Move outbound rules

type Handler = { method: string; params?: unknown };

type OutboundHandler = (
	request: Request,
	env: Env,
	params: unknown,
) => Response | Promise<Response>;

// The outbound fields of your 0.12 class.
const ENABLE_INTERNET = false;
const ALLOWED_HOSTS: string[] | undefined = [
	"github.com",
	"registry.npmjs.org",
	"api.example.com",
];
const DENIED_HOSTS: string[] | undefined = undefined;
const OUTBOUND_BY_HOST: Record<string, Handler> = {
	"api.example.com": { method: "withToken" },
};
const OUTBOUND: Handler | undefined = undefined;

// Your 0.12 handlers, by name.
const HANDLERS: Record<string, OutboundHandler> = {
	withToken: (request, env) => {
		const headers = new Headers(request.headers);
		headers.set("Authorization", `Bearer ${env.API_TOKEN}`);
		return fetch(new Request(request, { headers }));
	},
};

import { WorkerEntrypoint } from "cloudflare:workers";

// The shape that 0.12 stored under OUTBOUND_CONFIGURATION.
type StoredRules = {
	outboundByHostOverrides?: Record<string, Handler>;
	outboundHandlerOverride?: Handler;
	allowedHosts?: string[];
	deniedHosts?: string[];
};

// "*" matches any run of characters, as in 0.12.
function matches(pattern: string, hostname: string): boolean {
	const escaped = pattern
		.split("*")
		.map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"));
	return new RegExp(`^${escaped.join(".*")}$`).test(hostname);
}

function lookup(
	handlers: Record<string, Handler> | undefined,
	hostname: string,
): Handler | undefined {
	return (
		handlers?.[hostname] ??
		Object.entries(handlers ?? {}).find(([pattern]) =>
			matches(pattern, hostname),
		)?.[1]
	);
}

export class Outbound extends WorkerEntrypoint<Env, StoredRules> {
	async fetch(request: Request): Promise<Response> {
		const rules = this.ctx.props;
		const allowed = rules.allowedHosts ?? ALLOWED_HOSTS;
		const denied = rules.deniedHosts ?? DENIED_HOSTS;
		const url = new URL(request.url);
		const hostname = url.hostname.replace(/\.+$/, "");
		const listed = (patterns: string[]) =>
			patterns.some((pattern) => matches(pattern, hostname));
		const blocked = new Response("Origin is disallowed", {
			status: 520,
		});

		if (denied && listed(denied)) {
			return blocked;
		}

		if (allowed && !listed(allowed)) {
			return blocked;
		}

		const handler = [
			lookup(rules.outboundByHostOverrides, hostname),
			lookup(OUTBOUND_BY_HOST, hostname),
			rules.outboundHandlerOverride,
			OUTBOUND,
		].find((handler) => handler && HANDLERS[handler.method]);

		if (handler) {
			const run = HANDLERS[handler.method];
			return run(request, this.env, handler.params);
		}

		if (allowed || ENABLE_INTERNET) {
			return fetch(request);
		}

		return blocked;
	}
}

const RULES = "OUTBOUND_CONFIGURATION";
const CA = "/etc/cloudflare/certs/cloudflare-containers-ca.crt";
const BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
const ENV = {
	NODE_ENV: "test",
	NODE_EXTRA_CA_CERTS: CA,
	REQUESTS_CA_BUNDLE: BUNDLE,
};
// Keep a copy of the system bundle, wait up to 10 seconds for the
// certificate, then write the bundle from the copy and the certificate.
const SYSTEM = "/etc/ssl/certs/ca-certificates.system.crt";
const CA_WAIT = `until [ -s ${CA} ]; do sleep 0.1; done`;
const CA_READY = `timeout 10 sh -c '${CA_WAIT}'`;
const TRUST = [
	"sh",
	"-c",
	`[ -e ${SYSTEM} ] || { cp ${BUNDLE} ${SYSTEM}.tmp && mv ${SYSTEM}.tmp ${SYSTEM}; }
	${CA_READY} && cat ${SYSTEM} ${CA} >${BUNDLE}.tmp && mv ${BUNDLE}.tmp ${BUNDLE}`,
];

export class MySandbox extends DurableObject<Env> {
	// ...

	private rules(): StoredRules {
		return this.ctx.storage.kv.get<StoredRules>(RULES) ?? {};
	}

	private async intercept(): Promise<void> {
		const props = this.rules();
		const outbound = this.ctx.exports.Outbound({ props });
		await this.container.interceptAllOutboundHttp(outbound);
		await this.container.interceptOutboundHttps("*", outbound);
	}

	private async trust(): Promise<void> {
		const trust = await this.container.exec(TRUST);

		if ((await trust.exitCode) !== 0) {
			throw new Error("The container did not trust the intercept CA");
		}
	}

	private async startContainer(): Promise<void> {
		const newContainer = !this.container.running;

		if (newContainer) {
			this.container.start({
				image: this.container.images.sandbox,
				instance: "standard-1",
				env: ENV,
				enableInternet: ENABLE_INTERNET,
			});
		}

		try {
			if (newContainer) {
				// Replaces onStart().
				await this.ctx.storage.put("startedAt", Date.now());
			}
			await this.intercept();
			await this.trust();
			await this.container.setInactivityTimeout(
				INACTIVITY_TIMEOUT_MS,
			);
		} catch (error) {
			// The next request starts a new container.
			await this.container.destroy();
			throw error;
		}
	}
}