server.ts

import { serveDir } from '@std/http/file-server';

const port = Number(Deno.env.get('PORT')) || 8000;

console.log(`Server running at http://0.0.0.0:${port}/`);
console.log('Press Ctrl+C to stop');

function generateNonce(): string {
  const array = new Uint8Array(16);
  crypto.getRandomValues(array);
  return btoa(String.fromCharCode(...array));
}

Deno.serve({ port, hostname: '0.0.0.0' }, async (req: Request) => {
  const url = new URL(req.url);
  const nonce = generateNonce();

  if (url.pathname === '/' || url.pathname === '/index.html') {
    try {
      let html = await Deno.readTextFile('./static/index.html');

      html = html.replaceAll('__NONCE__', nonce);

      const headers = new Headers({
        'Content-Type': 'text/html',
      });

      headers.set('X-Content-Type-Options', 'nosniff');
      headers.set('X-Frame-Options', 'DENY');
      headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
      headers.set(
        'Content-Security-Policy',
        "default-src 'self'; " +
          `script-src 'self' 'nonce-${nonce}' blob:; ` + // Nonce for scripts, no unsafe-inline
          "style-src 'self' 'unsafe-inline'; " + // unsafe-inline for Tailwind
          "img-src 'self' data: blob:; " +
          "media-src 'self' blob:; " +
          "worker-src 'self' blob:; " +
          "connect-src 'self'; " +
          "font-src 'self'; " +
          "object-src 'none'; " +
          "base-uri 'self'; " +
          "form-action 'self'; " +
          "frame-ancestors 'none';",
      );

      return new Response(html, { headers });
    } catch (error) {
      console.error('Error serving index.html:', error);
      return new Response('Internal Server Error', { status: 500 });
    }
  }

  const response = await serveDir(req, {
    fsRoot: './static',
    showDirListing: false,
    showIndex: false,
    quiet: true,
  });

  const headers = new Headers(response.headers);

  headers.set('X-Content-Type-Options', 'nosniff');
  headers.set('X-Frame-Options', 'DENY');
  headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');

  return new Response(response.body, {
    status: response.status,
    statusText: response.statusText,
    headers: headers,
  });
});