export class ProxyError extends Error {
  constructor(public status: number, public code: string, message: string) {
    super(message);
  }
}

export function validateTarget(raw: string, allowed: string, websocket = false): URL {
  let target: URL;
  try { target = new URL(raw); }
  catch { throw new ProxyError(400, "INVALID_BARE_HEADER", "Invalid target URL."); }
  if (!(websocket ? ["wss:"] : ["https:"]).includes(target.protocol)
      || target.username || target.password || (target.port && target.port !== "443")) {
    throw new ProxyError(403, "TARGET_BLOCKED", "Only HTTPS/WSS on port 443 is supported.");
  }
  const host = target.hostname.toLowerCase();
  const domains = allowed.split(",").map(s => s.trim().toLowerCase()).filter(Boolean);
  if (!domains.some(domain => host === domain || host.endsWith("." + domain))) {
    throw new ProxyError(403, "TARGET_BLOCKED", "Destination is not allowed: " + host);
  }
  target.hash = "";
  return target;
}

export function parseHeaderObject(value: unknown): Headers {
  if (!value || typeof value !== "object" || Array.isArray(value)) {
    throw new ProxyError(400, "INVALID_BARE_HEADER", "Headers must be an object.");
  }
  const result = new Headers();
  const entries = Object.entries(value);
  if (entries.length > 150 || JSON.stringify(value).length > 64 * 1024) {
    throw new ProxyError(431, "INVALID_BARE_HEADER", "Request headers are too large.");
  }
  // Transport headers are generated by fetch. Never let the browser supply them.
  const blocked = new Set(["host", "connection", "transfer-encoding", "content-length",
    "upgrade", "sec-websocket-key", "sec-websocket-version", "sec-websocket-extensions",
    "cf-access-jwt-assertion", "cf-access-client-id", "cf-access-client-secret"]);
  try {
    for (const [key, value] of entries) {
      if (blocked.has(key.toLowerCase())) continue;
      if (typeof value === "string") result.set(key, value);
      else if (Array.isArray(value) && value.every(item => typeof item === "string")) {
        for (const item of value) result.append(key, item);
      } else throw new Error("Invalid value");
    }
  } catch { throw new ProxyError(400, "INVALID_BARE_HEADER", "Invalid header name or value."); }
  return result;
}

export function readBareHeaders(headers: Headers): Headers {
  let raw = headers.get("x-bare-headers");
  if (!raw) {
    const pieces: [number, string][] = [];
    for (const [name, value] of headers) {
      const match = /^x-bare-headers-(\d+)$/.exec(name);
      if (!match) continue;
      if (!value.startsWith(";")) throw new ProxyError(400, "INVALID_BARE_HEADER", "Invalid split header.");
      pieces.push([Number(match[1]), value.slice(1)]);
    }
    pieces.sort((a, b) => a[0] - b[0]);
    if (pieces.some(([id], index) => id !== index)) {
      throw new ProxyError(400, "INVALID_BARE_HEADER", "Split header sequence has a gap.");
    }
    raw = pieces.map(([, value]) => value).join("");
  }
  if (!raw || raw.length > 64 * 1024) throw new ProxyError(400, "INVALID_BARE_HEADER", "Missing or oversized headers.");
  let parsed: unknown;
  try { parsed = JSON.parse(raw); }
  catch { throw new ProxyError(400, "INVALID_BARE_HEADER", "Malformed headers JSON."); }
  return parseHeaderObject(parsed);
}

export function setBareHeaders(output: Headers, upstream: Headers): void {
  const values: Record<string, string | string[]> = {};
  for (const [name, value] of upstream) {
    if (name !== "set-cookie") values[name] = value;
  }
  const cookies = upstream.getSetCookie();
  if (cookies.length) values["set-cookie"] = cookies;
  const raw = JSON.stringify(values);
  if (raw.length <= 3072) output.set("x-bare-headers", raw);
  else for (let i = 0; i < raw.length; i += 3000) {
    output.set("x-bare-headers-" + i / 3000, ";" + raw.slice(i, i + 3000));
  }
}

export function assertSameOrigin(request: Request): void {
  const origin = request.headers.get("origin");
  if (origin && origin !== new URL(request.url).origin) {
    throw new ProxyError(403, "ORIGIN_BLOCKED", "Use the relay from its own launch page.");
  }
  if (request.headers.get("sec-fetch-site") === "cross-site") {
    throw new ProxyError(403, "ORIGIN_BLOCKED", "Cross-site relay requests are blocked.");
  }
}