@open-mercato/shared 0.9.1-develop.7548.1.ee60458c45 → 0.9.1-develop.7552.1.4acf199f7a

package/dist/lib/url.js

@@ -199,6 +199,29 @@ function toSecurityEmailUrl(input, path, env = process.env) {
   const base = getSecurityEmailBaseUrl(input, env);
   return `${base}/${path.replace(/^\/+/, "")}`;
 }
+function isCrossSiteBrowserRequest(req, env = process.env) {
+  const rawFetchSite = req.headers.get("sec-fetch-site");
+  const fetchSite = rawFetchSite?.trim().toLowerCase() ?? null;
+  if (fetchSite === "cross-site") return true;
+  if (fetchSite === "same-origin" || fetchSite === "none") return false;
+  const rawOrigin = req.headers.get("origin");
+  if (rawOrigin === null) return rawFetchSite !== null;
+  const origin = normalizeOrigin(rawOrigin);
+  if (!origin) return true;
+  const allowedOrigins = readAllowedOrigins(env);
+  if (allowedOrigins.has(origin)) return false;
+  if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) return false;
+  const forwardedProto = readFirstHeaderValue(req.headers.get("x-forwarded-proto"));
+  const protocol = forwardedProto ? forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:` : new URL(origin).protocol;
+  const host = req.headers.get("host");
+  const forwardedHost = req.headers.get("x-forwarded-host");
+  if (originFromHost(protocol, forwardedHost) === origin) return false;
+  if (originFromHost(protocol, host) === origin) return false;
+  if (env.NODE_ENV !== "test") {
+    logger.warn("Cross-site request rejected", { origin, host, forwardedHost });
+  }
+  return true;
+}
 function mapSecurityEmailUrlError(error, mapping) {
   if (error instanceof AppOriginRejectedError) {
     return { status: 400, body: { error: "Invalid request origin" } };
@@ -215,6 +238,7 @@ export {
   assertAllowedAppOrigin,
   getAppBaseUrl,
   getSecurityEmailBaseUrl,
+  isCrossSiteBrowserRequest,
   mapSecurityEmailUrlError,
   resolveRequestOrigin,
   toAbsoluteUrl,

package/dist/lib/url.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/url.ts"],
-  "sourcesContent": ["import { createLogger } from './logger'\n\nconst logger = createLogger('shared').child({ component: 'origin-check' })\n\nconst DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\ntype RequestOriginCandidates = {\n  urlOrigin: string | null\n  headerOrigins: Set<string>\n}\n\nfunction readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {\n  const candidates: RequestOriginCandidates = {\n    urlOrigin: null,\n    headerOrigins: new Set<string>(),\n  }\n  if (!input) return candidates\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return candidates\n  }\n\n  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (typeof input === 'string') return candidates\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)\n  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)\n  return candidates\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  if (urlOrigin) origins.add(urlOrigin)\n  for (const origin of headerOrigins) origins.add(origin)\n  return origins\n}\n\nfunction logOriginDebugContext(\n  input: RequestInput,\n  allowedOrigins: Set<string>,\n  rejectedOrigin?: string,\n  level: 'error' | 'warn' = 'error',\n  nodeEnv?: string,\n): void {\n  if (level === 'warn' && nodeEnv === 'test') return\n  const log = (msg: string, fields: Record<string, unknown>) =>\n    level === 'warn' ? logger.warn(msg, fields) : logger.error(msg, fields)\n\n  if (typeof input === 'string') {\n    log('Origin check rejected string input', {\n      requestUrl: input,\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  if (!input) {\n    log('Origin check rejected empty input', {\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  log('Origin check rejected request', {\n    requestUrl: input.url,\n    host: input.headers.get('host'),\n    forwardedHost: input.headers.get('x-forwarded-host'),\n    forwardedProto: input.headers.get('x-forwarded-proto'),\n    derivedOrigins: Array.from(requestOrigins(input)),\n    rejectedOrigin: rejectedOrigin ?? null,\n    allowedOrigins: Array.from(allowedOrigins),\n  })\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      logOriginDebugContext(input, allowedOrigins)\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))\n\n  for (const origin of headerOrigins) {\n    if (allowedOrigins.has(origin)) continue\n    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)\n    throw new AppOriginRejectedError('Request origin is not allowed')\n  }\n\n  if (!urlOrigin) return\n  if (allowedOrigins.has(urlOrigin)) return\n  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return\n  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return\n\n  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)\n  throw new AppOriginRejectedError('Request origin is not allowed')\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    logger.error('APP_URL is required in production', { scope: mapping.scope })\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEzE,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAOA,SAAS,4BAA4B,OAA8C;AACjF,QAAM,aAAsC;AAAA,IAC1C,WAAW;AAAA,IACX,eAAe,oBAAI,IAAY;AAAA,EACjC;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,gBAAgB,UAAU,MAAM;AACvD,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,YAAW,cAAc,IAAI,UAAU;AACvD,MAAI,oBAAqB,YAAW,cAAc,IAAI,mBAAmB;AACzE,SAAO;AACT;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,MAAI,UAAW,SAAQ,IAAI,SAAS;AACpC,aAAW,UAAU,cAAe,SAAQ,IAAI,MAAM;AACtD,SAAO;AACT;AAEA,SAAS,sBACP,OACA,gBACA,gBACA,QAA0B,SAC1B,SACM;AACN,MAAI,UAAU,UAAU,YAAY,OAAQ;AAC5C,QAAM,MAAM,CAAC,KAAa,WACxB,UAAU,SAAS,OAAO,KAAK,KAAK,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM;AAExE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,sCAAsC;AAAA,MACxC,YAAY;AAAA,MACZ,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,QAAI,qCAAqC;AAAA,MACvC,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,iCAAiC;AAAA,IACnC,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,MAAM;AAAA,IAC9B,eAAe,MAAM,QAAQ,IAAI,kBAAkB;AAAA,IACnD,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB;AAAA,IACrD,gBAAgB,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IAChD,gBAAgB,kBAAkB;AAAA,IAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,eAAgC;AAClF,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,4BAAsB,OAAO,cAAc;AAC3C,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,QAAM,yBAAyB,MAAM,KAAK,aAAa,EAAE,KAAK,CAAC,WAAW,eAAe,IAAI,MAAM,CAAC;AAEpG,aAAW,UAAU,eAAe;AAClC,QAAI,eAAe,IAAI,MAAM,EAAG;AAChC,QAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,0BAAsB,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AACzE,UAAM,IAAI,uBAAuB,+BAA+B;AAAA,EAClE;AAEA,MAAI,CAAC,UAAW;AAChB,MAAI,eAAe,IAAI,SAAS,EAAG;AACnC,MAAI,0BAA0B,WAAW,gBAAgB,GAAG,EAAG;AAC/D,MAAI,iBAAiB,SAAS,KAAK,uBAAwB;AAE3D,wBAAsB,OAAO,gBAAgB,WAAW,QAAQ,IAAI,QAAQ;AAC5E,QAAM,IAAI,uBAAuB,+BAA+B;AAClE;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,WAAO,MAAM,qCAAqC,EAAE,OAAO,QAAQ,MAAM,CAAC;AAC1E,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
+  "sourcesContent": ["import { createLogger } from './logger'\n\nconst logger = createLogger('shared').child({ component: 'origin-check' })\n\nconst DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\ntype RequestOriginCandidates = {\n  urlOrigin: string | null\n  headerOrigins: Set<string>\n}\n\nfunction readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {\n  const candidates: RequestOriginCandidates = {\n    urlOrigin: null,\n    headerOrigins: new Set<string>(),\n  }\n  if (!input) return candidates\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return candidates\n  }\n\n  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (typeof input === 'string') return candidates\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)\n  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)\n  return candidates\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  if (urlOrigin) origins.add(urlOrigin)\n  for (const origin of headerOrigins) origins.add(origin)\n  return origins\n}\n\nfunction logOriginDebugContext(\n  input: RequestInput,\n  allowedOrigins: Set<string>,\n  rejectedOrigin?: string,\n  level: 'error' | 'warn' = 'error',\n  nodeEnv?: string,\n): void {\n  if (level === 'warn' && nodeEnv === 'test') return\n  const log = (msg: string, fields: Record<string, unknown>) =>\n    level === 'warn' ? logger.warn(msg, fields) : logger.error(msg, fields)\n\n  if (typeof input === 'string') {\n    log('Origin check rejected string input', {\n      requestUrl: input,\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  if (!input) {\n    log('Origin check rejected empty input', {\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  log('Origin check rejected request', {\n    requestUrl: input.url,\n    host: input.headers.get('host'),\n    forwardedHost: input.headers.get('x-forwarded-host'),\n    forwardedProto: input.headers.get('x-forwarded-proto'),\n    derivedOrigins: Array.from(requestOrigins(input)),\n    rejectedOrigin: rejectedOrigin ?? null,\n    allowedOrigins: Array.from(allowedOrigins),\n  })\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      logOriginDebugContext(input, allowedOrigins)\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))\n\n  for (const origin of headerOrigins) {\n    if (allowedOrigins.has(origin)) continue\n    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)\n    throw new AppOriginRejectedError('Request origin is not allowed')\n  }\n\n  if (!urlOrigin) return\n  if (allowedOrigins.has(urlOrigin)) return\n  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return\n  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return\n\n  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)\n  throw new AppOriginRejectedError('Request origin is not allowed')\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function isCrossSiteBrowserRequest(req: Request, env: EnvLike = process.env): boolean {\n  const rawFetchSite = req.headers.get('sec-fetch-site')\n  const fetchSite = rawFetchSite?.trim().toLowerCase() ?? null\n  if (fetchSite === 'cross-site') return true\n  if (fetchSite === 'same-origin' || fetchSite === 'none') return false\n\n  const rawOrigin = req.headers.get('origin')\n  if (rawOrigin === null) return rawFetchSite !== null\n  const origin = normalizeOrigin(rawOrigin)\n  if (!origin) return true\n\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.has(origin)) return false\n  if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) return false\n\n  const forwardedProto = readFirstHeaderValue(req.headers.get('x-forwarded-proto'))\n  const protocol = forwardedProto\n    ? (forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`)\n    : new URL(origin).protocol\n  const host = req.headers.get('host')\n  const forwardedHost = req.headers.get('x-forwarded-host')\n  if (originFromHost(protocol, forwardedHost) === origin) return false\n  if (originFromHost(protocol, host) === origin) return false\n\n  if (env.NODE_ENV !== 'test') {\n    logger.warn('Cross-site request rejected', { origin, host, forwardedHost })\n  }\n  return true\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    logger.error('APP_URL is required in production', { scope: mapping.scope })\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEzE,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAOA,SAAS,4BAA4B,OAA8C;AACjF,QAAM,aAAsC;AAAA,IAC1C,WAAW;AAAA,IACX,eAAe,oBAAI,IAAY;AAAA,EACjC;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,gBAAgB,UAAU,MAAM;AACvD,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,YAAW,cAAc,IAAI,UAAU;AACvD,MAAI,oBAAqB,YAAW,cAAc,IAAI,mBAAmB;AACzE,SAAO;AACT;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,MAAI,UAAW,SAAQ,IAAI,SAAS;AACpC,aAAW,UAAU,cAAe,SAAQ,IAAI,MAAM;AACtD,SAAO;AACT;AAEA,SAAS,sBACP,OACA,gBACA,gBACA,QAA0B,SAC1B,SACM;AACN,MAAI,UAAU,UAAU,YAAY,OAAQ;AAC5C,QAAM,MAAM,CAAC,KAAa,WACxB,UAAU,SAAS,OAAO,KAAK,KAAK,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM;AAExE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,sCAAsC;AAAA,MACxC,YAAY;AAAA,MACZ,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,QAAI,qCAAqC;AAAA,MACvC,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,iCAAiC;AAAA,IACnC,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,MAAM;AAAA,IAC9B,eAAe,MAAM,QAAQ,IAAI,kBAAkB;AAAA,IACnD,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB;AAAA,IACrD,gBAAgB,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IAChD,gBAAgB,kBAAkB;AAAA,IAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,eAAgC;AAClF,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,4BAAsB,OAAO,cAAc;AAC3C,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,QAAM,yBAAyB,MAAM,KAAK,aAAa,EAAE,KAAK,CAAC,WAAW,eAAe,IAAI,MAAM,CAAC;AAEpG,aAAW,UAAU,eAAe;AAClC,QAAI,eAAe,IAAI,MAAM,EAAG;AAChC,QAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,0BAAsB,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AACzE,UAAM,IAAI,uBAAuB,+BAA+B;AAAA,EAClE;AAEA,MAAI,CAAC,UAAW;AAChB,MAAI,eAAe,IAAI,SAAS,EAAG;AACnC,MAAI,0BAA0B,WAAW,gBAAgB,GAAG,EAAG;AAC/D,MAAI,iBAAiB,SAAS,KAAK,uBAAwB;AAE3D,wBAAsB,OAAO,gBAAgB,WAAW,QAAQ,IAAI,QAAQ;AAC5E,QAAM,IAAI,uBAAuB,+BAA+B;AAClE;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,0BAA0B,KAAc,MAAe,QAAQ,KAAc;AAC3F,QAAM,eAAe,IAAI,QAAQ,IAAI,gBAAgB;AACrD,QAAM,YAAY,cAAc,KAAK,EAAE,YAAY,KAAK;AACxD,MAAI,cAAc,aAAc,QAAO;AACvC,MAAI,cAAc,iBAAiB,cAAc,OAAQ,QAAO;AAEhE,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ;AAC1C,MAAI,cAAc,KAAM,QAAO,iBAAiB;AAChD,QAAM,SAAS,gBAAgB,SAAS;AACxC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,IAAI,MAAM,EAAG,QAAO;AACvC,MAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG,QAAO;AAEnE,QAAM,iBAAiB,qBAAqB,IAAI,QAAQ,IAAI,mBAAmB,CAAC;AAChF,QAAM,WAAW,iBACZ,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc,MAClE,IAAI,IAAI,MAAM,EAAE;AACpB,QAAM,OAAO,IAAI,QAAQ,IAAI,MAAM;AACnC,QAAM,gBAAgB,IAAI,QAAQ,IAAI,kBAAkB;AACxD,MAAI,eAAe,UAAU,aAAa,MAAM,OAAQ,QAAO;AAC/D,MAAI,eAAe,UAAU,IAAI,MAAM,OAAQ,QAAO;AAEtD,MAAI,IAAI,aAAa,QAAQ;AAC3B,WAAO,KAAK,+BAA+B,EAAE,QAAQ,MAAM,cAAc,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,WAAO,MAAM,qCAAqC,EAAE,OAAO,QAAQ,MAAM,CAAC;AAC1E,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.9.1-develop.7548.1.ee60458c45";
+const APP_VERSION = "0.9.1-develop.7552.1.4acf199f7a";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.9.1-develop.7548.1.ee60458c45';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.9.1-develop.7552.1.4acf199f7a';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.9.1-develop.7548.1.ee60458c45",
+  "version": "0.9.1-develop.7552.1.4acf199f7a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -121,7 +121,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.9.1-develop.7548.1.ee60458c45",
+    "@open-mercato/cache": "0.9.1-develop.7552.1.4acf199f7a",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/__tests__/url.cross-site.test.ts

@@ -0,0 +1,140 @@
+import { isCrossSiteBrowserRequest } from '../url'
+
+function req(headers: Record<string, string>, url = 'https://app.example.com/api/auth/login') {
+  return new Request(url, { method: 'POST', headers })
+}
+
+const configured = { APP_URL: 'https://app.example.com', NODE_ENV: 'production' }
+const unconfiguredDev = { NODE_ENV: 'development' }
+
+describe('isCrossSiteBrowserRequest', () => {
+  describe('non-browser callers (no Origin, no Sec-Fetch-Site) are never cross-site', () => {
+    test.each([
+      ['configured', configured],
+      ['unconfigured dev', unconfiguredDev],
+    ])('%s', (_label, env) => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com' }), env)).toBe(false)
+    })
+  })
+
+  describe('Fetch Metadata is authoritative when present', () => {
+    test('cross-site is rejected regardless of Origin', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', 'sec-fetch-site': 'cross-site' }), configured)).toBe(true)
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', 'sec-fetch-site': 'cross-site', origin: 'https://app.example.com' }), configured)).toBe(true)
+    })
+
+    test('same-origin and none are accepted even when the proxy hides the public host', () => {
+      const internal = 'http://app-internal:3000/api/auth/login'
+      expect(isCrossSiteBrowserRequest(req({ host: 'app-internal:3000', origin: 'https://public.example.net', 'sec-fetch-site': 'same-origin' }, internal), {})).toBe(false)
+      expect(isCrossSiteBrowserRequest(req({ host: 'app-internal:3000', 'sec-fetch-site': 'none' }, internal), {})).toBe(false)
+    })
+
+    test('same-site falls back to the Origin allowlist', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://blog.example.com', 'sec-fetch-site': 'same-site' }), configured)).toBe(true)
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://ops.example.com', 'sec-fetch-site': 'same-site' }), {
+        ...configured,
+        APP_ALLOWED_ORIGINS: 'https://ops.example.com',
+      })).toBe(false)
+    })
+
+    test('an unknown Sec-Fetch-Site token falls back to the Origin check', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://evil.example', 'sec-fetch-site': 'bogus' }), configured)).toBe(true)
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://app.example.com', 'sec-fetch-site': 'bogus' }), configured)).toBe(false)
+    })
+  })
+
+  describe('Origin check (browsers without Fetch Metadata)', () => {
+    test('Origin: null is cross-site', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'null' }), configured)).toBe(true)
+    })
+
+    test('a malformed Origin is cross-site', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'not a url' }), configured)).toBe(true)
+    })
+
+    test('a foreign Origin is cross-site', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://evil.example' }), configured)).toBe(true)
+    })
+
+    test('Origin matching a configured origin (APP_URL / NEXT_PUBLIC_APP_URL / APP_ALLOWED_ORIGINS) is accepted', () => {
+      const internal = 'http://app-internal:3000/api/auth/login'
+      expect(isCrossSiteBrowserRequest(req({ host: 'app-internal:3000', origin: 'https://app.example.com' }, internal), configured)).toBe(false)
+      expect(isCrossSiteBrowserRequest(req({ host: 'app-internal:3000', origin: 'https://admin.example.com' }, internal), {
+        NEXT_PUBLIC_APP_URL: 'https://admin.example.com',
+      })).toBe(false)
+    })
+
+    test('Origin matching the request Host authority is accepted (portal custom domains, unconfigured dev)', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'shop.acme.test', origin: 'https://shop.acme.test' }, 'https://shop.acme.test/api/customer_accounts/login'), configured)).toBe(false)
+      expect(isCrossSiteBrowserRequest(req({ host: 'localhost:3000', origin: 'http://localhost:3000' }, 'http://localhost:3000/api/auth/login'), unconfiguredDev)).toBe(false)
+    })
+
+    test('Origin matching X-Forwarded-Host is accepted even when the proxy did not forward the scheme', () => {
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app-internal:3000',
+        'x-forwarded-host': 'admin.example.com',
+        origin: 'https://admin.example.com',
+      }, 'http://app-internal:3000/api/auth/login'), {})).toBe(false)
+    })
+
+    test('a different port on the same host is cross-origin', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://app.example.com:8443' }), configured)).toBe(true)
+    })
+
+    test('a Host carrying the default port matches the Origin', () => {
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app.example.com:443',
+        'x-forwarded-proto': 'https',
+        origin: 'https://app.example.com',
+      }, 'http://app.example.com:443/api/auth/login'), {})).toBe(false)
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app.example.com:443',
+        origin: 'https://app.example.com',
+      }, 'http://app.example.com:443/api/auth/login'), {})).toBe(false)
+    })
+
+    test('an uppercase Host matches the Origin', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'APP.Example.COM', origin: 'https://app.example.com' }), {})).toBe(false)
+    })
+
+    test('an IPv6 loopback Host matches the Origin in dev', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: '[::1]:3000', origin: 'http://[::1]:3000' }, 'http://[::1]:3000/api/auth/login'), unconfiguredDev)).toBe(false)
+    })
+
+    test('only the first X-Forwarded-Host value is used', () => {
+      const internal = 'http://app-internal:3000/api/auth/login'
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app-internal:3000',
+        'x-forwarded-host': 'admin.example.com, evil.example',
+        origin: 'https://admin.example.com',
+      }, internal), {})).toBe(false)
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app-internal:3000',
+        'x-forwarded-host': 'admin.example.com, evil.example',
+        origin: 'https://evil.example',
+      }, internal), {})).toBe(true)
+    })
+
+    test('a forwarded scheme that differs from the Origin scheme is cross-origin', () => {
+      expect(isCrossSiteBrowserRequest(req({
+        host: 'app.example.com',
+        'x-forwarded-proto': 'https',
+        origin: 'http://app.example.com',
+      }), {})).toBe(true)
+    })
+  })
+
+  describe('Fetch Metadata without Origin', () => {
+    test('same-site without Origin is cross-site', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', 'sec-fetch-site': 'same-site' }), configured)).toBe(true)
+    })
+
+    test('an unknown token without Origin is cross-site', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', 'sec-fetch-site': 'bogus' }), configured)).toBe(true)
+    })
+
+    test('the Sec-Fetch-Site value is compared case- and whitespace-insensitively', () => {
+      expect(isCrossSiteBrowserRequest(req({ host: 'app.example.com', origin: 'https://app.example.com', 'sec-fetch-site': ' Cross-Site ' }), configured)).toBe(true)
+    })
+  })
+})

package/src/lib/url.ts

@@ -267,6 +267,36 @@ export function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLi
   return `${base}/${path.replace(/^\/+/, '')}`
 }
 
+export function isCrossSiteBrowserRequest(req: Request, env: EnvLike = process.env): boolean {
+  const rawFetchSite = req.headers.get('sec-fetch-site')
+  const fetchSite = rawFetchSite?.trim().toLowerCase() ?? null
+  if (fetchSite === 'cross-site') return true
+  if (fetchSite === 'same-origin' || fetchSite === 'none') return false
+
+  const rawOrigin = req.headers.get('origin')
+  if (rawOrigin === null) return rawFetchSite !== null
+  const origin = normalizeOrigin(rawOrigin)
+  if (!origin) return true
+
+  const allowedOrigins = readAllowedOrigins(env)
+  if (allowedOrigins.has(origin)) return false
+  if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) return false
+
+  const forwardedProto = readFirstHeaderValue(req.headers.get('x-forwarded-proto'))
+  const protocol = forwardedProto
+    ? (forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`)
+    : new URL(origin).protocol
+  const host = req.headers.get('host')
+  const forwardedHost = req.headers.get('x-forwarded-host')
+  if (originFromHost(protocol, forwardedHost) === origin) return false
+  if (originFromHost(protocol, host) === origin) return false
+
+  if (env.NODE_ENV !== 'test') {
+    logger.warn('Cross-site request rejected', { origin, host, forwardedHost })
+  }
+  return true
+}
+
 export function mapSecurityEmailUrlError(
   error: unknown,
   mapping: SecurityEmailUrlErrorMapping,