26/12/2024

export default {
	async fetch(request, env, ctx) {
		// firstly we're going to do a bit of authentication. it's not exactly bulletproof
		// but it's unlikely that people are going to be able to guess my token so I'm
		// alright with it
		const url = new URL(request.url)
		const token = url.searchParams.get('X-TOKEN')

		if (token !== env.TOKEN) {
			return new Response('no')
		}

		// this approach does violate SOLID, which isn't exactly cool from the
		// perspective of a Cloudflare worker, but these functions are going 
		// to be fairly lightweight for the most part and I wanted to encapsulate
		// anything I might need in Shortcuts into one worker. This is unlikely to 
		// become a monolith in the true sense
		const fns = {
			'/notrack': notrack
		}

		const fn = fns[url.pathname]

		if (fn) {
			return fn(request, env, ctx, url)
		} else {
			return new Response('Nothing')
		}
	},
};

// this approach for this function might seem a little weird, but Instagram has 
// these new URLs that are like https://instagram.com/share/ABCDEF which totally 
// obfuscate the original URL, meaning we need to do redirects to find the true URL
//
// We, therefore, start with the original URL and as soon as we're not redirecting
// any more, we're satisfied that that's the _actual_ URL and we can return it
//
// I fully expect Meta to have some in-page rendered redirect next, which will mean 
// I need to revisit this approach but we'll cross that bridge when we come to it
// I'm not using any of the original `fetch` stuff at this point but I wanted to 
// keep it in there, just in case.
const notrack = async (_request, _env, _ctx, url) => {
	let source = url.searchParams.get('u')
	// I keep the checked URLs for debugging purposes, but I don't actually use them anywhere
	const checked = [source]
	let searching = true
	while (searching) {
		const response = await fetch(
			source, {
				method: 'HEAD',
				headers: {
					'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0',
					// this sec-fetch-mode is completely new to me. I couldn't figure out why `fetch` wasn't working 
					// but `curl` was so Charlie helped me but using mitmproxy to sniff out the hidden headers that 
					// curl and fetch use to play spot the difference. It never occurred to me to use an mitm this way
					'sec-fetch-mode': 'navigate',
				}
			}
		)
		// if this request was redirected, we go again
		if (response.redirected) {
			source = response.url
			checked.push(source)
		// otherwise we're done
		} else {
			searching = false
		}
	}

	return new Response(removeQueryString(source))
}

const removeQueryString = (url) => {
	// just to make this a bit less aggressive, we want to make sure that we only remove tracking 
	// parameters. In my old shortcut I was removing the entire query string, which breaks 
	// most pagination and forums and I didn't want to port that nuance to this
	const blocklist = [
		'igsh', // instagram
		'igshid', // instagram
		'si', // youtube, spotify
		'fbclid', //facebook
		'feature', // youtube but just the domain you came from
		'gclid', // google
		'rdid', // facebook
		'share_url', // facebook
	]
	// we just take the passed URL, and iterate over my blocked parameters to remove them
	const uri = new URL(url)
	for (const param of blocklist) {
		uri.searchParams.delete(param)
	}

	return uri.toString()
}