Ο κωδικός 39α βγαίνει από εδώ.

Αυτό είναι όλο το πρόγραμμα που τρέχει στον διακομιστή. Ενσωματώνεται αυτόματα από το ίδιο αρχείο που ανεβαίνει στο Cloudflare, οπότε είναι πάντα η τρέχουσα έκδοση.

// The whole server side of kodikos39a.app.
//
// AADE's 39a service does not allow browsers to call it directly (no CORS), so the page sends
// its SOAP request to /api/aade and this Worker forwards it, unchanged, to one fixed AADE address.
// It does not read, store or log the request or the response.
//
// The only thing stored is one number: how many one-time codes were issued through the site.
// The page reports each success to /api/issued with an empty request, and /api/stats returns
// the total. Everything else on the site is static files.

interface Env {
  ASSETS: { fetch(request: Request): Promise<Response> };
  LIMITER: { limit(options: { key: string }): Promise<{ success: boolean }> };
  DB: D1Database;
}

// The only address the relay ever talks to.
const AADE = "https://www1.gsis.gr/wsaade/VtWs39aFPA/VtWs39aFPA";
const SERVICE = "http://vtws39afpa/VtWs39aFPAService";
// Only these operations are forwarded: version check and the buyer's one-time codes.
const OPERATIONS = new Set(["vt39afpaVersionInfo", "vt39afpaBu9GetOtp"]);
const MAX_BODY = 8 * 1024;

const reply = (status: number, message = "") =>
  new Response(message, { status, headers: { "Cache-Control": "no-store", "Content-Type": "text/plain; charset=utf-8" } });

// Rate limit per connection, so the relay can't be used to guess passwords and the counter
// can't be pumped. The IP is used only as a counter key in memory and is not stored.
async function limited(request: Request, env: Env, scope: string) {
  const ip = request.headers.get("CF-Connecting-IP") ?? "unknown";
  return !(await env.LIMITER.limit({ key: `${scope}:${ip}` })).success;
}

async function relay(request: Request, env: Env, url: URL): Promise<Response> {
  if (request.method !== "POST") return reply(405);
  // Only this site's own page may use the relay.
  if (request.headers.get("Origin") !== url.origin) return reply(403);

  const operation = request.headers.get("X-AADE-Operation") ?? "";
  if (!OPERATIONS.has(operation)) return reply(400);
  if (await limited(request, env, "aade")) return reply(429);

  const body = await request.arrayBuffer();
  if (body.byteLength === 0 || body.byteLength > MAX_BODY) return reply(413);

  let upstream: Response;
  try {
    upstream = await fetch(AADE, {
      method: "POST",
      headers: { "Content-Type": `application/soap+xml; charset=utf-8; action="${SERVICE}:${operation}"` },
      body,
      signal: AbortSignal.timeout(30_000),
    });
  } catch {
    return reply(504);
  }

  // AADE's answer goes back to the browser as it is.
  return new Response(upstream.body, {
    status: upstream.status,
    headers: { "Content-Type": "application/soap+xml; charset=utf-8", "Cache-Control": "no-store" },
  });
}

const total = (issued: number | undefined) =>
  Response.json({ issued: issued ?? 0 }, { headers: { "Cache-Control": "no-store" } });

// +1 to the public counter. The request carries no data at all; the reply is the new total.
async function issued(request: Request, env: Env, url: URL): Promise<Response> {
  if (request.method !== "POST") return reply(405);
  if (request.headers.get("Origin") !== url.origin) return reply(403);
  if (await limited(request, env, "issued")) return reply(429);
  const row = await env.DB.prepare("UPDATE stats SET issued = issued + 1 WHERE id = 1 RETURNING issued").first<{ issued: number }>();
  return total(row?.issued);
}

// The current total for everyone, read fresh on every visit.
async function stats(request: Request, env: Env): Promise<Response> {
  if (request.method !== "GET") return reply(405);
  const row = await env.DB.prepare("SELECT issued FROM stats WHERE id = 1").first<{ issued: number }>();
  return total(row?.issued);
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);
    switch (url.pathname) {
      case "/api/aade":
        return relay(request, env, url);
      case "/api/issued":
        return issued(request, env, url);
      case "/api/stats":
        return stats(request, env);
      default:
        return env.ASSETS.fetch(request);
    }
  },
};