mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-28 07:02:51 +08:00
25 lines
1.1 KiB
Bash
Executable File
25 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# Small, allowlisted bridge from authenticated LuCI RPC to the local HTTP API.
|
|
# Caller-controlled hosts, ports and arbitrary API paths are never accepted.
|
|
set -eu
|
|
case "$#:${1:-}:${2:-}" in
|
|
2:GET:/version|2:GET:/configs|2:GET:/connections) body='' ;;
|
|
3:PATCH:/configs)
|
|
mode=$(jsonfilter -s "$3" -e '@.mode')
|
|
case "$mode" in rule|global|direct) ;; *) echo 'Invalid mode' >&2; exit 1 ;; esac
|
|
body="{\"mode\":\"$mode\"}"
|
|
;;
|
|
*) echo 'Unsupported API request' >&2; exit 1 ;;
|
|
esac
|
|
method=$1
|
|
path=$2
|
|
port=$(uci -q get meow.main.panel_port || echo 9090)
|
|
case "$port" in ''|*[!0-9]*) echo 'Invalid API port' >&2; exit 1 ;; esac
|
|
[ "$port" -ge 1 ] && [ "$port" -le 65535 ] || exit 1
|
|
secret=$(uci -q get meow.main.secret || true)
|
|
set -- --noproxy '*' --silent --show-error --fail --connect-timeout 2 --max-time 5 \
|
|
--request "$method" "http://127.0.0.1:$port$path"
|
|
[ -z "$secret" ] || set -- "$@" --header "Authorization: Bearer $secret"
|
|
[ -z "$body" ] || set -- "$@" --header 'Content-Type: application/json' --data-binary "$body"
|
|
exec curl "$@"
|