MAS_API is a Smarty function plugin for CMS Made Simple 2.x that fetches or
sends data to external HTTP(S) APIs directly from templates, without embedding
secrets in the database.

Features:
- Methods: GET, POST, PUT, DELETE (cURL; TLS verification on)
- JSON: request body from body/json params; optional JSON decode of response
(parse_json / json=1)
- Security: mandatory mas_api.allowlist.php (hosts and/or suffixes; fail closed
if missing or empty); DNS resolution checked against private/reserved ranges;
manual redirects with re-validation per hop; response size cap; timeouts
(bounded)
- Cache: optional TTL-based file cache under TMP_CACHE_LOCATION/mas_api (2xx
only); CMSMS “Clear cache” may not remove these files
- Rate limit: optional per-IP (and optional trust_x_forwarded_for) per target
host, file-based under tmp
- Auth: named profiles in mas_api.credentials.php (headers only on disk, not in
templates)
- Webhooks-style signing: optional sign_profile adds X-Hub-Signature-256
(HMAC-SHA256) using secrets from the credentials file only
- Cloudflare: use profiles for CF Access client id/secret headers; default
User-Agent CMSMS-MAS_API/1.x

Example:
{mas_api url="https://api.example.com/data" method="GET" cache="300"
parse_json="1" assign="api_data"}

Installation:
- Copy function.mas_api.php and the mas_api/ folder into assets/plugins/
- Copy mas_api.allowlist.sample.php to mas_api.allowlist.php and edit allowed
hosts/suffixes (and ports if needed)
- Optionally copy mas_api.credentials.sample.php to mas_api.credentials.php for
profiles and sign_profiles