Bot de demonstração de arbitragem

1. Registe-se em dash.cloudflare.com — conta gratuita, sem dados de pagamento.
2. Workers & Pages → Create → Start with Hello World → Deploy.
3. Abra Edit code, apague o que lá estiver, cole o código abaixo e faça Deploy outra vez.
4. Copie o endereço do worker (tem o formato https://algo.workers.dev) e cole-o no campo acima.

Uma conta gratuita permite 100 000 pedidos por dia em todos os seus workers, reiniciando às 00:00 UTC. Uma varredura completa do histórico gasta cerca de 1 900; o bot de demonstração com intervalo de um minuto, cerca de 7 000 por dia. Para uso normal sobra bastante.

/**
 * Crypto Exchange CORS + geo proxy — Cloudflare Worker
 * ----------------------------------------------------
 * Why: browsers block direct calls to exchange APIs (CORS), and some exchanges
 * geo-block certain server IPs. This Worker runs on Cloudflare's network, adds
 * CORS headers, and forwards the request (GET for market data, POST for P2P).
 *
 * This file is shown inside the tool itself, so anyone can run their own copy.
 * Yours is yours: nothing here reports to the site, and the address you deploy
 * to is stored only in your own browser.
 *
 * DEPLOY (free, no card, no CLI needed):
 *   1. dash.cloudflare.com → Workers & Pages → Create → Start with Hello World
 *   2. Deploy once, then Edit code, replace everything with THIS file, Deploy again.
 *   3. Copy the address (https://something.workers.dev) and paste it into the
 *      tool, under "Your own proxy".
 *
 * A free account allows 100,000 requests a day across all your workers, which
 * resets at 00:00 UTC. A full history sweep spends roughly 1,900 of them.
 *
 * USAGE:
 *   GET  https://<worker>/?url=https://api.binance.com/api/v3/ticker/price
 *   POST https://<worker>/?url=https://p2p.binance.com/bapi/c2c/v2/friendly/c2c/adv/search
 *        (with a JSON body — used for P2P ad search)
 */

const ALLOWED_HOSTS = new Set([
  // Spot market data
  'api.binance.com',
  'api.exchange.coinbase.com',
  'api.kraken.com',
  'api.gemini.com',
  'www.bitstamp.net',
  'api.crypto.com',
  'api.bybit.com',
  'www.okx.com',
  'api.okx.com',
  'api.kucoin.com',
  'api.gateio.ws',
  'api-cloud.huobi.pro',   // HTX
  'api.huobi.pro',
  'api.mexc.com',
  'api-pub.bitfinex.com',
  'api.coingecko.com',     // aggregated fallback
  // P2P (POST endpoints)
  'p2p.binance.com',
  'api2.bybit.com',
  'www.okx.com',           // OKX P2P shares the host (already listed)
  'www.bitget.com',
  'api.bitget.com',
]);

const CORS = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
  'Access-Control-Allow-Headers': 'Content-Type',
};

export default {
  async fetch(request) {
    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: CORS });
    if (request.method !== 'GET' && request.method !== 'POST') {
      return json({ error: 'Method not allowed' }, 405);
    }

    const target = new URL(request.url).searchParams.get('url');
    if (!target) return json({ error: 'Missing ?url=' }, 400);

    let parsed;
    try { parsed = new URL(target); } catch { return json({ error: 'Bad url' }, 400); }
    if (parsed.protocol !== 'https:' || !ALLOWED_HOSTS.has(parsed.hostname)) {
      return json({ error: 'Host not allowed' }, 403);
    }

    const isPost = request.method === 'POST';
    const init = {
      method: request.method,
      headers: {
        'Accept': 'application/json',
        'User-Agent': 'Mozilla/5.0 (simplytoolz-proxy)',
      },
    };
    if (isPost) {
      init.headers['Content-Type'] = 'application/json';
      init.body = await request.text(); // forward the JSON body verbatim
    } else {
      // Only GET responses are edge-cached; P2P/POST must stay fresh.
      init.cf = { cacheTtl: 5, cacheEverything: true };
    }

    try {
      const upstream = await fetch(parsed.toString(), init);
      const body = await upstream.text();
      return new Response(body, {
        status: upstream.status,
        headers: {
          ...CORS,
          'Content-Type': 'application/json',
          'Cache-Control': isPost ? 'no-store' : 'public, max-age=5',
        },
      });
    } catch (e) {
      return json({ error: 'Upstream fetch failed', detail: String(e) }, 502);
    }
  },
};

function json(obj, status) {
  return new Response(JSON.stringify(obj), { status, headers: { ...CORS, 'Content-Type': 'application/json' } });
}