feat: 完善 N7 智能座舱交互与控制链路

src/cognitive_agent/auth.py

@@ -14,12 +14,63 @@ import time
 from collections import defaultdict, deque
 from dataclasses import dataclass
 from threading import RLock
-
+from urllib.parse import urlsplit
 
 PASSWORD_SCHEME = "pbkdf2_sha256"
 PASSWORD_ITERATIONS = 600_000
 
 
+def is_json_content_type(value: str) -> bool:
+    """Return whether an HTTP Content-Type is JSON, allowing normal parameters."""
+
+    media_type = value.split(";", 1)[0].strip().casefold()
+    return media_type == "application/json"
+
+
+def origin_matches_host(origin: str, host: str, scheme: str) -> bool:
+    """Compare a browser Origin with the request's externally visible origin.
+
+    Host names are case-insensitive and default ports are normalized, but aliases
+    are intentionally not: ``localhost`` and ``127.0.0.1`` are different origins.
+    """
+
+    normalized_scheme = scheme.strip().casefold()
+    if normalized_scheme not in {"http", "https"} or not origin or not host:
+        return False
+    try:
+        candidate = urlsplit(origin.strip())
+        expected = urlsplit(f"{normalized_scheme}://{host.strip()}")
+        if (
+            candidate.scheme.casefold() != normalized_scheme
+            or not candidate.netloc
+            or candidate.path
+            or candidate.query
+            or candidate.fragment
+            or candidate.username is not None
+            or candidate.password is not None
+            or not expected.netloc
+            or expected.path
+            or expected.query
+            or expected.fragment
+            or expected.username is not None
+            or expected.password is not None
+        ):
+            return False
+        candidate_host = candidate.hostname
+        expected_host = expected.hostname
+        if candidate_host is None or expected_host is None:
+            return False
+        default_port = 443 if normalized_scheme == "https" else 80
+        candidate_port = candidate.port or default_port
+        expected_port = expected.port or default_port
+    except (UnicodeError, ValueError):
+        return False
+    return (
+        candidate_host.casefold() == expected_host.casefold()
+        and candidate_port == expected_port
+    )
+
+
 def _b64encode(value: bytes) -> str:
     return base64.urlsafe_b64encode(value).decode("ascii").rstrip("=")