//#region src/gateway/security/origin-check.ts
const LOOPBACK_HOSTNAMES = new Set([
	"localhost",
	"127.0.0.1",
	"::1",
	"[::1]"
]);
function isLoopbackHost(hostname) {
	return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
}
function parseOriginHost(originRaw) {
	const trimmed = (originRaw ?? "").trim();
	if (!trimmed || trimmed === "null") return null;
	try {
		const url = new URL(trimmed);
		return {
			origin: url.origin.toLowerCase(),
			host: url.host.toLowerCase(),
			hostname: url.hostname.toLowerCase()
		};
	} catch {
		return null;
	}
}
function normalizeHostHeader(hostRaw) {
	return (hostRaw ?? "").trim().toLowerCase();
}
function checkBrowserOrigin(params) {
	const parsedOrigin = parseOriginHost(params.origin);
	if (!parsedOrigin) return {
		ok: false,
		reason: "origin missing or invalid"
	};
	const allowlist = new Set((params.allowedOrigins ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean));
	if (allowlist.has("*") || allowlist.has(parsedOrigin.origin)) return {
		ok: true,
		matchedBy: "allowlist"
	};
	const requestHost = normalizeHostHeader(params.requestHost);
	if (params.autoAllowSameHostFromTrustedProxy === true && requestHost && parsedOrigin.host === requestHost) return {
		ok: true,
		matchedBy: "trusted-proxy-same-host"
	};
	if (params.allowHostHeaderOriginFallback === true && requestHost && parsedOrigin.host === requestHost) return {
		ok: true,
		matchedBy: "host-header-fallback"
	};
	if (params.isLocalClient && isLoopbackHost(parsedOrigin.hostname)) return {
		ok: true,
		matchedBy: "local-loopback"
	};
	return {
		ok: false,
		reason: "origin not allowed"
	};
}
//#endregion
export { checkBrowserOrigin };

//# sourceMappingURL=origin-check.js.map