package todo

import "net/http"

// originCheck is the contract's cross-site protection: a POST carrying
// an Origin header that isn't exactly this app's own answers 403, and a
// POST with no Origin header is allowed.
//
// It is deliberately not csrf.Protect. Protect refuses a POST that
// carries none of Sec-Fetch-Site, Origin and Referer, which the
// bakeoff's shared tests and load tests send and the contract allows;
// and it trusts Sec-Fetch-Site ahead of Origin, so a request claiming
// "same-origin" would pass with a foreign Origin. Here the Origin
// header alone decides.
func originCheck(origin string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if r.Method != http.MethodGet && r.Method != http.MethodHead && r.Method != http.MethodOptions {
				if o := r.Header.Get("Origin"); o != "" && o != origin {
					http.Error(w, "cross-origin form submission refused", http.StatusForbidden)
					return
				}
			}
			next.ServeHTTP(w, r)
		})
	}
}