app.ts

1import type { Database } from "bun:sqlite";2import { join } from "node:path";3import { Hono } from "hono";4import { bodyLimit } from "hono/body-limit";5import { secureHeaders } from "hono/secure-headers";6import { registerStatus } from "../admin/console.ts";7import { registerIssues } from "../admin/issues.ts";8import { registerReleases } from "../admin/releases.ts";9import { registerRepos } from "../admin/repos.ts";10import { registerSite } from "../admin/site.ts";11import { openBucket } from "../bucket/reader.ts";12import { isSafePath } from "../bucket/repo.ts";13import { registerIssuePages } from "../issues/pages.ts";14import { registerArchivesPage } from "../pages/archives.ts";15import { registerDocsPages } from "../pages/docs.ts";16import { registerFileRoutes } from "../pages/files.ts";17import { registerFrontPages } from "../pages/front.ts";18import { registerHousekeeping } from "../pages/housekeeping.ts";19import { registerKepr2Routes } from "../pages/kepr2.ts";20import { registerProfilePage } from "../pages/profile.ts";21import { registerReleasesPage } from "../pages/releases.ts";22import { registerRepoPage } from "../pages/repo.ts";23import { registerSavePage } from "../pages/save.ts";24import { registerReleaseRoutes } from "../releases/routes.ts";25import { registerTarballRoutes } from "../tarball/archive.ts";26import type { Config } from "./config.ts";27import { connectKeys, noCode, registerConnect } from "./connect.ts";28import { registerLogin } from "./login.ts";2930const MAX_BODY_BYTES = 64 * 1024;31const PUBLIC_DIR = join(import.meta.dir, "../../public");32// §18 allows Bunny Fonts: its stylesheet and the font files it points at.33const FONTS = "https://fonts.bunny.net";3435/** The Hono app with §25's headers and body cap, and every route built so far. */36export function createApp(config: Config, kepr: Database): Hono {37	const app = new Hono();38	// §25 allows images from the presigned host, which is the bucket endpoint's origin.39	const imgSrc =40		config.bucket.kind === "s3" ? ["'self'", new URL(config.bucket.endpoint).origin] : ["'self'"];41	app.use("*", async (c, next) => {42		await next();43		const path = c.req.path;44		if (/^\/[^/]+\/raw\/.+/.test(path) || path.startsWith("/static/assets/")) {45			const policy = c.res.headers.get("Content-Security-Policy");46			c.header("Content-Security-Policy", policy ? `${policy}; sandbox` : "sandbox");47		}48	});49	app.use(50		secureHeaders({51			contentSecurityPolicy: {52				defaultSrc: ["'self'"],53				scriptSrc: ["'self'"],54				styleSrc: ["'self'", FONTS],55				fontSrc: [FONTS],56				imgSrc,57				objectSrc: ["'none'"],58				baseUri: ["'none'"],59				formAction: ["'self'"],60				frameAncestors: ["'none'"],61			},62			xFrameOptions: "DENY",63		}),64	);65	app.use(66		bodyLimit({67			maxSize: MAX_BODY_BYTES,68			onError: (c) =>69				// An oversized redemption is one more failed redemption, not a different answer.70				c.req.path === "/api/connect" ? noCode(c) : c.text("Request body too large", 413),71		}),72	);73	// `/static/assets/` is the operator's uploads in `data/assets/` (§19), such as the signature.74	const assetsDir = join(config.dataDir, "assets");75	app.get("/static/:path{.+}", async (c) => {76		const path = c.req.param("path");77		if (!isSafePath(path)) return c.notFound();78		const file = Bun.file(79			path.startsWith("assets/") ? join(assetsDir, path.slice(7)) : join(PUBLIC_DIR, path),80		);81		if (!(await file.exists())) return c.notFound();82		c.header("Cache-Control", "public, max-age=3600");83		return c.body(await file.bytes(), 200, { "Content-Type": file.type });84	});85	const ctx = { domain: config.domain, kepr, mirrorDir: join(config.dataDir, "mirror") };86	const bucket = openBucket(config.bucket);87	registerLogin(app, ctx, config.adminPasswordHash);88	registerConnect(app, config, ctx);89	const admin = {90		...ctx,91		canConnect: connectKeys(config) !== null,92		dataDir: config.dataDir,93		sync: { bucket, kepr, mirrorDir: ctx.mirrorDir, tarballDir: join(config.dataDir, "tarballs") },94	};95	registerStatus(app, admin);96	registerRepos(app, admin);97	registerIssues(app, admin);98	registerReleases(app, admin);99	registerSite(app, admin);100	registerHousekeeping(app, ctx);101	registerFrontPages(app, ctx);102	registerDocsPages(app, ctx);103	registerProfilePage(app, ctx);104	registerKepr2Routes(app, ctx);105	registerRepoPage(app, ctx);106	registerFileRoutes(app, ctx);107	registerSavePage(app, ctx);108	registerArchivesPage(app, ctx);109	registerReleasesPage(app, ctx);110	registerIssuePages(app, ctx);111	registerTarballRoutes(app, ctx, join(config.dataDir, "tarballs"));112	registerReleaseRoutes(app, ctx, bucket);113	return app;114}