import { isSameOrigin } from '@platform-modules/util/csrf';

export class CsrfError extends Error {
  override readonly name = 'CsrfError';
}

export function assertCsrf(
  request: Request,
  { authMode, siteOrigin }: { authMode: 'token' | 'session'; siteOrigin: string },
): void {
  if (authMode === 'token') return;
  if (!isSameOrigin(request.headers, [siteOrigin])) {
    throw new CsrfError('cross-origin or missing Origin on session mutation');
  }
}