chore: publish from main

2026-08-07 18:03:02 +00:00 · 2026-08-06 12:30:14 +00:00
parent ca17038502
commit e321e4a9c7
775 changed files with 72454 additions and 1180 deletions
@@ -0,0 +1,38 @@
+export const CAPABILITY_TOKEN_HEADER = "x-pr-artifact-explorer-token";
+
+export function isCanonicalHost(req, canonicalHost) {
+  return (
+    String(req.headers.host ?? "").toLowerCase() ===
+    String(canonicalHost ?? "").toLowerCase()
+  );
+}
+
+export function isCrossSiteRequest(req, canonicalOrigin) {
+  const origin = req.headers.origin;
+  if (origin) {
+    if (origin === canonicalOrigin) return false;
+    if (origin === "null") return true;
+    if (/^https?:\/\//i.test(origin)) return true;
+    return false;
+  }
+  const site = req.headers["sec-fetch-site"];
+  return site === "cross-site" || site === "same-site";
+}
+
+export function requiresCapabilityToken(pathname) {
+  return (
+    pathname.startsWith("/api/") ||
+    pathname.startsWith("/content/") ||
+    pathname === "/events"
+  );
+}
+
+export function hasCapabilityToken(req, url, expectedToken) {
+  if (!expectedToken) return false;
+  const header = req.headers[CAPABILITY_TOKEN_HEADER];
+  const headerToken = Array.isArray(header) ? header[0] : header;
+  if (headerToken === expectedToken) return true;
+  const allowsQueryToken =
+    url.pathname.startsWith("/content/") || url.pathname === "/events";
+  return allowsQueryToken && url.searchParams.get("token") === expectedToken;
+}