set $senthor_orig_method $request_method;
set $senthor_orig_host   $http_host;
set $senthor_orig_uri    $request_uri;
set $senthor_orig_ip     $remote_addr;

auth_request_set $senthor_decision         $upstream_http_senthor_decision;
auth_request_set $senthor_payment_response $upstream_http_payment_response;
auth_request_set $senthor_payment_receipt $upstream_http_payment_receipt;

location = /senthor-check {
    internal;

    proxy_ssl_server_name on;

    proxy_pass_request_body off;
    proxy_set_header Content-Length "";

    proxy_set_header X-Senthor-Method $request_method;
    proxy_set_header X-Senthor-Host $http_host;
    proxy_set_header X-Senthor-URI $request_uri;
    proxy_set_header X-Senthor-IP $remote_addr;

    # Strip sensitive headers
    proxy_set_header Cookie "";
    proxy_set_header Set-Cookie "";
    proxy_set_header X-CSRF-Token "";

    # Treat connection failures as success for auth_request
    proxy_intercept_errors on;
    error_page 500 502 503 504 =204 /senthor-empty-res;

    proxy_pass https://waf-api.senthor.io/api/nginx-request;
}

location = /senthor-empty-res {
    internal;
    return 204;
}

location = /senthor-paywall {
    internal;

    proxy_ssl_server_name on;

    proxy_set_header X-Senthor-Method $senthor_orig_method;
    proxy_set_header X-Senthor-Host   $senthor_orig_host;
    proxy_set_header X-Senthor-URI    $senthor_orig_uri;
    proxy_set_header X-Senthor-IP     $senthor_orig_ip;

    proxy_set_header Senthor-Decision $senthor_decision;
    proxy_set_header Payment-Response $senthor_payment_response;
    proxy_set_header Payment-Receipt $senthor_payment_receipt;

    proxy_pass https://waf-api.senthor.io/api/nginx-response;
}

add_header PAYMENT-RESPONSE $senthor_payment_response always;
add_header PAYMENT-RECEIPT $senthor_payment_receipt always;
