<?php
/**
 * echo-headers.php — request-side identity probe for the SSO diagnosis.
 *
 * The ONLY reliable way to see the identity header LemonLDAP injects into the
 * request IT forwards to the backend is to place an endpoint *behind* the same
 * reverse proxy (same vhost as PeerTube) and have it echo the request headers.
 * Response headers on the public site can never reveal this.
 *
 * Deploy this file anywhere served through the SAME LemonLDAP vhost that
 * protects videos.erg.be (e.g. a static location, or a tiny PHP handler on the
 * backend), authenticate at portail.erg.school, then hit it — it returns JSON
 * of every inbound header. Forward the resulting URL to sso-diagnose.sh:
 *
 *   scripts/sso-diagnose.sh --echo 'https://videos.erg.be/path/to/echo-headers.php'
 *
 * Output (subset):
 *   {
 *     "headers": { "X-Remote-User": "jsmith", "Auth-User": "jsmith", ... },
 *     "server":  { "REMOTE_USER": "...", ... }
 *   }
 *
 * It also mirrors the CGI subprocess environment (REMOTE_USER, etc.), which is
 * where Apache/LemonLDAP often land the identity. Safe: emits NO secret — only
 * the incoming headers it was handed.
 */

header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');

$headers = [];
foreach ($_SERVER as $k => $v) {
    if (str_starts_with($k, 'HTTP_')) {
        $name = str_replace('_', '-', substr($k, 5));
        $headers[$name] = $v;
    }
}

// Also surface the classic CGI environment identity vars directly.
$server = [
    'REMOTE_USER'       => $_SERVER['REMOTE_USER'] ?? null,
    'AUTH_USER'         => $_SERVER['AUTH_USER'] ?? null,
    'PHP_AUTH_USER'     => $_SERVER['PHP_AUTH_USER'] ?? null,
    'REDIRECT_REMOTE_USER' => $_SERVER['REDIRECT_REMOTE_USER'] ?? null,
];

echo json_encode([
    'headers' => $headers,
    'server'  => $server,
    'remote_addr' => $_SERVER['REMOTE_ADDR'] ?? null,
], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);