T5DE's local proxy for IMVU Classic

The client sends it every HTTP request and its IMQ connection; it makes them with current TLS and
certificates, upgrades IMVU's plain-HTTP hosts to HTTPS, and refuses IMVU's reporting endpoints. CI
tests it and publishes t5de-proxy.exe as nightlies and tagged releases.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/proxy/policy.go

@@ -0,0 +1,76 @@
+package proxy
+
+import (
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+// upgradeHosts are IMVU hosts the client reaches over plain HTTP that serve the same over HTTPS: the proxy
+// fetches them over HTTPS, so the client's account headers (X-imvu-auth, cookies) and what it browses don't cross
+// the network in the clear. Checked against the client's real requests (docs/hosts.md).
+var upgradeHosts = map[string]bool{
+	"www.imvu.com":            true,
+	"client-dynamic.imvu.com": true,
+	"secure.imvu.com":         true,
+	"api.imvu.com":            true,
+	"userimages.imvu.com":     true,
+	"userimages-akm.imvu.com": true,
+	"static-akm.imvu.com":     true,
+	"static.imvu.com":         true,
+	"webasset-akm.imvu.com":   true,
+	"chat.imvu.com":           true,
+	"chatnow.imvu.com":        true,
+}
+
+// numberedUpgradeHosts are the numbered image hosts (userimages01-akm.imvu.com, ...), upgraded like the others.
+var numberedUpgradeHosts = regexp.MustCompile(`^userimages[0-9]+-akm\.imvu\.com$`)
+
+// Upgrade reports whether an http URL is fetched over HTTPS instead.
+func Upgrade(u *url.URL) bool {
+	if u.Scheme != "http" || u.Port() != "" {
+		return false
+	}
+	host := strings.ToLower(u.Hostname())
+	return upgradeHosts[host] || numberedUpgradeHosts.MatchString(host)
+}
+
+// blocked are IMVU's crash, error, log and metrics reporting endpoints: by host, or by path on hosts it shares
+// with the API. T5DE's `reporting-blocklist` patch blocks the same in the client; the proxy blocks them again
+// for anything that reaches it.
+var (
+	blockedHosts = []string{"bugs.imvu.com"}
+	blockedPaths = []string{
+		"/api/drv.php",
+		"/api/increment_counter.php",
+		"/api/record_gauge.php",
+		"/catalog/web_submit_logs.php",
+		"/catalog/imvu_monitor_submit.php",
+	}
+	// blockedPrefixes are blocked on api.imvu.com only.
+	blockedAPIPrefixes = []string{"/events"}
+)
+
+// Blocked reports whether a request to u is refused.
+func Blocked(u *url.URL) bool {
+	host := strings.ToLower(u.Hostname())
+	for _, h := range blockedHosts {
+		if host == h {
+			return true
+		}
+	}
+	path := strings.ToLower(u.EscapedPath())
+	for _, p := range blockedPaths {
+		if path == p {
+			return true
+		}
+	}
+	if host == "api.imvu.com" {
+		for _, p := range blockedAPIPrefixes {
+			if path == p || strings.HasPrefix(path, p+"/") {
+				return true
+			}
+		}
+	}
+	return false
+}