Embed loader with domain allowlist

<?php

namespace App\Embed;

use Illuminate\Http\Request;

final class OriginAllowlist
{
    /** The page that embeds us: Origin header, else the Referer's origin. */
    public static function requestOrigin(Request $request): ?string
    {
        $raw = $request->headers->get('Origin');
        if (! $raw || $raw === 'null') {
            $raw = $request->headers->get('Referer');
        }

        return $raw ? self::normalise($raw) : null;
    }

    /** scheme://host[:port] lower-cased, default ports removed, anything else rejected. */
    public static function normalise(string $url): ?string
    {
        $p = parse_url(strtolower(trim($url)));
        if (! isset($p['scheme'], $p['host']) || ! in_array($p['scheme'], ['http', 'https'], true)) {
            return null;
        }
        $port = $p['port'] ?? null;
        if (($p['scheme'] === 'https' && $port === 443) || ($p['scheme'] === 'http' && $port === 80)) {
            $port = null;
        }

        return $p['scheme'].'://'.$p['host'].($port ? ":{$port}" : '');
    }

    /** Entries are exact origins; a leading "*." matches subdomains but not the bare domain. */
    public static function allows(?string $origin, array $allowed): bool
    {
        if ($origin === null) {
            return false; // an empty list therefore allows nothing
        }
        foreach ($allowed as $entry) {
            $entry = strtolower(trim($entry));
            if ($entry === $origin) {
                return true;
            }
            if (str_contains($entry, '://*.')) {
                [$scheme, $suffix] = explode('://*.', $entry, 2);
                $host = parse_url($origin, PHP_URL_HOST);
                if (str_starts_with($origin, $scheme.'://') && str_ends_with($host, '.'.$suffix)) {
                    return true;
                }
            }
        }

        return false;
    }
}

<?php

namespace App\Http\Controllers;

use App\Embed\OriginAllowlist;
use App\Models\Site;
use Illuminate\Http\Request;

class EmbedController extends Controller
{
    // Route::get('/embed/{siteKey}.js', EmbedController::class);
    public function __invoke(Request $request, string $siteKey)
    {
        $site = Site::where('key', $siteKey)->firstOrFail();
        $origin = OriginAllowlist::requestOrigin($request);

        if (! OriginAllowlist::allows($origin, $site->allowed_origins ?? [])) {
            return response('/* origin not allowed */', 403, ['Content-Type' => 'application/javascript']);
        }

        $js = 'window.AcmeWidget='.json_encode(['site' => $site->key, 'api' => url('/api')]).';'
            .file_get_contents(public_path('widget/loader.js'));

        return response($js, 200, [
            'Content-Type' => 'application/javascript; charset=utf-8',
            'Access-Control-Allow-Origin' => $origin,
            'Vary' => 'Origin',
            'Cache-Control' => 'private, max-age=300',
            // The widget iframe may only be framed by the same approved sites.
            'Content-Security-Policy' => 'frame-ancestors '.implode(' ', $site->allowed_origins),
        ]);
    }
}