Build the API endpoint

server.js

// A small web server with no framework: node:http is enough to show every moving part.
//   node server.js   then open http://localhost:3000
//
// It serves the files in public/ and one API route. All the real work happens in
// src/handler.js; this file only speaks HTTP.

import http from "node:http";
import fs from "node:fs/promises";
import path from "node:path";
import { handleDeckRequest } from "./src/handler.js";

const PORT = Number(process.env.PORT ?? 3000);
const PUBLIC_DIR = path.join(import.meta.dirname, "public");
const MAX_BODY_BYTES = 50_000;
const TYPES = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8" };

const server = http.createServer(async (request, response) => {
  try {
    if (request.method === "POST" && request.url === "/api/deck") {
      const body = await readJson(request);
      const { status, json } = await handleDeckRequest({ body, userId: clientId(request) });
      return send(response, status, JSON.stringify(json), "application/json");
    }
    if (request.method === "GET") return await serveStatic(request, response);
    send(response, 405, "Method not allowed", "text/plain");
  } catch (error) {
    // Only errors we created on purpose (like "body too large") have a message safe to show.
    const status = error.status ?? 500;
    send(response, status, JSON.stringify({ error: error.expose ? error.message : "Something went wrong." }), "application/json");
  }
});

server.listen(PORT, () => console.log(`Slide generator running on http://localhost:${PORT}`));

/** Read a JSON body, refusing anything bigger than MAX_BODY_BYTES. */
async function readJson(request) {
  let size = 0;
  const chunks = [];
  for await (const chunk of request) {
    size += chunk.length;
    if (size > MAX_BODY_BYTES) throw httpError(413, "That request is too large.");
    chunks.push(chunk);
  }
  try {
    return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
  } catch {
    throw httpError(400, "The request body isn't valid JSON.");
  }
}

/** Serve a file from public/, and nothing outside it. */
async function serveStatic(request, response) {
  const url = new URL(request.url, "http://localhost");
  const relative = url.pathname === "/" ? "index.html" : decodeURIComponent(url.pathname).replace(/^\/+/, "");
  const file = path.resolve(PUBLIC_DIR, relative);
  if (!file.startsWith(PUBLIC_DIR + path.sep)) return send(response, 403, "Forbidden", "text/plain"); // "../../etc/passwd"
  try {
    send(response, 200, await fs.readFile(file), TYPES[path.extname(file)] ?? "application/octet-stream");
  } catch {
    send(response, 404, "Not found", "text/plain");
  }
}

/** Who is asking. There is no login here, so the IP address stands in for a user id. */
function clientId(request) {
  return String(request.headers["x-forwarded-for"] ?? request.socket.remoteAddress ?? "anonymous").split(",")[0].trim();
}

function send(response, status, body, type) {
  response.writeHead(status, { "content-type": type, "x-content-type-options": "nosniff" });
  response.end(body);
}

function httpError(status, message) {
  return Object.assign(new Error(message), { status, expose: true });
}