function.js

function handler(event) {
    const request = event.request;
    const viewerIp = (event.viewer && event.viewer.ip) || '';

    // rationale: README.md#allowlisted-uris
    if (allowlistedUriRegex.test(request.uri || '')) {
        return request;
    }

    // Block requests with no user agent (cheap check, done before any URI decoding)
    const userAgentHeader = request.headers['user-agent'];
    if (!userAgentHeader || !userAgentHeader.value || !userAgentHeader.value.trim()) {
        return createNotFoundResponse();
    }

    const uri = decodeUri(request.uri || '');
    if (uri === null) {
        return createNotFoundResponse();
    }

    // Lowercased copy for case-insensitive pattern matching (UA, file extensions, etc.)
    const uriLower = uri.trim().toLowerCase();
    const ua = userAgentHeader.value.toLowerCase();

    // rationale: README.md#bad-actor-response-mapping
    if (isBadActor(uriLower, ua) || isBlockedBot(ua, uriLower) || isBlockedIpRange(viewerIp)) {
        return uriLower === '/feed.xml' ? createFakeFeedResponse() : createNotFoundResponse();
    }

    if (isDisallowedAsset(uriLower) || isCoverDenied(uriLower, request.headers.referer)) {
        return createNotFoundResponse();
    }

    return request;
}

// rationale: README.md#uri-decoding
function decodeUri(uri) {
    try {
        for (let i = 0; i < 3 && uri.indexOf('%') !== -1; i++) {
            const decoded = decodeURIComponent(uri);
            if (decoded === uri) break;
            uri = decoded;
        }
    } catch (_e) {
        return null;
    }
    return uri;
}

// rationale: README.md#json-allowlist
// rationale: README.md#js-allowlist
function isDisallowedAsset(uri) {
    return (uri.slice(-5) === '.json' && !allowedJsonRegex.test(uri)) ||
        (uri.slice(-3) === '.js' && !allowedJsRegex.test(uri));
}

// rationale: README.md#cover-referer
function isCoverDenied(uri, referer) {
    return coverUriRegex.test(uri) &&
        (!referer || !referer.value || referer.value.toLowerCase().indexOf(COVER_REFERER_PREFIX) !== 0);
}

// rationale: README.md#cover-referer
const coverUriRegex = /^\/assets\/posts(_640)?\/.+\.webp$/;
const COVER_REFERER_PREFIX = 'https://post-tenebras-lire.net/';

// rationale: README.md#json-allowlist
const allowedJsonRegex = /^\/(about\/data\/(blogs|pages|visitors)|human|pagefind\/pagefind-entry)\.json$/;

// rationale: README.md#allowlisted-uris
const allowlistedUriRegex = /^\/(backup\.zip|robots\.txt|ads\.txt)$/i;

// rationale: README.md#js-allowlist
const allowedJsRegex = /^\/(javascript\/(recommended-blogs|chart\.umd\.min|bootstrap\.bundle\.min)|pagefind\/pagefind(-worker|-ui)?)\.js$/;

// rationale: README.md#bad-actor-check-order
function isBadActor(uri, ua) {
    return isPathTraversal(uri) ||
        isDotfilePath(uri) ||
        isSecurityScanUri(uri) ||
        isTruncatedChromeUA(ua) ||
        isMalformedChromeClaim(ua) ||
        isSuspiciousChromeUA(ua) ||
        isSuspiciousEdgeUA(ua) ||
        isSuspiciousFirefoxUA(ua) ||
        isSuspiciousSafariUA(ua);
}

// rationale: README.md#dotfile-path
const dotfilePathRegex = /\/\./;

function isDotfilePath(uri) {
    return dotfilePathRegex.test(uri);
}

// rationale: README.md#security-scan-regex
const securityScanRegex = /\.(php\d*|sql|bak|swp|phtml|config|ya?ml|toml|conf|key|pem|axd|boto|s3cfg|htpasswd|tfstate|old|env|map|webmanifest)$|~$|^\/(images?|img|wp-includes|wp-content|wp-json|static|wp|wordpress|old|new|blog|backup|cgi-bin|admin|administrator|wp-admin|phpmyadmin|vendor|uploads|plugins|login|webmail|roundcube|mail|rc|actuator|api|@fs|@vite|userfiles|telescope|horizon|storage|debug|console|server-status|server-info|manage|graphql|v1|health|proc|var|dockerfile)(\/|$)|^\/(secrets?|config|credentials?|service[-_]account|firebase-(?:adminsdk|service-account|config)|serviceaccountkey|settings|env|auth|app-config|appsettings|openapi|swagger|amplifyconfiguration)\.json$|^\/(_|id_)/;

function isSecurityScanUri(uri) {
    return uri === '/ip' || securityScanRegex.test(uri);
}

// rationale: README.md#path-traversal
function isPathTraversal(uri) {
    return uri.indexOf('..') !== -1;
}

// rationale: README.md#truncated-chrome-ua
const UA_OPEN = 'mozilla\\/5\\.0 \\(';
const CLOSE_APPLEWEBKIT = '\\) applewebkit\\/537\\.36';
const WINDOWS_PLATFORM = 'windows nt 10\\.0; win64; x64';
const truncatedWindowsUaRegex = new RegExp('^' + UA_OPEN + WINDOWS_PLATFORM + CLOSE_APPLEWEBKIT + '$');

function isTruncatedChromeUA(ua) {
    return truncatedWindowsUaRegex.test(ua);
}

// rationale: README.md#malformed-chrome-claim
function isMalformedChromeClaim(ua) {
    return ua.indexOf('chrome/') !== -1 && ua.indexOf('applewebkit') === -1;
}

// rationale: README.md#min-chrome-major
const MIN_CHROME_MAJOR = 142;
// rationale: README.md#chrome-floor-exemptions
const chromeFloorExemptRegex = /compatible;|samsungbrowser\/|feeder\.co;|newsblur\.com|chrome-lighthouse/;

// rationale: README.md#min-edge-major
const MIN_EDGE_MAJOR = 152;

// rationale: README.md#min-firefox-major
const MIN_FIREFOX_MAJOR = 140;
// rationale: README.md#firefox-esr-115-exemption
const firefoxFloorExemptRegex = /firefox\/115\.|googleimageproxy/;

// rationale: README.md#min-safari-major
const MIN_SAFARI_MAJOR = 17;
// rationale: README.md#safari-floor-exemptions
const safariFloorExemptRegex = /compatible;|crios\/|fxios\/|edgios\/|duckduckgo|ucbrowser\//;

function isBelowMinMajor(ua, versionRegex, minMajor) {
    const match = ua.match(versionRegex);
    if (!match) return false;
    return parseInt(match[1], 10) < minMajor;
}

function isSuspiciousChromeUA(ua) {
    return isBelowMinMajor(ua, /chrome\/(\d+)\./, MIN_CHROME_MAJOR) && !chromeFloorExemptRegex.test(ua);
}

function isSuspiciousEdgeUA(ua) {
    return isBelowMinMajor(ua, /edg\/(\d+)\./, MIN_EDGE_MAJOR) && !chromeFloorExemptRegex.test(ua);
}

function isSuspiciousFirefoxUA(ua) {
    return isBelowMinMajor(ua, /firefox\/(\d+)\./, MIN_FIREFOX_MAJOR) && !firefoxFloorExemptRegex.test(ua);
}

function isSuspiciousSafariUA(ua) {
    return ua.indexOf('safari/') !== -1 &&
        isBelowMinMajor(ua, /version\/(\d+)\./, MIN_SAFARI_MAJOR) &&
        !safariFloorExemptRegex.test(ua);
}

// rationale: README.md#blocked-bot-regex
const blockedBotRegex = /linkupbot\/|sleepbot|mozilla\/4\.0 \(compatible; ms-office; msoffice 16\)|got \(https:\/\/github\.com\/sindresorhus\/got|palo alto networks|trident|amzn-searchbot\/|ccbot\/|aiohttp\/|emacs\/|meta-webindexer\/|twitterbot\/1\.0|presto|analyseseonet\/|scrapy|headlesschrome|aranea web-crawled corpora project|pimeyes-downloader-api|bytespider|python-httpx\/|mach-o|intelx\.io_bot|welley\/|searchenginebot|python-requests\/|databankmetasearch|shapbot|cms-detector\/|navcrawl\/|wellknownbot|siteauditbot\/|ev-crawler|builtwith|timpibot|xai-searchbot\/|semrushbot|livelapbot\/|engagemiibot\/|sitescan\/|stackyenrich\/|testsearchspider|atlas-enrich\/|fyndbot|wpbot\/|googlebot-image|dataforseobot|imagebot\/|loadedbot\/|google-cloudvertexbot|googleother|koofie\.net\/|domain-intel\/|screaming frog seo spider|openclaw|discordbot\/|sharkey \(like|reflectionbot\/|lightpanda\/|forestengine\/|seojuice-searchbot\/|coccocbot|hubspot crawler|domain-harvester\/|mapthenetbot\/|expansel-monitor\/|fogbot\/|newsletterformresearchbot\/|srchs-research-bot\/|aionbot\/|tiktokspider|opentheboxbot\/|veryhip\/|cms-security-auditor\/|censysinspect\/|publicwwwbot\/|wp2shell|webatlabot|ssi-nutch\/|variableratio-publicassetresearch\/|halobot\/|flowb0t-contentengine\/|claritybot\/|undici|serpex-index\/|compatible; crawler\)|webapp-mapper\/|ironfountain-leads\/|what10bot\/|konqueror\/|brightbot|rust-scrape\/|crawl-engine\/|keenablebot\/|wordpress\/|curl\/|tphotobot\/|websiteresearch\/|surdotlybot\/|aonsightmetabot\/|baiduspider-render\//;

function isBlockedBot(normalizedUserAgent, uri) {
    // rationale: README.md#feedfetcher-google
    if (normalizedUserAgent.indexOf('feedfetcher-google') !== -1) {
        return uri !== '/feed.xml';
    }
    return blockedBotRegex.test(normalizedUserAgent);
}

// rationale: README.md#ip-range-blocking
const blockedIpRangeRegex = /^(45\.148\.10\.|93\.123\.109\.|195\.178\.110\.|213\.209\.159\.|213\.177\.179\.|62\.60\.131\.|45\.138\.12\.|185\.218\.86\.)/;

function isBlockedIpRange(ip) {
    return blockedIpRangeRegex.test(ip);
}

// rationale: README.md#bad-actor-response-mapping
function createNotFoundResponse() {
    return {
        statusCode: 404,
        statusDescription: 'Not Found',
        headers: {"content-type": {value: "text/plain"}},
        body: 'Not Found'
    };
}

function createFakeFeedResponse() {
    return {
        statusCode: 200,
        statusDescription: 'OK',
        headers: {
            "content-type": {value: "application/atom+xml"},
            "cache-control": {value: "public, max-age=604800"}
        },
        body: '<?xml version="1.0" encoding="UTF-8"?>\n<feed xmlns="http://www.w3.org/2005/Atom">' +
            '<title>Feed</title><id>tag:feed,2026-01-01:feed</id><updated>2026-01-01T00:00:00Z</updated></feed>\n'
    };
}

export {handler};