@nitronjs/framework 0.2.26 → 0.3.0

package/lib/Session/Manager.js

@@ -2,6 +2,7 @@ import crypto from "crypto";
 import Config from "../Core/Config.js";
 import Memory from "./Memory.js";
 import File from "./File.js";
+import RedisStore from "./Redis.js";
 import Session from "./Session.js";
 
 /**
@@ -44,7 +45,26 @@ class SessionManager {
         this.#config = Config.all("session");
         this.#config.cookie.signed = true;
 
-        this.#store = this.#config.driver === "file" ? new File() : new Memory();
+        switch (this.#config.driver) {
+            case "file":
+                this.#store = new File();
+                break;
+
+            case "memory":
+                this.#store = new Memory();
+                break;
+
+            case "redis":
+                this.#store = new RedisStore(this.#config.lifetime);
+                break;
+
+            case "none":
+                this.#store = null;
+                return;
+
+            default:
+                throw new Error(`[Session] Unknown driver: "${this.#config.driver}"`);
+        }
 
         if (this.#store.ready) {
             await this.#store.ready;
@@ -122,6 +142,10 @@ class SessionManager {
     get cookieConfig() {
         const config = { ...this.#config.cookie, signed: true };
 
+        if (!config.sameSite) {
+            config.sameSite = "Lax";
+        }
+
         if (config.maxAge) {
             config.maxAge = Math.floor(config.maxAge / 1000);
         }
@@ -182,6 +206,17 @@ class SessionManager {
         }
     }
 
+    /**
+     * Closes the session store connection.
+     */
+    async close() {
+        this.stopGC();
+
+        if (this.#store && typeof this.#store.close === "function") {
+            await this.#store.close();
+        }
+    }
+
     /**
      * Sets up session middleware for Fastify.
      * @param {import("fastify").FastifyInstance} server
@@ -189,9 +224,20 @@ class SessionManager {
     static async setup(server) {
         const manager = await SessionManager.getInstance();
 
+        if (!manager.#store) {
+            return;
+        }
+
         server.decorateRequest("session", null);
 
         server.addHook("preHandler", async (request, response) => {
+            const lastSegment = request.url.split("/").pop().split("?")[0];
+            const dotIndex = lastSegment.lastIndexOf(".");
+
+            if (dotIndex > 0 && STATIC_EXTENSIONS.has(lastSegment.slice(dotIndex + 1).toLowerCase())) {
+                return;
+            }
+
             request.session = await manager.load(request, response);
         });
 
@@ -217,4 +263,101 @@ class SessionManager {
     }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Private Constants
+// ─────────────────────────────────────────────────────────────────────────────
+
+const STATIC_EXTENSIONS = new Set([
+    // ── Styles ──────────────────────────────────────────────────────────────
+    "css", "less", "scss", "sass", "styl", "stylus", "pcss", "postcss", "sss",
+
+    // ── Scripts & Source Maps ───────────────────────────────────────────────
+    "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx",
+    "map", "coffee", "litcoffee", "elm", "dart", "vue", "svelte",
+
+    // ── Images (Raster) ────────────────────────────────────────────────────
+    "png", "jpg", "jpeg", "jpe", "jfif", "gif", "bmp", "dib",
+    "tiff", "tif", "webp", "avif", "heic", "heif", "ico", "cur",
+    "psd", "psb", "ai", "eps", "raw", "cr2", "nef", "orf", "sr2", "arw",
+    "dng", "raf", "rw2", "pef", "srw", "x3f", "jxl", "qoi", "hdr", "exr",
+
+    // ── Images (Vector) ────────────────────────────────────────────────────
+    "svg", "svgz", "cgm", "emf", "wmf",
+
+    // ── Fonts ───────────────────────────────────────────────────────────────
+    "woff", "woff2", "ttf", "otf", "eot", "pfb", "pfm",
+
+    // ── Video ───────────────────────────────────────────────────────────────
+    "mp4", "m4v", "webm", "ogv", "ogg", "avi", "mov", "mkv", "flv", "wmv",
+    "mpg", "mpeg", "mpe", "3gp", "3g2", "ts", "mts", "m2ts", "vob", "divx",
+    "asf", "rm", "rmvb", "f4v", "swf", "hevc", "av1",
+
+    // ── Audio ───────────────────────────────────────────────────────────────
+    "mp3", "wav", "flac", "aac", "m4a", "wma", "opus", "oga",
+    "aiff", "aif", "aifc", "mid", "midi", "amr", "ape", "dsf", "dff",
+    "ac3", "dts", "pcm", "au", "snd", "ra", "tak", "tta", "wv", "caf",
+
+    // ── Documents & Office ──────────────────────────────────────────────────
+    "pdf", "doc", "docx", "docm", "dot", "dotx", "dotm",
+    "xls", "xlsx", "xlsm", "xlsb", "xlt", "xltx", "xltm",
+    "ppt", "pptx", "pptm", "pot", "potx", "potm", "pps", "ppsx",
+    "odt", "ods", "odp", "odg", "odf", "odb", "odc",
+    "rtf", "tex", "latex", "bib", "epub", "mobi", "azw", "azw3",
+    "djvu", "djv", "xps", "oxps", "pages", "numbers", "key", "keynote",
+
+    // ── Data & Config ───────────────────────────────────────────────────────
+    "xml", "json", "jsonl", "ndjson", "json5", "jsonc",
+    "yaml", "yml", "toml", "ini", "cfg", "conf", "properties",
+    "csv", "tsv", "dsv", "parquet", "avro", "arrow", "feather",
+    "sql", "sqlite", "db", "mdb", "accdb",
+
+    // ── Text & Markup ───────────────────────────────────────────────────────
+    "txt", "text", "md", "markdown", "rst", "adoc", "asciidoc",
+    "log", "diff", "patch", "nfo", "diz",
+    "htm", "html", "xhtml", "mhtml", "mht", "shtml",
+    "ics", "ical", "vcf", "vcard", "ldif",
+
+    // ── Archives & Compression ──────────────────────────────────────────────
+    "zip", "rar", "7z", "tar", "gz", "gzip", "bz2", "bzip2",
+    "xz", "lzma", "lz", "lz4", "zst", "zstd", "br", "brotli",
+    "cab", "arj", "ace", "lzh", "lha", "cpio", "rpm", "deb",
+    "pkg", "dmg", "iso", "img", "vhd", "vhdx", "vmdk", "ova", "ovf",
+    "apk", "ipa", "xpi", "crx", "nupkg", "snap", "flatpak", "appimage",
+    "jar", "war", "ear",
+
+    // ── Executables & Libraries ─────────────────────────────────────────────
+    "exe", "msi", "dll", "sys", "so", "dylib", "lib", "a", "o", "obj",
+    "bin", "dat", "com", "bat", "cmd", "sh", "bash", "ps1", "psm1",
+
+    // ── 3D & CAD & Design ───────────────────────────────────────────────────
+    "glb", "gltf", "obj", "stl", "fbx", "dae", "3ds", "blend", "max",
+    "c4d", "ma", "mb", "lwo", "lws", "ply", "wrl", "vrml", "x3d",
+    "dwg", "dxf", "dgn", "step", "stp", "iges", "igs", "sat",
+    "skp", "3dm", "usd", "usda", "usdc", "usdz",
+
+    // ── GIS & Mapping ───────────────────────────────────────────────────────
+    "shp", "shx", "dbf", "prj", "cpg", "geojson", "topojson",
+    "kml", "kmz", "gpx", "osm", "pbf", "mbtiles",
+
+    // ── Scientific & Research ───────────────────────────────────────────────
+    "hdf5", "h5", "hdf", "nc", "netcdf", "fits", "mat", "sav",
+
+    // ── WebAssembly & Runtime ───────────────────────────────────────────────
+    "wasm", "wat", "swc",
+
+    // ── Certificates & Keys ─────────────────────────────────────────────────
+    "pem", "crt", "cer", "der", "p12", "pfx", "p7b", "p7c",
+    "csr", "key", "pub", "asc", "gpg", "sig",
+
+    // ── Web Manifests & PWA ─────────────────────────────────────────────────
+    "webmanifest", "manifest", "browserconfig",
+
+    // ── Misc ────────────────────────────────────────────────────────────────
+    "ani", "icns", "lnk", "url", "webloc", "desktop",
+    "torrent", "metalink", "magnet",
+    "sub", "srt", "ass", "ssa", "vtt", "sbv", "dfxp", "ttml",
+    "bak", "tmp", "temp", "swp", "swo", "lock",
+    "pid", "socket", "fifo"
+]);
+
 export default SessionManager;

package/lib/Session/Redis.js

@@ -0,0 +1,117 @@
+import { createClient } from "redis";
+import Log from "../Logging/Log.js";
+
+/**
+ * Redis-based session storage.
+ * Stores sessions as JSON strings with automatic TTL expiry.
+ */
+class RedisStore {
+    #client;
+    #prefix;
+    #ttl;
+    ready;
+
+    constructor(lifetime) {
+        this.#prefix = (process.env.APP_NAME || "app") + ":session:";
+        this.#ttl = Math.ceil(lifetime / 1000);
+        this.ready = this.#connect();
+    }
+
+    /**
+     * Gets session data by ID.
+     * @param {string} id
+     * @returns {Promise<Object|null>}
+     */
+    async get(id) {
+        const data = await this.#client.get(this.#prefix + id);
+
+        if (!data) {
+            return null;
+        }
+
+        try {
+            return JSON.parse(data);
+        }
+        catch {
+            await this.delete(id);
+
+            return null;
+        }
+    }
+
+    /**
+     * Stores session data with automatic TTL.
+     * @param {string} id
+     * @param {Object} value
+     */
+    async set(id, value) {
+        await this.#client.set(this.#prefix + id, JSON.stringify(value), {
+            EX: this.#ttl
+        });
+    }
+
+    /**
+     * Deletes a session.
+     * @param {string} id
+     */
+    async delete(id) {
+        await this.#client.del(this.#prefix + id);
+    }
+
+    /**
+     * Garbage collection — no-op for Redis.
+     * Redis handles expiry automatically via TTL.
+     * @returns {Promise<number>}
+     */
+    async gc() {
+        return 0;
+    }
+
+    /**
+     * Closes the Redis connection gracefully.
+     */
+    async close() {
+        if (this.#client) {
+            await this.#client.quit();
+            this.#client = null;
+        }
+    }
+
+    /** @private */
+    async #connect() {
+        const host = process.env.REDIS_HOST || "127.0.0.1";
+        const port = Number(process.env.REDIS_PORT) || 6379;
+        const password = process.env.REDIS_PASSWORD || undefined;
+
+        this.#client = createClient({
+            socket: {
+                host,
+                port,
+                reconnectStrategy: (retries) => {
+                    if (retries > 10) {
+                        console.error("\x1b[31m✕ [Session Redis] Connection lost after 10 retries. Shutting down.\x1b[0m");
+                        Log.fatal("Redis connection lost permanently", { retries });
+                        process.emit("SIGTERM");
+
+                        return false;
+                    }
+
+                    return Math.min(retries * 100, 5000);
+                }
+            },
+            password
+        });
+
+        this.#client.on("error", (err) => {
+            console.error(`\x1b[31m✕ [Session Redis] ${err.message}\x1b[0m`);
+        });
+
+        this.#client.on("ready", () => {
+            console.log("\x1b[32m✓ [Session Redis] Connected\x1b[0m");
+        });
+
+        await this.#client.connect();
+    }
+}
+
+export default RedisStore;

package/lib/Session/Session.js

@@ -31,10 +31,6 @@ class Session {
         return this.#createdAt;
     }
 
-    get lastActivity() {
-        return this.#lastActivity;
-    }
-
     /**
      * Gets a session value.
      * @param {string} key

package/lib/Support/Str.js

@@ -1,24 +1,26 @@
+import { randomBytes } from "crypto";
+
 /**
  * String utility class with helper methods.
  * Provides Laravel-style string manipulation functions.
- * 
+ *
  * @example
  * Str.slug("Hello World"); // "hello-world"
  * Str.camel("user_name");  // "userName"
  */
 class Str {
     /**
-     * Generates a random alphanumeric string.
+     * Generates a cryptographically secure random alphanumeric string.
      * @param {number} length - Desired string length
      * @returns {string} Random string
      */
     static random(length) {
         const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        const bytes = randomBytes(length);
         let result = "";
-        const charactersLength = characters.length;
 
         for (let i = 0; i < length; i++) {
-            result += characters.charAt(Math.floor(Math.random() * charactersLength));
+            result += characters.charAt(bytes[i] % characters.length);
         }
 
         return result;