CORS & CSRF

import { normalizeOrigins } from "@convex/lib/utils";
import type { NextRequest } from "next/server";

const isProd = process.env.NODE_ENV === "production";

const computeDefaultOrigins = (): string[] => {
  const explicit = normalizeOrigins(
    (process.env.ALLOWED_WEB_ORIGINS ?? "").split(",")
  );
  if (explicit.length) {
    return explicit;
  }

  return normalizeOrigins([
    process.env.APP_BASE_URL,
    isProd ? undefined : "http://localhost:3000",
    isProd ? undefined : "http://127.0.0.1:3000",
  ]);
};

export const defaultAllowlist = new Set<string>(computeDefaultOrigins());

export function assertOrigin(
  req: NextRequest,
  allowlist: Set<string> | string[] = defaultAllowlist
) {
  const method = req.method.toUpperCase();
  if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
    return; // Safe methods bypass origin check
  }

  const whitelist = getAllowedOrigins(allowlist);
  const origin =
    req.headers.get("origin") ??
    (() => {
      try {
        const ref = req.headers.get("referer");
        return ref ? new URL(ref).origin : null;
      } catch {
        return null;
      }
    })();

  const normalizedOrigin = origin ? normalizeOrigin(origin) : undefined;

  if (!(normalizedOrigin && whitelist.has(normalizedOrigin))) {
    const err: Error & { status?: number; code?: string } = new Error(
      "Forbidden"
    );
    err.status = 403;
    err.code = "CSRF_PROTECTION";
    throw err;
  }
}

import { enforceMutationRequest } from "~/lib/security/csrf";
import { secureUserJson, secureErrorJson } from "@workspace/security";

export async function POST(request: Request) {
  enforceMutationRequest(request); // Throws on violation

  const user = await getCurrentUser();
  if (!user) {
    return secureErrorJson(
      { message: "Unauthorized", code: "AUTH_REQUIRED" },
      { status: 401, userScoped: true }
    );
  }

  // Business logic here
  return secureUserJson({ success: true });
}

/**
 * Check if request passes fetch metadata security checks.
 *
 * Allows:
 * - Same-origin requests
 * - Same-site requests
 * - Navigation requests (user clicking links)
 * - CORS requests for specific resource types
 *
 * Blocks:
 * - Cross-site state-changing requests (POST/PUT/PATCH/DELETE)
 * - Cross-site requests without proper metadata
 */
export function passesFetchMetadata(req: Request): boolean {
  const mode = req.headers.get("sec-fetch-mode") || "";
  const site = req.headers.get("sec-fetch-site") || "";
  const dest = req.headers.get("sec-fetch-dest") || "";

  // Allow same-origin and same-site requests
  if (site === "same-origin" || site === "same-site") {
    return true;
  }

  // Allow user navigation (clicking links, typing URLs)
  if (mode === "navigate") {
    return true;
  }

  // Allow simple GETs for resources if needed
  // Block all cross-site state-changing requests
  if (mode === "cors" && ["image", "style", "script", "font"].includes(dest)) {
    return true;
  }

  // Block everything else (cross-site POST/PUT/PATCH/DELETE)
  return false;
}

/**
 * Assert request passes fetch metadata checks.
 * Throws an error if the request fails security checks.
 */
export function assertFetchMetadata(req: Request): void {
  if (!passesFetchMetadata(req)) {
    const error: Error & { status?: number; code?: string } = new Error(
      "Cross-site request blocked by fetch metadata policy"
    );
    error.status = 403;
    error.code = "CSRF_PROTECTION";
    throw error;
  }
}

import { assertFetchMetadata } from "./fetch-metadata";

export function enforceMutationRequest(
  req: NextRequest,
  allowlist: Set<string> | string[] = defaultAllowlist
) {
  assertOrigin(req, allowlist);
  assertFetchMetadata(req);
}

export { assertFetchMetadata, passesFetchMetadata } from "./fetch-metadata";

import { enforceMutationRequest } from "~/lib/security/csrf";
import { secureErrorJson } from "@workspace/security";

export async function POST(request: Request) {
  try {
    enforceMutationRequest(request);
  } catch (err) {
    if (err.code === "CSRF_PROTECTION") {
      return secureErrorJson(
        { message: "Forbidden", code: "CSRF_PROTECTION" },
        { status: 403 }
      );
    }
    throw err;
  }

  // Protected business logic
}