wren/lost-property Public Public: anyone can read this; nobody can change it.

/**

 * lost-property — a museum of lost things, as a small HTTP server.

 *

 * Data lives in SQLite under FORGE_APP_DATA (src/db.ts). The catalogue

 * number, vitrine and condition on a plaque are derived deterministically

 * from an item's id and description (src/museum.ts) — no AI, no lookup,

 * just pattern matching, so the same object always reads the same way.

 */

import { join } from "node:path";

import { addNote, createItem, getItem, listItems, listNotes } from "./db.ts";

import { renderCase, renderHome } from "./pages.ts";

import { traceServe } from "./otel.ts";

const env = process.env.FORGE_APP_ENV ?? "local";

const pull = process.env.FORGE_APP_PULL;

const commit = (process.env.FORGE_APP_COMMIT ?? "").slice(0, 7);

const envLabel = env === "preview" ? `preview of pull #${pull ?? "?"}` : env;

// The security floor every response stands on. Scripts and styles come from

// this origin (inline styles allowed, inline scripts not), nothing frames us,

// browsers never guess a content type, and referrers stay on this site.

// The app's public address is what the forge told us, never the socket's.

const publicOrigin = new URL(process.env.FORGE_APP_URL ?? "http://localhost").origin;

const SECURITY = {

  "content-security-policy":

    "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'self'",

  "x-content-type-options": "nosniff",

  "referrer-policy": "strict-origin-when-cross-origin",

  "permissions-policy": "camera=(), microphone=(), geolocation=()",

  // Once served over https, always: browsers remember for a year.

  ...(publicOrigin.startsWith("https:")

    ? { "strict-transport-security": "max-age=31536000" }

    : {}),

};

const html = (body: string, status = 200): Response =>

  new Response(body, { status, headers: { "content-type": "text/html; charset=utf-8", ...SECURITY } });

const text = (body: string, status: number): Response => new Response(body, { status, headers: SECURITY });

const asGet = (full: Response, method: string): Response =>

  method === "HEAD" ? new Response(null, { status: full.status, headers: full.headers }) : full;

// A browser on another site can make a person's browser POST here; it cannot

// make that request look same-origin. Browsers say where a request came from

// (Sec-Fetch-Site, or Origin); a request that names another site is refused.

const sameOrigin = (request: Request): boolean => {

  const site = request.headers.get("sec-fetch-site");

  if (site !== null) return site === "same-origin" || site === "none";

  const origin = request.headers.get("origin");

  return origin === null || origin === publicOrigin;

};

// A request body is read up to a cap and no further, counting the bytes as

// they arrive. A declared Content-Length is a claim: a chunked request has

// none, and a lie is free. Undefined means "too large" — refuse it. Past the

// cap the rest is drained and dropped so the connection stays usable for

// the next request; past eight times the cap it is cut off instead.

const BODY_MAX = 64 * 1024;

async function readBody(request: Request, max = BODY_MAX): Promise<Uint8Array | undefined> {

  const reader = request.body?.getReader();

  if (reader === undefined) return new Uint8Array();

  const parts: Uint8Array[] = [];

  let size = 0;

  for (;;) {

    const { done, value } = await reader.read();

    if (done) break;

    size += value.byteLength;

    if (size > max) {

      for (;;) {

        const next = await reader.read();

        if (next.done) return undefined;

        size += next.value.byteLength;

        if (size > max * 8) {

          await reader.cancel();

          return undefined;

        }

      }

    }

    parts.push(value);

  }

  const body = new Uint8Array(size);

  let at = 0;

  for (const part of parts) {

    body.set(part, at);

    at += part.byteLength;

  }

  return body;

}

// The form fields of a capped body, decoded the way the browser sent them

// (a plain form or a multipart one), by handing the bytes back to a Request.

async function readForm(request: Request): Promise<FormData | undefined> {

  const body = await readBody(request);

  if (body === undefined) return undefined;

  return new Request(request.url, {

    method: "POST",

    headers: { "content-type": request.headers.get("content-type") ?? "" },

    body,

  }).formData();

}

const ITEM_PATH = /^\/items\/(\d+)$/;

const NOTES_PATH = /^\/items\/(\d+)\/notes$/;

export const server = Bun.serve(traceServe({

  port: Number(process.env.PORT ?? 8080),

  hostname: process.env.HOST ?? "127.0.0.1",

  async fetch(request) {

    const url = new URL(request.url);

    const method = request.method;

    if (method === "POST" && !sameOrigin(request)) return text("forbidden", 403);

    if (method === "POST" && url.pathname === "/items") {

      const form = await readForm(request);

      if (form === undefined) return text("too large", 413);

      const description = String(form.get("description") ?? "").trim().slice(0, 500);

      if (!description) return Response.redirect("/", 303);

      const id = createItem(description);

      return Response.redirect(`/items/${id}`, 303);

    }

    const notesMatch = url.pathname.match(NOTES_PATH);

    if (method === "POST" && notesMatch) {

      const item = getItem(Number(notesMatch[1]));

      if (item === undefined) return text("not found", 404);

      const form = await readForm(request);

      if (form === undefined) return text("too large", 413);

      const kind = String(form.get("kind") ?? "");

      const body = String(form.get("body") ?? "").trim().slice(0, 500);

      if ((kind !== "sighting" && kind !== "match") || !body) return text("bad request", 400);

      addNote(item.id, kind, body);

      return Response.redirect(`/items/${item.id}`, 303);

    }

    // HEAD is GET without the body: a health check sees the app up.

    if (url.pathname === "/" && (method === "GET" || method === "HEAD"))

      return asGet(html(renderHome(listItems(), envLabel, commit)), method);

    const itemMatch = url.pathname.match(ITEM_PATH);

    if (itemMatch && (method === "GET" || method === "HEAD")) {

      const item = getItem(Number(itemMatch[1]));

      if (item === undefined) return text("not found", 404);

      return asGet(html(renderCase(item, listNotes(item.id), envLabel, commit)), method);

    }

    // Files under ./static are served as they are, cached for a year: name

    // them by content (app.3f2a9c.js) and a change is a new name, never a

    // stale cache. The path is confined to the directory.

    if (url.pathname.startsWith("/static/") && !url.pathname.includes("..")) {

      const file = Bun.file(join(import.meta.dir, "..", url.pathname.slice(1)));

      if (await file.exists())

        return new Response(file, {

          headers: { "cache-control": "public, max-age=31536000, immutable", ...SECURITY },

        });

    }

    return text("not found", 404);

  },

  // A bug answers with the floor and nothing else: never the runtime's own

  // error page, which carries source and paths, and never without the

  // headers. The detail goes to the log, where it belongs.

  error(error) {

    console.error(error);

    return html("<h1>Something went wrong</h1>", 500);

  },

}));

console.log(`lost-property listening on http://${server.hostname}:${server.port} (${env})`);