Analyze the whole code throughly and Make it to do it's job perfectly, effectively, efficiently and make sure it doesn't it's job as a proxy service in cloudflare worker's environment to bypass all of the CORS policy restrictions for all of the requests and responses of allowed domains correctly without any issue and let all types of requests and responses pass through the proxy without getting any CORS error for the allowed domains. Strengthen it more to Make it practically impossible for the allowed domain users to get any type of CORS policy restriction error in any possible situation and circumstances. Send the fully working full codes. -- // Default Configuration
const DEFAULT_CONFIG = {
  ALLOWED_ORIGINS: new Set([
    'https://api.abhibhai.com',
    'https://lnee.netlify.app',
    'https://proxe.netlify.app',
    'http://localhost:8080',
  ]),
  ALLOWED_TARGET_DOMAINS: new Set(['*']),
  BLOCKED_TARGET_HOSTS: new Set(['blocked.example.com']),
  FORWARD_HEADERS: new Set([
    'accept',
    'accept-language',
    'user-agent',
    'content-type',
    'authorization',
    'cache-control',
    'pragma',
    'expires',
    'last-modified',
    'if-modified-since',
    'if-none-match',
    'range',
    'content-range',
    'accept-encoding',
    'accept-datetime',
    'cookie',
  ]),
  REMOVE_HEADERS: new Set([
    'cf-connecting-ip', 'x-forwarded-for', 'x-real-ip', 'forwarded', 'via',
    'proxy-authorization', 'proxy-authenticate', 'client-ip', 'true-client-ip',
    'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-forwarded-protocol',
    'x-forwarded-ssl', 'x-url-scheme', 'x-original-forwarded-for', 'x-http-forwarded-for',
    'x-original-host', 'x-forwarded-by', 'x-proxy-user-ip', 'x-cluster-client-ip',
    'x-forwarded', 'x-real-ip', 'forwarded-for', 'forwarded-proto',
  ]),
  TIMEOUT: 29000, // milliseconds
  AUTH_KEY: 'your-secure-auth-key', // Replace with your actual auth key
  SECURITY_HEADERS: {
    'X-Content-Type-Options': 'nosniff',
    'Referrer-Policy': 'no-referrer',
    'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
    'X-Frame-Options': 'DENY',
  },
  CUSTOM_ERROR_RESPONSES: {}, // e.g., { 404: { error: 'Not Found' } }
  CACHE_CONTROL: {
    DEFAULT_MAX_AGE: 300, // seconds
    CUSTOM_RULES: {}, // e.g., { '/path': 'public, max-age=600' }
  },
};

// Clone and normalize default configuration
let CONFIG = {
  ...DEFAULT_CONFIG,
  ALLOWED_ORIGINS: new Set([...DEFAULT_CONFIG.ALLOWED_ORIGINS].map(origin => origin.toLowerCase())),
  ALLOWED_TARGET_DOMAINS: new Set([...DEFAULT_CONFIG.ALLOWED_TARGET_DOMAINS].map(domain => domain.toLowerCase())),
  BLOCKED_TARGET_HOSTS: new Set([...DEFAULT_CONFIG.BLOCKED_TARGET_HOSTS].map(host => host.toLowerCase())),
  FORWARD_HEADERS: new Set([...DEFAULT_CONFIG.FORWARD_HEADERS].map(header => header.toLowerCase())),
  REMOVE_HEADERS: new Set([...DEFAULT_CONFIG.REMOVE_HEADERS].map(header => header.toLowerCase())),
};

// Custom Error Class for Proxy-Specific Errors
class ProxyError extends Error {
  constructor(message, status) {
    super(message);
    this.name = 'ProxyError';
    this.status = status;
  }
}

// Fetch Event Listener
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event).catch(error => handleError(error, event.request)));
});

// Main Request Handler
async function handleRequest(event) {
  const request = event.request;
  const url = new URL(request.url);

  // Preflight CORS Check
  if (request.method === 'OPTIONS') {
    return handlePreflight(request);
  }

  // Configuration Update Endpoint
  if (request.method === 'POST' && url.pathname === '/config') {
    return handleConfigUpdate(request);
  }

  // Validate Origin
  const origin = request.headers.get('Origin');
  if (origin && !isAllowedOrigin(origin)) {
    throw new ProxyError('Forbidden: Origin not allowed', 403);
  }

  // Forward the Request
  return forwardRequest(request, origin);
}

// Check if Origin is Allowed
function isAllowedOrigin(origin) {
  const normalized = origin.toLowerCase();
  return CONFIG.ALLOWED_ORIGINS.has(normalized) || CONFIG.ALLOWED_ORIGINS.has('*');
}

// Forward Incoming Request to Target
async function forwardRequest(request, origin) {
  const targetUrl = request.headers.get('x-target-url') || new URL(request.url).searchParams.get('target');
  if (!targetUrl) throw new ProxyError('Bad Request: Missing target URL', 400);

  let parsedTarget;
  try {
    parsedTarget = new URL(targetUrl);
  } catch {
    throw new ProxyError('Invalid target URL', 400);
  }

  const targetHost = parsedTarget.host.toLowerCase();
  if (CONFIG.BLOCKED_TARGET_HOSTS.has(targetHost)) throw new ProxyError('Forbidden: Target host is blocked', 403);
  if (!isTargetAllowed(parsedTarget.hostname.toLowerCase())) throw new ProxyError('Forbidden: Target domain not allowed', 403);

  // Prepare Forwarded Headers
  const forwardedHeaders = filterHeaders(request.headers, CONFIG.FORWARD_HEADERS, CONFIG.REMOVE_HEADERS);
  forwardedHeaders.set('Host', parsedTarget.host);

  // Handle Request Body
  const options = {
    method: request.method,
    headers: forwardedHeaders,
    redirect: 'follow',
    signal: AbortSignal.timeout(CONFIG.TIMEOUT),
  };
  if (!['GET', 'HEAD'].includes(request.method)) {
    options.body = await request.arrayBuffer();
  }

  // Fetch Response
  let response;
  try {
    response = await fetch(parsedTarget.toString(), options);
  } catch (err) {
    if (err.name === 'AbortError') throw new ProxyError('Request Timed Out', 504);
    throw new ProxyError('Error Fetching Target URL', 502);
  }

  // Modify and Return Response
  return modifyResponse(response, request);
}

// Check if Target Domain is Allowed
function isTargetAllowed(domain) {
  return CONFIG.ALLOWED_TARGET_DOMAINS.has('*') || CONFIG.ALLOWED_TARGET_DOMAINS.has(domain);
}

// Filter Headers: Forward allowed headers and remove disallowed ones
function filterHeaders(headers, allowed, removed) {
  const result = new Headers();
  for (const [key, value] of headers.entries()) {
    const lowerKey = key.toLowerCase();
    if (allowed.has(lowerKey) && !removed.has(lowerKey)) {
      result.set(key, value);
    }
  }
  return result;
}

// Handle Preflight CORS Requests
function handlePreflight(request) {
  const headers = generateCorsHeaders(request);
  return new Response(null, { status: 204, headers });
}

// Generate CORS Headers
function generateCorsHeaders(request) {
  const origin = request.headers.get('Origin');
  const headers = new Headers();

  if (origin && isAllowedOrigin(origin)) {
    headers.set('Access-Control-Allow-Origin', origin);
    headers.set('Access-Control-Allow-Credentials', 'true');
    const reqHeaders = request.headers.get('Access-Control-Request-Headers');
    headers.set('Access-Control-Allow-Headers', reqHeaders || Array.from(CONFIG.FORWARD_HEADERS).join(', '));
    headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
    headers.set('Access-Control-Expose-Headers', Array.from(CONFIG.FORWARD_HEADERS).join(', '));
    headers.set('Access-Control-Max-Age', '86400'); // 1 day
    headers.append('Vary', 'Origin');
  }

  return headers;
}

// Modify Response: Add CORS and Security Headers, Manage Cache
async function modifyResponse(response, request) {
  const corsHeaders = generateCorsHeaders(request);
  const resHeaders = new Headers(response.headers);

  // Remove Disallowed Headers
  CONFIG.REMOVE_HEADERS.forEach(header => resHeaders.delete(header));

  // Add CORS Headers
  if (request.headers.get('Origin')) {
    corsHeaders.forEach((value, key) => resHeaders.set(key, value));
  }

  // Add Security Headers
  Object.entries(CONFIG.SECURITY_HEADERS).forEach(([key, value]) => resHeaders.set(key, value));

  // Apply Cache Control
  const cacheControl = CONFIG.CACHE_CONTROL.CUSTOM_RULES[new URL(response.url).pathname] || `public, max-age=${CONFIG.CACHE_CONTROL.DEFAULT_MAX_AGE}`;
  resHeaders.set('Cache-Control', cacheControl);

  return new Response(response.body, {
    status: response.status,
    statusText: response.statusText,
    headers: resHeaders,
  });
}

// Handle Errors and Generate Responses
async function handleError(error, request) {
  console.error('Error:', error);
  const status = error instanceof ProxyError ? error.status : 500;
  const message = error.message || 'Internal Server Error';

  const corsHeaders = generateCorsHeaders(request);
  const headers = new Headers({
    'Content-Type': 'application/json',
    ...CONFIG.SECURITY_HEADERS,
  });

  if (request.headers.get('Origin')) {
    corsHeaders.forEach((value, key) => headers.set(key, value));
  }

  const customResponse = CONFIG.CUSTOM_ERROR_RESPONSES[status];
  const body = customResponse ? JSON.stringify(customResponse) : JSON.stringify({ error: message });

  return new Response(body, { status, headers });
}

// Handle Configuration Updates via POST /config
async function handleConfigUpdate(request) {
  const authHeader = request.headers.get('Authorization');
  if (!isAuthorized(authHeader)) throw new ProxyError('Unauthorized', 401);

  let updatedConfig;
  try {
    updatedConfig = await request.json();
    validateConfig(updatedConfig);
    applyConfig(updatedConfig);
  } catch (err) {
    if (err instanceof ProxyError) throw err;
    throw new ProxyError('Invalid Configuration Data', 400);
  }

  const responseBody = { message: 'Configuration updated successfully' };
  const headers = new Headers({
    'Content-Type': 'application/json',
    ...CONFIG.SECURITY_HEADERS,
  });

  const origin = request.headers.get('Origin');
  if (origin && isAllowedOrigin(origin)) {
    const corsHeaders = generateCorsHeaders(request);
    corsHeaders.forEach((value, key) => headers.set(key, value));
  }

  return new Response(JSON.stringify(responseBody), { status: 200, headers });
}

// Authorization Check for Configuration Updates
function isAuthorized(authHeader) {
  return authHeader === `Bearer ${CONFIG.AUTH_KEY}`;
}

// Validate Incoming Configuration
function validateConfig(newConfig) {
  const validators = {
    ALLOWED_ORIGINS: validateStringSet,
    ALLOWED_TARGET_DOMAINS: validateStringSet,
    BLOCKED_TARGET_HOSTS: validateStringSet,
    FORWARD_HEADERS: validateStringSet,
    REMOVE_HEADERS: validateStringSet,
    SECURITY_HEADERS: validateKeyValuePairs,
    CACHE_CONTROL: validateCacheControl,
    CUSTOM_ERROR_RESPONSES: validateCustomErrors,
    AUTH_KEY: validateNonEmptyString,
    TIMEOUT: validatePositiveNumber,
  };

  for (const [key, validator] of Object.entries(validators)) {
    if (key in newConfig) {
      validator(key, newConfig[key]);
    }
  }
}

// Validators
function validateStringSet(key, value) {
  if (!Array.isArray(value)) throw new ProxyError(`Invalid ${key} format`, 400);
  value.forEach(item => {
    if (typeof item !== 'string' || !item.trim()) throw new ProxyError(`Invalid entry in ${key}: ${item}`, 400);
    if (key.includes('ORIGIN') || key.includes('DOMAIN') || key.includes('HOST')) {
      if (item !== '*' && isNaN(new URL(item).origin)) throw new ProxyError(`Invalid URL in ${key}: ${item}`, 400);
    }
  });
}

function validateKeyValuePairs(key, value) {
  if (typeof value !== 'object' || Array.isArray(value) || value === null) throw new ProxyError(`Invalid ${key} format`, 400);
  for (const [k, v] of Object.entries(value)) {
    if (typeof k !== 'string' || typeof v !== 'string') throw new ProxyError(`Invalid key-value in ${key}: ${k}: ${v}`, 400);
  }
}

function validateCacheControl(key, value) {
  if (typeof value !== 'object' || Array.isArray(value) || value === null) throw new ProxyError('Invalid CACHE_CONTROL format', 400);
  if ('DEFAULT_MAX_AGE' in value) {
    if (typeof value.DEFAULT_MAX_AGE !== 'number' || value.DEFAULT_MAX_AGE < 0) throw new ProxyError('Invalid DEFAULT_MAX_AGE in CACHE_CONTROL', 400);
  }
  if ('CUSTOM_RULES' in value) {
    if (typeof value.CUSTOM_RULES !== 'object' || Array.isArray(value.CUSTOM_RULES) || value.CUSTOM_RULES === null) throw new ProxyError('Invalid CUSTOM_RULES in CACHE_CONTROL', 400);
  }
}

function validateCustomErrors(key, value) {
  if (typeof value !== 'object' || Array.isArray(value) || value === null) throw new ProxyError('Invalid CUSTOM_ERROR_RESPONSES format', 400);
  for (const [status, body] of Object.entries(value)) {
    const code = parseInt(status, 10);
    if (isNaN(code) || code < 100 || code > 599) throw new ProxyError(`Invalid status code in CUSTOM_ERROR_RESPONSES: ${status}`, 400);
    if (typeof body !== 'object' || body === null) throw new ProxyError(`Invalid body for status ${status} in CUSTOM_ERROR_RESPONSES`, 400);
  }
}

function validateNonEmptyString(key, value) {
  if (typeof value !== 'string' || !value.trim()) throw new ProxyError(`Invalid ${key} format`, 400);
}

function validatePositiveNumber(key, value) {
  if (typeof value !== 'number' || value <= 0 || !Number.isFinite(value)) throw new ProxyError(`Invalid ${key} value`, 400);
}

// Apply Updated Configuration
function applyConfig(newConfig) {
  for (const [key, value] of Object.entries(newConfig)) {
    if (key in CONFIG) {
      if (['ALLOWED_ORIGINS', 'ALLOWED_TARGET_DOMAINS', 'BLOCKED_TARGET_HOSTS', 'FORWARD_HEADERS', 'REMOVE_HEADERS'].includes(key)) {
        CONFIG[key] = new Set(value.map(item => item.toLowerCase()));
      } else if (typeof value === 'object' && !Array.isArray(value)) {
        CONFIG[key] = { ...CONFIG[key], ...value };
      } else {
        CONFIG[key] = value;
      }
    }
  }

  // Enforce Timeout Limit (Cloudflare max 30 seconds)
  if ('TIMEOUT' in newConfig) {
    CONFIG.TIMEOUT = Math.min(CONFIG.TIMEOUT, 30000);
  }
}