/**
 * Is this state-changing request from one of our own pages? Used by route handlers that act on a
 * signed-in session (SameSite=Lax cookies still ride along on cross-site top-level navigations).
 *
 * Modern browsers send Sec-Fetch-Site on every request; older ones send Origin on POST. With
 * neither header we refuse: no browser that runs our admin pages omits both on a form POST.
 */
export function isSameOriginRequest(headers: Pick<Headers, 'get'>, allowedOrigins: readonly string[]): boolean {
  const fetchSite = headers.get('sec-fetch-site');
  if (fetchSite !== null) return fetchSite === 'same-origin';
  const origin = headers.get('origin');
  if (origin === null || origin === 'null') return false;
  return allowedOrigins.includes(origin);
}