captcha.js

async function checkCookieAndCaptcha(r) {
    var cookie = r.headersIn.Cookie;
    // Check if the secure cookie is present and valid
    if (cookie && cookie.includes("MCLVALID")) {
        // Implement your logic to validate the cookie value
        let valid = await validateCookie(r);
        if (valid) {
            // Perform an internal subrequest to proxy the request
            r.internalRedirect('/internal_proxy');
            return
        }
    }

    r.internalRedirect('/captcha_page.html');
}

function checkXForwardedFor(r, ip) {
    let xffHeader = r.headersIn['X-Forwarded-For'];
    if (xffHeader) {
        // Split the header value by comma to handle multiple IPs
        let ips = xffHeader.split(',');

        // Trim whitespace and check if the target IP is in the list
        for (let i = 0; i < ips.length; i++) {
            if (ips[i].trim() === ip) {
                return true; // IP found in the X-Forwarded-For header
            }
        }
    }

    return false; // IP not found in the X-Forwarded-For header
}

async function validateCaptcha(r) {
    try {
        let thirdPartyApiUrl = 'https://decrypt.mcl.spur.us/api/v1/assessment';
        let data = JSON.parse(r.requestText);
        let response = await ngx.fetch(thirdPartyApiUrl, {
            method: 'POST',
            body: data.captchaData,
            headers: {
                'Content-Type': 'text/plain',
                'Token': r.variables.mclVerifyToken,
            },
        });

        if (!response.ok) {
            throw new Error(`API call failed: ${response.statusText}`);
        }

        let responseData = await response.json();
        let clientIpAddress = r.remoteAddress;

        // Parse the timestamp from the response
        let responseTime = new Date(responseData.ts);

        // Get the current time
        let currentTime = new Date();

        // Calculate the difference in seconds
        let timeDifference = Math.abs(currentTime - responseTime) / 1000;

        // Check if the time difference is within 5 seconds
        if (timeDifference > 5) {
            r.return(403, JSON.stringify(responseData));
            return;
        }

        if (r.variables.blockVPNs !== "false" && responseData.anon && responseData.vpn) {
            r.return(403, JSON.stringify(responseData));
            return;
        }

        if (r.variables.blockProxies !== "false" && responseData.anon && responseData.proxied) {
            r.return(403, JSON.stringify(responseData));
            return;
        }

        if (r.variables.testLocalhost !== "false" || responseData.ip == clientIpAddress || (r.variables.checkXForwardedFor !== "false" && checkXForwardedFor(r, responseData.ip))) {
            await setSecureCookie(responseData.ip, r);
            r.return(200);
        } else {
            r.return(403, JSON.stringify(responseData));
        }
    } catch (error) {
        r.return(500, "Internal Server Error");
    }
}

function hexStringToByteArray(hexString) {
    var result = [];
    for (var i = 0; i < hexString.length; i += 2) {
        result.push(parseInt(hexString.substr(i, 2), 16));
    }
    return result;
}

async function validateCookie(r) {
    const cookies = r.headersIn.Cookie;
    if (!cookies) {
        return false;
    }

    const cookieName = "MCLVALID=";
    let start = cookies.indexOf(cookieName);
    if (start === -1) {
        return false;
    }

    start += cookieName.length;
    let end = cookies.indexOf(';', start);
    if (end === -1) end = cookies.length;

    const encryptedCookie = cookies.substring(start, end).split('.');
    const encryptedData = encryptedCookie[0];
    const ivHex = encryptedCookie[1];
    const iv = new Uint8Array(hexStringToByteArray(ivHex));

    const keyMaterial = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(r.variables.cookieSecret));
    const key = await crypto.subtle.importKey("raw", keyMaterial, { name: "AES-CBC" }, false, ["decrypt"]);
    const decryptedData = await crypto.subtle.decrypt({ name: "AES-CBC", iv }, key, new Uint8Array(hexStringToByteArray(encryptedData)));
    const decryptedString = new TextDecoder().decode(decryptedData);
    const decryptedParts = decryptedString.split('|');
    const decryptedIp = decryptedParts[0];
    const expiryTime = decryptedParts[1];

    if (Math.floor(Date.now() / 1000) >= parseInt(expiryTime, 10)) {
        return false;
    }

    let isRemoteAddressMatch = r.remoteAddress === decryptedIp;
    let isXForwardedForCheckEnabled = r.variables.checkXForwardedFor !== "false";
    let isXForwardedForMatch = checkXForwardedFor(r, decryptedIp);

    return isRemoteAddressMatch || (isXForwardedForCheckEnabled && isXForwardedForMatch);
}

function byteArrayToHex(buffer) {
    var hex = [];
    buffer.forEach(b => hex.push((b & 0xFF).toString(16).padStart(2, '0')));
    return hex.join('');
}

async function setSecureCookie(ip, r) {
    const data = `${ip}|${Math.floor(Date.now() / 1000) + 3600}`; // Data to encrypt
    const keyMaterial = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(r.variables.cookieSecret));
    const key = await crypto.subtle.importKey("raw", keyMaterial, { name: "AES-CBC" }, false, ["encrypt"]);
    const iv = crypto.getRandomValues(new Uint8Array(16)); // Generate a random IV
    const encryptedData = await crypto.subtle.encrypt({ name: "AES-CBC", iv }, key, new TextEncoder().encode(data));
    const encryptedDataHex = byteArrayToHex(new Uint8Array(encryptedData));
    const ivHex = byteArrayToHex(iv);

    // Set the encrypted cookie
    r.headersOut['Set-Cookie'] = `MCLVALID=${encryptedDataHex}.${ivHex}; Secure; HttpOnly; Path=/; SameSite=Strict`;
}

export default { checkCookieAndCaptcha, validateCaptcha };