From 8c6ae808230602bf5521ebec303346774ff72370 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=B8=D0=BA=D1=82=D0=BE=D1=80?=
 <78488229+viktor138irk@users.noreply.github.com>
Date: Fri, 8 May 2026 20:47:50 +0900
Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=BB=D0=B5?=
 =?UTF-8?q?=D0=BD=D0=B0=20=D0=BF=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=BA=D0=B0?=
 =?UTF-8?q?=20origin=20=D0=B2=D0=B8=D0=B4=D0=B6=D0=B5=D1=82=D0=B0=20=D0=BF?=
 =?UTF-8?q?=D0=BE=20=D1=81=D0=B0=D0=B9=D1=82=D0=B0=D0=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/db.js | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/backend/src/db.js b/backend/src/db.js
index 58d530d..cd62ce1 100644
--- a/backend/src/db.js
+++ b/backend/src/db.js
@@ -94,6 +94,7 @@ export function migrate() {
     CREATE INDEX IF NOT EXISTS idx_messages_conversation_created ON messages(conversation_id, created_at);
     CREATE INDEX IF NOT EXISTS idx_messages_site_created ON messages(site_id, created_at);
     CREATE INDEX IF NOT EXISTS idx_operators_telegram_user_id ON operators(telegram_user_id);
+    CREATE INDEX IF NOT EXISTS idx_sites_domain_active ON sites(domain, is_active);
   `);
 
   ensureDefaultSite();
@@ -112,6 +113,37 @@ export function ensureDefaultSite() {
   return 'site_default';
 }
 
+function normalizeHost(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^https?:\/\//, '')
+    .replace(/^www\./, '')
+    .split('/')[0]
+    .split(':')[0];
+}
+
+export function isAllowedWidgetOrigin(origin) {
+  if (!origin) return true;
+
+  let originHost = '';
+  try {
+    originHost = normalizeHost(new URL(origin).hostname);
+  } catch {
+    originHost = normalizeHost(origin);
+  }
+
+  if (!originHost) return false;
+
+  const rows = db.prepare(`
+    SELECT domain
+    FROM sites
+    WHERE is_active = 1
+  `).all();
+
+  return rows.some((row) => normalizeHost(row.domain) === originHost);
+}
+
 function boolToSetting(value) {
   return value ? 'true' : 'false';
 }