Hankan/server/src/main.ts

/* Hankan's server: sync, and the tutor.

   Both endpoints are stateless. The client owns its database and its
   transcript; this process owns a Postgres table and an API key. Nothing
   here needs to survive a restart. */

import { serve } from "@hono/node-server";
import { Hono } from "hono";

import { pkFor, PAGE_SIZE, PROTOCOL, PROTOCOL_HEADER } from "../../shared/sync-protocol.mjs";
import { openStore, type WireRow } from "./db.ts";
import { tutorRoute } from "./tutor.ts";

const PORT = Number(process.env.PORT ?? 8787);
const TOKEN = process.env.HANKAN_TOKEN ?? "";
const DATABASE_URL = process.env.DATABASE_URL ?? "";
// One learner. The column exists so a second is a config change, not a
// migration.
const USER_ID = process.env.HANKAN_USER ?? "default";

/* Which origins may call this from a browser.

   The Android build is the reason this exists at all: a Capacitor webview
   runs from its own origin (http://localhost, or capacitor://localhost on
   iOS), so every request it makes to the Pi is cross-origin. Without CORS
   the phone cannot sync or reach the tutor — it fails at the preflight,
   before any of this code runs.

   Default "*" is deliberate and not a hole. The gate here is a bearer
   token, not a cookie, so a hostile page gains nothing by being allowed to
   *send* a request it cannot authenticate; CORS never protected a
   token-authenticated API. Set HANKAN_ALLOWED_ORIGINS to a comma-separated
   list to narrow it anyway. */
const ALLOWED_ORIGINS = (process.env.HANKAN_ALLOWED_ORIGINS ?? "*")
  .split(",")
  .map((o) => o.trim())
  .filter(Boolean);

if (!TOKEN) {
  console.error("HANKAN_TOKEN is required — refusing to start an unauthenticated sync endpoint.");
  process.exit(1);
}
if (!DATABASE_URL) {
  console.error("DATABASE_URL is required.");
  process.exit(1);
}

const store = await openStore(DATABASE_URL, pkFor);

const app = new Hono();

/* CORS first, and above all BEFORE the auth middleware.

   A browser sends the preflight OPTIONS with no Authorization header — it
   is not allowed to — so putting auth first rejects it 401 and the real
   request is never attempted. That is the whole failure, and it looks like
   a network error rather than an auth error, which sends you hunting in
   the wrong place. */
app.use("*", async (c, next) => {
  const origin = c.req.header("origin");
  const allow = !origin
    ? null
    : ALLOWED_ORIGINS.includes("*")
      ? origin
      : ALLOWED_ORIGINS.includes(origin)
        ? origin
        : null;

  if (c.req.method === "OPTIONS") {
    if (!allow) return c.body(null, 403);
    return c.body(null, 204, {
      "Access-Control-Allow-Origin": allow,
      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
      "Access-Control-Allow-Headers": `authorization, content-type, ${PROTOCOL_HEADER}`,
      "Access-Control-Max-Age": "86400",
      Vary: "Origin",
    });
  }

  await next();
  if (allow) {
    c.res.headers.set("Access-Control-Allow-Origin", allow);
    c.res.headers.set("Vary", "Origin");
  }
});

/* Bearer auth on everything except the health check, which has to be
   reachable by a container healthcheck that holds no secret. */
app.use("/api/*", async (c, next) => {
  const header = c.req.header("authorization") ?? "";
  const presented = header.startsWith("Bearer ") ? header.slice(7) : "";
  // Constant-time-ish: compare lengths first, then every byte, so a wrong
  // token cannot be narrowed down by timing the response.
  const ok =
    presented.length === TOKEN.length &&
    presented.split("").reduce((acc, ch, i) => acc & (ch === TOKEN[i] ? 1 : 0), 1) === 1;
  if (!ok) return c.json({ error: "unauthorized" }, 401);
  await next();
});

app.get("/health", (c) => c.json({ ok: true }));

/* ── sync ────────────────────────────────────────────────────────────── */

/* Refuse any client not speaking this protocol. A client on protocol 1 is
   exactly the device the artifact lost data to — an old build that pushes
   before it pulls and trusts its own clock — so it gets a clear 426 rather
   than a half-understood write. */
app.use("/api/sync", async (c, next) => {
  if (c.req.header(PROTOCOL_HEADER) !== String(PROTOCOL)) {
    return c.json({ error: "this server speaks sync protocol 2 — update the app", protocol: PROTOCOL }, 426);
  }
  await next();
});

app.get("/api/sync", async (c) => {
  const cursor = Number(c.req.query("cursor") ?? 0);
  if (!Number.isFinite(cursor) || cursor < 0) return c.json({ error: "bad cursor" }, 400);
  return c.json(await store.pull(USER_ID, cursor, PAGE_SIZE));
});

app.post("/api/sync", async (c) => {
  const body = (await c.req.json()) as { rows?: WireRow[] };
  const rows = Array.isArray(body.rows) ? body.rows : [];
  if (rows.length > PAGE_SIZE) return c.json({ error: "too many rows" }, 413);
  return c.json(await store.push(USER_ID, rows));
});

/* Wipes this user's rows. Exists only when HANKAN_TEST_MODE is set, so it
   cannot be reached on the Pi even if the token leaks. */
if (process.env.HANKAN_TEST_MODE === "1") {
  app.post("/api/test/reset", async (c) => {
    await store.reset(USER_ID);
    return c.json({ ok: true });
  });
  console.warn("HANKAN_TEST_MODE — /api/test/reset is enabled. Never set this in production.");
}

/* ── tutor ───────────────────────────────────────────────────────────── */

app.route("/api/tutor", tutorRoute());

const server = serve({ fetch: app.fetch, port: PORT }, (info) => {
  console.log(`hankan server on :${info.port}`);
});

for (const sig of ["SIGINT", "SIGTERM"] as const) {
  process.on(sig, () => {
    server.close(() => void store.close().then(() => process.exit(0)));
  });
}