1
// 配置压缩参数和缓存TTL
2
const CONFIG_QUALITY = 80;
3
const CONFIG_TTL = 604800;
4

5
// 匹配: kasuha.com, localhost 等
6
const ALLOWED_HOSTNAME_REGEX = /^([a-zA-Z0-9-]+\.)*(kasuha\.com|localhost)$/i;
7

8
// 非法路径正则：防止目录穿越及控制字符
9
const INVALID_PATH_REGEX = /(?:\.\.|[\x00-\x1F\x7F])/;
10

11
export default {
12
  async fetch(request, env, ctx) {
13
    if (request.method !== 'GET') {
14
      return new Response('Method Not Allowed', { status: 405 });
15
    }
16

17
    const url = new URL(request.url);
18
    const rawPath = url.pathname.slice(1);
19
    const key = decodeURIComponent(rawPath);
20

21
    if (!key || INVALID_PATH_REGEX.test(key)) {
22
      return new Response('Bad Request', { status: 400 });
23
    }
24

25
    // 极速防盗链与 CORS 验证
26
    const refererStr = request.headers.get('Referer') || request.headers.get('Origin');
27
    let isAllowed = false;
28
    let requestOrigin = '';
29

30
    if (refererStr) {
31
      try {
32
        // 解析 Referer 为 URL 对象提取 hostname，避免正则处理复杂的完整 URL
33
        const refUrl = new URL(refererStr);
34
        requestOrigin = refUrl.origin;
35
        if (ALLOWED_HOSTNAME_REGEX.test(refUrl.hostname)) {
36
          isAllowed = true;
37
        }
38
      } catch (e) {
39
        // 如果 Referer 连合法的 URL 都不是，直接判定为非法
40
        isAllowed = false;
41
      }
42

43
      if (!isAllowed) {
44
        return new Response('Forbidden', { status: 403 });
45
      }
46
    } else {
47
      // 允许无 Referer 的直接访问（例如浏览器地址栏直接敲回车）
48
      // 如果你想禁止空 Referer，把这里改为 false 并 return 403
49
      isAllowed = true;
50
    }
51

52
    // 格式判断与规范的 Cache Key
53
    let targetFormat = 'image/webp';
54

55
    const cacheUrl = new URL(url.origin + url.pathname);
56
    cacheUrl.searchParams.set('f', targetFormat);
57
    const cacheRequest = new Request(cacheUrl.toString(), request);
58

59
    const cache = caches.default;
60
    let cachedResponse = await cache.match(cacheRequest);
61

62
    if (cachedResponse) {
63
      const response = new Response(cachedResponse.body, cachedResponse);
64
      response.headers.set('X-Cache-Status', 'HIT');
65
      return response;
66
    }
67

68
    // 核心业务：R2读取与图片压缩
69
    try {
70
      const sourceObject = await env.BUCKET.get(key);
71
      if (!sourceObject) {
72
        return new Response('Not Found', { status: 404 });
73
      }
74

75
      const imageResult = await env.IMAGES.input(sourceObject.body)
76
        .transform({ quality: CONFIG_QUALITY })
77
        .output({ format: targetFormat });
78

79
      const response = imageResult.response();
80
      const headers = new Headers(response.headers);
81

82
      // 安全响应头与精确 CORS
83
      if (isAllowed && requestOrigin) {
84
        headers.set('Access-Control-Allow-Origin', requestOrigin);
85
        headers.set('Vary', 'Origin');
86
      }
87
      headers.set('Cache-Control', `public, max-age=${CONFIG_TTL}`);
88
      headers.set('X-Content-Type-Options', 'nosniff');
89
      headers.set('X-Cache-Status', 'MISS');
90

91
      const finalResponse = new Response(response.body, {
92
        status: response.status,
93
        headers
94
      });
95

96
      if (CONFIG_TTL > 0) {
97
        ctx.waitUntil(cache.put(cacheRequest, finalResponse.clone()));
98
      }
99

100
      return finalResponse;
101

102
    } catch (e) {
103
      return new Response('Internal Server Error', { status: 500 });
104
    }
105
  },
106
};