fix: attach CSRF token to state-changing requests

frontend/src/lib/csrf.ts

@@ -0,0 +1,13 @@
+export function csrfHeader(method?: string) {
+  if (method && !['GET', 'HEAD', 'OPTIONS'].includes(method.toUpperCase())) {
+    const token = getCookie('dodo_csrf')
+    if (token) return { 'x-csrf-token': token }
+  }
+  return {}
+}
+export function getCookie(name: string) {
+  if (typeof document === 'undefined') return ''
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`))
+  return match ? decodeURIComponent(match[1]) : ''
+}