op-packages/luci-app-daede/root/www/cgi-bin/daede-graphql
github-actions[bot] 5e3fdcdde2 🎈 Sync 2026-06-19 02:57:28
2026-06-19 02:57:28 +08:00

40 lines
1.3 KiB
Bash

#!/bin/sh
# daede-graphql - same-origin GraphQL relay to local daed.
#
# HTTPS LuCI pages can't fetch daed's plain-HTTP :2023 (mixed content),
# so the converter posts here and we relay to 127.0.0.1 over loopback.
# daed still checks its own bearer token; no extra exposure. See #11.
reply() { printf 'Status: %s\r\nContent-Type: application/json\r\n\r\n%s\n' "$1" "$2"; exit 0; }
fail() { reply '502 Bad Gateway' '{"errors":[{"message":"daed relay failed"}]}'; }
[ "$REQUEST_METHOD" = "POST" ] || reply '405 Method Not Allowed' '{"errors":[{"message":"POST only"}]}'
# daed listen port from uci, default 2023
port=$(uci -q get daed.config.listen_addr | sed -n 's/.*:\([0-9]\{1,5\}\)$/\1/p')
[ -n "$port" ] || port=2023
len=${CONTENT_LENGTH:-0}
[ "$len" -gt 0 ] 2>/dev/null || fail
body=$(mktemp /tmp/daede-gql.XXXXXX) || fail
head -c "$len" > "$body"
if [ -n "$HTTP_AUTHORIZATION" ]; then
resp=$(uclient-fetch -q -O - \
--header="Content-Type: ${CONTENT_TYPE:-application/json}" \
--header="Authorization: $HTTP_AUTHORIZATION" \
--post-file="$body" \
"http://127.0.0.1:$port/graphql" 2>/dev/null)
else
resp=$(uclient-fetch -q -O - \
--header="Content-Type: ${CONTENT_TYPE:-application/json}" \
--post-file="$body" \
"http://127.0.0.1:$port/graphql" 2>/dev/null)
fi
rc=$?
rm -f "$body"
[ "$rc" = 0 ] || fail
reply '200 OK' "$resp"