hyprcrd/relay/index.php

<?php
// ── hyprcrd Relay — Multi-tenant ──
//
// Entry point. Loads bootstrap + helpers, dispatches API routes,
// renders the UI layout. The actual logic lives in inc/ and ui/.
//
// Architecture (encryption flow for cross-tenant messages):
//   1. Client A encrypts a message with A's tenant secret
//   2. POST /api/messages, server authenticates A, decrypts with A's secret
//   3. Server re-encrypts with the inter-tenant key (relay-wide shared
//      key, generated at install, stored encrypted with the master key)
//   4. Stored in messages table with recipient_id = B's tenant id
//   5. B fetches /api/messages, server decrypts with inter-tenant key,
//      re-encrypts with B's tenant secret, returns to client B
//   6. Client B decrypts with its own secret
//
// The relay sees plaintext briefly during the cross-tenant hop. This
// is not strict end-to-end — that requires per-pair key exchange and
// is on the roadmap for the planned encrypted chat feature. See
// README.md.

define('RELAY_BOOTSTRAPPED', true);

require_once __DIR__ . '/inc/bootstrap.php';
require_once __DIR__ . '/inc/crypto.php';
require_once __DIR__ . '/inc/tenants.php';
require_once __DIR__ . '/inc/auth.php';

// ── Routing ────────────────────────────────────────────────────────

$route = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$base = dirname($_SERVER['SCRIPT_NAME']);
if ($base !== '/') $route = substr($route, strlen($base));
$route = '/' . ltrim($route ?: '/', '/');
$method = $_SERVER['REQUEST_METHOD'];

$isSetup = tenantCount($db) === 0;

// ── API ────────────────────────────────────────────────────────────

if (str_starts_with($route, '/api/')) {
    header('Content-Type: application/json');
    // CORS: the hyprcrd client hits us server-side (no browser CORS in play)
    // and the relay UI lives same-origin, so the only legitimate cross-origin
    // callers are other tenant UIs on the same relay host. We allow the
    // relay's own scheme+host, plus an opt-in allowlist via RELAY_CORS_ORIGINS
    // (comma-separated). Credentials are intentionally NOT allowed — API auth
    // is header-based (X-Relay-User/Key) and the UI is same-origin.
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
    $ownScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https' ? 'https' : 'http';
    $ownOrigin = $ownScheme . '://' . ($_SERVER['HTTP_HOST'] ?? '');
    $allowed = [$ownOrigin];
    $extra = getenv('RELAY_CORS_ORIGINS');
    if ($extra) {
        foreach (explode(',', $extra) as $o) {
            $o = trim($o);
            if ($o !== '') $allowed[] = $o;
        }
    }
    if ($origin && in_array($origin, $allowed, true)) {
        header('Access-Control-Allow-Origin: ' . $origin);
        header('Vary: Origin');
    }
    header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key');
    header('Access-Control-Allow-Methods: GET, POST, PATCH, DELETE, OPTIONS');
    if ($method === 'OPTIONS') exit;

    $contentLength = (int)($_SERVER['CONTENT_LENGTH'] ?? 0);
    $sizeLimit = ($route === '/api/attachments') ? 15728640 : 262144;
    if ($contentLength > $sizeLimit) jsonResponse(['error' => 'payload too large'], 413);

    // Each route file contains its handlers as if-blocks that exit on
    // match. Order matters: public.php sets up $sessionTenant which
    // admin.php and messages.php use later in the chain.
    require __DIR__ . '/inc/routes/public.php';
    require __DIR__ . '/inc/routes/account.php';
    require __DIR__ . '/inc/routes/admin.php';
    require __DIR__ . '/inc/routes/messages.php';
    require __DIR__ . '/inc/routes/chat.php';
    require __DIR__ . '/inc/routes/collab-buckets.php';
    require __DIR__ . '/inc/routes/collab-cards.php';
    require __DIR__ . '/inc/routes/collab-locks.php';
    require __DIR__ . '/inc/routes/shopping.php';

    jsonResponse(['error' => 'not found'], 404);
}

// ── UI ─────────────────────────────────────────────────────────────

require __DIR__ . '/ui/layout.php';