src/security/origin.ts

export function hostAllowed(host: string | undefined, allowed: string[]): boolean {
  if (!host) return false;
  if (allowed.some((h) => h.trim() === "*")) return true;
  // Strip port suffix.
  const bare = host.split(":")[0].trim().toLowerCase();
  return allowed.some((h) => {
    const a = h.trim().toLowerCase();
    if (a === bare) return true;
    if (a.startsWith("*.")) {
      const suffix = a.slice(1); // ".hf.space"
      return bare.endsWith(suffix);
    }
    return false;
  });
}

export function originAllowed(origin: string | undefined, allowed: string[]): boolean {
  if (!origin) return true; // Origin header absent → not a browser cross-origin request.
  if (allowed.length === 0) return false;
  return allowed.some((entry) => {
    const e = entry.trim();
    if (e === "*") return true;
    if (e === origin) return true;
    // simple wildcard subdomain support: https://*.example.com
    const m = /^(https?:\/\/)\*\.(.+)$/.exec(e);
    if (m) {
      const scheme = m[1];
      const suffix = m[2];
      if (!origin.startsWith(scheme)) return false;
      const hostPart = origin.slice(scheme.length).split("/")[0];
      return hostPart.endsWith(`.${suffix}`) || hostPart === suffix;
    }
    return false;
  });
}