ccn/Services/Website/Sources/App/App+build.swift

import Configuration
import Hummingbird
import HummingbirdCompression
import Logging
import WebsiteCore

/// Builds the website application.
///
/// Reads the log level, server name, static files location, minimum response size to compress, and
/// security headers from the configuration, then assembles the router, server configuration, and logger.
/// - Parameter reader: the configuration reader the values are read from.
/// - Returns: the configured application, ready to run as a service.
func application(
    reader: ConfigReader
) async -> some ApplicationProtocol {
    let cacheControl = cacheControl(
        textMaxAge: reader.int(
            forKey: .Cache.maxAgeText,
            default: .Cache.maxAgeText
        ),
        imageMaxAge: reader.int(
            forKey: .Cache.maxAgeImage,
            default: .Cache.maxAgeImage
        ),
        defaultMaxAge: reader.int(
            forKey: .Cache.maxAgeDefault,
            default: .Cache.maxAgeDefault
        )
    )
    let compressionMinResponseSize = reader.int(
        forKey: .Compression.minResponseSize,
        default: .Compression.minResponseSize
    )
    let logLevel = reader.string(
        forKey: .Log.level,
        as: Logger.Level.self,
        default: .info
    )
    let serverName = reader.string(
        forKey: .HTTP.serverName,
        default: .Server.name
    )
    let staticFilesPath = reader.string(
        forKey: .Path.staticFiles,
        default: .Path.staticResources
    )
    let securityHeaders = securityHeaders(
        reader: reader
    )

    return Application(
        router: router(
            staticFilesPath: staticFilesPath,
            cacheControl: cacheControl,
            compressionMinResponseSize: compressionMinResponseSize,
            securityHeaders: securityHeaders,
            logLevel: logLevel
        ),
        configuration: ApplicationConfiguration(
            reader: reader.scoped(to: "http")
        ),
        logger: logger(
            serverName: serverName,
            logLevel: logLevel
        )
    )
}

// MARK: - Helpers

// Request context used by application
private typealias AppRequestContext = WebsiteRequestContext

/// Builds the cache-control policy applied to the served static files.
///
/// Static files are public and validated by `FileMiddleware` through their `ETag` and
/// `Last-Modified` headers, so each media type is given a `max-age` after which the browser
/// revalidates. Text-based assets (CSS, JavaScript) are additionally marked `must-revalidate`
/// since they change between deployments while keeping their filenames.
/// - Parameters:
///   - textMaxAge: the max-age, in seconds, applied to text-based static files (CSS, JavaScript, plain text).
///   - imageMaxAge: the max-age, in seconds, applied to image static files (ICO, PNG, SVG).
///   - defaultMaxAge: the max-age, in seconds, applied to all other static files (e.g. the web manifest).
/// - Returns: the configured cache-control policy.
private func cacheControl(
    textMaxAge: Int,
    imageMaxAge: Int,
    defaultMaxAge: Int
) -> CacheControl {
    .init([
        (.text, [.public, .maxAge(textMaxAge), .mustRevalidate]),
        (.image, [.public, .maxAge(imageMaxAge)]),
        (.init(type: .any), [.public, .maxAge(defaultMaxAge)]),
    ])
}

/// Builds the security-headers configuration applied to every response.
///
/// Each header value falls back to the hardened default in `String.Security` when the matching
/// configuration key is unset. `Strict-Transport-Security` has no default: it is read as an optional
/// and omitted entirely unless explicitly configured, so it stays off in plain-HTTP development and
/// is enabled only behind TLS in production.
/// - Parameter reader: the configuration reader the header values are read from.
/// - Returns: the configured security-headers configuration.
private func securityHeaders(
    reader: ConfigReader
) -> SecurityHeadersMiddleware<AppRequestContext>.Configuration {
    .init(
        contentSecurityPolicy: reader.string(
            forKey: .Security.contentSecurityPolicy,
            default: .Security.contentSecurityPolicy
        ),
        contentTypeOptions: reader.string(
            forKey: .Security.contentTypeOptions,
            default: .Security.contentTypeOptions
        ),
        frameOptions: reader.string(
            forKey: .Security.frameOptions,
            default: .Security.frameOptions
        ),
        referrerPolicy: reader.string(
            forKey: .Security.referrerPolicy,
            default: .Security.referrerPolicy
        ),
        permissionsPolicy: reader.string(
            forKey: .Security.permissionsPolicy,
            default: .Security.permissionsPolicy
        ),
        strictTransportSecurity: reader.string(
            forKey: .Security.strictTransportSecurity
        )
    )
}

/// Builds the application's logger.
/// - Parameters:
///   - serverName: the label applied to the logger.
///   - logLevel: the minimum level the logger emits.
/// - Returns: the configured logger.
private func logger(
    serverName: String,
    logLevel: Logger.Level
) -> Logger {
    var logger = Logger(label: serverName)

    logger.logLevel = logLevel

    return logger
}

/// Builds the application's router.
///
/// Registers the request-logging middleware, the security-headers middleware that stamps the given
/// `securityHeaders` onto every response, the response-compression middleware that compresses
/// responses larger than `minimumResponseSizeToCompress` when the client advertises support, the
/// localization middleware that negotiates the request's language from its `Accept-Language` header,
/// the not-found middleware that serves the error page, and the static file middleware that serves the
/// contents of `staticFilesPath` (tagging responses with the given `cacheControl` directives), then
/// adds the `RootController` routes that render the landing page and the `HealthController` routes
/// that serve the health check.
///
/// The security-headers middleware sits just inside request logging so it covers every response that
/// reaches a client — the landing page, the compressed responses, the rendered error page, and the
/// served static files.
/// - Parameters:
///   - staticFilesPath: the folder, relative to the working directory, the static files are served from.
///   - cacheControl: the cache-control directives applied to the served static files.
///   - compressionMinResponseSize: the minimum response body size, in bytes, before compression is applied.
///   - securityHeaders: the security headers applied to every response.
///   - logLevel: the level the request-logging middleware logs at.
/// - Returns: the configured router.
private func router(
    staticFilesPath: String,
    cacheControl: CacheControl,
    compressionMinResponseSize: Int,
    securityHeaders: SecurityHeadersMiddleware<AppRequestContext>.Configuration,
    logLevel: Logger.Level
) -> Router<AppRequestContext> {
    let router = Router(context: AppRequestContext.self)

    router.addMiddleware {
        LogRequestsMiddleware(logLevel)
        SecurityHeadersMiddleware(
            configuration: securityHeaders
        )
        ResponseCompressionMiddleware(
            minimumResponseSizeToCompress: compressionMinResponseSize
        )
        LocalizationMiddleware()
        NotFoundMiddleware()
        FileMiddleware(
            staticFilesPath,
            cacheControl: cacheControl
        )
    }

    router.addRoutes {
        RootController<AppRequestContext>().routes
        HealthController<AppRequestContext>().routes
    }

    return router
}