用 iPhone 快捷指令 + Cloudflare Worker,把微信通知安全转发到另一台手机的 Telegram

iPhone A
  微信通知
    │  (iOS 通知自动化触发,标题过滤 = 白名单)
    ▼
  快捷指令 「获取 URL 内容」
    │  HTTPS POST + X-Webhook-Key
    ▼
Cloudflare Worker
    ├─ ① 校验 Webhook Key
    ├─ ② 限制请求体大小
    ├─ ③ 白名单(标题精确匹配)
    ├─ ④ 敏感内容过滤
    ├─ ⑤ 按模式组装文本(notify / full)
    │
    │  HTTPS + Bot Token(仅存在于 Worker Secret)
    ▼
Telegram Bot API
    ▼
iPhone B(Telegram)

read -s "TOKEN?粘贴 Bot Token 后回车: "
curl -s "https://api.telegram.org/bot${TOKEN}/getUpdates"
unset TOKEN

read -rsp "粘贴 Bot Token 后回车: " TOKEN; echo
curl -s "https://api.telegram.org/bot${TOKEN}/getUpdates"
unset TOKEN

"chat": { "id": 123456789, "type": "private" }

openssl rand -hex 32

curl -i -X POST 'https://wechat-notify.example.workers.dev' \
  -H 'Content-Type: application/json' \
  -H 'X-Webhook-Key: 你的密钥' \
  --data '{"title":"张三","message":"明天见"}'

curl -i -X POST 'https://wechat-notify.example.workers.dev' \
  -H 'Content-Type: application/json' \
  -H 'X-Webhook-Key: 你的密钥' \
  --data '{"title":"陌生人","message":"你好"}'

curl -i -X POST 'https://wechat-notify.example.workers.dev' \
  -H 'Content-Type: application/json' \
  -H 'X-Webhook-Key: 你的密钥' \
  --data '{"title":"张三","message":"验证码 123456"}'

// Cloudflare Worker: iPhone Shortcut -> Worker -> Telegram Bot
//
// Secrets (Settings -> Variables and Secrets -> type "Secret"):
//   TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, WEBHOOK_KEY
// Plain-text variables:
//   ALLOW_TITLES  comma-separated exact notification titles allowed to be forwarded
//                 (contact remark names / group names). Empty = forward nothing.
//   MODE          "notify" (default: only sender, no message body)
//                 "full"   (sender + body, after filters)

const MAX_BODY_CHARS = 8192;

export default {
  async fetch(request, env) {
    if (request.method !== "POST") {
      return plain("Method Not Allowed", 405, { Allow: "POST" });
    }
    if (!env.WEBHOOK_KEY || !env.TELEGRAM_BOT_TOKEN || !env.TELEGRAM_CHAT_ID) {
      return plain("Server Misconfigured", 500);
    }

    // 1. Authenticate before reading the body
    const supplied = request.headers.get("X-Webhook-Key") || "";
    if (!(await safeEqual(supplied, env.WEBHOOK_KEY))) {
      return plain("Unauthorized", 401);
    }

    // 2. Parse with a size cap
    const raw = await request.text();
    if (raw.length > MAX_BODY_CHARS) return plain("Payload Too Large", 413);

    let data;
    try {
      data = JSON.parse(raw);
    } catch {
      return plain("Bad Request", 400);
    }
    if (!data || typeof data !== "object") return plain("Bad Request", 400);

    const title = clean(data.title, 200);
    const subtitle = clean(data.subtitle, 200);
    const message = clean(data.message, 1500);

    if (!title && !subtitle && !message) {
      return reply("ignored", "empty");
    }

    // 3. Allowlist (fail closed): only exact-match titles are forwarded
    const allow = parseAllowList(env.ALLOW_TITLES);
    if (!allow.has(normalize(title))) {
      return reply("ignored", "not_allowed");
    }

    // 4. Sensitive-content filter (second line of defence, biased toward dropping)
    if (isSensitive(subtitle, message)) {
      return reply("blocked", "sensitive");
    }

    // 5. Build text (no parse_mode, so no markup injection)
    const full = (env.MODE || "notify").toLowerCase() === "full";
    let text = "📱 微信\n👤 " + title;
    if (full) {
      if (subtitle) text += "\nℹ️ " + subtitle;
      if (message) text += "\n\n💬 " + message;
    } else {
      text += " 发来消息";
    }
    text = truncate(text, 3500);

    // 6. Send
    const ok = await sendTelegram(env, text);
    if (!ok) return plain("Upstream Error", 502);

    return reply("sent");
  },
};

// ---------------------------------------------------------------------------

const SENSITIVE_ZH = [
  "验证码", "驗證碼", "校验码", "校驗碼", "动态码", "動態碼", "安全码", "安全碼",
  "验证", "驗證", "校验", "登录", "登錄", "登入", "口令", "一次性",
  "密码", "密碼", "银行卡", "銀行卡", "信用卡", "身份证", "身份證", "护照", "護照",
  "转账", "轉賬", "转帐", "支付", "付款", "收款", "红包", "紅包", "账单", "賬單",
];

const SENSITIVE_EN =
  /\b(otp|pin|passcode|password|passwd|verification|verify|security code|one[- ]time|iban|cvv)\b/i;

function isSensitive(subtitle, message) {
  const body = normalize(`${subtitle}\n${message}`);
  if (SENSITIVE_ZH.some((w) => body.includes(w))) return true;
  if (SENSITIVE_EN.test(body)) return true;
  // Any run of 4-8 digits (typical verification codes); NFKC already folds full-width digits
  if (/\p{Nd}{4,8}/u.test(body)) return true;
  return false;
}

function parseAllowList(value) {
  const set = new Set();
  if (typeof value !== "string") return set;
  for (const item of value.split(/[,，、\n]/)) {
    const n = normalize(item);
    if (n) set.add(n);
  }
  return set;
}

function normalize(s) {
  return (s || "").normalize("NFKC").trim().toLowerCase();
}

function clean(value, max) {
  if (typeof value !== "string") return "";
  return truncate(value.replace(/\u0000/g, "").trim(), max);
}

// Code-point aware: never splits an emoji surrogate pair
function truncate(value, max) {
  if (!value) return "";
  const chars = Array.from(value);
  return chars.length <= max ? value : chars.slice(0, max).join("") + "…";
}

async function safeEqual(a, b) {
  const enc = new TextEncoder();
  const [ha, hb] = await Promise.all([
    crypto.subtle.digest("SHA-256", enc.encode(a)),
    crypto.subtle.digest("SHA-256", enc.encode(b)),
  ]);
  return crypto.subtle.timingSafeEqual(ha, hb);
}

async function sendTelegram(env, text) {
  const url = `https://api.telegram.org/bot${env.TELEGRAM_BOT_TOKEN}/sendMessage`;
  for (let attempt = 0; attempt < 2; attempt++) {
    try {
      const res = await fetch(url, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          chat_id: env.TELEGRAM_CHAT_ID,
          text,
          link_preview_options: { is_disabled: true },
        }),
        signal: AbortSignal.timeout(8000),
      });
      if (res.ok) return true;
      if (res.status === 429 && attempt === 0) {
        const j = await res.json().catch(() => ({}));
        const wait = Math.min(Number(j?.parameters?.retry_after) || 1, 3);
        await new Promise((r) => setTimeout(r, wait * 1000));
        continue;
      }
      return false;
    } catch {
      if (attempt === 1) return false;
    }
  }
  return false;
}

function reply(action, reason) {
  const body = { ok: true, action };
  if (reason) body.reason = reason;
  return new Response(JSON.stringify(body), {
    status: 200,
    headers: {
      "Content-Type": "application/json; charset=utf-8",
      "Cache-Control": "no-store",
    },
  });
}

function plain(text, status, extra = {}) {
  return new Response(text, {
    status,
    headers: { "Cache-Control": "no-store", ...extra },
  });
}