Fix car monitor shared auth

monitor.php

@@ -882,6 +882,15 @@ function car_monitor_launcher_session(): array
         return $session;
     }
 
+    $cookieHeader = trim((string)($_SERVER['HTTP_COOKIE'] ?? ''));
+    if ($cookieHeader !== '') {
+        $remoteSession = car_monitor_launcher_api_request('GET', 'https://chaegeon.com/custom/launcher/api.php?session=1', null, $cookieHeader);
+        if (is_array($remoteSession)) {
+            $session = $remoteSession;
+            return $session;
+        }
+    }
+
     $commonAuth = '/mnt/synology-web/custom/common/auth.php';
     if (is_readable($commonAuth)) {
         require_once $commonAuth;
@@ -901,25 +910,40 @@ function car_monitor_launcher_session(): array
         }
     }
 
-    $cookieHeader = trim((string)($_SERVER['HTTP_COOKIE'] ?? ''));
     if ($cookieHeader === '') {
         $session = ['authenticated' => false, 'admin' => false];
         return $session;
     }
 
-    $url = 'https://chaegeon.com/custom/launcher/api.php?session=1';
+    $session = ['authenticated' => false, 'admin' => false];
+    return $session;
+}
+
+function car_monitor_launcher_api_request(string $method, string $url, ?array $payload = null, string $cookieHeader = ''): ?array
+{
     $body = false;
 
     if (function_exists('curl_init')) {
         $ch = curl_init($url);
         if ($ch !== false) {
+            $headers = ['User-Agent: car-monitor-auth/1.0'];
+            if ($cookieHeader !== '') {
+                $headers[] = 'Cookie: ' . $cookieHeader;
+            }
+            if ($payload !== null) {
+                $headers[] = 'Content-Type: application/json';
+            }
+
             curl_setopt_array($ch, [
                 CURLOPT_RETURNTRANSFER => true,
                 CURLOPT_CONNECTTIMEOUT => 2,
                 CURLOPT_TIMEOUT => 4,
-                CURLOPT_HTTPHEADER => ['Cookie: ' . $cookieHeader],
+                CURLOPT_CUSTOMREQUEST => strtoupper($method),
-                CURLOPT_USERAGENT => 'car-monitor-auth/1.0',
+                CURLOPT_HTTPHEADER => $headers,
             ]);
+            if ($payload !== null) {
+                curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload, JSON_UNESCAPED_UNICODE));
+            }
             $body = curl_exec($ch);
             curl_close($ch);
         }
@@ -928,18 +952,19 @@ function car_monitor_launcher_session(): array
     if ($body === false) {
         $context = stream_context_create([
             'http' => [
-                'method' => 'GET',
+                'method' => strtoupper($method),
                 'timeout' => 4,
-                'header' => "Cookie: {$cookieHeader}\r\nUser-Agent: car-monitor-auth/1.0\r\n",
+                'header' => ($cookieHeader !== '' ? "Cookie: {$cookieHeader}\r\n" : '')
+                    . "User-Agent: car-monitor-auth/1.0\r\n"
+                    . ($payload !== null ? "Content-Type: application/json\r\n" : ''),
+                'content' => $payload !== null ? json_encode($payload, JSON_UNESCAPED_UNICODE) : '',
             ],
         ]);
         $body = @file_get_contents($url, false, $context);
     }
 
     $data = is_string($body) ? json_decode($body, true) : null;
-    $session = is_array($data) ? $data : ['authenticated' => false, 'admin' => false];
+    return is_array($data) ? $data : null;
-
-    return $session;
 }
 
 function car_monitor_has_access(): bool
@@ -1049,11 +1074,23 @@ function car_monitor_auth_api(): void
         json_response(['result' => 'fail', 'message' => 'password_digits_only'], 401);
     }
 
-    if (function_exists('custom_verify_password') && custom_verify_password($password)) {
+    $remote = car_monitor_launcher_api_request('POST', 'https://chaegeon.com/custom/launcher/api.php', [
+        'action' => 'login',
+        'password' => $password,
+    ]);
+    if (is_array($remote) && ($remote['result'] ?? '') === 'ok') {
         custom_issue_auth_cookie(false);
         json_response(['result' => 'ok']);
     }
 
+    try {
+        if (function_exists('custom_verify_password') && custom_verify_password($password)) {
+            custom_issue_auth_cookie(false);
+            json_response(['result' => 'ok']);
+        }
+    } catch (Throwable $e) {
+    }
+
     json_response(['result' => 'fail'], 401);
 }