From 6f17b15f4be4744afb0a8175343ece309a4b0209 Mon Sep 17 00:00:00 2001
From: seo <seo@chaegeon.com>
Date: Tue, 28 Jul 2026 23:01:04 +0900
Subject: [PATCH] =?UTF-8?q?=EB=9F=B0=EC=B2=98=20=EA=B4=80=EB=A6=AC?=
 =?UTF-8?q?=EC=9E=90=20=EC=A6=9D=ED=91=9C=20=EC=9D=91=EB=8B=B5=20=EC=B6=94?=
 =?UTF-8?q?=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api.php | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/api.php b/api.php
index 022b955..7e51a7a 100644
--- a/api.php
+++ b/api.php
@@ -27,6 +27,19 @@ function launcher_is_digit_password(string $password): bool
     return preg_match('/^\d{4}$/', $password) === 1;
 }
 
+function launcher_admin_assertion(array $config): string
+{
+    $body = base64_encode(json_encode([
+        'aud' => 'car-monitor',
+        'admin' => true,
+        'iat' => time(),
+        'exp' => time() + 120,
+    ], JSON_UNESCAPED_SLASHES));
+    $sig = hash_hmac('sha256', $body, (string)($config['auth']['secret'] ?? ''));
+
+    return $body . '.' . $sig;
+}
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $data = custom_read_request_data();
     $action = $data['action'] ?? 'login';
@@ -114,7 +127,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         if ($isAdmin) {
             custom_issue_auth_cookie(true);
         }
-        custom_json(['admin' => $isAdmin, 'authenticated' => $isAdmin]);
+        custom_json([
+            'admin' => $isAdmin,
+            'authenticated' => $isAdmin,
+            'assertion' => $isAdmin ? launcher_admin_assertion($config) : '',
+        ]);
     }
 
     if (isset($_GET['failMessages'])) {