"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
/**
 * @param {Request} req
 * @returns {Boolean}
 *        True iff the host on the other end of the request is a Cloudflare Worker.
 *        See https://groups.google.com/a/optimizely.com/d/msg/webdelivery/xYp30TLJIDI/VNi3djBiAwAJ
 */
function isFromCloudflareWorker(req) {
    return req.headers.has('cf-worker');
}
/**
 * @param {Request} req
 * @returns {Boolean}
 *        True iff the request uses TLS.
 */
function isHttps(req) {
    return Boolean(req.cf.tlsVersion);
}
/**
 * edge-decider requirement CJS-3518: The API must not fulfill insecure requests.
 * It turns out, though, that requests from Cloudflare-operated hosts are almost surely
 * insecure (or so we've been told by support, and observe to be true). As a result, our
 * acceptance algorithm is:
 *   1) Is the request from Cloudflare? If yes, Allow.
 *   2) Is the request over HTTPS? If yes, Allow.
 *   3) Otherwise, Forbid.
 */
function evaluateHttpsRules(req) {
    const fromWorker = isFromCloudflareWorker(req);
    const secure = isHttps(req);
    const ok = fromWorker || secure;
    return {
        fromWorker,
        secure,
        ok,
    };
}
exports.default = {
    evaluateHttpsRules,
};
