fix(server): admit reverse-proxied same-origin terrain requests

Review follow-up on #975. The shared same-site gate refuses any forwarding header, which is right for routes that spend a key, but terrain is keyless and needed for rendering: behind the reverse proxy the README documents, every /api/terrain/heights chunk got 403 and fell back to the geoid. Terrain now uses admitSameSiteKeyless, which keeps the Sec-Fetch-Site and exact-Origin checks (comparing Origin against a single X-Forwarded-Proto scheme) but does not refuse forwarding headers. The shared admitSameSite gate is unchanged for every other route. The changelog entry moves to changelog.d/975-terrain-cross-site-gate.md.

Co-authored-by: daikaginza <[email protected]>

server/providers/common/same-site.js

@@ -41,3 +41,48 @@ export function sameSiteGated(handler) {
     return handler(req, res, next);
   };
 }
+
+/**
+ * Proxy header values arrive client-controlled; read one only when it is a
+ * single scheme token, never a comma-separated chain.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {'http:'|'https:'}
+ */
+function forwardedProtocol(req) {
+  if (req.socket?.encrypted) return 'https:';
+  const proto = String(req.headers?.['x-forwarded-proto'] || '')
+    .trim()
+    .toLowerCase();
+  return proto === 'https' ? 'https:' : 'http:';
+}
+
+/**
+ * Cross-site gate for keyless routes the map needs in order to render
+ * (`/api/terrain/heights`). It refuses the same cross-site browser shapes as
+ * `admitSameSite` (a `Sec-Fetch-Site` other than same-origin/none, a foreign
+ * or opaque `Origin`) but does not refuse reverse-proxy forwarding headers:
+ * those protect credentials and spend, which a keyless route has neither of,
+ * and refusing them would break rendering for an instance served behind the
+ * reverse proxy the README documents. A single `X-Forwarded-Proto` supplies
+ * the scheme an `Origin` is compared against. That header cannot be attached
+ * to a cross-site browser request without a CORS preflight this server never
+ * answers, and `Sec-Fetch-Site` is still enforced regardless.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @returns {boolean} True when a 403 was sent.
+ */
+export function admitSameSiteKeyless(req, res) {
+  const verdict = admitSameSiteRequest({
+    hostHeader: req.headers?.host,
+    protocol: forwardedProtocol(req),
+    origin: req.headers?.origin,
+    secFetchSite: req.headers?.['sec-fetch-site'],
+    proxyHeaders: {},
+  });
+  if (verdict.ok) return false;
+  res.statusCode = verdict.status;
+  res.setHeader('Content-Type', 'application/json');
+  res.setHeader('Cache-Control', 'no-store');
+  res.end(JSON.stringify({ error: verdict.error }));
+  return true;
+}