@serfab/cadre-host 0.7.1

package/src/server/__tests__/status-route.test.ts

@@ -0,0 +1,113 @@
+import Fastify from 'fastify';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+
+import { registerErrorHandler } from '../error-handler.js';
+import { registerStatusRoute } from '../routes/status.js';
+import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
+import type { ManagedNodeInfo } from '../../orchestrator/types.js';
+import type { TrustCircleService } from '../../auth/index.js';
+import type { TrustCircleSnapshot } from '../../auth/types.js';
+import type { NatService } from '../../nat/index.js';
+import type { NatStatusSnapshot } from '../../nat/types.js';
+import type { UpdateService } from '../../update/index.js';
+import type { UpdateState } from '../../update/types.js';
+
+function fakeOrchestrator(nodes: ManagedNodeInfo[]): HostProcessOrchestrator {
+  return { listNodes: () => nodes } as unknown as HostProcessOrchestrator;
+}
+function fakeTrustCircle(snap: TrustCircleSnapshot): TrustCircleService {
+  return { list: async () => snap } as unknown as TrustCircleService;
+}
+function fakeNat(snap: NatStatusSnapshot): NatService {
+  return { getStatus: () => snap } as unknown as NatService;
+}
+function fakeUpdate(state: UpdateState): UpdateService {
+  return { getState: async () => state } as unknown as UpdateService;
+}
+
+const SAMPLE_CONNECTIVITY: NatStatusSnapshot = {
+  portMode: 'auto-upnp',
+  externalPort: 4001,
+  internalPort: 4001,
+  routerExternalIp: '203.0.113.5',
+  mappingLeaseExpiresAt: null,
+  externalIp: '203.0.113.5',
+  externalIpDetectedAt: null,
+  cgnatDetected: false,
+  directReachability: 'reachable',
+  lastTestedAt: null,
+  ddns: {
+    providerId: null,
+    hostname: null,
+    externallyManaged: false,
+    lastUpdateAt: null,
+    lastUpdateOk: null,
+    lastError: null,
+  },
+};
+
+describe('GET /api/status', () => {
+  let app: ReturnType<typeof Fastify>;
+
+  afterEach(async () => { await app.close(); });
+
+  it('returns aggregated status without update service', async () => {
+    app = Fastify();
+    registerErrorHandler(app);
+    registerStatusRoute(app, {
+      orchestrator: fakeOrchestrator([
+        {
+          id: 'alice',
+          dockerId: '1234:abc',
+          partyId: 'party-alice',
+          profile: 'storage',
+          status: 'running',
+          spawnedAt: '2025-01-01T00:00:00Z',
+          workdir: '/tmp/alice',
+          ports: { health: 1, metrics: 2, p2p: 3 },
+        },
+      ]),
+      trustCircle: fakeTrustCircle({
+        members: [{ peerId: 'p1', label: 'Self', addedAt: '2025-01-01T00:00:00Z', self: true }],
+        pending: [],
+      }),
+      nat: fakeNat(SAMPLE_CONNECTIVITY),
+    });
+
+    const res = await app.inject({ method: 'GET', url: '/api/status' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      service: { name: string; version: string; uptimeSeconds: number };
+      nodes: Array<{ id: string; status: string }>;
+      trustCircle: { members: number; pending: number };
+      connectivity: { portMode: string };
+      update?: { available?: string };
+    };
+    expect(body.service.name).toBe('cadre-host');
+    expect(body.nodes).toHaveLength(1);
+    expect(body.nodes[0]).toMatchObject({ id: 'alice', status: 'running' });
+    expect(body.trustCircle).toEqual({ members: 1, pending: 0 });
+    expect(body.connectivity.portMode).toBe('auto-upnp');
+    expect(body.update).toBeUndefined();
+  });
+
+  it('includes update info when service is present', async () => {
+    app = Fastify();
+    registerErrorHandler(app);
+    registerStatusRoute(app, {
+      orchestrator: fakeOrchestrator([]),
+      trustCircle: fakeTrustCircle({ members: [], pending: [] }),
+      nat: fakeNat(SAMPLE_CONNECTIVITY),
+      update: fakeUpdate({
+        version: 1,
+        lastChecked: '2025-06-01T00:00:00Z',
+        available: { version: '0.7.0', publishedAt: '2025-06-01T00:00:00Z' },
+      }),
+    });
+
+    const res = await app.inject({ method: 'GET', url: '/api/status' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { update?: { available?: string; lastChecked?: string } };
+    expect(body.update).toEqual({ available: '0.7.0', lastChecked: '2025-06-01T00:00:00Z' });
+  });
+});

package/src/server/error-handler.ts

@@ -0,0 +1,108 @@
+/**
+ * Fastify error handler — translates known typed errors to stable HTTP status
+ * codes and uniform `{ ok: false, error: { code, message } }` payloads.
+ *
+ * Codes (cross-referenced with `auth/types.ts`, `nat/types.ts`, `update/types.ts`):
+ *   - TrustCircleError
+ *       invalid_label, invalid_token             → 400
+ *       not_found, already_redeemed              → 404
+ *       expired                                  → 410
+ *       storage_error                            → 500
+ *   - NatError
+ *       invalid_config, ddns_provider_unknown,
+ *       ddns_credentials_missing                 → 400
+ *       secrets_unavailable, storage_error,
+ *       mapping_failed, router_unreachable,
+ *       ip_detection_failed, ddns_update_failed  → 500
+ *   - UpdateErrorException
+ *       manifest_invalid, no_update_available,
+ *       min_previous_version                     → 400
+ *       apply_in_progress                        → 409
+ *       signature_invalid, unsupported_state_version,
+ *       apply_failed, rollback_failed, storage_error → 500
+ *   - everything else                            → 500 (code "internal")
+ */
+
+import type { FastifyError, FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import debug from 'debug';
+
+import { TrustCircleError, type TrustCircleErrorCode } from '../auth/types.js';
+import { NatError, type NatErrorCode } from '../nat/types.js';
+import { UpdateErrorException, type UpdateErrorCode } from '../update/types.js';
+
+const log = debug('cadre:host:error-handler');
+
+const TRUST_STATUS: Record<TrustCircleErrorCode, number> = {
+  invalid_label: 400,
+  invalid_token: 400,
+  not_found: 404,
+  already_redeemed: 404,
+  expired: 410,
+  storage_error: 500,
+};
+
+const NAT_STATUS: Record<NatErrorCode, number> = {
+  invalid_config: 400,
+  ddns_provider_unknown: 400,
+  ddns_credentials_missing: 400,
+  secrets_unavailable: 500,
+  storage_error: 500,
+  mapping_failed: 500,
+  router_unreachable: 500,
+  ip_detection_failed: 500,
+  ddns_update_failed: 500,
+};
+
+const UPDATE_STATUS: Record<UpdateErrorCode, number> = {
+  manifest_invalid: 400,
+  no_update_available: 400,
+  min_previous_version: 400,
+  apply_in_progress: 409,
+  signature_invalid: 500,
+  unsupported_state_version: 500,
+  apply_failed: 500,
+  rollback_failed: 500,
+  storage_error: 500,
+};
+
+export function registerErrorHandler(app: FastifyInstance): void {
+  app.setErrorHandler((err: FastifyError, request: FastifyRequest, reply: FastifyReply) => {
+    const { status, code, message } = classify(err);
+    if (status >= 500) {
+      log('5xx %s %s: [%s] %s', request.method, request.url, code, message);
+    } else {
+      log('%d %s %s: [%s] %s', status, request.method, request.url, code, message);
+    }
+    return reply.code(status).send({
+      ok: false,
+      error: { code, message },
+    });
+  });
+}
+
+interface Classified {
+  status: number;
+  code: string;
+  message: string;
+}
+
+function classify(err: FastifyError): Classified {
+  if (err instanceof TrustCircleError) {
+    return { status: TRUST_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+  }
+  if (err instanceof NatError) {
+    return { status: NAT_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+  }
+  if (err instanceof UpdateErrorException) {
+    return { status: UPDATE_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+  }
+  // Fastify body-parsing / validation errors have a statusCode we should honour.
+  if (typeof err.statusCode === 'number' && err.statusCode >= 400 && err.statusCode < 600) {
+    return {
+      status: err.statusCode,
+      code: err.code ?? (err.statusCode === 404 ? 'not_found' : 'bad_request'),
+      message: err.message ?? 'request failed',
+    };
+  }
+  return { status: 500, code: 'internal', message: err.message || 'internal error' };
+}

package/src/server/events/bus.ts

@@ -0,0 +1,42 @@
+/**
+ * In-memory event bus for the local UI.
+ *
+ * Tiny synchronous fan-out: publishers (route adapters, orchestrator hook,
+ * update observer) call `publish`; SSE connections subscribe and receive every
+ * event until they unsubscribe. Listener errors are caught so one broken
+ * client cannot break others.
+ */
+
+import debug from 'debug';
+
+import type { LocalUiEvent } from './types.js';
+
+const log = debug('cadre:host:event-bus');
+
+export type LocalUiEventListener = (event: LocalUiEvent) => void;
+
+export class EventBus {
+  private readonly listeners = new Set<LocalUiEventListener>();
+
+  publish(event: LocalUiEvent): void {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch (err) {
+        log('listener threw for event %s: %s', event.type, (err as Error).message);
+      }
+    }
+  }
+
+  subscribe(listener: LocalUiEventListener): () => void {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+
+  /** Test helper. */
+  listenerCount(): number {
+    return this.listeners.size;
+  }
+}

package/src/server/events/sse-route.ts

@@ -0,0 +1,81 @@
+/**
+ * Server-Sent Events route — `GET /api/events`.
+ *
+ * Hand-rolled (~40 lines vs. the 30 KB @fastify/sse-v2 dep). The wire format:
+ *
+ *   retry: 5000\n\n          ← reconnect hint
+ *   : heartbeat\n\n          ← comment line, every 15 s
+ *   event: <type>\n          ← event name
+ *   data: <json>\n\n         ← payload
+ *
+ * The handler subscribes to the bus on connect, unsubscribes on client
+ * disconnect, and ticks a heartbeat so corporate proxies don't close the
+ * connection at the idle timeout.
+ */
+
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import debug from 'debug';
+
+import type { EventBus } from './bus.js';
+import type { LocalUiEvent } from './types.js';
+
+const log = debug('cadre:host:sse');
+
+const HEARTBEAT_INTERVAL_MS = 15_000;
+const RECONNECT_HINT_MS = 5_000;
+
+export interface SseRouteOptions {
+  events: EventBus;
+  /** Test override: shorter heartbeat. */
+  heartbeatIntervalMs?: number;
+}
+
+export function registerSseRoute(app: FastifyInstance, opts: SseRouteOptions): void {
+  const heartbeatMs = opts.heartbeatIntervalMs ?? HEARTBEAT_INTERVAL_MS;
+
+  app.get('/api/events', (request: FastifyRequest, reply: FastifyReply) => {
+    // Tell Fastify we're handling the reply ourselves — it won't try to
+    // serialise or send a payload.
+    reply.hijack();
+    reply.raw.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    });
+    reply.raw.write(`retry: ${RECONNECT_HINT_MS}\n\n`);
+    reply.raw.write(`: connected\n\n`);
+
+    const onEvent = (event: LocalUiEvent): void => {
+      try {
+        reply.raw.write(`event: ${event.type}\n`);
+        reply.raw.write(`data: ${JSON.stringify(event)}\n\n`);
+      } catch (err) {
+        log('write failed (client likely gone): %s', (err as Error).message);
+      }
+    };
+    const unsubscribe = opts.events.subscribe(onEvent);
+
+    const heartbeat = setInterval(() => {
+      try {
+        reply.raw.write(`: heartbeat\n\n`);
+      } catch (err) {
+        log('heartbeat write failed: %s', (err as Error).message);
+      }
+    }, heartbeatMs);
+    // Don't hold the event loop open for the heartbeat alone.
+    if (typeof heartbeat === 'object' && 'unref' in heartbeat) {
+      (heartbeat as { unref?: () => void }).unref?.();
+    }
+
+    const cleanup = (): void => {
+      clearInterval(heartbeat);
+      unsubscribe();
+    };
+    request.raw.on('close', cleanup);
+    request.raw.on('error', cleanup);
+
+    // The reply object is intentionally not returned — Fastify must not
+    // attempt to serialise an SSE response.
+  });
+}

package/src/server/events/types.ts

@@ -0,0 +1,22 @@
+/**
+ * Event types broadcast over the SPA's SSE channel.
+ *
+ * Publishers (orchestrator hook, route adapters, update observer) call
+ * EventBus.publish; the `/api/events` route fan-outs to connected clients.
+ */
+
+import type { ContainerStatus } from '@serfab/cadre-provider';
+
+import type { DirectReachability, PortForwardMode } from '../../nat/index.js';
+
+export type LocalUiEvent =
+  | { type: 'node-state-changed'; nodeId: string; status: ContainerStatus }
+  | { type: 'trust-circle-changed'; kind: 'invited' | 'redeemed' | 'revoked' }
+  | {
+      type: 'connectivity-changed';
+      portMode: PortForwardMode;
+      directReachability: DirectReachability;
+    }
+  | { type: 'update-available'; version: string; releaseNotesUrl?: string };
+
+export type LocalUiEventType = LocalUiEvent['type'];

package/src/server/index.ts

@@ -0,0 +1,209 @@
+/**
+ * Public surface for the cadre-host local UI server.
+ *
+ * `createLocalUiServer(opts)` wires:
+ *   - the origin guard + error handler
+ *   - existing trust-circle / NAT / update typed handlers, mounted at
+ *     `/auth/*`, `/nat/*`, `/update/*` (the CLI contract)
+ *   - new UI-only routes under `/api/*` (status, nodes, settings, events)
+ *   - the static SPA mount at `/`
+ *
+ * Callers (cadre-host start) own the subsystems and pass them in. The
+ * server doesn't construct them — start has to own their lifecycle anyway
+ * (orchestrator init, trust-circle/NAT bring-up, update timer).
+ */
+
+import type { FastifyInstance } from 'fastify';
+
+import type { HostProcessOrchestrator } from '../orchestrator/index.js';
+import type { TrustCircleService } from '../auth/index.js';
+import { createTrustCircleHandlers } from '../auth/index.js';
+import type { NatService } from '../nat/index.js';
+import { createNatHandlers } from '../nat/index.js';
+import type { UpdateService } from '../update/index.js';
+import { createUpdateHandlers } from '../update/index.js';
+
+import { EventBus } from './events/bus.js';
+import { registerSseRoute } from './events/sse-route.js';
+import { registerErrorHandler } from './error-handler.js';
+import { registerOriginGuard } from './origin-guard.js';
+import { registerStaticMount } from './static.js';
+import { buildFastify, startListening, stopListening } from './server.js';
+import { registerNatRoutes } from './routes/nat.js';
+import { registerTrustCircleRoutes } from './routes/trust-circle.js';
+import { registerUpdateRoutes } from './routes/update.js';
+import { registerStatusRoute } from './routes/status.js';
+import { registerNodesRoutes } from './routes/nodes.js';
+import { registerSettingsRoutes } from './routes/settings.js';
+import { HostSettingsStore } from './settings-store.js';
+
+export interface LocalUiServerOptions {
+  /** Configured UI port from host.config.json. May be re-bound on collision. */
+  uiPort: number;
+  /** Resolved data dir (passed by cadre-host start). */
+  dataDir: string;
+  /** Wired dependencies — all owned by the caller. */
+  orchestrator: HostProcessOrchestrator;
+  trustCircle: TrustCircleService;
+  nat: NatService;
+  /** Optional — 6.4.2 lands this; nullable while still iterating. */
+  update?: UpdateService;
+  /** Settings I/O facade. Defaults to a new one rooted at `dataDir`. */
+  settingsStore?: HostSettingsStore;
+  /** Bus instance — pass the same one to subsystems that publish events. */
+  events?: EventBus;
+  /**
+   * Static asset root override. Defaults to `<package>/dist/ui`. When the
+   * directory is absent the root handler returns a placeholder HTML.
+   */
+  staticRoot?: string;
+  /**
+   * Test-only: bind to port 0 (OS picks any free port). The returned URL
+   * reflects the actual bound port.
+   */
+  forcePort?: 0;
+  /**
+   * SSE heartbeat interval (ms). Defaults to 15 000 ms. Tests reduce this
+   * so the heartbeat can be observed quickly.
+   */
+  sseHeartbeatMs?: number;
+}
+
+export interface LocalUiServer {
+  app: FastifyInstance;
+  events: EventBus;
+  /** Resolves with the actually-bound port. */
+  start(): Promise<{ port: number; url: string }>;
+  stop(): Promise<void>;
+}
+
+/** How often to poll UpdateService.getState() looking for new versions. */
+const UPDATE_OBSERVER_INTERVAL_MS = 60_000;
+
+export function createLocalUiServer(opts: LocalUiServerOptions): LocalUiServer {
+  const events = opts.events ?? new EventBus();
+  const settingsStore = opts.settingsStore ?? new HostSettingsStore({ dataDir: opts.dataDir });
+
+  const app = buildFastify();
+
+  // Bound port is unknown until start(); the guard is registered then.
+
+  registerErrorHandler(app);
+
+  // /api/events (SSE) — must be registered before the static fallback so
+  // the not-found handler doesn't try to serve it.
+  registerSseRoute(app, {
+    events,
+    ...(opts.sseHeartbeatMs !== undefined ? { heartbeatIntervalMs: opts.sseHeartbeatMs } : {}),
+  });
+
+  registerStatusRoute(app, {
+    orchestrator: opts.orchestrator,
+    trustCircle: opts.trustCircle,
+    nat: opts.nat,
+    ...(opts.update ? { update: opts.update } : {}),
+  });
+  registerNodesRoutes(app, { orchestrator: opts.orchestrator });
+  registerSettingsRoutes(app, { settingsStore, nat: opts.nat, ...(opts.update ? { update: opts.update } : {}) });
+
+  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(opts.trustCircle), events });
+  registerNatRoutes(app, { handlers: createNatHandlers(opts.nat), events });
+  if (opts.update) {
+    registerUpdateRoutes(app, { handlers: createUpdateHandlers(opts.update), events });
+  }
+
+  // Static mount registers as the not-found handler — declared last so the
+  // API paths above win.
+  registerStaticMount(app, { ...(opts.staticRoot !== undefined ? { rootDir: opts.staticRoot } : {}) });
+
+  let bound: { port: number; url: string } | null = null;
+  let stopped = false;
+  const teardown: Array<() => void> = [];
+
+  return {
+    app,
+    events,
+    async start() {
+      if (bound) return bound;
+      // Origin guard reads the port at request time via the getter so the
+      // post-fallback bound port is honoured. Registered here (not at
+      // factory time) so it lives in the same lifecycle as listen.
+      registerOriginGuard(app, { port: () => bound?.port ?? opts.uiPort });
+      const started = await startListening(app, {
+        preferredPort: opts.uiPort,
+        ...(opts.forcePort === 0 ? { forcePort: 0 as const } : {}),
+      });
+      bound = started;
+
+      // Orchestrator → bus adapter: forward node state changes.
+      teardown.push(
+        opts.orchestrator.onStateChange((info) => {
+          events.publish({
+            type: 'node-state-changed',
+            nodeId: info.id,
+            status: info.status === 'running' ? 'running' : 'stopped',
+          });
+        }),
+      );
+
+      // One-shot connectivity publish — the SPA will get a sane initial
+      // signal even if no settings have changed yet this session.
+      try {
+        const snap = opts.nat.getStatus();
+        events.publish({
+          type: 'connectivity-changed',
+          portMode: snap.portMode,
+          directReachability: snap.directReachability,
+        });
+      } catch {
+        // NatService.start may not have completed; harmless to skip.
+      }
+
+      // Update observer: poll UpdateService.getState() every 60 s and emit
+      // `update-available` when `available.version` changes. Cheap, avoids
+      // poking at the service's internals.
+      if (opts.update) {
+        const update = opts.update;
+        let lastVersion: string | undefined;
+        const tick = async (): Promise<void> => {
+          try {
+            const state = await update.getState();
+            const available = state.available;
+            if (available && available.version && available.version !== lastVersion) {
+              lastVersion = available.version;
+              events.publish({
+                type: 'update-available',
+                version: available.version,
+                ...(available.releaseNotesUrl ? { releaseNotesUrl: available.releaseNotesUrl } : {}),
+              });
+            }
+          } catch {
+            // Update store I/O failure — silent, will retry next tick.
+          }
+        };
+        // Fire once on boot in case the timer set `available` before the server bound.
+        void tick();
+        const timer = setInterval(() => { void tick(); }, UPDATE_OBSERVER_INTERVAL_MS);
+        if (typeof timer === 'object' && 'unref' in timer) {
+          (timer as { unref?: () => void }).unref?.();
+        }
+        teardown.push(() => clearInterval(timer));
+      }
+
+      return started;
+    },
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      for (const fn of teardown.splice(0, teardown.length)) {
+        try { fn(); } catch { /* ignore teardown errors */ }
+      }
+      await stopListening(app);
+    },
+  };
+}
+
+export { EventBus } from './events/bus.js';
+export type { LocalUiEventListener } from './events/bus.js';
+export type { LocalUiEvent, LocalUiEventType } from './events/types.js';
+export { HostSettingsStore } from './settings-store.js';

package/src/server/origin-guard.ts

@@ -0,0 +1,84 @@
+/**
+ * Origin guard — defeats DNS-rebind attacks against the loopback listener.
+ *
+ * The listener is bound to 127.0.0.1 only, but a malicious page on
+ * `evil.example.com` can still resolve its own hostname to 127.0.0.1 and
+ * speak HTTP to us. We mitigate by requiring that:
+ *   - `Host` is `127.0.0.1[:port]` or `localhost[:port]` (case-insensitive),
+ *   - `Origin` (when present) matches one of those origins.
+ *
+ * Forbidden requests return 403 with the standard error envelope.
+ *
+ * The expected port can be supplied as a constant or as a getter — the
+ * server's port-fallback loop discovers the bound port only after `listen`,
+ * but Fastify hooks must be registered before `ready`, so the guard reads
+ * the port at request time via the getter.
+ */
+
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+
+export interface OriginGuardOptions {
+  /** Bound port (constant) or a getter for the current bound port. */
+  port: number | (() => number);
+  /** Allow these additional hosts (test harnesses, integrations). */
+  extraAllowedHosts?: ReadonlyArray<string>;
+}
+
+const ALLOWED_HOSTNAMES = ['127.0.0.1', 'localhost', '[::1]', '::1'] as const;
+
+export function registerOriginGuard(app: FastifyInstance, opts: OriginGuardOptions): void {
+  const getPort = typeof opts.port === 'function' ? opts.port : () => opts.port as number;
+  const extras = (opts.extraAllowedHosts ?? []).map((e) => e.toLowerCase());
+
+  app.addHook('onRequest', async (request: FastifyRequest, reply: FastifyReply) => {
+    const port = getPort();
+    const allowedHosts = buildAllowedHostHeaders(port, extras);
+    const allowedOrigins = buildAllowedOrigins(port, extras);
+
+    const hostHeader = (request.headers.host ?? '').toLowerCase();
+    if (!hostHeader || !allowedHosts.has(hostHeader)) {
+      return reply.code(403).send({
+        ok: false,
+        error: {
+          code: 'forbidden_origin',
+          message: `Host header "${request.headers.host ?? ''}" is not allowed`,
+        },
+      });
+    }
+    const origin = request.headers.origin;
+    if (typeof origin === 'string' && origin.length > 0) {
+      if (!allowedOrigins.has(origin.toLowerCase())) {
+        return reply.code(403).send({
+          ok: false,
+          error: {
+            code: 'forbidden_origin',
+            message: `Origin "${origin}" is not allowed`,
+          },
+        });
+      }
+    }
+    return undefined;
+  });
+}
+
+function buildAllowedHostHeaders(port: number, extras: ReadonlyArray<string>): Set<string> {
+  const set = new Set<string>();
+  for (const host of ALLOWED_HOSTNAMES) {
+    set.add(host);
+    set.add(`${host}:${port}`);
+  }
+  for (const e of extras) set.add(e);
+  return set;
+}
+
+function buildAllowedOrigins(port: number, extras: ReadonlyArray<string>): Set<string> {
+  const set = new Set<string>();
+  for (const host of ALLOWED_HOSTNAMES) {
+    set.add(`http://${host}`);
+    set.add(`http://${host}:${port}`);
+    set.add(`https://${host}`);
+    set.add(`https://${host}:${port}`);
+  }
+  for (const e of extras) set.add(e);
+  return set;
+}