app.ts

1.9 KB · raw
1import type { Database } from "bun:sqlite";2import { join } from "node:path";3import { Hono } from "hono";4import { bodyLimit } from "hono/body-limit";5import { secureHeaders } from "hono/secure-headers";6import { isSafePath } from "../bucket/repo.ts";7import { registerFileRoutes } from "../pages/files.ts";8import { registerRepoPage } from "../pages/repo.ts";9import type { Config } from "./config.ts";1011const MAX_BODY_BYTES = 64 * 1024;12const PUBLIC_DIR = join(import.meta.dir, "../../public");13// §18 allows Bunny Fonts: its stylesheet and the font files it points at.14const FONTS = "https://fonts.bunny.net";1516/** The Hono app with §25's headers and body cap, and every route built so far. */17export function createApp(config: Config, kepr: Database): Hono {18	const app = new Hono();19	// §25 allows images from the presigned host, which is the bucket endpoint's origin.20	const imgSrc =21		config.bucket.kind === "s3" ? ["'self'", new URL(config.bucket.endpoint).origin] : ["'self'"];22	app.use(23		secureHeaders({24			contentSecurityPolicy: {25				defaultSrc: ["'self'"],26				scriptSrc: ["'self'"],27				styleSrc: ["'self'", FONTS],28				fontSrc: [FONTS],29				imgSrc,30				objectSrc: ["'none'"],31				baseUri: ["'none'"],32				formAction: ["'self'"],33				frameAncestors: ["'none'"],34			},35			xFrameOptions: "DENY",36		}),37	);38	app.use(39		bodyLimit({ maxSize: MAX_BODY_BYTES, onError: (c) => c.text("Request body too large", 413) }),40	);41	app.get("/static/:path{.+}", async (c) => {42		const path = c.req.param("path");43		const file = Bun.file(join(PUBLIC_DIR, path));44		if (!isSafePath(path) || !(await file.exists())) return c.notFound();45		c.header("Cache-Control", "public, max-age=3600");46		return c.body(await file.bytes(), 200, { "Content-Type": file.type });47	});48	const ctx = { domain: config.domain, kepr, mirrorDir: join(config.dataDir, "mirror") };49	registerRepoPage(app, ctx);50	registerFileRoutes(app, ctx);51	return app;52}