margins 0.1.0

package/lib/links.js

@@ -0,0 +1,314 @@
+/**
+ * Links between files: finding them in markdown, and working out which file
+ * each one means.
+ *
+ * Loaded by the server, to find what links to a file, and by the page, to
+ * render and follow links -- one implementation, so the two can never
+ * disagree about where [[Some Note]] points. It is written so it runs in
+ * both: no requires, no DOM, and it exports itself either way.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.MarginsLinks = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  var MARKDOWN_EXTENSIONS = ['.md', '.markdown', '.mdown', '.mkd', '.mkdn', '.mdx'];
+
+  /**
+   * The same markdown with code blanked out, character for character.
+   *
+   * A link inside a code block is an example of a link, not a link, and a
+   * backlinks list that includes every README's "[text](url)" syntax sample
+   * is wrong. Blanking rather than removing keeps every line and column where
+   * it was, so what is found can still be reported by line number.
+   */
+  function blankCode(markdown) {
+    var lines = String(markdown).split('\n');
+    var fence = null;
+
+    for (var i = 0; i < lines.length; i++) {
+      var line = lines[i];
+      var open = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+
+      if (fence) {
+        // A fence closes on a run of the same character at least as long.
+        if (open && open[1][0] === fence[0] && open[1].length >= fence.length && /^ {0,3}[`~]+\s*$/.test(line)) {
+          fence = null;
+        }
+        lines[i] = line.replace(/[^\s]/g, ' ');
+        continue;
+      }
+      if (open) {
+        fence = open[1];
+        lines[i] = line.replace(/[^\s]/g, ' ');
+        continue;
+      }
+
+      // Inline code: a run of backticks closes on the same length run.
+      lines[i] = line.replace(/(`+)([^`]|[^`][\s\S]*?[^`])\1(?!`)/g, function (match) {
+        return match.replace(/[^\s]/g, ' ');
+      });
+    }
+    return lines.join('\n');
+  }
+
+  /** "Note#Heading|Alias" -> its parts. */
+  function parseWikilink(inner) {
+    var text = String(inner).trim();
+    var alias = null;
+    var pipe = text.indexOf('|');
+    if (pipe !== -1) {
+      alias = text.slice(pipe + 1).trim() || null;
+      text = text.slice(0, pipe).trim();
+    }
+    var heading = null;
+    var hash = text.indexOf('#');
+    if (hash !== -1) {
+      heading = text.slice(hash + 1).trim() || null;
+      text = text.slice(0, hash).trim();
+    }
+    return { target: text, heading: heading, alias: alias };
+  }
+
+  var INLINE_LINK = /(!?)\[((?:[^[\]\\]|\\.|\[[^\]]*\])*)\]\(\s*(<[^>\n]*>|[^\s)]+)(?:\s+(?:"[^"\n]*"|'[^'\n]*'|\([^)\n]*\)))?\s*\)/g;
+  var REFERENCE_DEF = /^ {0,3}\[([^\]]+)\]:\s*(<[^>\n]*>|\S+)/;
+  var WIKILINK = /(!?)\[\[([^[\]\n]+?)\]\]/g;
+
+  /**
+   * Every link in a markdown document.
+   *
+   * @param {string} markdown
+   * @returns {{type: 'link'|'image'|'wiki'|'embed', target: string, line: number, text: string}[]}
+   *   `line` is 1-based; `text` is that whole line, for showing context.
+   */
+  function extractLinks(markdown) {
+    var original = String(markdown).split('\n');
+    var blanked = blankCode(markdown).split('\n');
+    var links = [];
+
+    for (var i = 0; i < blanked.length; i++) {
+      var line = blanked[i];
+      var context = original[i].trim();
+      var match;
+
+      WIKILINK.lastIndex = 0;
+      while ((match = WIKILINK.exec(line)) !== null) {
+        var parsed = parseWikilink(match[2]);
+        if (parsed.target || parsed.heading) {
+          links.push({ type: match[1] ? 'embed' : 'wiki', target: match[2].trim(), line: i + 1, text: context });
+        }
+      }
+
+      INLINE_LINK.lastIndex = 0;
+      while ((match = INLINE_LINK.exec(line)) !== null) {
+        var target = match[3];
+        if (target.charAt(0) === '<') target = target.slice(1, -1);
+        links.push({ type: match[1] ? 'image' : 'link', target: target, line: i + 1, text: context });
+      }
+
+      var def = REFERENCE_DEF.exec(line);
+      if (def) {
+        var href = def[2];
+        if (href.charAt(0) === '<') href = href.slice(1, -1);
+        links.push({ type: 'link', target: href, line: i + 1, text: context });
+      }
+    }
+    return links;
+  }
+
+  /** Whether an href leaves the folder: a scheme, or protocol-relative. */
+  function isExternal(href) {
+    return /^[a-z][a-z0-9+.-]*:/i.test(href) || href.indexOf('//') === 0;
+  }
+
+  function dirname(path) {
+    var slash = path.lastIndexOf('/');
+    return slash === -1 ? '' : path.slice(0, slash);
+  }
+
+  /** Join and normalise forward-slash segments; null if they climb out of the root. */
+  function normalise(parts) {
+    var out = [];
+    for (var i = 0; i < parts.length; i++) {
+      var part = parts[i];
+      if (part === '' || part === '.') continue;
+      if (part === '..') {
+        if (out.length === 0) return null;
+        out.pop();
+      } else {
+        out.push(part);
+      }
+    }
+    return out.join('/');
+  }
+
+  function safeDecode(text) {
+    try {
+      return decodeURIComponent(text);
+    } catch (error) {
+      return text;
+    }
+  }
+
+  /**
+   * Where a relative href in `fromPath` points, as a path from the root.
+   *
+   * @returns {{path: string, fragment: string|null}|null} null for an
+   *   external link, an empty one, or one that climbs out of the folder
+   */
+  function resolveHref(fromPath, href) {
+    var raw = String(href || '').trim();
+    if (!raw || isExternal(raw)) return null;
+
+    var fragment = null;
+    var hash = raw.indexOf('#');
+    if (hash !== -1) {
+      fragment = safeDecode(raw.slice(hash + 1)) || null;
+      raw = raw.slice(0, hash);
+    }
+    var query = raw.indexOf('?');
+    if (query !== -1) raw = raw.slice(0, query);
+
+    // "#heading" alone is a link within the same file.
+    if (raw === '') return { path: fromPath, fragment: fragment };
+
+    var decoded = safeDecode(raw);
+    var base = decoded.charAt(0) === '/' ? [] : dirname(fromPath).split('/');
+    var path = normalise(base.concat(decoded.split('/')));
+    return path === null ? null : { path: path, fragment: fragment };
+  }
+
+  function stripExtension(name) {
+    var lower = name.toLowerCase();
+    for (var i = 0; i < MARKDOWN_EXTENSIONS.length; i++) {
+      if (lower.slice(-MARKDOWN_EXTENSIONS[i].length) === MARKDOWN_EXTENSIONS[i]) {
+        return name.slice(0, -MARKDOWN_EXTENSIONS[i].length);
+      }
+    }
+    return name;
+  }
+
+  function basename(path) {
+    var slash = path.lastIndexOf('/');
+    return slash === -1 ? path : path.slice(slash + 1);
+  }
+
+  /**
+   * Look-up tables for resolving wikilinks against every file in the folder,
+   * built once. Resolving by scanning the list each time is fine for one
+   * link and quadratic for a backlinks pass over a few thousand notes.
+   *
+   * @param {string[]} paths every file, as paths from the root
+   */
+  function buildIndex(paths) {
+    var byPath = {};
+    var byName = {};
+    for (var i = 0; i < paths.length; i++) {
+      var path = paths[i];
+      byPath[path.toLowerCase()] = path;
+
+      // Markdown files answer to their name without the extension, which is
+      // how people write [[Some Note]]; every file answers to its full name,
+      // which is how [[diagram.png]] is written.
+      var names = [basename(path).toLowerCase()];
+      var bare = stripExtension(basename(path));
+      if (bare !== basename(path)) names.push(bare.toLowerCase());
+      for (var j = 0; j < names.length; j++) {
+        (byName[names[j]] = byName[names[j]] || []).push(path);
+      }
+    }
+    return { byPath: byPath, byName: byName };
+  }
+
+  function depth(path) {
+    return path.split('/').length;
+  }
+
+  /**
+   * Which file a wikilink means, the way Obsidian decides it: by name, not
+   * by path, because notes move and [[Some Note]] should not break when they
+   * do.
+   *
+   * An exact path wins. Otherwise, of the files with that name, the one in
+   * the linking file's own folder, then the shallowest, then the first
+   * alphabetically -- so the answer is always the same one, not whichever the
+   * disk happened to list first.
+   *
+   * @param {string} target the part before any # or |
+   * @param {string} fromPath the linking file
+   * @param {{byPath: Object, byName: Object}} index from buildIndex
+   * @returns {string|null}
+   */
+  function resolveWikilink(target, fromPath, index) {
+    var wanted = normalise(String(target || '').trim().split('/'));
+    if (!wanted) return null;
+    var lower = wanted.toLowerCase();
+
+    // A path, with or without its extension: from the linking file's own
+    // folder first, then from the root. Here first, because [[Ideas]] written
+    // in notes/ next to notes/Ideas.md means that one, not a root Ideas.md --
+    // the same reason a relative link is resolved from its own folder.
+    var here = dirname(fromPath);
+    var candidates = here ? [(here + '/' + lower).toLowerCase(), lower] : [lower];
+    for (var i = 0; i < candidates.length; i++) {
+      if (index.byPath[candidates[i]]) return index.byPath[candidates[i]];
+      for (var e = 0; e < MARKDOWN_EXTENSIONS.length; e++) {
+        var withExt = candidates[i] + MARKDOWN_EXTENSIONS[e];
+        if (index.byPath[withExt]) return index.byPath[withExt];
+      }
+    }
+
+    // By name. "folder/Note" narrows to files whose path ends that way.
+    var name = basename(lower);
+    var matches = (index.byName[name] || []).slice();
+    if (wanted.indexOf('/') !== -1) {
+      matches = matches.filter(function (path) {
+        var bare = stripExtension(path).toLowerCase();
+        return bare === lower || bare.slice(-(lower.length + 1)) === '/' + lower ||
+          path.toLowerCase().slice(-(lower.length + 1)) === '/' + lower;
+      });
+    }
+    if (matches.length === 0) return null;
+
+    matches.sort(function (a, b) {
+      var aHere = dirname(a) === here ? 0 : 1;
+      var bHere = dirname(b) === here ? 0 : 1;
+      if (aHere !== bHere) return aHere - bHere;
+      if (depth(a) !== depth(b)) return depth(a) - depth(b);
+      return a < b ? -1 : a > b ? 1 : 0;
+    });
+    return matches[0];
+  }
+
+  /**
+   * A heading's anchor, the way GitHub makes them, so links written for
+   * GitHub -- README.md#installation -- land in the same place here.
+   */
+  function slugify(text) {
+    return String(text)
+      .trim()
+      .toLowerCase()
+      .replace(/<[^>]*>/g, '')
+      .replace(/[^\p{L}\p{N}\s_-]/gu, '')
+      .replace(/\s/g, '-');
+  }
+
+  function isMarkdownPath(path) {
+    return stripExtension(basename(path)) !== basename(path);
+  }
+
+  return {
+    MARKDOWN_EXTENSIONS: MARKDOWN_EXTENSIONS,
+    blankCode: blankCode,
+    buildIndex: buildIndex,
+    extractLinks: extractLinks,
+    isExternal: isExternal,
+    isMarkdownPath: isMarkdownPath,
+    normalise: normalise,
+    parseWikilink: parseWikilink,
+    resolveHref: resolveHref,
+    resolveWikilink: resolveWikilink,
+    slugify: slugify
+  };
+}));

package/lib/paths.js

@@ -0,0 +1,159 @@
+'use strict';
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+/**
+ * Keeping every file margins touches inside the folder it was opened on.
+ *
+ * margins writes files, and people open folders they did not write -- a
+ * cloned repository, a colleague's notes. So a path from the page is never
+ * trusted as a path. It is a list of names below the root, each checked, and
+ * the result is checked again after symlinks are followed, because a link
+ * inside the folder can point anywhere on the disk.
+ */
+
+/** A request for something outside the root, or somewhere margins will not go. */
+class ForbiddenPathError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'ForbiddenPathError';
+    this.status = 403;
+  }
+}
+
+/** A path inside the root that names nothing. */
+class NotFoundError extends Error {
+  constructor(rel) {
+    super(`Nothing at ${rel || 'the root'}`);
+    this.name = 'NotFoundError';
+    this.status = 404;
+  }
+}
+
+// Folders that are never listed, searched or written. `.git` is not merely
+// noise: writing `.git/hooks/pre-commit` is running code the next time the
+// user commits, and a page that can write files must not be able to reach it.
+const PROTECTED_DIRS = new Set(['.git', 'node_modules']);
+
+/** Whether `candidate` is `root` or somewhere below it. */
+function isInside(root, candidate) {
+  const rel = path.relative(root, candidate);
+  if (rel === '') return true;
+  // A folder may legitimately be called "..notes"; only a leading ".." path
+  // segment means "above the root".
+  return rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
+
+/**
+ * The names in a page-supplied relative path, or a ForbiddenPathError.
+ *
+ * Paths from the page are always forward-slash separated and relative to the
+ * root. Anything that could climb out -- `..`, an absolute path, a NUL byte,
+ * a backslash that Windows would read as a separator -- is refused rather
+ * than normalised away, because normalising is how "a/../../etc" becomes
+ * a path that looked fine.
+ *
+ * @param {unknown} rel
+ * @returns {string[]}
+ */
+function segmentsOf(rel) {
+  if (typeof rel !== 'string') throw new ForbiddenPathError('A path must be a string.');
+  if (rel.includes('\0')) throw new ForbiddenPathError('A path cannot contain a NUL byte.');
+  if (rel.includes('\\')) throw new ForbiddenPathError('Use forward slashes in paths.');
+  if (rel.startsWith('/')) throw new ForbiddenPathError('Paths are relative to the folder margins opened.');
+
+  const segments = rel.split('/').filter(segment => segment !== '' && segment !== '.');
+  for (const segment of segments) {
+    if (segment === '..') throw new ForbiddenPathError('Paths cannot climb out of the folder.');
+    if (PROTECTED_DIRS.has(segment)) {
+      throw new ForbiddenPathError(`margins does not open anything inside ${segment}/.`);
+    }
+  }
+  return segments;
+}
+
+/** Normalise a page-supplied path to the canonical form used everywhere else. */
+function normaliseRel(rel) {
+  return segmentsOf(rel).join('/');
+}
+
+/**
+ * The real, absolute path of something that exists inside the root.
+ *
+ * @param {string} realRoot the root, already through fs.realpath
+ * @param {string} rel
+ * @returns {Promise<string>}
+ * @throws {ForbiddenPathError|NotFoundError}
+ */
+async function resolveExisting(realRoot, rel) {
+  const segments = segmentsOf(rel);
+  const target = path.join(realRoot, ...segments);
+
+  let real;
+  try {
+    real = await fs.realpath(target);
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') throw new NotFoundError(segments.join('/'));
+    throw error;
+  }
+
+  // The check that matters. `target` was inside by construction; `real` is
+  // where it actually is once symlinks are followed.
+  if (!isInside(realRoot, real)) {
+    throw new ForbiddenPathError('That path leads outside the folder through a symlink.');
+  }
+  return real;
+}
+
+/**
+ * The absolute path a new file would be created at, inside the root.
+ *
+ * The file does not exist yet, so its own realpath cannot be checked. Its
+ * nearest existing ancestor can, and must be inside the root: otherwise a
+ * symlinked folder inside the root is a way to create files anywhere.
+ *
+ * @param {string} realRoot
+ * @param {string} rel
+ * @returns {Promise<string>}
+ */
+async function resolveNew(realRoot, rel) {
+  const segments = segmentsOf(rel);
+  if (segments.length === 0) throw new ForbiddenPathError('A new file needs a name.');
+
+  const target = path.join(realRoot, ...segments);
+  let probe = path.dirname(target);
+  for (;;) {
+    try {
+      const real = await fs.realpath(probe);
+      if (!isInside(realRoot, real)) {
+        throw new ForbiddenPathError('That path leads outside the folder through a symlink.');
+      }
+      break;
+    } catch (error) {
+      if (error instanceof ForbiddenPathError) throw error;
+      if (error.code !== 'ENOENT') throw error;
+      const parent = path.dirname(probe);
+      if (parent === probe) throw new ForbiddenPathError('No existing folder above that path.');
+      probe = parent;
+    }
+  }
+  return target;
+}
+
+/** The forward-slash path of `abs` relative to the root, as the page names it. */
+function toRel(realRoot, abs) {
+  return path.relative(realRoot, abs).split(path.sep).join('/');
+}
+
+module.exports = {
+  ForbiddenPathError,
+  NotFoundError,
+  PROTECTED_DIRS,
+  isInside,
+  normaliseRel,
+  resolveExisting,
+  resolveNew,
+  segmentsOf,
+  toRel
+};

package/lib/search.js

@@ -0,0 +1,117 @@
+'use strict';
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+const { MAX_TEXT_BYTES, looksBinary } = require('./files');
+const { buildIndex, extractLinks, isMarkdownPath, resolveHref, resolveWikilink } = require('./links');
+
+/**
+ * Finding text across the folder, and finding what links to a file.
+ *
+ * Both read every file they look at, every time. There is no index on disk:
+ * margins writes nothing into the folder but what you save, and a folder of
+ * notes is small enough that reading it is faster than keeping a cache
+ * honest.
+ */
+
+const SEARCH_LIMIT = 200;
+const LINE_PREVIEW = 240;
+
+async function readText(abs) {
+  try {
+    const stat = await fs.stat(abs);
+    if (stat.size > MAX_TEXT_BYTES) return null;
+    const buffer = await fs.readFile(abs);
+    return looksBinary(buffer) ? null : buffer.toString('utf8');
+  } catch {
+    return null;
+  }
+}
+
+/** A line cut down around a match, so a 5,000-character line does not fill the panel. */
+function preview(line, column, length) {
+  if (line.length <= LINE_PREVIEW) return { text: line, start: column };
+  const from = Math.max(0, column - 60);
+  const text = (from > 0 ? '…' : '') + line.slice(from, from + LINE_PREVIEW) + '…';
+  return { text, start: column - from + (from > 0 ? 1 : 0) };
+}
+
+/**
+ * Case-insensitive search for a phrase across every text file.
+ *
+ * @param {string} realRoot
+ * @param {{path: string}[]} files from walkFiles
+ * @param {string} query
+ * @returns {Promise<{results: object[], truncated: boolean, filesSearched: number}>}
+ */
+async function searchFiles(realRoot, files, query, { limit = SEARCH_LIMIT } = {}) {
+  const needle = query.toLowerCase();
+  const results = [];
+  let filesSearched = 0;
+
+  // Markdown first: in a mixed folder the notes are what someone searching
+  // is looking for, and a cap reached halfway through a lockfile would hide
+  // them.
+  const ordered = [...files].sort((a, b) => (isMarkdownPath(b.path) ? 1 : 0) - (isMarkdownPath(a.path) ? 1 : 0));
+
+  for (const file of ordered) {
+    if (file.kind === 'image') continue;
+    const content = await readText(path.join(realRoot, ...file.path.split('/')));
+    if (content === null) continue;
+    filesSearched += 1;
+
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      const column = lines[i].toLowerCase().indexOf(needle);
+      if (column === -1) continue;
+
+      const shown = preview(lines[i], column, needle.length);
+      results.push({ path: file.path, line: i + 1, text: shown.text, start: shown.start, length: needle.length });
+      if (results.length >= limit) return { results, truncated: true, filesSearched };
+    }
+  }
+  return { results, truncated: false, filesSearched };
+}
+
+/**
+ * Every place in a markdown file elsewhere in the folder that links to
+ * `target` -- by relative path, as GitHub would follow it, or by
+ * [[wikilink]], as Obsidian would.
+ *
+ * @param {string} realRoot
+ * @param {{path: string}[]} files from walkFiles
+ * @param {string} target a path from the root
+ */
+async function findBacklinks(realRoot, files, target) {
+  const index = buildIndex(files.map(file => file.path));
+  const backlinks = [];
+
+  for (const file of files) {
+    if (!isMarkdownPath(file.path) || file.path === target) continue;
+    const content = await readText(path.join(realRoot, ...file.path.split('/')));
+    if (content === null) continue;
+
+    const seenLines = new Set();
+    for (const link of extractLinks(content)) {
+      let resolved = null;
+      if (link.type === 'wiki' || link.type === 'embed') {
+        const inner = link.target.split('|')[0].split('#')[0].trim();
+        // [[#Heading]] is a link within the same note, not to another one.
+        resolved = inner ? resolveWikilink(inner, file.path, index) : null;
+      } else {
+        resolved = resolveHref(file.path, link.target)?.path ?? null;
+      }
+
+      // One entry per line: a line linking to the same note twice is one
+      // mention of it, not two.
+      if (resolved === target && !seenLines.has(link.line)) {
+        seenLines.add(link.line);
+        backlinks.push({ path: file.path, line: link.line, text: link.text.slice(0, LINE_PREVIEW) });
+      }
+    }
+  }
+  return backlinks;
+}
+
+module.exports = { SEARCH_LIMIT, findBacklinks, searchFiles };

package/lib/security.js

@@ -0,0 +1,89 @@
+'use strict';
+
+/**
+ * What stops a web page -- this one, or any other -- from doing more with
+ * margins than reading and writing the folder it was opened on, at the
+ * request of the person using it.
+ *
+ * Three different attacks, three different defences, and none of them is
+ * sufficient alone:
+ *
+ * 1. A markdown file in a cloned repository containing script. Rendered
+ *    naively, it would run in this origin and could call the write API.
+ *    The page sanitises what it renders; this Content-Security-Policy is the
+ *    backstop that refuses to run any script margins did not ship itself.
+ *
+ * 2. Another website, open in the same browser, sending requests to
+ *    127.0.0.1. It cannot read the answers (no CORS headers are ever sent),
+ *    but it can *send* a write. So writes need an Origin that is margins' own.
+ *
+ * 3. DNS rebinding: a site whose name is re-pointed at 127.0.0.1, so its
+ *    requests count as same-origin to the browser. The Host header still
+ *    carries the attacker's name, so requests are only answered for the
+ *    addresses margins actually listens on.
+ */
+
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self'",
+  // Remote images are allowed because READMEs are full of badges and a
+  // viewer that breaks them looks broken. no-referrer below means they are
+  // fetched without saying which file, or which folder, they appeared in.
+  "img-src 'self' data: https:",
+  "connect-src 'self'",
+  "font-src 'self'",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'"
+].join('; ');
+
+/** Headers on every response. */
+function baseHeaders() {
+  return {
+    'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+    'Cross-Origin-Opener-Policy': 'same-origin',
+    'Cross-Origin-Resource-Policy': 'same-origin',
+    'X-Frame-Options': 'DENY'
+  };
+}
+
+/**
+ * For files served raw -- images, most of all SVG. An SVG is a document that
+ * can carry script, and opened directly it would run as margins. `sandbox`
+ * gives it an origin of its own with scripts off, so the worst a hostile SVG
+ * can do is draw itself.
+ */
+const RAW_CONTENT_SECURITY_POLICY = "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox";
+
+/** The Host values margins answers to, for the port it is on. */
+function allowedHosts(port) {
+  return new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]);
+}
+
+/** Refuse anything addressed by another name -- see (3) above. */
+function hostIsAllowed(req, port) {
+  return allowedHosts(port).has(String(req.headers.host || '').toLowerCase());
+}
+
+/**
+ * Whether a request that changes something came from margins' own page --
+ * see (2) above. A missing Origin is refused too: browsers send one on every
+ * write they make, and only a request crafted outside a browser leaves it
+ * out, which is not what this API is for.
+ */
+function originIsAllowed(req, port) {
+  const origin = String(req.headers.origin || '').toLowerCase();
+  return [...allowedHosts(port)].some(host => origin === `http://${host}`);
+}
+
+module.exports = {
+  CONTENT_SECURITY_POLICY,
+  RAW_CONTENT_SECURITY_POLICY,
+  baseHeaders,
+  hostIsAllowed,
+  originIsAllowed
+};