import { Hono } from "hono";
import { bodyLimit } from "hono/body-limit";
import { secureHeaders } from "hono/secure-headers";
import type { Config } from "./config.ts";

const MAX_BODY_BYTES = 64 * 1024;

/** The Hono app with §25's headers and body cap; routes join it phase by phase. */
export function createApp(config: Config): Hono {
	const app = new Hono();
	// §25 allows images from the presigned host, which is the bucket endpoint's origin.
	const imgSrc =
		config.bucket.kind === "s3" ? ["'self'", new URL(config.bucket.endpoint).origin] : ["'self'"];
	app.use(
		secureHeaders({
			contentSecurityPolicy: {
				defaultSrc: ["'self'"],
				scriptSrc: ["'self'"],
				imgSrc,
				objectSrc: ["'none'"],
				baseUri: ["'none'"],
				formAction: ["'self'"],
				frameAncestors: ["'none'"],
			},
			xFrameOptions: "DENY",
		}),
	);
	app.use(
		bodyLimit({ maxSize: MAX_BODY_BYTES, onError: (c) => c.text("Request body too large", 413) }),
	);
	return app;
}