Simple AMP for Email compatible server for notes

server.js

/*
Copyright 2020 Google LLC

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

const ampCors = require('@ampproject/toolbox-cors');
const bodyParser = require('body-parser');
const express = require('express');
const fs = require('fs');
const crypto = require('crypto');
const multer  = require('multer');

const app = express();
app.use(bodyParser.urlencoded({ extended: true }));
app.use(ampCors({ email: true }));

app.get('/', (request, response) => {
  response.sendStatus(200);
});

const DEFAULT_MESSAGE = 'Remember to wash your hands.';

app.get('/getNotes', (request, response) => {
  const user = hash(request.query.user);
  if (!user) {
    response.status(400).json({ error: 'invalid argument' });
    return;
  }
  const db = loadDB();
  let result = { notes: DEFAULT_MESSAGE };
  if (db[user] && db[user].notes) {
    result = { notes: db[user].notes };
  }
  response.json({ items: result });
});

app.post('/setNotes', multer().none(), (request, response) => {
  const user = hash(request.query.user);
  const notes = sanitizeInput(request.body.notes);
  if (!user) {
    response.status(400).json({ error: 'invalid argument' });
    return;
  }
  const db = loadDB();
  db[user] = { notes };
  saveDB(db);
  response.json({ status: 'ok' });
});

const MAX_INPUT_SIZE = 1024;

function sanitizeInput(input) {
  if (typeof input !== 'string') {
    return '';
  }
  return input.substring(0, MAX_INPUT_SIZE).trim();
}

function hash(input) {
  if (typeof input !== 'string' || input === '') {
    return null;
  }
  const hash = crypto.createHash('sha256');
  hash.update(input);
  return hash.digest('base64');
}

const DB_FILE_PATH = './.data/db.json';
const DB_MAX_AGE = 15 * 60 * 1000; // 15 minutes

function loadDB() {
  try {
    const age = Date.now() - fs.statSync(DB_FILE_PATH).mtime.getTime();
    if (age <= DB_MAX_AGE) {
      const db = JSON.parse(fs.readFileSync(DB_FILE_PATH, 'utf8'));
      if (db && typeof db === 'object') {
        return db;
      }
    }
  } catch (e) {}
  return Object.create(null);
}

function saveDB(db) {
  fs.writeFileSync(DB_FILE_PATH, JSON.stringify(db), 'utf8');
}

const listener = app.listen(process.env.PORT, () => {
  console.log('App listening on port ' + listener.address().port);
});