worker.js

// --- SECURITY UTILITIES ---
async function sign(message, secret) {
  const encoder = new TextEncoder();
  const data = encoder.encode(message);
  const key = await crypto.subtle.importKey(
    "raw", encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false, ["sign"]
  );
  const signature = await crypto.subtle.sign("HMAC", key, data);
  return btoa(String.fromCharCode(...new Uint8Array(signature)));
}

async function getVerifiedRole(request, secret) {
  const cookieHeader = request.headers.get("Cookie") || "";
  const match = cookieHeader.match(/auth=([^;]+)/);
  if (!match) return null;

  const value = decodeURIComponent(match[1]);
  const [role, signature] = value.split('.');
  if (!role || !signature) return null;

  const expectedSig = await sign(role, secret);
  return (signature === expectedSig) ? role : null;
}

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    const path = url.pathname;
    const secret = env.SESSION_SECRET || "SUPER_SECRET_FALLBACK_CHANGE_THIS";

    // Auth Status
    const role = await getVerifiedRole(request, secret);
    const isAdmin = role === "admin";
    const isGuest = role === "guest";
    const authed = isAdmin || isGuest;

    // 1. ROUTE: Index
    if (path === "/" || path === "/index.html") {
      const obj = await env.R2.get("index.html");
      if (!obj) return new Response("index.html not found", { status: 404 });
      return new Response(obj.body, { headers: { "Content-Type": "text/html; charset=utf-8" } });
    }

    // 2. ROUTE: Login
    if (path === "/login" && request.method === "POST") {
      const body = await request.json();
      let userRole = "";
      if (body.password === env.SITE_PASSWORD) userRole = "admin";
      else if (body.password === env.FRIEND_PASSWORD) userRole = "guest";

      if (userRole) {
        const signature = await sign(userRole, secret);
        const cookieValue = `${userRole}.${signature}`;
        return new Response("ok", {
          headers: { 
            "Set-Cookie": `auth=${cookieValue}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=604800` 
          }
        });
      }
      return new Response("wrong", { status: 401 });
    }

    // 3. ROUTE: Logout (Clears the HttpOnly cookie)
    if (path === "/logout") {
      return new Response("ok", {
        headers: { "Set-Cookie": "auth=; Path=/; HttpOnly; Secure; SameSite=Strict; Expires=Thu, 01 Jan 1970 00:00:00 GMT" }
      });
    }

    // 4. ROUTE: List
    if (path === "/list.json") {
      if (!authed) return new Response("unauthorized", { status: 401 });
      let files = [];
      if (isAdmin) {
        const a = await env.R2.list({ prefix: "admin/" });
        const g = await env.R2.list({ prefix: "guest/" });
        files = [...a.objects, ...g.objects];
      } else {
        const g = await env.R2.list({ prefix: "guest/" });
        files = g.objects;
      }
      const data = files.map(o => ({ name: o.key, size: o.size, display: o.key.split('/').pop() }));
      return new Response(JSON.stringify(data), { headers: { "Content-Type": "application/json" } });
    }

    // 5. ROUTE: Upload
    if (path === "/upload" && request.method === "POST") {
      if (!authed) return new Response("unauthorized", { status: 401 });
      const form = await request.formData();
      const file = form.get("file");
      if (!file || typeof file === "string") return new Response("no file", { status: 400 });

      if (isGuest) {
        const list = await env.R2.list({ prefix: "guest/" });
        const total = list.objects.reduce((acc, o) => acc + o.size, 0);
        if (total + file.size > 5368709120) return new Response("limit", { status: 403 });
      }

      const prefix = isAdmin ? "admin/" : "guest/";
      await env.R2.put(prefix + file.name, file.stream(), {
        httpMetadata: { contentType: file.type || "application/octet-stream" }
      });
      return new Response("ok");
    }

    // 6. ROUTE: Delete
    if (path === "/delete" && request.method === "POST") {
      if (!isAdmin) return new Response("unauthorized", { status: 401 });
      const body = await request.json();
      await env.R2.delete(body.name);
      return new Response("ok");
    }

    // 7. ROUTE: Serve Files (With Permission Check)
    if (path.length > 1) {
      const key = decodeURIComponent(path.slice(1));
      // Security: Prevent guests from accessing admin folder via direct URL
      if (!isAdmin && key.startsWith("admin/")) return new Response("unauthorized", { status: 401 });
      if (!authed) return new Response("unauthorized", { status: 401 });

      const obj = await env.R2.get(key);
      if (!obj) return new Response("not found", { status: 404 });
      return new Response(obj.body, { headers: { "Content-Type": obj.httpMetadata?.contentType || "application/octet-stream" } });
    }

    return new Response("not found", { status: 404 });
  }
}