api/manage-auth.js

export const manageCookieName = "ai_banner_manage_session";
const authEndpoint = "https://agent-venture-studio.com/api/internal/ai-banner-auth";

export function readManageAssertion(request) {
  const cookies = String(request.headers.cookie || "").split(";").map((part) => part.trim());
  return cookies.find((part) => part.startsWith(`${manageCookieName}=`))?.slice(manageCookieName.length + 1) || "";
}

export async function exchangeManageToken(token, fetchImpl = fetch) {
  const response = await fetchImpl(authEndpoint, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ token }) });
  const data = await response.json().catch(() => ({}));
  if (!response.ok || typeof data.assertion !== "string") throw Object.assign(new Error("管理Tokenが違います"), { status: 401 });
  return data.assertion;
}

export async function hasManageSession(request, fetchImpl = fetch) {
  const assertion = readManageAssertion(request);
  if (!assertion) return false;
  const response = await fetchImpl(authEndpoint, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ assertion }) });
  return response.ok;
}

export function isSameOrigin(request) {
  const origin = request.headers.origin;
  const host = request.headers["x-forwarded-host"] || request.headers.host;
  if (!origin || !host) return false;
  try { return new URL(origin).host === host; } catch { return false; }
}