benjivers/notes Public Public: anyone can read this; nobody can change it.

/**

 * The floor every response stands on, and the few things a route needs to

 * read a request safely. Nothing in here knows what a note is; who may

 * come in at all is `security.ts`.

 */

import { createHash } from "node:crypto";

import { existsSync, readFileSync } from "node:fs";

import { join } from "node:path";

import { env, publicOrigin } from "./env.ts";

// Scripts and styles come from this origin (inline styles allowed, inline

// scripts not), nothing frames us, browsers never guess a content type, and

// referrers stay on this site. Once served over https, always: browsers

// remember for a year. Anything but production asks not to be indexed: a

// preview is a draft, and its address goes away with its pull.

export const SECURITY: Record<string, string> = {

  "content-security-policy":

    "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'self'",

  "x-content-type-options": "nosniff",

  "referrer-policy": "strict-origin-when-cross-origin",

  "permissions-policy": "camera=(), microphone=(), geolocation=()",

  ...(publicOrigin.startsWith("https:")

    ? { "strict-transport-security": "max-age=31536000" }

    : {}),

  ...(env === "production" ? {} : { "x-robots-tag": "noindex" }),

};

export const escape = (s: string): string =>

  s.replace(

    /[&<>"']/g,

    (c) =>

      ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[

        c

      ] ?? c,

  );

export const html = (

  body: string,

  status = 200,

  headers: Record<string, string> = {},

): Response =>

  new Response(body, {

    status,

    headers: {

      "content-type": "text/html; charset=utf-8",

      ...SECURITY,

      ...headers,

    },

  });

export const json = (data: unknown, status = 200): Response =>

  new Response(JSON.stringify(data), {

    status,

    headers: { "content-type": "application/json; charset=utf-8", ...SECURITY },

  });

export const text = (body: string, status = 200): Response =>

  new Response(body, {

    status,

    headers: { "content-type": "text/plain; charset=utf-8", ...SECURITY },

  });

/** Back to the page, with a word for it to show once (`readNotice`). */

export const back = (notice?: string): Response =>

  new Response(null, {

    status: 303,

    headers: {

      location: "/",

      ...SECURITY,

      ...(notice === undefined

        ? {}

        : { "set-cookie": cookie("notice", encodeURIComponent(notice), 30) }),

    },

  });

/** To one of the app's own pages, with a word for it to show once. Only a path on this site: never an address a request supplied. */

export const go = (path: string, notice?: string): Response =>

  new Response(null, {

    status: 303,

    headers: {

      location: path.startsWith("/") && !path.startsWith("//") ? path : "/",

      ...SECURITY,

      ...(notice === undefined

        ? {}

        : { "set-cookie": cookie("notice", encodeURIComponent(notice), 30) }),

    },

  });

/** The notice a redirect left, and the header that clears it. */

export function readNotice(request: Request): {

  notice?: string;

  clear: Record<string, string>;

} {

  const raw = /(?:^|;\s*)notice=([^;]*)/.exec(

    request.headers.get("cookie") ?? "",

  )?.[1];

  if (raw === undefined) return { clear: {} };

  return {

    notice: decodeURIComponent(raw),

    clear: { "set-cookie": cookie("notice", "", 0) },

  };

}

// Every cookie the app sets itself is HttpOnly and SameSite=Lax, and Secure

// wherever the public address is https.

const cookie = (name: string, value: string, maxAge: number): string =>

  `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${publicOrigin.startsWith("https:") ? "; Secure" : ""}`;

// A request body is read up to a cap and no further, counting the bytes as

// they arrive. A declared Content-Length is a claim: a chunked request has

// none, and a lie is free. Undefined means "too large" — refuse it. Past the

// cap the rest is drained and dropped so the connection stays usable for

// the next request; past eight times the cap it is cut off instead.

export const BODY_MAX = 64 * 1024;

/** What a whole note may weigh on the wire: 200,000 characters, any script. */

export const NOTE_BYTES = 1024 * 1024;

export async function readBody(

  request: Request,

  max = BODY_MAX,

): Promise<Uint8Array | undefined> {

  const reader = request.body?.getReader();

  if (reader === undefined) return new Uint8Array();

  const parts: Uint8Array[] = [];

  let size = 0;

  for (;;) {

    const { done, value } = await reader.read();

    if (done) break;

    size += value.byteLength;

    if (size > max) {

      for (;;) {

        const next = await reader.read();

        if (next.done) return undefined;

        size += next.value.byteLength;

        if (size > max * 8) {

          await reader.cancel();

          return undefined;

        }

      }

    }

    parts.push(value);

  }

  const body = new Uint8Array(size);

  let at = 0;

  for (const part of parts) {

    body.set(part, at);

    at += part.byteLength;

  }

  return body;

}

/** The form fields of a capped body, decoded the way the browser sent them. */

export async function readForm(request: Request, max = BODY_MAX) {

  const body = await readBody(request, max);

  if (body === undefined) return undefined;

  return new Request(request.url, {

    method: "POST",

    headers: { "content-type": request.headers.get("content-type") ?? "" },

    body: new Uint8Array(body),

  }).formData();

}

/** The JSON of a capped body: `undefined` when too large, `null` when not JSON. */

export async function readJson(

  request: Request,

  max = BODY_MAX,

): Promise<unknown> {

  const body = await readBody(request, max);

  if (body === undefined) return undefined;

  try {

    return JSON.parse(new TextDecoder().decode(body));

  } catch {

    return null;

  }

}

/** A JSON object's fields, whatever the wire carried. */

export const fields = (value: unknown): Record<string, unknown> =>

  typeof value === "object" && value !== null && !Array.isArray(value)

    ? (value as Record<string, unknown>)

    : {};

// Files under ./static are served as they are. A page links each one by

// its content (`/static/app.css?v=3f2a9c1e`), and that address is cached

// for a year: a change is a new address, never a stale cache.

const STATIC = join(import.meta.dir, "..", "static");

const versions = new Map<string, string>();

export function asset(name: string): string {

  let v = versions.get(name);

  if (v === undefined) {

    v = createHash("sha256")

      .update(readFileSync(join(STATIC, name)))

      .digest("hex")

      .slice(0, 8);

    versions.set(name, v);

  }

  return `/static/${name}?v=${v}`;

}

export function staticFile(name: string, versioned: boolean): Response {

  const path = join(STATIC, name);

  if (name.includes("/") || name.includes("..") || !existsSync(path))

    return text("not found", 404);

  return new Response(Bun.file(path), {

    headers: {

      "cache-control": versioned

        ? "public, max-age=31536000, immutable"

        : "no-cache",

      ...SECURITY,

    },

  });

}