@chidchanun/bcp 0.1.0

package/packages/server/src/standalone-production-server.ts

@@ -0,0 +1,6 @@
+export {
+    createStandaloneProductionServer,
+    type StandaloneApiRoute,
+    type StandalonePageRoute,
+    type StandaloneProductionServerOptions,
+} from "./standalone-production-runtime-v5.js";

package/packages/server/src/static-assets.ts

@@ -0,0 +1,262 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+export interface StaticAsset {
+    filePath: string;
+
+    content: Buffer;
+
+    contentType: string;
+
+    etag: string;
+
+    lastModified: string;
+}
+
+/**
+ * Read a file from the application's `public/` directory.
+ *
+ * The resolver intentionally works from the filesystem root
+ * instead of trusting the URL path. It also resolves symlinks
+ * and verifies that the final file remains inside `public/`.
+ */
+export async function readPublicAsset(
+    rootDirectory: string,
+    pathname: string
+): Promise<StaticAsset | null> {
+    if (
+        !pathname.startsWith("/") ||
+        pathname === "/" ||
+        pathname.startsWith("/_bcp/") ||
+        pathname === "/_bcp"
+    ) {
+        return null;
+    }
+
+    let decodedPath: string;
+
+    try {
+        decodedPath =
+            decodeURIComponent(pathname);
+    } catch {
+        return null;
+    }
+
+    if (
+        decodedPath.includes("\0")
+    ) {
+        return null;
+    }
+
+    const publicDirectory =
+        path.resolve(
+            rootDirectory,
+            "public"
+        );
+
+    const relativePath =
+        decodedPath
+            .replace(/^\/+/, "")
+            .replaceAll("/", path.sep);
+
+    if (!relativePath) {
+        return null;
+    }
+
+    const candidatePath =
+        path.resolve(
+            publicDirectory,
+            relativePath
+        );
+
+    if (
+        !isPathInside(
+            publicDirectory,
+            candidatePath
+        )
+    ) {
+        return null;
+    }
+
+    let realPublicDirectory: string;
+
+    try {
+        realPublicDirectory =
+            await fs.realpath(
+                publicDirectory
+            );
+    } catch {
+        return null;
+    }
+
+    let realFilePath: string;
+
+    try {
+        realFilePath =
+            await fs.realpath(
+                candidatePath
+            );
+    } catch {
+        return null;
+    }
+
+    if (
+        !isPathInside(
+            realPublicDirectory,
+            realFilePath
+        )
+    ) {
+        return null;
+    }
+
+    let stat: Awaited<
+        ReturnType<typeof fs.stat>
+    >;
+
+    try {
+        stat =
+            await fs.stat(
+                realFilePath
+            );
+    } catch {
+        return null;
+    }
+
+    if (!stat.isFile()) {
+        return null;
+    }
+
+    const content =
+        await fs.readFile(
+            realFilePath
+        );
+
+    const etag =
+        crypto
+            .createHash("sha1")
+            .update(content)
+            .digest("hex");
+
+    return {
+        filePath: realFilePath,
+
+        content,
+
+        contentType:
+            getContentType(
+                realFilePath
+            ),
+
+        etag: `"${etag}"`,
+
+        lastModified:
+            stat.mtime.toUTCString(),
+    };
+}
+
+export function getContentType(
+    filePath: string
+): string {
+    const extension =
+        path.extname(
+            filePath
+        ).toLowerCase();
+
+    const contentTypes: Record<
+        string,
+        string
+    > = {
+        ".html":
+            "text/html; charset=utf-8",
+
+        ".htm":
+            "text/html; charset=utf-8",
+
+        ".css":
+            "text/css; charset=utf-8",
+
+        ".js":
+            "text/javascript; charset=utf-8",
+
+        ".mjs":
+            "text/javascript; charset=utf-8",
+
+        ".json":
+            "application/json; charset=utf-8",
+
+        ".txt":
+            "text/plain; charset=utf-8",
+
+        ".xml":
+            "application/xml; charset=utf-8",
+
+        ".csv":
+            "text/csv; charset=utf-8",
+
+        ".svg":
+            "image/svg+xml",
+
+        ".ico":
+            "image/x-icon",
+
+        ".png":
+            "image/png",
+
+        ".jpg":
+            "image/jpeg",
+
+        ".jpeg":
+            "image/jpeg",
+
+        ".gif":
+            "image/gif",
+
+        ".webp":
+            "image/webp",
+
+        ".avif":
+            "image/avif",
+
+        ".bmp":
+            "image/bmp",
+
+        ".wasm":
+            "application/wasm",
+
+        ".pdf":
+            "application/pdf",
+
+        ".webmanifest":
+            "application/manifest+json",
+    };
+
+    return (
+        contentTypes[extension] ??
+        "application/octet-stream"
+    );
+}
+
+function isPathInside(
+    parent: string,
+    child: string
+): boolean {
+    const relative =
+        path.relative(
+            parent,
+            child
+        );
+
+    return (
+        relative === "" ||
+        (
+            relative !== ".." &&
+            !relative.startsWith(
+                `..${path.sep}`
+            ) &&
+            !path.isAbsolute(
+                relative
+            )
+        )
+    );
+}