export default {
  async fetch(request) {
    if (request.method === 'OPTIONS') {
      return new Response(null, {
        headers: {
          'Access-Control-Allow-Origin': '*',
          'Access-Control-Allow-Methods': 'GET, OPTIONS',
        }
      });
    }
    const url = new URL(request.url);
    const target = url.searchParams.get('url');
    if (!target) return new Response('no url', { status: 400 });
    const allowed = ['query1.finance.yahoo.com','query2.finance.yahoo.com','stooq.com','finviz.com'];
    const targetUrl = new URL(target);
    if (!allowed.some(d => targetUrl.hostname.includes(d))) {
      return new Response('not allowed', { status: 403 });
    }
    const resp = await fetch(target, {
      headers: { 'User-Agent': 'Mozilla/5.0' }
    });
    const body = await resp.text();
    return new Response(body, {
      status: resp.status,
      headers: {
        'Content-Type': resp.headers.get('content-type') || 'application/json',
        'Access-Control-Allow-Origin': '*',
        'Cache-Control': 'public, max-age=300',
      }
    });
  }
};