: 303 See Other'
	for(c in $*) echo 'Set-Cookie: '^$c
	echo 'Location: '^$sso_to
	echo
	exit
}

fn misaki-sso_init { misaki_sso_auth }

# POST /_users/misaki: log in here with the misaki session (a cross-site POST carries no misaki cookie, so no forced logins)
# /_users/logout: drop this site's login only, misaki stays signed in
if(~ $REQUEST_URI /_users/misaki && ~ $REQUEST_METHOD POST && ~ $SERVER_NAME thirdculture.diy *.thirdculture.diy) {
	misaki_sso_auth force
	if(~ $#logged_user 0)
		sso_go 'https://misaki.thirdculture.diy/login?next=https://'^$SERVER_NAME^'/_users/login'
	sso_go /_users/login 'werc_sso=1; Max-Age=604800'^$sso_domain^$sso_cookie
}
if(~ $REQUEST_URI /_users/logout)
	sso_go / 'werc_sso=; Max-Age=0'^$sso_domain^$sso_cookie 'werc_sso=; Max-Age=0'^$sso_cookie 'werc_user=; Max-Age=0; Path=/'

misaki_sso_auth