"""A temporary screen without external scripts, secrets or network calls."""
import os
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlsplit

port = int(os.environ.get("ESF_PORT", "4100"))
base_path = os.environ.get("ESF_BASE_PATH", "").rstrip("/")
if not 4100 <= port <= 4999:
    raise ValueError("Unsupported web port.")
page = b'<!doctype html><html lang="en"><meta charset="utf-8"><title>Private scratchpad</title><body><h1>Your temporary scratchpad</h1><p>This example sends no network requests. Text disappears when this session closes.</p><label for="notes">Notes</label><textarea id="notes" rows="12" cols="60"></textarea></body></html>'

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if urlsplit(self.path).path not in ("/", base_path, base_path + "/"):
            self.send_error(404)
            return
        self.send_response(200)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.send_header("Cache-Control", "no-store")
        self.send_header("Content-Security-Policy", "default-src 'none'; form-action 'none'; base-uri 'none'")
        self.send_header("X-Content-Type-Options", "nosniff")
        self.end_headers()
        self.wfile.write(page)

    def log_message(self, *args):
        pass  # Do not record requests or user data.

HTTPServer(("0.0.0.0", port), Handler).serve_forever()
