app.ts

969 B · raw
1import { Hono } from "hono";2import { bodyLimit } from "hono/body-limit";3import { secureHeaders } from "hono/secure-headers";4import type { Config } from "./config.ts";56const MAX_BODY_BYTES = 64 * 1024;78/** The Hono app with §25's headers and body cap; routes join it phase by phase. */9export function createApp(config: Config): Hono {10	const app = new Hono();11	// §25 allows images from the presigned host, which is the bucket endpoint's origin.12	const imgSrc =13		config.bucket.kind === "s3" ? ["'self'", new URL(config.bucket.endpoint).origin] : ["'self'"];14	app.use(15		secureHeaders({16			contentSecurityPolicy: {17				defaultSrc: ["'self'"],18				scriptSrc: ["'self'"],19				imgSrc,20				objectSrc: ["'none'"],21				baseUri: ["'none'"],22				formAction: ["'self'"],23				frameAncestors: ["'none'"],24			},25			xFrameOptions: "DENY",26		}),27	);28	app.use(29		bodyLimit({ maxSize: MAX_BODY_BYTES, onError: (c) => c.text("Request body too large", 413) }),30	);31	return app;32}