function.test.js

import { describe, it, expect } from "vitest";
import { handler } from "./function.js";

function makeEvent({ uri = "/", userAgent = "Mozilla/5.0", extraHeaders = {}, ip } = {}) {
  const headers = {};
  if (userAgent !== null) {
    headers["user-agent"] = { value: userAgent };
  }
  Object.assign(headers, extraHeaders);
  const event = { request: { uri, headers } };
  if (ip !== undefined) {
    event.viewer = { ip };
  }
  return event;
}

function expectNotFound(result) {
  expect(result.statusCode).toBe(404);
  expect(result.body).toBe("Not Found");
}

function expectNotBlocked(result) {
  expect(result.statusCode).not.toBe(404);
}

// =====================================================
// URI allowlist — passes through no matter what else would block it
// =====================================================
describe("URI allowlist", () => {
  it("allows /backup.zip through with no user agent", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/backup.zip", userAgent: null })));
  });

  it("allows /backup.zip through for a blocked bot UA", () => {
    expectNotBlocked(
      handler(makeEvent({ uri: "/backup.zip", userAgent: "Scrapy/1.0" }))
    );
  });

  it("allows /backup.zip through for a blocked IP range", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/backup.zip", ip: "45.148.10.5" })));
  });

  it.each(["/robots.txt", "/ads.txt"])("allows %s through for blocked UA and IP", (uri) => {
    expectNotBlocked(handler(makeEvent({ uri, userAgent: "Scrapy/1.0", ip: "45.148.10.5" })));
  });

  it("is case-insensitive", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/Backup.ZIP" })));
  });

  it("does not allowlist a similarly-named path", () => {
    expectNotFound(handler(makeEvent({ uri: "/backup.zip.php" })));
  });
});

// =====================================================
// Scanner probes — backups, env, source maps, debug/admin endpoints
// =====================================================
describe("scanner probe blocking", () => {
  it.each([
    "/wp-config.old", "/wp-config.php.old", "/secrets.env", "/manifest.webmanifest",
    "/pages/index.astro.mjs.map", "/_astro/pages/index.astro.mjs.map",
    "/storage/logs/laravel.log",
  ])("returns 404 for %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it.each([
    "/userfiles/", "/userfiles/x/", "/_ignition/health-check/", "/__debug__/",
    "/_debugbar/open/", "/_profiler/latest/", "/telescope/requests/",
    "/horizon/api/stats/", "/debug/vars/", "/debug/pprof/", "/console/",
    "/server-status/", "/server-info/", "/manage/env/", "/graphql/",
    "/graphql/console/", "/v1/graphql/", "/v1/onboarding/config/", "/health/",
    "/proc/self/cmdline/",
    "/var/run/secrets/kubernetes.io/serviceaccount/token/", "/Dockerfile/",
  ])("returns 404 for %s (trailing slash)", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it.each(["/id_rsa", "/id_ed25519", "/id_rsa.pub", "/id_dsa"])("returns 404 for ssh key probe %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it.each(["/_next/static/x", "/_nuxt/x", "/_anything"])("returns 404 for underscore-prefixed %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it("does not block similarly-prefixed legitimate paths", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/variables-explained/" })));
    expectNotBlocked(handler(makeEvent({ uri: "/healthy-eating/" })));
  });
});

// =====================================================
// Security scan blocking — PHP files → 404
// =====================================================
describe("PHP file blocking", () => {
  it("returns 404 for a .php file at the root", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-login.php" })));
  });

  it("returns 404 for a .php file in a sub-directory", () => {
    expectNotFound(handler(makeEvent({ uri: "/path/to/script.php" })));
  });

  it("PHP block is case-insensitive due to URI normalisation", () => {
    expectNotFound(handler(makeEvent({ uri: "/Shell.PHP" })));
  });

    it("does not block a path that merely contains 'php' as a substring", () => {
      expectNotBlocked(handler(makeEvent({ uri: "/php-info" })));
    });

  it("returns 404 for a .php5 file", () => {
    expectNotFound(handler(makeEvent({ uri: "/shell.php5" })));
  });

  it("returns 404 for a .php7 file", () => {
    expectNotFound(handler(makeEvent({ uri: "/shell.php7" })));
  });

  it("returns 404 for a .phtml file", () => {
    expectNotFound(handler(makeEvent({ uri: "/page.phtml" })));
  });

  it("returns 404 for a multi-digit .phpNN suffix", () => {
    expectNotFound(handler(makeEvent({ uri: "/zup.php73" })));
    expectNotFound(handler(makeEvent({ uri: "/about.php525" })));
  });
});

// =====================================================
// Bad actors (security-scan URIs, truncated/malformed Chrome UAs, stale
// Firefox UAs) get a 404 like everything else.
// =====================================================
describe("404 response for bad actors", () => {
  it("returns 404 for a security scan URI", () => {
    const result = handler(makeEvent({ uri: "/wp-login.php" }));
    expectNotFound(result);
    expect(result.headers["content-type"].value).toBe("text/plain");
  });

  it("does not affect non-security-scan URIs", () => {
    const event = makeEvent({ uri: "/" });
    expect(handler(event)).toEqual(event.request);
  });

  const badActorAgents = [
    ["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0", "outdated Firefox 72"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0", "outdated Firefox 99"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0", "outdated Firefox 138 (below MIN_FIREFOX_MAJOR)"],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
      "truncated Windows UA missing KHTML/Chrome/Safari tail",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0",
      "malformed Chrome claim missing AppleWebKit/KHTML entirely",
    ],
    [
      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
      "Chrome/83 (below MIN_CHROME_MAJOR, no organic signal in logs.db)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36",
      "Chrome/80 (below MIN_CHROME_MAJOR, no organic signal in logs.db)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
      "Chrome/141 (just below MIN_CHROME_MAJOR)",
    ],
    [
      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
      "Chrome/120 (below MIN_CHROME_MAJOR — the largest bot fleet in logs.db)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36",
      "Chrome/98, full build/patch version (below MIN_CHROME_MAJOR, no organic signal in logs.db)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
      "Chrome/130, full build/patch version (below MIN_CHROME_MAJOR, no organic signal in logs.db)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0",
      "Edg/151 (just below MIN_EDGE_MAJOR)",
    ],
    [
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0",
      "Edg/144 (below MIN_EDGE_MAJOR, stale-UA fleet per user's logs.db analysis)",
    ],
    [
      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15",
      "Safari/16.6 (below MIN_SAFARI_MAJOR)",
    ],
    [
      "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1",
      "Mobile Safari/16.0 (below MIN_SAFARI_MAJOR)",
    ],
  ];

  it.each(badActorAgents)("returns 404 for '%s' (%s)", (userAgent) => {
    expectNotFound(handler(makeEvent({ userAgent })));
  });

  // A Chrome major-version range is NOT a reliable spoof signal by structure
  // alone: real Chrome freezes its UA to major.0.0.0, and logs.db showed
  // exactly this template as the two most common real UAs in production
  // traffic (see CLAUDE.md: never block Chrome solely on the .0.0.0
  // minor/patch version). MIN_CHROME_MAJOR is a separate, evidence-backed
  // floor on the version number (see README.md#min-chrome-major).
  const realChromeAgents = [
    ["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36", "Chrome/152 macOS"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36", "Chrome/150 Windows"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36", "Chrome/142, exactly at the floor"],
    ["Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36", "Chrome/151 Linux aarch64"],
    ["Mozilla/5.0 (Linux; Android 14; SM-S911B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36", "Samsung Internet 30 (lagging Chromium, exempted from the floor)"],
    ["Mozilla/5.0 (Linux; Android 13; SM-A536B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/27.0 Chrome/125.0.0.0 Mobile Safari/537.36", "Samsung Internet 27 (lagging Chromium, exempted from the floor)"],
    ["Mozilla/5.0 (Linux; Android 15; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/28.0 Chrome/150.0.7444.86 Mobile Safari/537.36", "Samsung Internet 28 with a full Chrome build/patch number (Samsung doesn't apply Chrome's UA-Reduction freeze)"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0", "Edg/152, exactly at the floor"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0", "Edg/152 Windows"],
  ];

  it.each(realChromeAgents)("passes through '%s' (%s)", (userAgent) => {
    const event = makeEvent({ uri: "/", userAgent });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Misskey/Sharkey federation UA", () => {
    const event = makeEvent({ uri: "/", userAgent: "Misskey/2025.4.7 (https://sharkey.vhack.eu/)" });
    expect(handler(event)).toEqual(event.request);
  });

  const realSafariAgents = [
    ["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15", "Safari/17.0, exactly at the floor"],
    ["Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1", "Mobile Safari/26.0 (post-renumbering)"],
    ["Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 EdgiOS/117.0.2045.60 Mobile/15E148 Safari/604.1", "EdgiOS carries its own stale Version/ token, exempted from the Safari floor"],
  ];

  it.each(realSafariAgents)("passes through '%s' (%s)", (userAgent) => {
    const event = makeEvent({ uri: "/", userAgent });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through PetalBot (obeys robots.txt, no longer blocked)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (compatible;PetalBot; https://webmaster.petalsearch.com/site/petalbot)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it.each([
    "Mozilla/5.0 (compatible; Baiduspider/2.0; http://www.baidu.com/search/spider.html)",
    "Baiduspider-image+(+http://www.baidu.com/search/spider.htm)",
  ])("passes through Baiduspider (allowed to index): %s", (userAgent) => {
    const event = makeEvent({ uri: "/", userAgent });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through PerplexityBot (allowed to index)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (compatible; PerplexityBot/1.0; https://perplexity.ai/perplexitybot)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through SummalyBot (fediverse link previews)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "SummalyBot/5.5.1 (https://mi.kyanos.one; https://github.com/misskey-dev/summaly/blob/master/README.md)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through GPTBot (allowed to index)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; https://openai.com/gptbot)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Amazonbot (allowed to index)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through ExaSearchBot (allowed to learn from the blog)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)",
    });
    expect(handler(event)).toEqual(event.request);
  });
});

// =====================================================
// Security scan blocking — bad folder prefixes → 404
// =====================================================
describe("bad folder blocking", () => {
  const cases404 = [
    ["/images/logo.png", "images"],
    ["/image/logo.png", "image (singular)"],
    ["/img/logo.png", "img"],
    ["/wp-includes/js/jquery.js", "wp-includes"],
    ["/static/app.js", "static"],
    ["/wp/xmlrpc.php", "wp"],
    ["/wordpress/index.php", "wordpress"],
    ["/old/site/index.html", "old"],
    ["/new/site/index.html", "new"],
    ["/blog/post/1", "blog"],
    ["/backup/db.sql", "backup"],
    ["/cgi-bin/test.cgi", "cgi-bin"],
    ["/vendor/autoload.php", "vendor"],
    ["/uploads/shell.php", "uploads"],
    ["/plugins/malicious.php", "plugins"],
    ["/login", "login (bare)"],
    ["/api/v2/config", "api (security scan)"],
    ["/@fs/home/ec2-user/.aws/credentials", "@fs"],
    ["/@vite/client", "@vite"],
    ["/__vite_ping", "__vite prefix (no trailing slash)"],
  ];

  const casesTrailingSlash = [
    ["/login/", "login (trailing slash)"],
    ["/webmail/", "webmail"],
    ["/roundcube/", "roundcube"],
    ["/mail/", "mail"],
    ["/rc/", "rc"],
    ["/__vite_rsc_findSourceMapURL/", "__vite prefix (trailing slash)"],
  ];

  it.each(cases404)("returns 404 for %s (%s)", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it.each(casesTrailingSlash)("returns 404 for %s (%s, trailing slash)", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it("returns 404 for a bad folder path with no trailing content (bare folder)", () => {
    expectNotFound(handler(makeEvent({ uri: "/cgi-bin" })));
  });

  it("does not block a path that shares a prefix but is a different folder", () => {
    // /images2 or /blog-post should NOT be caught — regex anchors with (\/|$)
    const event = makeEvent({ uri: "/images2/logo.png" });
    expect(handler(event)).toEqual(event.request);
  });

  it("does not block a path that merely shares a prefix with 'login' or 'uploads'", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/loginpage" })));
    expectNotBlocked(handler(makeEvent({ uri: "/uploads2/x" })));
  });

  it("does not block a path that merely shares a prefix with 'mail' or 'rc'", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/mailing-list" })));
    expectNotBlocked(handler(makeEvent({ uri: "/rcfiles/x" })));
  });

  it("blocking is case-insensitive due to URI normalisation", () => {
    expectNotFound(handler(makeEvent({ uri: "/WP-INCLUDES/load.php" })));
  });

  it("returns 404 for /ip (server IP disclosure probe)", () => {
    expectNotFound(handler(makeEvent({ uri: "/ip" })));
  });
});


// =====================================================
// Scrapper bot user-agent blocking → 404
// =====================================================
describe("scrapper bot blocking by user-agent", () => {
  const blockedAgents = [
    ["Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; https://developer.amazon.com/support/amazonbot)", "Amzn-SearchBot"],
    ["Mozilla/5.0 (compatible; LoadedBot/1.0; https://loaded.ai/bot)", "LoadedBot (ignores robots.txt)"],
    ["DataForSEOBot/1.0", "DataForSEO bot"],
    ["ev-crawler/1.0", "ev-crawler"],
    ["Mozilla/5.0 (compatible; xAI-SearchBot/1.0; https://x.ai)", "xAI-SearchBot token"],
    ["Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "Internet Explorer (Trident)"],
    ["Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.18", "Opera legacy (Presto)"],
    ["pimeyes-downloader-api/0.1", "PiMeyes downloader API"],
    ["SleepBot/1.0 (http://sleepbot.com/)", "SleepBot scraper"],
    ["got (https://github.com/sindresorhus/got)", "got HTTP client"],
    ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; BuiltWith/1.4; rb.gy/xprgqj) Chrome/124.0.0.0 Safari/537.36", "BuiltWith scraper"],
    ["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0", "ShapBot scraper"],
    ["rust-scrape/0.1.0", "rust-scrape"],
    ["crawl-engine/0.1 ( https://abuse.creasource.dev/; abuse-report@creasource.dev)", "crawl-engine"],
    ["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; KeenableBot/1.0; https://keenable.ai/)", "KeenableBot"],
    ["WordPress/6.4.3", "WordPress"],
    ["curl/8.6.0", "curl"],
    ["tphotobot/0.1 (+http://crawler.estidraft.com/)", "tphotobot"],
    ["Mozilla/5.0 (compatible; WebsiteResearch/1.0)", "WebsiteResearch"],
    ["Mozilla/5.0 (compatible; SurdotlyBot/1.0; http://sur.ly/bot.html)", "SurdotlyBot"],
    ["Mozilla/5.0 (compatible; AonsightMetaBot/1.0; https://aonsight.com/bot)", "AonsightMetaBot"],
    ["Mozilla/5.0 (iPhone; CPU iPhone OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1 (compatible; Baiduspider-render/2.0; http://www.baidu.com/search/spider.html)", "Baiduspider-render"],
    ["Scrapy/2.16.0 ( https://scrapy.org)", "Scrapy scraper"],
    ["Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)", "Bytespider"],
    ["Timpibot/1.0 ( http://timpi.io/crawler)", "Timpibot/1.0 scraper"],
    ["Mozilla/5.0 (compatible; Timpibot/0.8; http://www.timpi.io)", "Timpibot/0.8 scraper"],
    ["Mozilla/5.0 (compatible; StackyEnrich/1.0)", "StackyEnrich"],
    ["fyndbot (robots; https://fynd.bot)", "FyndBot (robots)"],
    ["fyndbot (recrawler; https://fynd.bot)", "FyndBot (recrawler)"],
    ["Mozilla/5.0 (compatible; WellKnownBot/0.1;  https://well-known.dev/about/#bot)", "WellKnownBot"],
    ["Mozilla/5.0 (compatible; wpbot/1.4; https://forms.gle/ajBaxygz9jSR8p8G9)", "wpbot"],
    ["python-httpx/0.28.1", "Python httpx"],
    ["python-requests/2.32.5", "Python requests"],
    ["Python/3.14 aiohttp/3.14.1", "Python aiohttp"],
    ["Mozilla/4.0 (compatible; ms-office; MSOffice 16)", "MS Office SaaS"],
    ["Welley/1.0 bot", "Welley/1.0 bot"],
    ["Welley/1.0", "Welley/1.0 (no bot suffix)"],
    ["LinkupBot/1.0 (LinkupBot for web indexing; https://linkup.so/bot; bot@linkup.so)", "LinkupBot"],
    ["Googlebot-Image/1.0", "Googlebot-Image"],
    ["CCBot/2.0 (https://commoncrawl.org/faq/)", "CCBot"],
    ["Aranea Web-Crawled Corpora Project ( http://aranea.juls.savba.sk/guest (Frenchch 2026 Summer Crawl))", "Aranea"],
    ["Mozilla/5.0 (compatible; intelx.io_bot https://intelx.io)", "intelx.io_bot"],
    ["Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4a) Gecko/20030401", "PPC Mach-O"],
    ["TestSearchSpider/0.1", "TestSearchSpider"],
    ["TestSearchSpider/2.0", "TestSearchSpider (any version)"],
    ["NavCrawl/0.4 ( https://example.com/bot)", "NavCrawl"],
    ["Mozilla/5.0 CMS-Detector/1.0", "CMS-Detector"],
    ["atlas-enrich/1.0", "atlas-enrich"],
    ["Mozilla/5.0 (compatible; SiteScan/1.0; free-tier enrichment; respects robots)", "SiteScan"],
    ["LivelapBot/0.2 (http://site.livelap.com/crawler)", "LivelapBot"],
    ["DatabankMetasearchProduction/0.2", "DatabankMetasearchProduction"],
    ["DatabankMetasearchExperiment/0.2", "DatabankMetasearchExperiment"],
    ["SearchEngineBot/0.1", "SearchEngineBot"],
    ["URL/Emacs Emacs/30.1 (X11; x86_64-pc-linux-gnu)", "Emacs URL/Emacs scraper"],
    [
      "ImageBot/1.0 (compatible; research crawler; https://github.com/rom1504/img2dataset; opt-out: abuse.notification.dcomp12b@gmail.com;",
      "ImageBot/img2dataset scraper",
    ],
    ["Mozilla/5.0 (compatible; Google-CloudVertexBot; https://cloud.google.com/vertex-ai-bot)", "Google-CloudVertexBot"],
    ["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GoogleOther)", "GoogleOther"],
    ["koofie.net/1.0 ( https://koofie.net/bot)", "koofie.net bot"],
    ["FeedFetcher-Google; (+http://www.google.com/feedfetcher.html)", "FeedFetcher-Google"],
    ["domain-intel/0.1", "domain-intel bot"],
    ["Screaming Frog SEO Spider/19.2", "Screaming Frog SEO Spider"],
    ["Mozilla/5.0 (compatible; OpenClaw-CN-Reach/1.0)", "OpenClaw-CN-Reach"],
    ["Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com/bots)", "Discordbot"],
    ["Sharkey (like Discordbot)", "Sharkey"],
    ["Mozilla/5.0 (compatible; Reflectionbot/1.0; https://reflection.ai/bot)", "Reflectionbot"],
    ["Lightpanda/1.0 internal-testing-crawler", "Lightpanda"],
    ["Mozilla/5.0 (compatible; ForestEngine/1.0; +https://forestengine.net/)", "ForestEngine"],
    ["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; https://seojuice.io/bot", "SEOJuice-SearchBot"],
    ["Mozilla/5.0 (compatible; coccocbot-web/1.0; http://help.coccoc.com/searchengine)", "coccocbot-web"],
    ["FogBot/0.3 ( m85953909@gmail.com)", "FogBot"],
    ["NewsletterFormResearchBot/1.3.1 ( read-only public-web research; no form submissions)", "NewsletterFormResearchBot"],
    ["Mozilla/5.0 (compatible; srchs-research-bot/0.1; public small-business domain research; contact: smashcarlito@gmail.com)", "srchs-research-bot"],
    ["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)", "AionBot"],
    ["Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)", "TikTokSpider"],
    ["OpenTheBoxBot/1.0", "OpenTheBoxBot"],
    ["Brightbot 1.0", "Brightbot"],
    ["webapp-mapper/0.1 (public technical analysis)", "webapp-mapper"],
    ["IronFountain-Leads/1.0 ( https://www.ironfountain.com)", "IronFountain-Leads"],
    ["What10Bot/2.0 ( https://what10.com/bot)", "What10Bot"],
    ["Mozilla/5.0 (compatible; Konqueror/3; Linux)", "Konqueror"],
    ["Mozilla/5.0 (compatible; VeryHip/0.1; https://veryhip.com/bot.html)", "VeryHip"],
    ["CMS-Security-Auditor/1.0 ( authorized self-check; contact: local-admin)", "CMS-Security-Auditor"],
    ["Mozilla/5.0 (compatible; CensysInspect/1.1; https://about.censys.io/)", "CensysInspect"],
    ["Mozilla/5.0 (compatible; PublicWWWBot/1.0; https://publicwww.com/bot.html)", "PublicWWWBot"],
    ["wp2shell/2.0", "wp2shell scanner"],
    ["Mozilla/5.0 (compatible; WebAtlaBot/1.0)", "WebAtlaBot"],
    ["SSI-Nutch/1.23 (SSI broad web crawler; https://ssi.inc/; adi@ssi.inc)", "SSI-Nutch"],
    ["VariableRatio-PublicAssetResearch/1.0", "VariableRatio-PublicAssetResearch"],
    ["ClarityBot/0.1 ( https://clarity.surf/bot)", "ClarityBot"],
    ["undici", "undici"],
    ["Mozilla/5.0 (compatible; serpex-index/1.0; https://serpex.dev)", "serpex-index"],
    ["Mozilla/5.0 (compatible; crawler)", "generic crawler"],
  ];

  it.each(blockedAgents)("blocks '%s' (%s)", (userAgent) => {
    const result = handler(makeEvent({ userAgent }));
    expect(result.statusCode).toBe(404);
  });

  it("lets FeedFetcher-Google fetch /feed.xml but blocks it elsewhere", () => {
    const userAgent = "FeedFetcher-Google; (+http://www.google.com/feedfetcher.html)";
    const event = makeEvent({ uri: "/feed.xml", userAgent });
    expect(handler(event)).toEqual(event.request);
    expect(handler(makeEvent({ uri: "/other", userAgent })).statusCode).toBe(404);
  });

  it("scrapper bot matching is case-insensitive (BuiltWith)", () => {
    const result = handler(makeEvent({ userAgent: "BuiltWith/1.4" }));
    expect(result.statusCode).toBe(404);
  });

  // /rss.xml gets no special treatment; /feed.xml has its own describe block below.
  const feedPaths = ["/rss.xml"];

  it.each(feedPaths)("blocks a blocked bot on %s with a plain 404", (uri) => {
    const result = handler(makeEvent({ uri, userAgent: "Scrapy/2.16.0" }));
    expect(result.statusCode).toBe(404);
    expect(result.body).toBe("Not Found");
  });

  it.each(feedPaths)("ignores conditional request headers on %s", (uri) => {
    const result = handler(makeEvent({
      uri,
      userAgent: "Scrapy/2.16.0",
      extraHeaders: {
        "if-none-match": { value: '"empty-feed-v1"' },
        "if-modified-since": { value: "Mon, 01 Jan 2024 00:00:00 GMT" },
      }
    }));
    expect(result.statusCode).toBe(404);
  });

  it.each(feedPaths)("still lets a normal browser through on %s", (uri) => {
    const event = makeEvent({ uri, userAgent: "Mozilla/5.0 (Macintosh) Safari/604.1" });
    expect(handler(event)).toEqual(event.request);
  });
});

// =====================================================
// IP range blocking (Techoff SRV Limited)
// =====================================================
describe("IP range blocking", () => {
  const blockedIps = [
    ["45.148.10.0", "45.148.10.0/24 start"],
    ["45.148.10.255", "45.148.10.0/24 end"],
    ["93.123.109.42", "93.123.109.0/24"],
    ["195.178.110.1", "195.178.110.0/24"],
    ["213.209.159.7", "213.209.159.0/24"],
    ["213.177.179.7", "213.177.179.0/24"],
    ["62.60.131.7", "62.60.131.0/24"],
    ["45.138.12.7", "45.138.12.0/24"],
    ["185.218.86.7", "185.218.86.0/24"],
  ];

  it.each(blockedIps)("blocks %s (%s)", (ip) => {
    const result = handler(makeEvent({ ip }));
    expect(result.statusCode).toBe(404);
    expect(result.body).toBe("Not Found");
  });

  const allowedIps = [
    ["45.148.11.0", "just past the 45.148.10.0/24 boundary"],
    ["45.148.9.255", "just before the 45.148.10.0/24 boundary"],
    ["93.123.108.255", "just before the 93.123.109.0/24 boundary"],
    ["195.178.111.0", "just past the 195.178.110.0/24 boundary"],
    ["8.8.8.8", "unrelated IP"],
  ];

  it.each(allowedIps)("does not block %s (%s)", (ip) => {
    const event = makeEvent({ ip });
    expect(handler(event)).toEqual(event.request);
  });

  it("does not block when no viewer IP is present on the event", () => {
    const event = makeEvent({});
    expect(handler(event)).toEqual(event.request);
  });

  it("blocks a blocked IP even with a normal browser UA", () => {
    const result = handler(makeEvent({
      ip: "93.123.109.7",
      userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    }));
    expect(result.statusCode).toBe(404);
  });
});

// =====================================================
// /robots.txt is allowlisted (always passes through, even for blocked bots/IPs)
// =====================================================
describe("robots.txt for blocked bots", () => {
  it("lets a blocked bot's /robots.txt through", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/robots.txt", userAgent: "Scrapy/2.16.0" })));
  });

  it("lets a blocked IP's /robots.txt through", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/robots.txt", ip: "45.148.10.5" })));
  });

  it("still lets a normal browser's /robots.txt through untouched", () => {
    const event = makeEvent({ uri: "/robots.txt", userAgent: "Mozilla/5.0 (Macintosh) Safari/604.1" });
    expect(handler(event)).toEqual(event.request);
  });
});

// =====================================================
// Empty feed.xml for blocked bots
// =====================================================
describe("feed.xml fake atom feed for blocked bots", () => {

  it("answers a blocked bot's /feed.xml with a empty 200 atom feed", () => {
    const result = handler(makeEvent({ uri: "/feed.xml", userAgent: "Scrapy/2.16.0" }));
    expect(result.statusCode).toBe(200);
    expect(result.headers["content-type"].value).toBe("application/atom+xml");
    expect(result.body).toContain('<feed xmlns="http://www.w3.org/2005/Atom">');
    expect(result.body).not.toContain('<entry>');
  });

  it("answers a blocked IP's /FEED.XML case-insensitively", () => {
    const result = handler(makeEvent({ uri: "/FEED.XML", ip: "45.148.10.5" }));
    expect(result.statusCode).toBe(200);
    expect(result.body).toContain('<feed xmlns="http://www.w3.org/2005/Atom">');
    expect(result.body).not.toContain('<entry>');
  });

  it("does not affect other bad-actor rules", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-login.php", userAgent: "Scrapy/2.16.0" })));
  });

  it("still lets a normal browser's /feed.xml through untouched", () => {
    const event = makeEvent({ uri: "/feed.xml", userAgent: "Mozilla/5.0 (Macintosh) Safari/604.1" });
    expect(handler(event)).toEqual(event.request);
  });
});

// =====================================================
// sitemap.xml gets no special treatment
// =====================================================
describe("sitemap.xml for blocked bots", () => {
  it("answers a blocked bot's /sitemap.xml with a plain 404", () => {
    expectNotFound(handler(makeEvent({ uri: "/sitemap.xml", userAgent: "Scrapy/2.16.0" })));
  });

  it("still lets a normal browser's /sitemap.xml through untouched", () => {
    const event = makeEvent({ uri: "/sitemap.xml", userAgent: "Mozilla/5.0 (Macintosh) Safari/604.1" });
    expect(handler(event)).toEqual(event.request);
  });
});

// =====================================================
// Null or empty user-agent → 404
// =====================================================
describe("null or empty user-agent blocking", () => {
  it("blocks a request with no user-agent header", () => {
    const result = handler(makeEvent({ uri: "/about", userAgent: null }));
    expect(result.statusCode).toBe(404);
  });

  it("blocks a request with an empty user-agent value", () => {
    const result = handler(makeEvent({ uri: "/about", userAgent: "" }));
    expect(result.statusCode).toBe(404);
  });

  it("blocks a request with a whitespace-only user-agent value", () => {
    const result = handler(makeEvent({ uri: "/about", userAgent: "   " }));
    expect(result.statusCode).toBe(404);
  });

});

// =====================================================
// Percent-encoded URI bypass prevention
// =====================================================
describe("percent-encoded URI handling", () => {
  it("returns 404 for a .php file with an encoded dot (%2E)", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-login%2Ephp" })));
  });

  it("returns 404 for a bad folder with an encoded character (%77p-includes)", () => {
    expectNotFound(handler(makeEvent({ uri: "/%77p-includes/load.php" })));
  });

  it("returns 404 for cgi-bin with an encoded hyphen (%2D)", () => {
    expectNotFound(handler(makeEvent({ uri: "/cgi%2Dbin/test" })));
  });

  it("returns 404 for a malformed percent-encoded URI", () => {
    const result = handler(makeEvent({ uri: "/%zz/path" }));
    expect(result.statusCode).toBe(404);
  });

  it("returns 404 for a double-encoded dotfile path (%252F hiding the / from a single decode)", () => {
    expectNotFound(handler(makeEvent({ uri: "/admin%252F.env" })));
  });
});


// =====================================================
// Dotfile / dot-directory path blocking → 404
// =====================================================
describe("dotfile path blocking", () => {
  const dotfileCases = [
    "/.env",
    "/.env.local",
    "/config/.env",
    "/.git/config",
    "/.git",
    "/.docker/config.json",
    "/.netrc",
    "/.yarnrc",
    "/.aws/config",
    "/.aws/credentials",
    "/.ssh/id_rsa",
    "/.ssh/authorized_keys",
    "/.ssh/known_hosts",
    "/.svn/entries",
    "/.profile",
    "/.zshrc",
    "/.bashrc",
    "/.bash_history",
  ];

  it.each(dotfileCases)("returns 404 for %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it("returns 404 for /.well-known/ paths (no exceptions, no ACME challenge on this site)", () => {
    expectNotFound(handler(makeEvent({ uri: "/.well-known/security.txt" })));
  });
});

// =====================================================
// Security scan blocking — .sql and .bak extensions → 404
// =====================================================
describe(".sql and .bak file blocking", () => {
  it("returns 404 for a .sql file", () => {
    expectNotFound(handler(makeEvent({ uri: "/dump.sql" })));
  });

  it("returns 404 for a .bak file", () => {
    expectNotFound(handler(makeEvent({ uri: "/config.bak" })));
  });

  it("returns 404 for a .swp file", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-config.php.swp" })));
  });

  it("returns 404 for a trailing ~ editor backup", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-config.php~" })));
  });
});

// =====================================================
// Security scan blocking — WordPress content/API probing → 404
// =====================================================
describe("wp-content and wp-json blocking", () => {
  it("returns 404 for /wp-content/ paths (no trailing slash)", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-content/uploads" })));
    expectNotFound(handler(makeEvent({ uri: "/wp-content/plugins/WordPressCore" })));
  });

  it("returns 404 for /wp-content/ paths with trailing slash", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-content/uploads/" })));
    expectNotFound(handler(makeEvent({ uri: "/wp-content/plugins/WordPressCore/" })));
  });

  it("returns 404 for /wp-json/ (no trailing slash)", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-json" })));
  });

  it("returns 404 for /wp-json/ (trailing slash)", () => {
    expectNotFound(handler(makeEvent({ uri: "/wp-json/" })));
  });
});

// =====================================================
// Security scan blocking — credential/config file scanning → 404
// =====================================================
describe("credential and config file scanning", () => {
  const extensionCases = [
    "/web.config",
    "/docker-compose.yaml",
    "/.gitlab-ci.yml",
    "/.aider.conf.yml",
    "/rclone.conf",
    "/server.key",
    "/key.pem",
    "/trace.axd",
    "/.boto",
    "/.s3cfg",
    "/.npmrc",
    "/.htpasswd",
    "/terraform.tfstate",
  ];

  it.each(extensionCases)("returns 404 for %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it("returns 404 for /.docker/config.json", () => {
    expectNotFound(handler(makeEvent({ uri: "/.docker/config.json" })));
  });

  const secretJsonCases = [
    "/secrets.json",
    "/config.json",
    "/credentials.json",
    "/service-account.json",
    "/service_account.json",
    "/firebase-adminsdk.json",
    "/serviceAccountKey.json",
    "/settings.json",
    "/env.json",
    "/auth.json",
    "/app-config.json",
    "/appsettings.json",
    "/openapi.json",
    "/swagger.json",
    "/amplifyconfiguration.json",
  ];

  it.each(secretJsonCases)("returns 404 for root-level %s", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });

  it("does not block legitimate nested .json data files", () => {
    const event = makeEvent({ uri: "/about/data/blogs.json" });
    expect(handler(event)).toEqual(event.request);
  });

  it("blocks /manifest.json (not in the json allowlist)", () => {
    expect(handler(makeEvent({ uri: "/manifest.json" })).statusCode).toBe(404);
  });
});

// =====================================================
// Security scan blocking — admin folder variants → 404
// =====================================================
describe("admin folder blocking", () => {
  const cases = [
    ["/admin/login", "admin"],
    ["/administrator/index.php", "administrator"],
    ["/wp-admin/admin-ajax.php", "wp-admin"],
    ["/phpmyadmin/index.php", "phpmyadmin"],
    ["/actuator/configprops", "actuator"],
    ["/actuator/env", "actuator"],
  ];

  it.each(cases)("returns 404 for %s (%s)", (uri) => {
    expectNotFound(handler(makeEvent({ uri })));
  });
});

// =====================================================
// ads.txt / llms.txt with blocked user-agents
// =====================================================
describe("ads.txt allowlisted; llms.txt follows normal UA blocking", () => {
  it("lets /ads.txt through for a blocked user-agent", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/ads.txt", userAgent: "CCBot/2.0" })));
  });

  it("blocks /llms.txt for a blocked user-agent", () => {
    const result = handler(makeEvent({ uri: "/llms.txt", userAgent: "CCBot/2.0" }));
    expect(result.statusCode).toBe(404);
  });
});

// =====================================================
// .json allowlist
// =====================================================
describe("json allowlist", () => {
  it.each([
    "/about/data/blogs.json",
    "/human.json",
    "/about/data/pages.json",
    "/about/data/visitors.json",
    "/pagefind/pagefind-entry.json",
  ])("allows %s", (uri) => {
    const event = makeEvent({ uri });
    expect(handler(event)).toEqual(event.request);
  });

  it.each([
    "/package.json",
    "/composer.json",
    "/about/data/other.json",
    "/x/human.json",
    "/human.json.json",
    "/%70ackage.json",
  ])("blocks %s", (uri) => {
    expect(handler(makeEvent({ uri })).statusCode).toBe(404);
  });

  it("blocks a bad user-agent on an allowed json file", () => {
    expect(handler(makeEvent({ uri: "/human.json", userAgent: "Scrapy/2.0" })).statusCode).toBe(404);
  });
});

// =====================================================
// .js allowlist
// =====================================================
describe("js allowlist", () => {
  it.each([
    "/javascript/recommended-blogs.js",
    "/javascript/chart.umd.min.js",
    "/javascript/bootstrap.bundle.min.js",
    "/pagefind/pagefind.js",
    "/pagefind/pagefind-worker.js",
    "/pagefind/pagefind-ui.js",
  ])("allows %s", (uri) => {
    const event = makeEvent({ uri });
    expect(handler(event)).toEqual(event.request);
  });

  it.each([
    "/app.js",
    "/main.js",
    "/javascript/other.js",
    "/x/pagefind/pagefind.js",
    "/pagefind/pagefind.js.js",
    "/%61pp.js",
    "/JAVASCRIPT/../app.js",
  ])("blocks %s", (uri) => {
    expect(handler(makeEvent({ uri })).statusCode).toBe(404);
  });

  it("blocks a bad user-agent on an allowed js file", () => {
    expect(handler(makeEvent({ uri: "/pagefind/pagefind.js", userAgent: "Scrapy/2.0" })).statusCode).toBe(404);
  });
});

// =====================================================
// Pass-through for normal traffic
// =====================================================
describe("pass-through", () => {
  it("returns the request object unchanged for a normal path", () => {
    const event = makeEvent({ uri: "/about/", userAgent: "Mozilla/5.0" });
    expect(handler(event)).toEqual(event.request);
  });

  it("returns the request object unchanged for the root path", () => {
    const event = makeEvent({ uri: "/" });
    expect(handler(event)).toEqual(event.request);
  });

  it("returns the request object unchanged for a directory-style path with no trailing slash", () => {
    const event = makeEvent({ uri: "/about" });
    expect(handler(event)).toEqual(event.request);
  });

  it("returns the request object unchanged for a file path with no trailing slash", () => {
    const event = makeEvent({ uri: "/about.html" });
    expect(handler(event)).toEqual(event.request);
  });

  it("allows real Googlebot through", () => {
    const event = makeEvent({
      userAgent: "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through iPhone Safari iOS 18.6 / Safari 26 on Mobile", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through current Firefox on Linux", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Tor Browser (Firefox ESR 140)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through real Firefox 140 with its frozen rv:109.0 (Mozilla's IE11-workaround UA freeze)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/140.0",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Firefox ESR 115 (Mozilla's extended-support train for legacy OSes)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Windows NT 6.1; rv:115.0) Gecko/20100101 Firefox/115.0",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Google Image Proxy despite its stale Firefox/11.0 UA", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("allows Gemini-Deep-Research through", () => {
    const event = makeEvent({
      userAgent: "Mozilla/5.0 (compatible; Gemini-Deep-Research; https://google.com/bot.html)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Chrome/150 on macOS", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Feeder (feeder.co) with its embedded UA token", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (feeder.co; Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through NewsBlur (newsblur.com) with its embedded UA token", () => {
    const event = makeEvent({
      uri: "/feed.xml",
      userAgent: "NewsBlur Feed Fetcher - 1 subscriber - https://www.newsblur.com/site/7441742/post-tenebras-lire-articles-complets (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0)",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Chrome-Lighthouse with an old embedded Chrome major", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Chrome-Lighthouse",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("allows real Bingbot through", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through Chrome/150 on Windows", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("passes through a real current Chrome on Linux x86_64 (aarch64 desktop Chrome would be unusual but is no longer specially blocked)", () => {
    const event = makeEvent({
      uri: "/",
      userAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    });
    expect(handler(event)).toEqual(event.request);
  });

  it("allows Google-InspectionTool through", () => {
    const event = makeEvent({
      userAgent: "Mozilla/5.0 (compatible; Google-InspectionTool/1.0)",
    });
    expect(handler(event)).toEqual(event.request);
  });
});



// =====================================================
// Cover referer check
// =====================================================
describe("Cover referer check", () => {
  const ref = (v) => ({ referer: { value: v } });
  const site = "https://post-tenebras-lire.net/blog/x/";

  for (const uri of ["/assets/posts/a.webp", "/assets/posts_640/a.webp"]) {
    it(`allows ${uri} with site referer`, () => {
      expectNotBlocked(handler(makeEvent({ uri, extraHeaders: ref(site) })));
    });
    it(`blocks ${uri} without referer`, () => {
      expectNotFound(handler(makeEvent({ uri })));
    });
    it(`blocks ${uri} with foreign referer`, () => {
      expectNotFound(
        handler(makeEvent({ uri, extraHeaders: ref("https://evil.example/?https://post-tenebras-lire.net/") }))
      );
    });
  }

  it("does not filter other assets", () => {
    expectNotBlocked(handler(makeEvent({ uri: "/assets/svgs/ecrit-par-un-humain.svg" })));
    expectNotBlocked(handler(makeEvent({ uri: "/assets/posts_other/no_drm.avif" })));
    expectNotBlocked(handler(makeEvent({ uri: "/assets/posts/a.avif" })));
  });
});