imgs.blue / src / index.ts

import { CID } from 'multiformats/cid';

const BASE62_CHARS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

interface Env {
  USER_CACHE: KVNamespace;
}

// TID (Timestamp Identifier) constants for AT Protocol record keys
const TID_LENGTH = 13;
const TID_REGEX = /^[234567abcdefghij][234567abcdefghijklmnopqrstuvwxyz]{12}$/;
const COLLECTION = 'blue.imgs.blup.image';

function base62ToBytes(base62: string): Uint8Array {
  let num = 0n;
  for (let i = 0; i < base62.length; i++) {
    num = num * 62n + BigInt(BASE62_CHARS.indexOf(base62[i]));
  }

  const bytes: number[] = [];
  while (num > 0n) {
    bytes.unshift(Number(num & 0xFFn));
    num = num >> 8n;
  }
  return new Uint8Array(bytes);
}

/**
 * Detect the format of the identifier in the URL path
 */
function detectIdentifierFormat(id: string): 'tid' | 'base32' | 'base62' {
  if (id.startsWith('bafkrei')) return 'base32';
  if (id.length === TID_LENGTH && TID_REGEX.test(id)) return 'tid';
  return 'base62';
}

async function resolveHandleToDID(handle: string): Promise<string | null> {
  let did: string | null = null;

  // First try DNS TXT lookup
  try {
    // @ts-ignore - DNS API might not be in types yet
    if (typeof globalThis.resolveDns !== 'undefined') {
      // @ts-ignore
      const records = await globalThis.resolveDns(`_atproto.${handle}`, 'TXT');
      if (records && Array.isArray(records)) {
        for (const rec of records) {
          if (rec.startsWith('did=')) {
            did = rec.split('did=')[1];
            break;
          }
        }
      }
    }
  } catch (error) {
    console.log('DNS lookup failed, trying HTTPS fallback');
  }

  // Fallback to DNS-over-HTTPS (works everywhere)
  if (!did) {
    try {
      const dnsUrl = `https://cloudflare-dns.com/dns-query?name=_atproto.${handle}&type=TXT`;

      const response = await fetch(dnsUrl, {
        headers: {
          'Accept': 'application/dns-json'
        },
        cf: {
          cacheTtl: 300,
          cacheEverything: true
        }
      });

      if (response.ok) {
        const dnsData = await response.json() as {
          Answer?: Array<{
            name: string;
            type: number;
            data: string;
          }>;
        };

        const txtRecord = dnsData.Answer?.find(record =>
          record.type === 16 && record.data.includes('did=')
        );

        if (txtRecord) {
          // Remove quotes and extract DID
          const match = txtRecord.data.replace(/"/g, '').match(/did=(did:[^\s]+)/);
          if (match) {
            did = match[1];
          }
        }
      }
    } catch (error) {
      console.error('DNS-over-HTTPS lookup failed:', error);
    }
  }

  // If DNS lookup failed, try HTTPS well-known
  if (!did) {
    try {
      const response = await fetch(`https://${handle}/.well-known/atproto-did`, {
        cf: {
          cacheTtl: 300,
          cacheEverything: true
        }
      });

      if (response.status === 200) {
        const maybeDid = await response.text();
        // Basic DID validation
        if (maybeDid.startsWith('did:')) {
          did = maybeDid.trim();
        }
      }
    } catch (error) {
      console.error('HTTPS well-known lookup failed:', error);
    }
  }

  return did;
}

async function resolvePDSHost(did: string): Promise<string | null> {
  try {
    var url = new URL(`https://plc.directory/${did}`)
    if (did.startsWith('did:web:')) {
      // For web DIDs, construct the well-known URL
      const domain = did.replace('did:web:', '');
      url = new URL(`https://${domain}/.well-known/did.json`)
    }

    // For PLC DIDs, resolve via PLC directory
    const plcResponse = await fetch(url, {
      cf: {
        cacheTtl: 3600,
        cacheEverything: true
      }
    });

    if (!plcResponse.ok) {
      return null;
    }

    const plcData = await plcResponse.json() as {
      service?: Array<{
        id: string;
        type: string;
        serviceEndpoint: string;
      }>;
    };

    const pdsService = plcData.service?.find(s => s.id === '#atproto_pds');
    return pdsService?.serviceEndpoint || null;

  } catch (error) {
    console.error('Error resolving PDS host:', error);
    return null;
  }
}

/**
 * Fetch blob CID from ATProto record using rkey
 */
async function fetchBlobCidFromRecord(
  did: string,
  rkey: string
): Promise<string | null> {
  const pdsHost = await resolvePDSHost(did);
  if (!pdsHost) return null;

  const url = `${pdsHost}/xrpc/com.atproto.repo.getRecord?` +
    `repo=${encodeURIComponent(did)}` +
    `&collection=${encodeURIComponent(COLLECTION)}` +
    `&rkey=${encodeURIComponent(rkey)}`;

  try {
    const response = await fetch(url, {
      method: 'GET',
      headers: {
        'Accept': 'application/json',
        'User-Agent': 'CloudflareWorker/1.0'
      },
      cf: {
        cacheTtl: 3600, // Cache record lookups for 1 hour
        cacheEverything: true
      }
    });

    if (!response.ok) {
      console.error(`Record fetch failed: ${response.status}`);
      return null;
    }

    const data = await response.json() as {
      uri: string;
      cid: string;
      value: {
        blob?: {
          ref?: { $link: string };
        };
      };
    };

    return data.value?.blob?.ref?.$link || null;
  } catch (error) {
    console.error('Error fetching record:', error);
    return null;
  }
}

async function downloadBlobUnauthenticated(
  did: string,
  blobRef: string,
  ctx: ExecutionContext
): Promise<Response> {
  // Resolve PDS host for the DID
  const pdsHost = await resolvePDSHost(did);
  if (!pdsHost) {
    return new Response('Failed to resolve PDS host', { status: 400 });
  }

  const url = `${pdsHost}/xrpc/com.atproto.sync.getBlob?did=${encodeURIComponent(did)}&cid=${encodeURIComponent(blobRef)}`;

  try {
    const response = await fetch(url, {
      method: 'GET',
      headers: {
        'Accept': 'application/octet-stream',
        'User-Agent': 'CloudflareWorker/1.0'
      },
      cf: {
        cacheTtl: 31536000, // Cache for 1 year
        cacheEverything: true
      }
    });

    if (response.status === 200) {
      // Return the response directly with appropriate headers
      return new Response(response.body, {
        status: 200,
        headers: {
          'Content-Type': response.headers.get('Content-Type') || 'application/octet-stream',
          'Cache-Control': 'public, max-age=31536000, immutable',
          'Content-Length': response.headers.get('Content-Length') || '',
          'Access-Control-Allow-Origin': '*'
        }
      });
    }

    return new Response('Blob not accessible via public endpoints', { status: 404 });
  } catch (error) {
    console.error('Error downloading blob:', error);
    return new Response('Failed to download blob', { status: 500 });
  }
}

// Export helper functions for testing
export {
  base62ToBytes,
  detectIdentifierFormat,
  resolveHandleToDID,
  resolvePDSHost,
  fetchBlobCidFromRecord,
  downloadBlobUnauthenticated,
};

export default {
  async fetch(
    request: Request,
    env: Env,
    ctx: ExecutionContext
  ): Promise<Response> {
    // Handle CORS preflight
    if (request.method === 'OPTIONS') {
      return new Response(null, {
        headers: {
          'Access-Control-Allow-Origin': '*',
          'Access-Control-Allow-Methods': 'GET, OPTIONS',
          'Access-Control-Allow-Headers': 'Content-Type',
        },
      });
    }

    const url = new URL(request.url);
    let [handle, base62OrCid] = url.pathname.split('/').filter(Boolean);

    if (!handle || !base62OrCid) {
      return new Response('Invalid path. Expected: /{handle}/{cid}', { status: 400 });
    }

    let did: string;
    let cid: string;

    // Handle resolution
    if (handle.startsWith('did:')) {
      did = handle;
    } else {
      const cacheKey = `${handle}`;
      let cachedDid = await env.USER_CACHE.get(cacheKey);

      if (!cachedDid) {
        // Use DNS lookup for handle resolution
        const resolvedDid = await resolveHandleToDID(handle);

        if (!resolvedDid) {
          return new Response('Handle not found', { status: 404 });
        }

        did = resolvedDid;

        // Cache the resolved DID
        const didId = did.replace('did:plc:', '').replace('did:web:', 'web:');
        ctx.waitUntil(
          env.USER_CACHE.put(cacheKey, didId, {
            expirationTtl: 31536000 // 1 year
          })
        );
      } else {
        did = cachedDid.startsWith('web:')
          ? `did:${cachedDid}`
          : `did:plc:${cachedDid}`;
      }
    }

    // ignore extensions on CID during lookup
    const match = base62OrCid.match(/^([^.@]+)/);
    if (match) {
      base62OrCid = match[1];
    }

    // Detect identifier format: TID (rkey), base32 CID, or base62 CID
    const format = detectIdentifierFormat(base62OrCid);

    switch (format) {
      case 'base32':
        // Already a proper CID
        cid = base62OrCid;
        break;
      case 'tid':
        // Fetch record to get blob CID
        const blobCid = await fetchBlobCidFromRecord(did, base62OrCid);
        if (!blobCid) {
          return new Response('Record not found', { status: 404 });
        }
        cid = blobCid;
        break;
      case 'base62':
      default:
        try {
          // Convert base62 to CID
          const bytes = base62ToBytes(base62OrCid);
          const cidObj = CID.decode(bytes);
          // Convert to base32 CIDv1 string (bafkrei format)
          cid = cidObj.toString();
        } catch (error) {
          return new Response('Invalid CID encoding', { status: 400 });
        }
    }

    // Download blob from AT Protocol PDS
    return downloadBlobUnauthenticated(did, cid, ctx);
  }
} satisfies ExportedHandler<Env>;