worker.js

// AUTO-GENERATED by scripts/build-worker.mjs — do not edit by hand.
// Cloudflare Worker: CORS proxy for Domain Hunter RDAP checks.
// Only resolves TLDs from the embedded map; no arbitrary URL passthrough (SPEC §13).
const TLD_MAP = {
  "com": "https://rdap.verisign.com/com/v1/domain/",
  "net": "https://rdap.verisign.com/net/v1/domain/",
  "cc": "https://tld-rdap.verisign.com/cc/v1/domain/",
  "tv": "https://tld-rdap.verisign.com/tv/v1/domain/",
  "dev": "https://pubapi.registry.google/rdap/domain/",
  "app": "https://pubapi.registry.google/rdap/domain/",
  "page": "https://pubapi.registry.google/rdap/domain/",
  "new": "https://pubapi.registry.google/rdap/domain/",
  "day": "https://pubapi.registry.google/rdap/domain/",
  "how": "https://pubapi.registry.google/rdap/domain/",
  "ing": "https://pubapi.registry.google/rdap/domain/",
  "meme": "https://pubapi.registry.google/rdap/domain/",
  "zip": "https://pubapi.registry.google/rdap/domain/",
  "mov": "https://pubapi.registry.google/rdap/domain/",
  "foo": "https://pubapi.registry.google/rdap/domain/",
  "dad": "https://pubapi.registry.google/rdap/domain/",
  "phd": "https://pubapi.registry.google/rdap/domain/",
  "prof": "https://pubapi.registry.google/rdap/domain/",
  "esq": "https://pubapi.registry.google/rdap/domain/",
  "nexus": "https://pubapi.registry.google/rdap/domain/",
  "rsvp": "https://pubapi.registry.google/rdap/domain/",
  "soy": "https://pubapi.registry.google/rdap/domain/",
  "boo": "https://pubapi.registry.google/rdap/domain/",
  "channel": "https://pubapi.registry.google/rdap/domain/",
  "io": "https://rdap.identitydigital.services/rdap/domain/",
  "ai": "https://rdap.identitydigital.services/rdap/domain/",
  "me": "https://rdap.identitydigital.services/rdap/domain/",
  "sh": "https://rdap.identitydigital.services/rdap/domain/",
  "ac": "https://rdap.identitydigital.services/rdap/domain/",
  "pro": "https://rdap.identitydigital.services/rdap/domain/",
  "info": "https://rdap.identitydigital.services/rdap/domain/",
  "live": "https://rdap.identitydigital.services/rdap/domain/",
  "world": "https://rdap.identitydigital.services/rdap/domain/",
  "email": "https://rdap.identitydigital.services/rdap/domain/",
  "studio": "https://rdap.identitydigital.services/rdap/domain/",
  "agency": "https://rdap.identitydigital.services/rdap/domain/",
  "life": "https://rdap.identitydigital.services/rdap/domain/",
  "digital": "https://rdap.identitydigital.services/rdap/domain/",
  "guru": "https://rdap.identitydigital.services/rdap/domain/",
  "ninja": "https://rdap.identitydigital.services/rdap/domain/",
  "works": "https://rdap.identitydigital.services/rdap/domain/",
  "today": "https://rdap.identitydigital.services/rdap/domain/",
  "news": "https://rdap.identitydigital.services/rdap/domain/",
  "media": "https://rdap.identitydigital.services/rdap/domain/",
  "finance": "https://rdap.identitydigital.services/rdap/domain/",
  "money": "https://rdap.identitydigital.services/rdap/domain/",
  "fund": "https://rdap.identitydigital.services/rdap/domain/",
  "estate": "https://rdap.identitydigital.services/rdap/domain/",
  "engineering": "https://rdap.identitydigital.services/rdap/domain/",
  "tools": "https://rdap.identitydigital.services/rdap/domain/",
  "services": "https://rdap.identitydigital.services/rdap/domain/",
  "support": "https://rdap.identitydigital.services/rdap/domain/",
  "consulting": "https://rdap.identitydigital.services/rdap/domain/",
  "business": "https://rdap.identitydigital.services/rdap/domain/",
  "company": "https://rdap.identitydigital.services/rdap/domain/",
  "group": "https://rdap.identitydigital.services/rdap/domain/",
  "network": "https://rdap.identitydigital.services/rdap/domain/",
  "systems": "https://rdap.identitydigital.services/rdap/domain/",
  "technology": "https://rdap.identitydigital.services/rdap/domain/",
  "solutions": "https://rdap.identitydigital.services/rdap/domain/",
  "global": "https://rdap.identitydigital.services/rdap/domain/",
  "community": "https://rdap.identitydigital.services/rdap/domain/",
  "social": "https://rdap.identitydigital.services/rdap/domain/",
  "expert": "https://rdap.identitydigital.services/rdap/domain/",
  "academy": "https://rdap.identitydigital.services/rdap/domain/",
  "education": "https://rdap.identitydigital.services/rdap/domain/",
  "university": "https://rdap.identitydigital.services/rdap/domain/",
  "design": "https://rdap.identitydigital.services/rdap/domain/",
  "gallery": "https://rdap.identitydigital.services/rdap/domain/",
  "video": "https://rdap.identitydigital.services/rdap/domain/",
  "events": "https://rdap.identitydigital.services/rdap/domain/",
  "market": "https://rdap.identitydigital.services/rdap/domain/",
  "pizza": "https://rdap.identitydigital.services/rdap/domain/",
  "bar": "https://rdap.identitydigital.services/rdap/domain/",
  "casino": "https://rdap.identitydigital.services/rdap/domain/",
  "games": "https://rdap.identitydigital.services/rdap/domain/",
  "dog": "https://rdap.identitydigital.services/rdap/domain/",
  "cat": "https://rdap.identitydigital.services/rdap/domain/",
  "wtf": "https://rdap.identitydigital.services/rdap/domain/",
  "cool": "https://rdap.identitydigital.services/rdap/domain/",
  "pink": "https://rdap.identitydigital.services/rdap/domain/",
  "blue": "https://rdap.identitydigital.services/rdap/domain/",
  "green": "https://rdap.identitydigital.services/rdap/domain/",
  "gold": "https://rdap.identitydigital.services/rdap/domain/",
  "fitness": "https://rdap.identitydigital.services/rdap/domain/",
  "doctor": "https://rdap.identitydigital.services/rdap/domain/",
  "taxi": "https://rdap.identitydigital.services/rdap/domain/",
  "team": "https://rdap.identitydigital.services/rdap/domain/",
  "tennis": "https://rdap.identitydigital.services/rdap/domain/",
  "soccer": "https://rdap.identitydigital.services/rdap/domain/",
  "xyz": "https://rdap.centralnic.com/xyz/domain/",
  "lol": "https://rdap.centralnic.com/lol/domain/",
  "icu": "https://rdap.centralnic.com/icu/domain/",
  "cyou": "https://rdap.centralnic.com/cyou/domain/",
  "bond": "https://rdap.centralnic.com/bond/domain/",
  "sbs": "https://rdap.centralnic.com/sbs/domain/",
  "cfd": "https://rdap.centralnic.com/cfd/domain/",
  "art": "https://rdap.centralnic.com/art/domain/",
  "lat": "https://rdap.centralnic.com/lat/domain/",
  "monster": "https://rdap.centralnic.com/monster/domain/",
  "ooo": "https://rdap.centralnic.com/ooo/domain/",
  "quest": "https://rdap.centralnic.com/quest/domain/",
  "cam": "https://rdap.centralnic.com/cam/domain/",
  "help": "https://rdap.centralnic.com/help/domain/",
  "mom": "https://rdap.centralnic.com/mom/domain/",
  "baby": "https://rdap.centralnic.com/baby/domain/",
  "beauty": "https://rdap.centralnic.com/beauty/domain/",
  "best": "https://rdap.centralnic.com/best/domain/",
  "fans": "https://rdap.centralnic.com/fans/domain/",
  "game": "https://rdap.centralnic.com/game/domain/",
  "hair": "https://rdap.centralnic.com/hair/domain/",
  "homes": "https://rdap.centralnic.com/homes/domain/",
  "inc": "https://rdap.centralnic.com/inc/domain/",
  "pics": "https://rdap.centralnic.com/pics/domain/",
  "rent": "https://rdap.centralnic.com/rent/domain/",
  "skin": "https://rdap.centralnic.com/skin/domain/",
  "tickets": "https://rdap.centralnic.com/tickets/domain/",
  "yachts": "https://rdap.centralnic.com/yachts/domain/",
  "college": "https://rdap.centralnic.com/college/domain/",
  "tech": "https://rdap.radix.host/rdap/domain/",
  "site": "https://rdap.radix.host/rdap/domain/",
  "online": "https://rdap.radix.host/rdap/domain/",
  "fun": "https://rdap.radix.host/rdap/domain/",
  "space": "https://rdap.radix.host/rdap/domain/",
  "store": "https://rdap.radix.host/rdap/domain/",
  "website": "https://rdap.radix.host/rdap/domain/",
  "press": "https://rdap.radix.host/rdap/domain/",
  "host": "https://rdap.radix.host/rdap/domain/",
  "uno": "https://rdap.radix.host/rdap/domain/",
  "pw": "https://rdap.radix.host/rdap/domain/",
  "cloud": "https://rdap.uniregistry.net/rdap/domain/",
  "link": "https://rdap.uniregistry.net/rdap/domain/",
  "top": "https://rdap.uniregistry.net/rdap/domain/",
  "win": "https://rdap.uniregistry.net/rdap/domain/",
  "bid": "https://rdap.uniregistry.net/rdap/domain/",
  "loan": "https://rdap.uniregistry.net/rdap/domain/",
  "men": "https://rdap.uniregistry.net/rdap/domain/",
  "de": "https://rdap.denic.de/domain/",
  "co": "https://rdap.registry.co/co/domain/",
  "us": "https://rdap.nic.us/domain/",
  "uk": "https://rdap.nominet.uk/uk/domain/",
  "nl": "https://rdap.sidn.nl/domain/",
  "fr": "https://rdap.afnic.fr/domain/",
  "ch": "https://rdap.nic.ch/domain/",
  "ru": "https://rdap.tcinet.ru/domain/",
  "so": "https://rdap.nic.so/domain/",
  "ly": "https://rdap.nic.ly/domain/",
  "pl": "https://rdap.dns.pl/domain/"
};

const UA = 'domain-hunter-worker/2.0';

// Public OAuth App client id for the device flow (set GH_CLIENT_ID when deploying).
const GH_CLIENT_ID = process.env.GH_CLIENT_ID || '__GH_CLIENT_ID__';

// Social handle checks (server-side, bypasses browser CORS blocks).
const SOCIAL_URLS = {
  github: (n) => 'https://api.github.com/users/' + n,
  x: (n) => 'https://x.com/' + n,
  youtube: (n) => 'https://www.youtube.com/@' + n,
  instagram: (n) => 'https://www.instagram.com/' + n,
  reddit: (n) => 'https://www.reddit.com/user/' + n + '/about.json',
  tiktok: (n) =>
    'https://www.tiktok.com/oembed?url=' + encodeURIComponent('https://www.tiktok.com/@' + n),
};

function json(body, status = 200) {
  return new Response(JSON.stringify(body), {
    status,
    headers: {
      'content-type': 'application/json',
      'access-control-allow-origin': '*',
      'cache-control': 'no-store',
    },
  });
}

export default {
  async fetch(request) {
    const url = new URL(request.url);
    const path = url.pathname.replace(/^\/+/, '');

    if (request.method === 'OPTIONS') {
      return new Response(null, {
        status: 204,
        headers: {
          'access-control-allow-origin': '*',
          'access-control-allow-methods': 'GET, POST, OPTIONS',
          'access-control-allow-headers': 'content-type',
          'access-control-max-age': '86400',
        },
      });
    }

    if (path === 'gh/device/code') {
      const upstream = await fetch('https://github.com/login/device/code', {
        method: 'POST',
        headers: { accept: 'application/json', 'content-type': 'application/json', 'user-agent': UA },
        body: JSON.stringify({ client_id: GH_CLIENT_ID }),
      });
      return new Response(await upstream.text(), {
        status: upstream.status,
        headers: {
          'content-type': 'application/json',
          'access-control-allow-origin': '*',
          'cache-control': 'no-store',
        },
      });
    }

    if (path === 'gh/device/token') {
      const req = await request.json().catch(() => null);
      if (!req || typeof req.device_code !== 'string') {
        return json({ error: 'device_code required' }, 400);
      }
      const upstream = await fetch('https://github.com/login/oauth/access_token', {
        method: 'POST',
        headers: { accept: 'application/json', 'content-type': 'application/json', 'user-agent': UA },
        body: JSON.stringify({
          client_id: GH_CLIENT_ID,
          device_code: req.device_code,
          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        }),
      });
      return new Response(await upstream.text(), {
        status: upstream.status,
        headers: {
          'content-type': 'application/json',
          'access-control-allow-origin': '*',
          'cache-control': 'no-store',
        },
      });
    }

    if (!path) {
      return json({ usage: 'GET /{domain} | GET /social/{platform}/{name}' });
    }

    const socialMatch = path.match(/^social\/([a-z]+)\/([a-z0-9_.]{1,30})$/);
    if (socialMatch) {
      const platform = socialMatch[1];
      const name = socialMatch[2];
      const buildUrl = SOCIAL_URLS[platform];
      if (!buildUrl) return json({ platform, error: 'unknown platform' }, 400);
      try {
        const res = await fetch(buildUrl(name), {
          headers: { 'user-agent': UA },
          redirect: 'follow',
        });
        const status = res.status === 200 ? 'taken' : res.status === 404 ? 'free' : 'unknown';
        return json({ platform, name, status });
      } catch (err) {
        return json({ platform, name, status: 'unknown', error: err?.message ?? 'fetch failed' });
      }
    }

    let domain;
    try {
      domain = decodeURIComponent(path);
    } catch {
      return json({ error: 'invalid encoding' }, 400);
    }

    const labels = domain.split('.');
    if (labels.length < 2) {
      return json({ domain, error: 'invalid domain' }, 400);
    }

    const tld = labels[labels.length - 1].toLowerCase();
    const base = TLD_MAP[tld];
    if (!base) {
      return json({ domain, tld, error: 'unknown tld' }, 400);
    }

    const upstream = base + domain;
    try {
      const res = await fetch(upstream, {
        headers: { 'user-agent': UA },
        redirect: 'manual',
      });
      return json({ domain, tld, status: res.status, free: res.status === 404 });
    } catch (err) {
      return json({ domain, tld, status: 0, free: false, error: err?.message ?? 'fetch failed' });
    }
  },
};