export default {
  async fetch(request) {
    const cors = {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET, OPTIONS',
      'Access-Control-Allow-Headers': '*'
    };
    if (request.method === 'OPTIONS') return new Response(null, { headers: cors });

    const target = new URL(request.url).searchParams.get('url');
    if (!target) return new Response('Missing url param', { status: 400, headers: cors });

    let t;
    try { t = new URL(target); } catch(e) {
      return new Response('Invalid url', { status: 400, headers: cors });
    }
    // Security: only allow proxying to Yahoo Finance
    const allowed = ['query1.finance.yahoo.com', 'query2.finance.yahoo.com'];
    if (!allowed.includes(t.hostname)) {
      return new Response('Host not allowed', { status: 403, headers: cors });
    }

    try {
      const resp = await fetch(target, {
        headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' }
      });
      const body = await resp.text();
      return new Response(body, {
        status: resp.status,
        headers: { ...cors, 'Content-Type': 'application/json' }
      });
    } catch(e) {
      return new Response('Fetch failed: ' + e.message, { status: 502, headers: cors });
    }
  }
};