Sub-Bridge Fortress

/**
 * Sub-Bridge Ultimate Fortress - 要塞防线版中转代码 (Cloudflare Workers)
 * 功能特性：
 * 1. 🛡️ 【极致安全】原始 URL 完全以 Secrets 形式加密分离存储，代码库无任何敏感链接
 * 2. 🧩 【随机防扫】中转路由映射键完全采用高强度随机 Path Key，隔绝常规后台扫描
 * 3. ⚡ 【0ms秒开】集成 Cache API 边缘 10分钟智能缓存，防机场网络抖动，减少 Vercel 回源开销
 * 4. 📊 【状态传递】智能传递流量状态进度条 (subscription-userinfo) 与自动更新头
 */

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    const userAgent = request.headers.get("user-agent") || "";
    const userPath = url.pathname.replace("/", "").trim().toLowerCase();

    // 1. 无状态随机 Path Key 属性配置表 (由 Vercel Dashboard 自动生成)
    const USERS = {

    };

    // 2. 匹配防扫随机路径
    if (!userPath || !USERS[userPath]) {
      return new Response("ERROR: Sub-Bridge 要塞防线提示：通道不存在或路径无效。", { status: 404 });
    }

    const item = USERS[userPath];

    // 3. 边缘风控第一层：管理员状态关停
    if (item.status === "banned") {
      return new Response("BANNED: This subscription channel is banned by administrator.", { status: 403 });
    }

    // 4. 边缘风控第二层：密码验证
    const clientPassword = url.searchParams.get("pwd") || url.searchParams.get("password") || "";
    if (item.password && clientPassword !== item.password) {
      return new Response("FORBIDDEN: Incorrect access credential (?pwd=xxx).", { status: 403 });
    }

    // 5. 边缘风控第三层：到期判断
    if (item.expire) {
      const now = new Date();
      const expireDate = new Date(item.expire + "T23:59:59+08:00"); // 北京东八区时间
      if (now > expireDate) {
        return new Response("EXPIRED: Your subscription channel has expired.", { status: 403 });
      }
    }

    // 6. 边缘风控第四层：正规代理软件 UA 检测
    const allowUA = ["Clash", "Shadowrocket", "Stash", "sing-box", "Surge", "Quantumult"];
    const allowed = allowUA.some(x => userAgent.toLowerCase().includes(x.toLowerCase()));
    if (!allowed) {
      return new Response("FORBIDDEN: Please fetch subscription via official proxy tools.", { status: 403 });
    }

    // 7. ⚡ 【重磅升级】边缘 Cache API 缓存机制检验 (实现 0ms 高速秒开且零回源占用)
    const cache = caches.default;
    // 以当前请求 URL (含 pwd 及格式参数) 作为缓存唯一键
    const cacheKey = new Request(url.toString(), request);
    let response = await cache.match(cacheKey);

    if (response) {
      // 缓存命中：直接返回边缘节点缓存的数据，免去网络请求回源
      const cachedHeaders = new Headers(response.headers);
      cachedHeaders.set("X-Sub-Bridge-Cache", "HIT-Edge-CDN");
      return new Response(response.body, { headers: cachedHeaders });
    }

    // 8. 缓存未命中：读取 CF Secrets 加密值拉取真实的 Vercel 订阅长链
    if (!item.sub) {
      return new Response("ERROR: Secret subscription source is not configured.", { status: 500 });
    }

    try {
      // 携带客户端原本的查询条件（Clash 格式转换）
      const vercelUrl = new URL(item.sub);
      url.searchParams.forEach((val, k) => {
        vercelUrl.searchParams.set(k, val);
      });

      const res = await fetch(vercelUrl.toString(), {
        headers: {
          "user-agent": userAgent // 穿透真实的客户端 UA，保证 Clash 分流配置智能返回
        }
      });

      if (!res.ok) {
        return new Response("ERROR: Backend subscription processor failed.", { status: 502 });
      }

      const text = await res.text();

      // 9. 组装响应并将头信息设置为在 CDN 边缘强行缓存 10分钟 (600秒)
      const headers = new Headers({
        "content-type": "text/plain;charset=utf-8",
        "subscription-userinfo": res.headers.get("subscription-userinfo") || "",
        "profile-update-interval": "24",
        "access-control-allow-origin": "*",
        "cache-control": "public, s-maxage=600", // 让 Cloudflare CDN 强缓存 10分钟
        "X-Sub-Bridge-Cache": "MISS-Loaded-New"
      });

      const newResponse = new Response(text, { status: 200, headers });

      // 异步存入全球边缘缓存，不阻塞当前的连接返回
      ctx.waitUntil(cache.put(cacheKey, newResponse.clone()));

      return newResponse;

    } catch (err) {
      return new Response("ERROR: Edge bridge connection failed: " + err.message, { status: 500 });
    }
  }
};