function.js

function handler(event) {
    const request = event.request;

    // rationale: README.md#allowlisted-uris
    if (allowlistedUriRegex.test(request.uri || '')) {
        return request;
    }

    // Block requests with no user agent (cheap check, done before any URI decoding)
    const userAgentHeader = request.headers['user-agent'];
    if (!userAgentHeader || !userAgentHeader.value || !userAgentHeader.value.trim()) {
        return createBlockedResponse(request.uri || '');
    }

    const uri = decodeUri(request.uri || '');
    if (uri === null) {
        return createNotFoundResponse();
    }

    // Lowercased copy for case-insensitive pattern matching (UA, file extensions, etc.)
    const uriLower = uri.trim().toLowerCase();
    const ua = userAgentHeader.value.toLowerCase();

    // rationale: README.md#bad-actor-response-mapping
    if (isBadActor(uriLower, ua) ||
        isBlockedAsn(request.headers['cloudfront-viewer-asn'], ua, uriLower) || isBlockedBot(ua, uriLower)) {
        return createBlockedResponse(uriLower);
    }

    if (isDisallowedAsset(uriLower) || isCoverDenied(uriLower, request.headers.referer)) {
        return createNotFoundResponse();
    }

    return request;
}

// rationale: README.md#uri-decoding
function decodeUri(uri) {
    try {
        for (let i = 0; i < 3 && uri.indexOf('%') !== -1; i++) {
            const decoded = decodeURIComponent(uri);
            if (decoded === uri) break;
            uri = decoded;
        }
    } catch (_e) {
        return null;
    }
    return uri;
}

// rationale: README.md#json-allowlist
// rationale: README.md#js-allowlist
function isDisallowedAsset(uri) {
    return (uri.slice(-5) === '.json' && !allowedJsonRegex.test(uri)) ||
        (uri.slice(-3) === '.js' && !allowedJsRegex.test(uri));
}

// rationale: README.md#cover-referer
function isCoverDenied(uri, referer) {
    return coverUriRegex.test(uri) &&
        (!referer || !referer.value || referer.value.toLowerCase().indexOf(COVER_REFERER_PREFIX) !== 0);
}

// rationale: README.md#cover-referer
const coverUriRegex = /^\/assets\/posts(_640)?\/.+\.webp$/;
const COVER_REFERER_PREFIX = 'https://post-tenebras-lire.net/';

// rationale: README.md#json-allowlist
const allowedJsonRegex = /^\/(about\/data\/(blogs|pages|visitors)|human|pagefind\/pagefind-entry)\.json$/;

// rationale: README.md#allowlisted-uris
const allowlistedUriRegex = /^\/(backup\.zip)$/i;

// rationale: README.md#js-allowlist
const allowedJsRegex = /^\/(javascript\/(recommended-blogs|chart\.umd\.min|bootstrap\.bundle\.min)|pagefind\/pagefind(-worker|-ui)?)\.js$/;

// rationale: README.md#bad-actor-check-order
function isBadActor(uri, ua) {
    return isPathTraversal(uri) ||
        isDotfilePath(uri) ||
        isSecurityScanUri(uri) ||
        isTruncatedChromeUA(ua) ||
        isMalformedChromeClaim(ua);
}

// rationale: README.md#dotfile-path
const dotfilePathRegex = /\/\./;

function isDotfilePath(uri) {
    return dotfilePathRegex.test(uri);
}

// rationale: README.md#security-scan-regex
const securityScanRegex = /\.(php\d*|sql|bak|swp|phtml|config|ya?ml|toml|conf|key|pem|axd|boto|s3cfg|htpasswd|tfstate|old|env|map|webmanifest)$|~$|^\/(images?|img|wp-includes|wp-content|wp-json|static|wp|wordpress|old|new|blog|backup|cgi-bin|admin|administrator|wp-admin|phpmyadmin|vendor|uploads|plugins|login|webmail|roundcube|mail|rc|actuator|api|@fs|@vite|userfiles|telescope|horizon|storage|debug|console|server-status|server-info|manage|graphql|v1|health|proc|var|dockerfile)(\/|$)|^\/(secrets?|config|credentials?|service[-_]account|firebase-(?:adminsdk|service-account|config)|serviceaccountkey|settings|env|auth|app-config|appsettings|openapi|swagger|amplifyconfiguration)\.json$|^\/(_|id_)/;

function isSecurityScanUri(uri) {
    return uri === '/ip' || securityScanRegex.test(uri);
}

// rationale: README.md#path-traversal
function isPathTraversal(uri) {
    return uri.indexOf('..') !== -1;
}

// rationale: README.md#truncated-chrome-ua
function isTruncatedChromeUA(ua) {
    return ua === 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36';
}

// rationale: README.md#malformed-chrome-claim
function isMalformedChromeClaim(ua) {
    return ua.indexOf('chrome/') !== -1 && ua.indexOf('applewebkit') === -1;
}

// rationale: README.md#blocked-bot-regex
const blockedBotRegex = /linkupbot\/|sleepbot|got \(https:\/\/github\.com\/sindresorhus\/got|palo alto networks|trident|amzn-searchbot\/|ccbot\/|aiohttp\/|emacs\/|meta-webindexer\/|twitterbot\/1\.0|presto|analyseseonet\/|scrapy|headlesschrome|aranea web-crawled corpora project|pimeyes-downloader-api|bytespider|python-httpx\/|mach-o|intelx\.io_bot|welley\/|searchenginebot|python-requests\/|databankmetasearch|shapbot|cms-detector\/|navcrawl\/|wellknownbot|siteauditbot\/|ev-crawler|builtwith|timpibot|xai-searchbot\/|semrushbot|livelapbot\/|engagemiibot\/|sitescan\/|stackyenrich\/|testsearchspider|atlas-enrich\/|fyndbot|wpbot\/|googlebot|dataforseobot|imagebot\/|loadedbot\/|google-cloudvertexbot|googleother|koofie\.net\/|domain-intel\/|screaming frog seo spider|openclaw|discordbot\/|sharkey \(like|reflectionbot\/|lightpanda\/|forestengine\/|seojuice-searchbot\/|coccocbot|hubspot crawler|domain-harvester\/|mapthenetbot\/|expansel-monitor\/|fogbot\/|newsletterformresearchbot\/|srchs-research-bot\/|aionbot\/|tiktokspider|opentheboxbot\/|veryhip\/|cms-security-auditor\/|censysinspect\/|publicwwwbot\/|wp2shell|webatlabot|ssi-nutch\/|variableratio-publicassetresearch\/|halobot\/|flowb0t-contentengine\/|claritybot\/|undici|serpex-index\/|compatible; crawler\)|webapp-mapper\/|ironfountain-leads\/|what10bot\/|konqueror\/|brightbot|rust-scrape\/|crawl-engine\/|keenablebot\/|wordpress\/|curl\/|tphotobot\/|websiteresearch\/|surdotlybot\/|aonsightmetabot\/|baiduspider|sqlspider\/|goscan-mini\/|storebot-google\/|feedfetcher-google|googleimageproxy|app::jupiter\/|httpx - open-source project/;

function isBlockedBot(normalizedUserAgent, uri) {
    // rationale: README.md#feedfetcher-google
    if (normalizedUserAgent.indexOf('feedfetcher-google') !== -1) {
        return uri !== '/feed.xml';
    }
    return blockedBotRegex.test(normalizedUserAgent);
}

// rationale: README.md#asn-blocking
const blockedAsnRegex = /^(16509|14618|215125|29222|396982|1299|48090|8075|4134|23724|271315|209334|41608|213230|212238|20326|51167|53667|218785|213438|132203|201738|45102|9534|24940|197540|211619|56655|14593|18779|57043|60404|7979|62874|200651|213790|62044|136907|9009|213954|35830|43444|26548|210906|46475|12876|212286|216014|59651|19148|3257|64249|136258|30900|62387|138915|60729|201341)$/;

// rationale: README.md#asn-allowed-hosted-software
const allowedHostedSoftwareRegex = /bingbot\/|mastodon\/|iceshrimp|duckduckbot\/|humanjson-survey\/|summalybot\/|misskey\//;

// rationale: README.md#asn-feed-exemption
function isAsnExemptUri(uri) {
    return uri === '/feed.xml' || uri === '/rss.xml';
}

function isBlockedAsn(asnHeader, ua, uri) {
    return !!asnHeader && blockedAsnRegex.test(asnHeader.value) &&
        !allowedHostedSoftwareRegex.test(ua) && !isAsnExemptUri(uri);
}

function createResponse(statusCode, statusDescription, contentType, body) {
    return {
        statusCode: statusCode,
        statusDescription: statusDescription,
        headers: {"content-type": {value: contentType}},
        body: body
    };
}

function createNotFoundResponse() {
    return createResponse(404, 'Not Found', 'text/plain', 'Not Found');
}

// rationale: README.md#fake-empty-feed
const emptyAtomFeed = '<?xml version="1.0" encoding="utf-8"?>' +
    '<feed xmlns="http://www.w3.org/2005/Atom"><title>Feed</title>' +
    '<id>urn:uuid:00000000-0000-0000-0000-000000000000</id>' +
    '<updated>2000-01-01T00:00:00Z</updated></feed>';

// rationale: README.md#fake-robots-txt
const denyAllRobotsTxt = 'User-agent: *\nDisallow: /\n';

// rationale: README.md#bad-actor-response-mapping
function createBlockedResponse(uri) {
    const path = uri.toLowerCase();
    // rationale: README.md#fake-robots-txt
    if (path === '/robots.txt') {
        return createResponse(200, 'OK', 'text/plain; charset=utf-8', denyAllRobotsTxt);
    }
    // rationale: README.md#fake-empty-feed
    if (path === '/feed.xml') {
        return createResponse(200, 'OK', 'application/atom+xml; charset=utf-8', emptyAtomFeed);
    }
    return createNotFoundResponse();
}

export {handler};