[[r2_buckets]]
binding = 'MY_BUCKET' # <~ valid JavaScript variable name
bucket_name = '<YOUR_BUCKET_NAME>'
prewview_bucket_name = '<YOUR_PREVIEW_BUCEKT_NAME>'

import { Env } from "./bindings.js"

export default {
  async fetch(request: Request, env: Env, context: ExecutionContext): Promise<Response> {
    return handleRequest(request, env);
  }
};

const handleRequest = async (request: Request, env: Env): Promise<Response> => {
  const { pathname } = new URL(request.url);
  const key = pathname.slice(1);

  switch (request.method) {
    case 'PUT':
      await MY_BUCKET.put(key, request.body);
      return new Response(`Put ${key} successfully!`);
    case 'GET':
      const object = await MY_BUCKET.get(key);

      if (!object) {
        return new Response('Object Not Found', { status: 404 });
      }

      return new Response(object.body);
    case 'DELETE':
      await MY_BUCKET.delete(key);
      return new Response('Deleted!', { status: 200 });

    default:
      return new Response('Route Not Found.', { status: 404 });
  }
}

const ALLOW_LIST = ['cat-pic.jpg'];
// Check requests for a pre-shared secret
const hasValidHeader = request => {
  return request.headers.get('X-Custom-Auth-Key') === AUTH_KEY_SECRET;
};

function authorizeRequest(request, key) {
  switch (request.method) {
    case 'PUT':
    case 'DELETE':
      return hasValidHeader(request);
    case 'GET':
      return ALLOW_LIST.includes(key);
    default:
      return false;
  }
}

async function handleRequest(request) {
  const url = new URL(request.url);
  const key = url.pathname.slice(1);

  if (!authorizeRequest(request, key)) {
    return new Response('Forbidden', { status: 403 });
  }
  // ...