Filter fake Webflow and Framer form signups

const API_URL = "https://simpleverifier.com/api/v1/verify";
const WARN_CODES = new Set(["role", "catch_all"]);
const ALLOW = { decision: "allow", reasonCode: null, message: null };

function blockMessage(reasonCode, reason) {
  if (reasonCode === "disposable") return "Please use a permanent email address, not a temporary inbox.";
  const hint = reason.match(/did you mean ([^?\s]+)\??/i)?.[1];
  if (hint) return `Check the spelling of your email address. Did you mean ${hint}?`;
  return "This email address can't receive mail. Please check it.";
}

async function checkSignupEmail(email, apiKey, timeoutMs = 8000) {
  if (!apiKey || !email) return ALLOW;
  let result;
  try {
    const res = await fetch(API_URL, {
      method: "POST",
      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
      body: JSON.stringify({ email: email.trim() }),
      signal: AbortSignal.timeout(timeoutMs),
    });
    if (!res.ok) return ALLOW; // fail open
    result = await res.json();
  } catch {
    return ALLOW; // timeout or network error: fail open
  }
  const reasonCode = result.reason_code ?? null;
  if (result.action === "do_not_send") {
    return { decision: "block", reasonCode, message: blockMessage(reasonCode ?? "", result.reason ?? "") };
  }
  if (result.likely_invented || WARN_CODES.has(reasonCode)) return { decision: "warn", reasonCode, message: null };
  return { decision: "allow", reasonCode, message: null };
}

function fieldsOf(body) {
  return body?.payload?.data ?? body?.data ?? body ?? {};
}

function emailIn(fields) {
  const key = Object.keys(fields).find((k) => /e-?mail/i.test(k));
  return key ? String(fields[key]) : "";
}

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    if (request.method !== "POST" || url.searchParams.get("token") !== env.FORM_WEBHOOK_TOKEN) {
      return new Response("Not found", { status: 404 });
    }
    const body = await request.json().catch(() => ({}));
    const fields = fieldsOf(body);
    const verdict = await checkSignupEmail(emailIn(fields), env.SIMPLEVERIFIER_KEY, 30000);

    if (verdict.decision === "block") {
      console.log("dropped submission", verdict.reasonCode);
      return new Response("ok"); // answer 200 so the form tool doesn't retry
    }
    await fetch(env.FORWARD_TO_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ ...fields, email_check: verdict.decision, email_reason: verdict.reasonCode }),
    });
    return new Response("ok");
  },
};

npx wrangler secret put SIMPLEVERIFIER_KEY
npx wrangler secret put FORM_WEBHOOK_TOKEN   # any long random string
npx wrangler secret put FORWARD_TO_URL       # e.g. your Zapier catch hook or CRM webhook
npx wrangler deploy