Function startServer

apps/api/src/templates/email/preview.ts:332–404

(port: number)

};

const startServer = (port: number): void => {
  const servableFiles = collectServableFiles();
  /*
   * Re-resolved each request so the index page picked up after
   * `generateIndex()` ran is reachable. Generation happens before
   * `startServer`, so the initial enumeration already contains it —
   * but keeping the read fresh-on-each-request makes the watch-mode
   * story honest, with no measurable cost on a dev-only server.
   */

  const server = http.createServer((req, res) => {
    /*
     * Strip query / fragment, normalise the route. Empty / "/" → index.
     * `req.url` is the untrusted KEY into `servableFiles`; its parsed
     * value never feeds into any filesystem call.
     */
    const rawUrl = req.url ?? "";
    const decoded = (() => {
      try {
        return decodeURIComponent(rawUrl.split("?")[0]?.split("#")[0] ?? "");
      } catch {
        return "";
      }
    })();
    const route = decoded === "" || decoded === "/" ? "/index.html" : decoded;

    /*
     * Lookup-by-lookup: the candidate paths below are STRINGS WE
     * AUTHORED ABOVE (literal "/index.html", or the request `route`
     * augmented with a literal ".html"). The path handed to
     * `fs.readFileSync` is always pulled FROM `servableFiles`, whose
     * values are absolute paths discovered via `fs.readdirSync` of
     * PREVIEW_DIR. There is no flow from `req.url` to `readFileSync`.
     */
    const resolvedPath =
      servableFiles.get(route) ?? servableFiles.get(`${route}.html`);

    if (resolvedPath === undefined) {
      res.writeHead(404, { "Content-Type": "text/html" });
      res.end("<h1>404 Not Found</h1>");

      return;
    }

    const ext = path.extname(resolvedPath);

    try {
      const content = fs.readFileSync(resolvedPath, "utf8");

      res.writeHead(200, {
        "Content-Type": CONTENT_TYPES[ext] ?? "text/plain",
      });
      res.end(content);
    } catch (error: unknown) {
      res.writeHead(500);
      res.end(
        `Error: ${error instanceof Error ? error.message : String(error)}`
      );