chore: import upstream snapshot with attribution

apps/webapp/app/utils/sameOriginNavigation.ts

@@ -0,0 +1,21 @@
+/**
+ * Whether `request` is an unambiguously same-origin navigation, used to
+ * CSRF-gate state-changing GET routes. `allowedOrigin` is the dashboard origin
+ * (caller passes `env.LOGIN_ORIGIN`, kept out so the rule stays testable).
+ *
+ * Deny-by-default: prefer `Sec-Fetch-Site: same-origin` when present, otherwise
+ * require a `Referer` whose origin matches `allowedOrigin`. Anything
+ * missing/cross-site/unparseable returns `false`.
+ */
+export function isSameOriginNavigation(request: Request, allowedOrigin: string): boolean {
+  const fetchSite = request.headers.get("sec-fetch-site");
+  if (fetchSite) return fetchSite === "same-origin";
+
+  const referer = request.headers.get("referer");
+  if (!referer) return false;
+  try {
+    return new URL(referer).origin === new URL(allowedOrigin).origin;
+  } catch {
+    return false;
+  }
+}