universo-platform-2d

1
const ALLOW_ORIGIN = [
2
  'https://affine.pro',
3
  'https://app.affine.pro',
4
  'https://insider.affine.pro',
5
  'https://affine.fail',
6
];
7

8
function isString(s: any): boolean {
9
  return typeof s === 'string' || s instanceof String;
10
}
11

12
function isOriginAllowed(
13
  origin: string,
14
  allowedOrigin: string | RegExp | Array<string | RegExp>
15
): boolean {
16
  if (Array.isArray(allowedOrigin)) {
17
    for (const allowed of allowedOrigin) {
18
      if (isOriginAllowed(origin, allowed)) {
19
        return true;
20
      }
21
    }
22
    return false;
23
  } else if (isString(allowedOrigin)) {
24
    return origin === allowedOrigin;
25
  } else if (allowedOrigin instanceof RegExp) {
26
    return allowedOrigin.test(origin);
27
  } else {
28
    return !!allowedOrigin;
29
  }
30
}
31

32
async function proxyImage(request: Request): Promise<Response> {
33
  const url = new URL(request.url);
34
  const imageURL = url.searchParams.get('url');
35

36
  if (!imageURL) {
37
    return new Response('Missing "url" parameter', { status: 400 });
38
  }
39

40
  const imageRequest = new Request(imageURL, {
41
    method: 'GET',
42
    headers: request.headers,
43
  });
44

45
  const response = await fetch(imageRequest);
46
  const modifiedResponse = new Response(response.body);
47

48
  modifiedResponse.headers.set(
49
    'Access-Control-Allow-Origin',
50
    request.headers.get('Origin') ?? 'null'
51
  );
52
  modifiedResponse.headers.set('Vary', 'Origin');
53
  modifiedResponse.headers.set('Access-Control-Allow-Methods', 'GET');
54

55
  return modifiedResponse;
56
}
57

58
const handler = {
59
  async fetch(request: Request) {
60
    if (!isOriginAllowed(request.headers.get('Origin') ?? '', ALLOW_ORIGIN)) {
61
      return new Response('unauthorized', { status: 401 });
62
    }
63

64
    const url = new URL(request.url);
65
    if (url.pathname.startsWith('/proxy/image')) {
66
      return await proxyImage(request);
67
    }
68

69
    return new Response('not found', { status: 404 });
70
  },
71
};
72

73
export default handler;
74