fix: attach CSRF token to state-changing requests

frontend/src/lib/csrf.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest'
+import { csrfHeader } from './csrf'
+
+let originalCookie = ''
+
+describe('csrf utilities', () => {
+  beforeEach(() => {
+    originalCookie = document.cookie
+    document.cookie = 'dodo_csrf=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/'
+  })
+
+  afterEach(() => {
+    document.cookie = originalCookie
+  })
+
+  it('adds the x-csrf-token header for write methods', () => {
+    document.cookie = 'dodo_csrf=token123; path=/'
+    expect(csrfHeader('POST')).toEqual({ 'x-csrf-token': 'token123' })
+    expect(csrfHeader('PATCH')).toEqual({ 'x-csrf-token': 'token123' })
+    expect(csrfHeader('DELETE')).toEqual({ 'x-csrf-token': 'token123' })
+  })
+
+  it('leaves read methods untouched', () => {
+    document.cookie = 'dodo_csrf=token123; path=/'
+    expect(csrfHeader('GET')).toEqual({})
+    expect(csrfHeader(undefined)).toEqual({})
+  })
+
+  it('does not add a header when the cookie is missing', () => {
+    expect(csrfHeader('POST')).toEqual({})
+  })
+})

frontend/src/lib/csrf.ts

@@ -0,0 +1,13 @@
+export function csrfHeader(method?: string) {
+  if (method && !['GET', 'HEAD', 'OPTIONS'].includes(method.toUpperCase())) {
+    const token = getCookie('dodo_csrf')
+    if (token) return { 'x-csrf-token': token }
+  }
+  return {}
+}
+export function getCookie(name: string) {
+  if (typeof document === 'undefined') return ''
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`))
+  return match ? decodeURIComponent(match[1]) : ''
+}