신호 관리자 티켓 발급

api.php

@@ -7,7 +7,11 @@ header('Content-Type: application/json; charset=utf-8');
 header('Cache-Control: no-store');
 
 $origin = (string)($_SERVER['HTTP_ORIGIN'] ?? '');
-if ($origin === 'https://chaegeon.com') {
+$allowedOrigins = [
+    'https://chaegeon.com',
+    'https://signal.chaegeon.com',
+];
+if (in_array($origin, $allowedOrigins, true)) {
     header('Access-Control-Allow-Origin: ' . $origin);
     header('Access-Control-Allow-Credentials: true');
     header('Access-Control-Allow-Headers: Content-Type, X-Requested-With');
@@ -27,6 +31,44 @@ function launcher_is_digit_password(string $password): bool
     return preg_match('/^\d{4}$/', $password) === 1;
 }
 
+function launcher_admin_ticket_audience(string $audience): string
+{
+    $audience = trim($audience);
+    if ($audience === '' || preg_match('/^[a-zA-Z0-9_.:-]{1,80}$/', $audience) !== 1) {
+        return '';
+    }
+    return $audience;
+}
+
+function launcher_issue_admin_ticket(string $audience): string
+{
+    return custom_signed_cookie_payload([
+        'scope' => 'launcher_admin_ticket',
+        'aud' => $audience,
+        'admin' => true,
+        'iat' => time(),
+        'exp' => time() + 300,
+    ]);
+}
+
+function launcher_valid_admin_ticket(string $ticket, string $audience): bool
+{
+    if ($ticket === '' || strlen($ticket) > 4096 || $audience === '') {
+        return false;
+    }
+
+    $payload = custom_verify_signed_cookie_payload($ticket);
+    if (!is_array($payload)) {
+        return false;
+    }
+
+    return ($payload['scope'] ?? '') === 'launcher_admin_ticket'
+        && ($payload['aud'] ?? '') === $audience
+        && !empty($payload['admin'])
+        && (int)($payload['iat'] ?? 0) <= time() + 30
+        && (int)($payload['exp'] ?? 0) >= time();
+}
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     custom_block_login_denied(true);
 
@@ -98,6 +140,16 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 }
 
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
+    if (isset($_GET['validateAdminTicket'])) {
+        $audience = launcher_admin_ticket_audience((string)($_GET['aud'] ?? ''));
+        $ticket = (string)($_GET['ticket'] ?? '');
+        $valid = launcher_valid_admin_ticket($ticket, $audience);
+        custom_json([
+            'valid' => $valid,
+            'admin' => $valid,
+        ]);
+    }
+
     if (isset($_GET['session'])) {
         $denied = custom_login_denied_state();
         $blockedType = (string)($denied['type'] ?? '');
@@ -151,10 +203,16 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         if ($isAdmin) {
             custom_issue_auth_cookie(true);
         }
-        custom_json([
+        $response = [
             'admin' => $isAdmin,
             'authenticated' => $isAdmin,
-        ]);
+        ];
+        $audience = launcher_admin_ticket_audience((string)($_GET['adminTicket'] ?? ''));
+        if ($isAdmin && $audience !== '') {
+            $response['adminTicket'] = launcher_issue_admin_ticket($audience);
+            $response['adminTicketExpiresIn'] = 300;
+        }
+        custom_json($response);
     }
 
     if (isset($_GET['failMessages'])) {