Adding skills & isac talent updates

src/routes/api/isac/calculation-assistant/+server.ts

@@ -15,6 +15,7 @@ import {
 } from '$lib/server/ai/calculation-authoring-schema';
 import { generateAiCalculationDraft } from '$lib/server/ai/calculation-authoring-service';
 import { AI_CALCULATION_PROMPT_VERSION } from '$lib/server/ai/calculation-authoring-prompt';
+import { isAllowedShdBuildRequestOrigin } from '$lib/server/request-origin';
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 
@@ -26,7 +27,7 @@ export const POST: RequestHandler = async ({ cookies, request, url }) => {
 		'ai.calculation.generate'
 	);
 	const origin = request.headers.get('origin');
-	if (origin && origin !== url.origin) {
+	if (!isAllowedShdBuildRequestOrigin(origin, url.origin)) {
 		return json(
 			{ message: 'Cross-origin calculation authoring requests are not allowed.' },
 			{ status: 403 }

src/routes/api/isac/mechanic-assistant/+server.ts

@@ -15,6 +15,7 @@ import {
 	AiMechanicRateLimitError,
 	reserveAiMechanicGeneration
 } from '$lib/server/ai/mechanic-authoring-rate-limit';
+import { isAllowedShdBuildRequestOrigin } from '$lib/server/request-origin';
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 
@@ -26,7 +27,7 @@ export const POST: RequestHandler = async ({ cookies, request, url }) => {
 		'ai.mechanic.generate'
 	);
 	const origin = request.headers.get('origin');
-	if (origin && origin !== url.origin) {
+	if (!isAllowedShdBuildRequestOrigin(origin, url.origin)) {
 		return json(
 			{ message: 'Cross-origin mechanic authoring requests are not allowed.' },
 			{ status: 403 }

src/routes/api/isac/mechanic-gap-report/+server.ts

@@ -5,6 +5,7 @@ import {
 	parseMechanicGapReport,
 	submitMechanicGapReport
 } from '$lib/server/ai/mechanic-gap-report';
+import { isAllowedShdBuildRequestOrigin } from '$lib/server/request-origin';
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 
@@ -16,7 +17,7 @@ export const POST: RequestHandler = async ({ cookies, request, url }) => {
 		'ai.mechanic.generate'
 	);
 	const origin = request.headers.get('origin');
-	if (origin && origin !== url.origin) {
+	if (!isAllowedShdBuildRequestOrigin(origin, url.origin)) {
 		return json({ message: 'Cross-origin mechanic gap reports are not allowed.' }, { status: 403 });
 	}
 	const contentLength = Number(request.headers.get('content-length') ?? 0);