256 lines
11 KiB
JavaScript
256 lines
11 KiB
JavaScript
import { createReadStream, existsSync, statSync } from "node:fs";
|
|
import { createServer } from "node:http";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { GameDatabaseError, openGameDatabase } from "./database.mjs";
|
|
|
|
const MIME_TYPES = new Map([
|
|
[".css", "text/css; charset=utf-8"], [".glb", "model/gltf-binary"],
|
|
[".html", "text/html; charset=utf-8"], [".ico", "image/x-icon"],
|
|
[".jpeg", "image/jpeg"], [".jpg", "image/jpeg"],
|
|
[".js", "text/javascript; charset=utf-8"], [".json", "application/json; charset=utf-8"],
|
|
[".ktx2", "image/ktx2"], [".mp3", "audio/mpeg"], [".ogg", "audio/ogg"],
|
|
[".png", "image/png"], [".sqlite", "application/vnd.sqlite3"],
|
|
[".svg", "image/svg+xml"], [".wasm", "application/wasm"],
|
|
[".webm", "video/webm"], [".webp", "image/webp"],
|
|
]);
|
|
|
|
function json(response, status, body, extraHeaders = {}) {
|
|
const content = Buffer.from(JSON.stringify(body));
|
|
response.writeHead(status, {
|
|
"Content-Type": "application/json; charset=utf-8",
|
|
"Content-Length": content.length,
|
|
"Cache-Control": "no-store",
|
|
...extraHeaders,
|
|
});
|
|
response.end(content);
|
|
}
|
|
|
|
function parseAllowedOrigins(value) {
|
|
return new Set(String(value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean));
|
|
}
|
|
|
|
function bearerToken(request) {
|
|
return /^Bearer\s+(.+)$/i.exec(String(request.headers.authorization ?? ""))?.[1] ?? "";
|
|
}
|
|
|
|
async function readJson(request, limit) {
|
|
const chunks = [];
|
|
let size = 0;
|
|
for await (const chunk of request) {
|
|
size += chunk.length;
|
|
if (size > limit) throw new GameDatabaseError("Request body is too large.", 413, "body_too_large");
|
|
chunks.push(chunk);
|
|
}
|
|
if (size === 0) return {};
|
|
try {
|
|
return JSON.parse(Buffer.concat(chunks).toString("utf8"));
|
|
} catch {
|
|
throw new GameDatabaseError("Request body must be valid JSON.", 400, "invalid_json");
|
|
}
|
|
}
|
|
|
|
function resolveStaticFile(staticDir, pathname, spaFallback = true) {
|
|
let decoded;
|
|
try { decoded = decodeURIComponent(pathname); } catch { return null; }
|
|
const relative = decoded.replace(/^\/+/, "");
|
|
const candidate = path.resolve(staticDir, relative || "index.html");
|
|
if (candidate !== staticDir && !candidate.startsWith(`${staticDir}${path.sep}`)) return null;
|
|
if (existsSync(candidate) && statSync(candidate).isFile()) return candidate;
|
|
if (spaFallback && !path.extname(relative)) {
|
|
const index = path.join(staticDir, "index.html");
|
|
if (existsSync(index)) return index;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function parseRange(value, size) {
|
|
const match = /^bytes=(\d*)-(\d*)$/.exec(String(value ?? ""));
|
|
if (!match) return null;
|
|
let start = match[1] ? Number(match[1]) : null;
|
|
let end = match[2] ? Number(match[2]) : null;
|
|
if (start === null && end !== null) {
|
|
start = Math.max(0, size - end);
|
|
end = size - 1;
|
|
} else {
|
|
start ??= 0;
|
|
end ??= size - 1;
|
|
}
|
|
if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start || start >= size) return null;
|
|
return { start, end: Math.min(end, size - 1) };
|
|
}
|
|
|
|
function serveStatic(request, response, staticDir, pathname, options = {}) {
|
|
if (request.method !== "GET" && request.method !== "HEAD") return false;
|
|
const filePath = resolveStaticFile(staticDir, pathname, options.spaFallback !== false);
|
|
if (!filePath) return false;
|
|
const stats = statSync(filePath);
|
|
const extension = path.extname(filePath).toLowerCase();
|
|
const range = request.headers.range ? parseRange(request.headers.range, stats.size) : null;
|
|
const headers = {
|
|
"Content-Type": MIME_TYPES.get(extension) ?? "application/octet-stream",
|
|
"Accept-Ranges": "bytes",
|
|
"Cache-Control": options.immutable
|
|
? "public, max-age=31536000, immutable"
|
|
: path.basename(filePath) === "index.html" || options.noCache
|
|
? "no-cache"
|
|
: "public, max-age=3600",
|
|
"X-Content-Type-Options": "nosniff",
|
|
};
|
|
if (request.headers.range && !range) {
|
|
response.writeHead(416, { ...headers, "Content-Range": `bytes */${stats.size}` });
|
|
response.end();
|
|
return true;
|
|
}
|
|
if (range) {
|
|
response.writeHead(206, {
|
|
...headers,
|
|
"Content-Length": range.end - range.start + 1,
|
|
"Content-Range": `bytes ${range.start}-${range.end}/${stats.size}`,
|
|
});
|
|
if (request.method === "HEAD") response.end();
|
|
else createReadStream(filePath, range).pipe(response);
|
|
return true;
|
|
}
|
|
response.writeHead(200, { ...headers, "Content-Length": stats.size });
|
|
if (request.method === "HEAD") response.end();
|
|
else createReadStream(filePath).pipe(response);
|
|
return true;
|
|
}
|
|
|
|
function originHeaders(request, allowedOrigins) {
|
|
const origin = String(request.headers.origin ?? "");
|
|
if (!origin || !allowedOrigins.has(origin)) return {};
|
|
return { "Access-Control-Allow-Origin": origin, "Access-Control-Allow-Credentials": "true", Vary: "Origin" };
|
|
}
|
|
|
|
function createAuthLimiter() {
|
|
const buckets = new Map();
|
|
return (key) => {
|
|
const now = Date.now();
|
|
const recent = (buckets.get(key) ?? []).filter((timestamp) => now - timestamp < 60_000);
|
|
if (recent.length >= 12) return false;
|
|
recent.push(now);
|
|
buckets.set(key, recent);
|
|
if (buckets.size > 1_000) {
|
|
for (const [entry, timestamps] of buckets) {
|
|
if (!timestamps.some((timestamp) => now - timestamp < 60_000)) buckets.delete(entry);
|
|
}
|
|
}
|
|
return true;
|
|
};
|
|
}
|
|
|
|
export function createGameServer(options = {}) {
|
|
const staticDir = path.resolve(options.staticDir ?? process.env.STATIC_DIR ?? "dist");
|
|
const contentDir = path.resolve(options.contentDir ?? process.env.CONTENT_DIR ?? "content");
|
|
const allowedOrigins = parseAllowedOrigins(options.corsOrigins ?? process.env.CORS_ORIGINS);
|
|
const bodyLimit = Math.max(1024, Number(options.bodyLimit ?? process.env.MAX_JSON_BODY_BYTES ?? 5 * 1024 * 1024));
|
|
const trustProxy = String(options.trustProxy ?? process.env.TRUST_PROXY ?? "").toLowerCase() === "true";
|
|
const gameDatabase = options.database ?? openGameDatabase(options);
|
|
const allowAuthRequest = createAuthLimiter();
|
|
gameDatabase.pruneExpiredSessions();
|
|
|
|
const server = createServer(async (request, response) => {
|
|
const cors = originHeaders(request, allowedOrigins);
|
|
const url = new URL(request.url ?? "/", "http://localhost");
|
|
response.setHeader("X-Frame-Options", "DENY");
|
|
response.setHeader("Referrer-Policy", "same-origin");
|
|
for (const [name, value] of Object.entries(cors)) response.setHeader(name, value);
|
|
if (request.method === "OPTIONS") {
|
|
if (request.headers.origin && Object.keys(cors).length === 0) {
|
|
json(response, 403, { error: "Origin is not allowed.", code: "origin_not_allowed" });
|
|
return;
|
|
}
|
|
response.writeHead(204, {
|
|
...cors,
|
|
"Access-Control-Allow-Headers": "Authorization, Content-Type",
|
|
"Access-Control-Allow-Methods": "GET, HEAD, POST, PUT, OPTIONS",
|
|
"Access-Control-Max-Age": "86400",
|
|
});
|
|
response.end();
|
|
return;
|
|
}
|
|
|
|
try {
|
|
if (url.pathname === "/api/health" && request.method === "GET") {
|
|
json(response, 200, { ok: true, service: "healer-man", time: new Date().toISOString() });
|
|
return;
|
|
}
|
|
if ((url.pathname === "/api/auth/register" || url.pathname === "/api/auth/login") && request.method === "POST") {
|
|
const forwarded = trustProxy ? String(request.headers["x-forwarded-for"] ?? "").split(",")[0]?.trim() : "";
|
|
if (!allowAuthRequest(forwarded || request.socket.remoteAddress || "unknown")) {
|
|
throw new GameDatabaseError("Too many login attempts. Try again shortly.", 429, "rate_limited");
|
|
}
|
|
const body = await readJson(request, 64 * 1024);
|
|
const result = url.pathname.endsWith("register")
|
|
? await gameDatabase.register(body.username, body.password)
|
|
: await gameDatabase.login(body.username, body.password);
|
|
json(response, url.pathname.endsWith("register") ? 201 : 200, result);
|
|
return;
|
|
}
|
|
if (url.pathname === "/api/auth/logout" && request.method === "POST") {
|
|
gameDatabase.logout(bearerToken(request));
|
|
json(response, 200, { ok: true });
|
|
return;
|
|
}
|
|
if (url.pathname === "/api/me" && request.method === "GET") {
|
|
json(response, 200, { account: gameDatabase.authenticate(bearerToken(request)) });
|
|
return;
|
|
}
|
|
if (url.pathname === "/api/cloud-save" && request.method === "GET") {
|
|
const account = gameDatabase.authenticate(bearerToken(request));
|
|
json(response, 200, gameDatabase.getCloudSave(account.id));
|
|
return;
|
|
}
|
|
if (url.pathname === "/api/cloud-save" && request.method === "PUT") {
|
|
const account = gameDatabase.authenticate(bearerToken(request));
|
|
const body = await readJson(request, bodyLimit);
|
|
json(response, 200, gameDatabase.putCloudSave(account.id, body.data));
|
|
return;
|
|
}
|
|
if (url.pathname.startsWith("/api/")) {
|
|
json(response, 404, { error: "API route not found.", code: "not_found" });
|
|
return;
|
|
}
|
|
if (url.pathname === "/content" || url.pathname.startsWith("/content/")) {
|
|
const contentPath = url.pathname.slice("/content".length) || "/manifest.json";
|
|
const served = serveStatic(request, response, contentDir, contentPath, {
|
|
spaFallback: false,
|
|
immutable: contentPath.startsWith("/objects/"),
|
|
noCache: !contentPath.startsWith("/objects/"),
|
|
});
|
|
if (served) return;
|
|
json(response, 404, { error: "Content file not found.", code: "content_not_found" });
|
|
return;
|
|
}
|
|
if (serveStatic(request, response, staticDir, url.pathname)) return;
|
|
json(response, 404, { error: "Not found.", code: "not_found" });
|
|
} catch (error) {
|
|
const known = error instanceof GameDatabaseError;
|
|
const status = known ? error.status : 500;
|
|
if (status >= 500) console.error(error);
|
|
if (!response.headersSent) json(response, status, {
|
|
error: known ? error.message : "The server could not complete the request.",
|
|
code: known ? error.code : "internal_error",
|
|
});
|
|
else response.destroy(error instanceof Error ? error : undefined);
|
|
}
|
|
});
|
|
|
|
server.on("close", () => gameDatabase.close());
|
|
return { server, database: gameDatabase, staticDir, contentDir };
|
|
}
|
|
|
|
if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
|
const host = process.env.HOST ?? "0.0.0.0";
|
|
const port = Number(process.env.PORT ?? 4173);
|
|
const runtime = createGameServer();
|
|
runtime.server.listen(port, host, () => {
|
|
console.log(`Healer Man server listening on http://${host}:${port}`);
|
|
console.log(`Serving ${runtime.staticDir}`);
|
|
console.log(`Content directory: ${runtime.contentDir}`);
|
|
console.log(`SQLite database: ${runtime.database.databasePath}`);
|
|
});
|
|
}
|