@nitronjs/framework 0.2.26 → 0.3.0

package/lib/Translation/Lang.js

@@ -1,54 +1,398 @@
 import fs from "node:fs";
 import path from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
 import Paths from "../Core/Paths.js";
+import Config from "../Core/Config.js";
+import Environment from "../Core/Environment.js";
+import { pluralize, replaceParams } from "./pluralize.js";
+
+const LangStore = new AsyncLocalStorage();
+
+// Safety cap — prevents DoS via arbitrary locale strings in setLocale
+const MAX_LOCALES = 50;
 
-/**
- * Translation manager for multi-language support.
- * Loads translations from JSON files and supports parameter replacement.
- */
 class Lang {
-    static #cache = new Map();
+    static #translations = {};
+    static #flatCache = {};
+    static #mtimes = {};
+    static #fallbackLocale = null;
+
+    static setup(server) {
+        const rawLocale = Config.get("app.locale", "en");
+        const rawFallback = Config.get("app.fallback_locale") || null;
+        const defaultLocale = isValidLocale(rawLocale) ? rawLocale : "en";
+
+        Lang.#fallbackLocale = (rawFallback && isValidLocale(rawFallback)) ? rawFallback : null;
+
+        if (Environment.isDev) {
+            if (rawLocale !== defaultLocale) console.warn(`Lang: Invalid app.locale "${rawLocale}", falling back to "en"`);
+            if (rawFallback && !Lang.#fallbackLocale) console.warn(`Lang: Invalid app.fallback_locale "${rawFallback}", ignoring`);
+        }
+
+        server.addHook("onRequest", async (req) => {
+            LangStore.enterWith({ locale: defaultLocale, req, langChecked: new Set() });
+            req.locale = defaultLocale;
+        });
+
+        globalThis.__nitron_lang_get = (key, params) => Lang.get(key, params);
+    }
+
+    static get(key, params = {}) {
+        const value = this.#resolveWithFallback(key);
+
+        if (!isResolvable(value)) return key;
+
+        let result = String(value);
+
+        // Pluralize only when count is provided and value has pipe-separated segments
+        if (params && typeof params === "object" && params.count !== undefined && result.includes("|")) {
+            result = pluralize(result, params.count);
+        }
+
+        return replaceParams(result, params);
+    }
+
+    static has(key) {
+        return isResolvable(this.#resolveWithFallback(key));
+    }
+
+    static locale() {
+        const store = LangStore.getStore();
+
+        if (store) return store.locale;
+
+        return Config.get("app.locale", "en");
+    }
+
+    static setLocale(locale) {
+        if (!isValidLocale(locale)) {
+            if (Environment.isDev) {
+                console.warn(`Lang.setLocale: Invalid locale format "${locale}"`);
+            }
+            return;
+        }
+
+        const store = LangStore.getStore();
+
+        if (!store) return;
+
+        store.locale = locale;
+
+        if (store.req) {
+            store.req.locale = locale;
+        }
+    }
+
+    static getFilteredTranslations(locale, keys) {
+        this.#ensureLoaded(locale);
+
+        const flat = this.#getFlat(locale);
+
+        const fallback = Lang.#fallbackLocale;
+        let fallbackFlat = null;
+
+        if (fallback && fallback !== locale) {
+            this.#ensureLoaded(fallback);
+            fallbackFlat = this.#getFlat(fallback);
+        }
+
+        if (keys === null || keys === undefined) {
+            if (fallbackFlat) {
+                return { ...fallbackFlat, ...flat };
+            }
+            return flat;
+        }
+
+        if (keys.length === 0) {
+            return {};
+        }
+
+        const result = {};
+
+        for (const key of keys) {
+            if (flat[key] !== undefined) {
+                result[key] = flat[key];
+            }
+            else if (fallbackFlat && fallbackFlat[key] !== undefined) {
+                result[key] = fallbackFlat[key];
+            }
+        }
+
+        return result;
+    }
+
+    // --- Internal: resolve + fallback ---
+
+    static #resolveWithFallback(key) {
+        const locale = this.locale();
+
+        this.#ensureLoaded(locale);
+
+        const value = this.#resolveKey(locale, key);
+
+        if (isResolvable(value)) return value;
+
+        const fallback = Lang.#fallbackLocale;
+
+        if (fallback && fallback !== locale) {
+            this.#ensureLoaded(fallback);
+            return this.#resolveKey(fallback, key);
+        }
+
+        return value;
+    }
+
+    static #ensureLoaded(locale) {
+        if (Environment.isDev) {
+            const store = LangStore.getStore();
+
+            if (store && !store.langChecked.has(locale)) {
+                store.langChecked.add(locale);
+                this.#checkAndReload(locale);
+            }
+            else if (!this.#translations[locale]) {
+                this.#loadTranslations(locale);
+            }
+
+            return;
+        }
+
+        if (!this.#translations[locale]) {
+            if (Object.keys(this.#translations).length >= MAX_LOCALES) return;
+            this.#loadTranslations(locale);
+        }
+    }
+
+    // --- Internal: dev-mode hot reload ---
+
+    static #checkAndReload(locale) {
+        const langsDir = Paths.langs;
+
+        if (!fs.existsSync(langsDir)) {
+            if (!this.#translations[locale]) {
+                this.#translations[locale] = {};
+            }
+            return;
+        }
+
+        const singleFile = path.join(langsDir, locale + ".json");
+        const folderDir = path.join(langsDir, locale);
+
+        let changed = false;
+        const currentPaths = new Set();
+
+        // Check single file mtime
+        if (fs.existsSync(singleFile)) {
+            currentPaths.add(singleFile);
+
+            try {
+                const mtime = fs.statSync(singleFile).mtimeMs;
+                if (this.#mtimes[singleFile] !== mtime) changed = true;
+            }
+            catch {}
+        }
+
+        // Check folder files mtime (always scan to keep currentPaths complete for deletion detection)
+        if (fs.existsSync(folderDir)) {
+            try {
+                if (fs.statSync(folderDir).isDirectory()) {
+                    for (const file of fs.readdirSync(folderDir)) {
+                        if (!file.endsWith(".json")) continue;
 
-    /**
-     * Gets a translated string for the current request language.
-     * @param {import("fastify").FastifyRequest} req - Fastify request with language property
-     * @param {string} key - Translation key to look up
-     * @param {Object|null} params - Optional parameters to replace in translation (e.g., { name: "John" } for ":name")
-     * @returns {string} Translated string or the key if not found
-     */
-    static get(req, key, params = null) {
-        const currentLang = req.language;
-        const langPath = path.join(Paths.langs, currentLang + ".json");
+                        const fullPath = path.join(folderDir, file);
 
-        if (!fs.existsSync(langPath)) {
-            return key;
+                        currentPaths.add(fullPath);
+
+                        if (!changed) {
+                            try {
+                                const mtime = fs.statSync(fullPath).mtimeMs;
+                                if (this.#mtimes[fullPath] !== mtime) changed = true;
+                            }
+                            catch {}
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                if (Environment.isDev) console.warn(`Lang: Failed to scan ${folderDir}: ${err.message}`);
+            }
         }
 
-        let translations = this.#cache.get(currentLang);
+        // Detect deleted files — tracked in #mtimes but no longer on disk
+        if (!changed) {
+            for (const tracked of Object.keys(this.#mtimes)) {
+                if (isLocalePath(tracked, singleFile, folderDir) && !currentPaths.has(tracked)) {
+                    changed = true;
+                    break;
+                }
+            }
+        }
+
+        if (changed || !this.#translations[locale]) {
+            this.#loadTranslations(locale);
+        }
+    }
+
+    // --- Internal: file loading ---
+
+    static #loadTranslations(locale) {
+        const langsDir = Paths.langs;
+        const result = {};
+
+        if (!fs.existsSync(langsDir)) {
+            this.#translations[locale] = result;
+            delete this.#flatCache[locale];
+            return;
+        }
+
+        const singleFile = path.join(langsDir, locale + ".json");
+        const folderDir = path.join(langsDir, locale);
+
+        // Purge stale mtime entries for this locale before repopulating
+        for (const tracked of Object.keys(this.#mtimes)) {
+            if (isLocalePath(tracked, singleFile, folderDir)) {
+                delete this.#mtimes[tracked];
+            }
+        }
+
+        // 1. Single file: resources/langs/tr.json
+        if (fs.existsSync(singleFile)) {
+            try {
+                const mtime = fs.statSync(singleFile).mtimeMs;
+                const content = fs.readFileSync(singleFile, "utf-8");
+                const data = JSON.parse(content);
+
+                this.#mtimes[singleFile] = mtime;
+                this.#deepMerge(result, data);
+            }
+            catch (err) {
+                console.warn(`Lang: Failed to parse ${singleFile}: ${err.message}`);
+            }
+        }
+
+        // 2. Folder structure: resources/langs/tr/messages.json (wins over single file keys)
+        if (fs.existsSync(folderDir)) {
+            try {
+                if (fs.statSync(folderDir).isDirectory()) {
+                    for (const file of fs.readdirSync(folderDir)) {
+                        if (!file.endsWith(".json")) continue;
+
+                        const fullPath = path.join(folderDir, file);
+                        const namespace = file.replace(/\.json$/, "");
+
+                        try {
+                            const mtime = fs.statSync(fullPath).mtimeMs;
+                            const content = fs.readFileSync(fullPath, "utf-8");
+                            const data = JSON.parse(content);
+
+                            this.#mtimes[fullPath] = mtime;
+
+                            if (Environment.isDev && result[namespace]) {
+                                console.warn(`Lang: Key "${namespace}" in ${fullPath} overrides single file`);
+                            }
 
-        if (!translations) {
-            const langFile = fs.readFileSync(langPath, { encoding: "utf-8", flag: "r" });
-            translations = JSON.parse(langFile);
-            this.#cache.set(currentLang, translations);
+                            result[namespace] = data;
+                        }
+                        catch (err) {
+                            console.warn(`Lang: Failed to parse ${fullPath}: ${err.message}`);
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                if (Environment.isDev) console.warn(`Lang: Failed to scan ${folderDir}: ${err.message}`);
+            }
         }
 
-        let translation = translations[key] || key;
+        this.#translations[locale] = result;
+        delete this.#flatCache[locale];
+    }
+
+    // --- Internal: cache + key resolution ---
+
+    static #getFlat(locale) {
+        if (this.#flatCache[locale]) return this.#flatCache[locale];
+
+        const tree = this.#translations[locale];
+        const flat = tree ? this.#flattenTree(tree, "") : {};
+
+        this.#flatCache[locale] = flat;
+        return flat;
+    }
+
+    static #resolveKey(locale, key) {
+        const tree = this.#translations[locale];
 
-        if (params) {
-            for (const [paramKey, paramValue] of Object.entries(params)) {
-                translation = translation.replaceAll(":" + paramKey, paramValue);
+        if (!tree) return undefined;
+
+        const parts = key.split(".");
+        let current = tree;
+
+        for (const part of parts) {
+            if (current === undefined || current === null || typeof current !== "object") {
+                return undefined;
             }
+
+            if (!Object.prototype.hasOwnProperty.call(current, part)) {
+                return undefined;
+            }
+
+            current = current[part];
         }
 
-        return translation;
+        return current;
     }
 
-    /**
-     * Clears the translation cache. Useful for development hot reload.
-     */
-    static clearCache() {
-        this.#cache.clear();
+    // --- Internal: tree utilities (input is always from JSON.parse — no circular refs) ---
+
+    static #deepMerge(target, source) {
+        for (const key of Object.keys(source)) {
+            if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+
+            if (
+                typeof source[key] === "object" && source[key] !== null && !Array.isArray(source[key]) &&
+                typeof target[key] === "object" && target[key] !== null && !Array.isArray(target[key])
+            ) {
+                this.#deepMerge(target[key], source[key]);
+            }
+            else {
+                target[key] = source[key];
+            }
+        }
+    }
+
+    static #flattenTree(tree, prefix) {
+        const result = {};
+
+        for (const [key, value] of Object.entries(tree)) {
+            const fullKey = prefix ? prefix + "." + key : key;
+
+            if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+                Object.assign(result, this.#flattenTree(value, fullKey));
+            }
+            else {
+                result[fullKey] = value;
+            }
+        }
+
+        return result;
     }
 }
 
+// --- Module-level helpers ---
+
+function isResolvable(value) {
+    return value !== undefined && value !== null && typeof value !== "object";
+}
+
+function isLocalePath(tracked, singleFile, folderDir) {
+    return tracked === singleFile || tracked.startsWith(folderDir + path.sep);
+}
+
+const LOCALE_RE = /^[a-z]{2,3}(-[a-zA-Z0-9]{1,8})*$/i;
+
+function isValidLocale(locale) {
+    return typeof locale === "string" && LOCALE_RE.test(locale);
+}
+
 export default Lang;

package/lib/Translation/pluralize.js

@@ -0,0 +1,81 @@
+/**
+ * Shared translation utilities — single source of truth.
+ * Used by Lang.js (server) and jsxRuntime.js (SSR + client via .toString() embedding).
+ *
+ * IMPORTANT: These functions are embedded client-side via .toString().
+ * Do NOT use arrow functions, template literals, const/let, or modern syntax.
+ */
+
+export function pluralize(value, count) {
+    count = typeof count === "number" ? count : Number(count) || 0;
+    if (count < 0) count = 0;
+    count = Math.floor(count);
+
+    var segments = value.split("|");
+
+    // Try explicit syntax first: {0} zero items | {1} one item | [2,*] many items
+    for (var i = 0; i < segments.length; i++) {
+        var trimmed = segments[i].trim();
+
+        // Exact match: {3} exactly three
+        var exactMatch = trimmed.match(/^\{(\d+)\}\s*(.*)/);
+
+        if (exactMatch) {
+            if (parseInt(exactMatch[1]) === count) return exactMatch[2];
+            continue;
+        }
+
+        // Range match: [2,5] between two and five | [6,*] six or more
+        var rangeMatch = trimmed.match(/^\[(\d+),(\d+|\*)\]\s*(.*)/);
+
+        if (rangeMatch) {
+            var min = parseInt(rangeMatch[1]);
+            var max = rangeMatch[2] === "*" ? Infinity : parseInt(rangeMatch[2]);
+
+            if (count >= min && count <= max) return rangeMatch[3];
+            continue;
+        }
+    }
+
+    // Simple fallback: "one item|many items" (no explicit ranges)
+    if (segments.length >= 2 && !hasExplicitRanges(segments)) {
+        return count === 1 ? segments[0].trim() : segments[1].trim();
+    }
+
+    return value;
+}
+
+export function replaceParams(value, params) {
+    if (!params || typeof params !== "object") return value;
+
+    var keys = Object.keys(params);
+
+    if (keys.length === 0) return value;
+
+    // Escape regex special chars in param names
+    var escaped = [];
+
+    for (var i = 0; i < keys.length; i++) {
+        escaped.push(keys[i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    }
+
+    // Sort longest-first so :name_full matches before :name
+    escaped.sort(function(a, b) { return b.length - a.length; });
+
+    var pattern = new RegExp(":(" + escaped.join("|") + ")", "g");
+
+    return value.replace(pattern, function(match, k) {
+        if (!Object.prototype.hasOwnProperty.call(params, k)) return match;
+        var v = params[k];
+        return (v !== null && v !== undefined) ? String(v) : match;
+    });
+}
+
+// --- Internal helpers ---
+
+function hasExplicitRanges(segments) {
+    for (var i = 0; i < segments.length; i++) {
+        if (/^\s*(\{\d+\}|\[\d+,(\d+|\*)\])/.test(segments[i])) return true;
+    }
+    return false;
+}

package/lib/Validation/MagicBytes.js

@@ -0,0 +1,120 @@
+// Signatures ordered by total check bytes (offset + bytes.length) descending
+const SIGNATURES = [
+    // 12-byte region: WebP (RIFF at 0, WEBP at 8)
+    { regions: [{ bytes: [0x52, 0x49, 0x46, 0x46], offset: 0 }, { bytes: [0x57, 0x45, 0x42, 0x50], offset: 8 }], mime: "image/webp" },
+    // 8 bytes
+    { bytes: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A], offset: 0, mime: "image/png" },
+    // 8-byte region: MP4/ISOBMFF (ftyp at offset 4)
+    { bytes: [0x66, 0x74, 0x79, 0x70], offset: 4, mime: "video/mp4" },
+    // 6 bytes
+    { bytes: [0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C], offset: 0, mime: "application/x-7z-compressed" },
+    { bytes: [0x52, 0x61, 0x72, 0x21, 0x1A, 0x07], offset: 0, mime: "application/x-rar-compressed" },
+    // 4 bytes
+    { bytes: [0x25, 0x50, 0x44, 0x46], offset: 0, mime: "application/pdf" },
+    { bytes: [0x50, 0x4B, 0x03, 0x04], offset: 0, mime: "application/zip" },
+    { bytes: [0x47, 0x49, 0x46, 0x38], offset: 0, mime: "image/gif" },
+    { bytes: [0x1A, 0x45, 0xDF, 0xA3], offset: 0, mime: "video/webm" },
+    { bytes: [0x00, 0x00, 0x01, 0x00], offset: 0, mime: "image/x-icon" },
+    // 3 bytes
+    { bytes: [0xFF, 0xD8, 0xFF], offset: 0, mime: "image/jpeg" },
+    { bytes: [0x49, 0x44, 0x33], offset: 0, mime: "audio/mpeg" },
+    // 2 bytes
+    { bytes: [0x1F, 0x8B], offset: 0, mime: "application/gzip" },
+    { bytes: [0x42, 0x4D], offset: 0, mime: "image/bmp" }
+];
+
+const MIME_FAMILIES = [
+    // ZIP family (jar/apk excluded)
+    ["application/zip", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.openxmlformats-officedocument.presentationml.presentation", "application/vnd.oasis.opendocument.text", "application/vnd.oasis.opendocument.spreadsheet", "application/vnd.oasis.opendocument.presentation"],
+    // MPEG-4/ISOBMFF family
+    ["video/mp4", "audio/mp4", "audio/m4a", "video/quicktime", "video/3gpp"],
+    // EBML family
+    ["video/webm", "video/x-matroska", "audio/webm"]
+];
+
+/**
+ * Detect MIME type from buffer magic bytes.
+ * Returns null if buffer is empty or no signature matches.
+ */
+export function detectMime(buffer) {
+    if (!buffer || buffer.length === 0) {
+        return null;
+    }
+
+    for (const sig of SIGNATURES) {
+        if (sig.regions) {
+            let allMatch = true;
+
+            for (const region of sig.regions) {
+                if (buffer.length < region.offset + region.bytes.length) {
+                    allMatch = false;
+                    break;
+                }
+
+                for (let i = 0; i < region.bytes.length; i++) {
+                    if (buffer[region.offset + i] !== region.bytes[i]) {
+                        allMatch = false;
+                        break;
+                    }
+                }
+
+                if (!allMatch) break;
+            }
+
+            if (allMatch) return sig.mime;
+        }
+        else {
+            if (buffer.length < sig.offset + sig.bytes.length) continue;
+
+            let match = true;
+
+            for (let i = 0; i < sig.bytes.length; i++) {
+                if (buffer[sig.offset + i] !== sig.bytes[i]) {
+                    match = false;
+                    break;
+                }
+            }
+
+            if (match) return sig.mime;
+        }
+    }
+
+    return null;
+}
+
+/**
+ * Check if two MIME types belong to the same family.
+ * ZIP family includes Office XML formats. MPEG-4 family shares ftyp. EBML family shares header.
+ */
+export function isSameMimeFamily(mime1, mime2) {
+    if (!mime1 || !mime2) return false;
+
+    const m1 = mime1.toLowerCase(), m2 = mime2.toLowerCase();
+
+    if (m1 === m2) return true;
+
+    for (const family of MIME_FAMILIES) {
+        const has1 = family.includes(m1) || (family === MIME_FAMILIES[0] && (m1.startsWith("application/vnd.openxmlformats-officedocument.") || m1.startsWith("application/vnd.oasis.opendocument.")));
+        const has2 = family.includes(m2) || (family === MIME_FAMILIES[0] && (m2.startsWith("application/vnd.openxmlformats-officedocument.") || m2.startsWith("application/vnd.oasis.opendocument.")));
+
+        if (has1 && has2) return true;
+    }
+
+    return false;
+}
+
+// Regex: null bytes, URL-encoded null, bidi/invisible Unicode, control chars
+const UNSAFE_CHARS = /\x00|%00|[\u202A-\u202E\u200E\u200F\u2066-\u2069\u200B-\u200D\uFEFF]|[\x01-\x08\x0B\x0C\x0E-\x1F]/gi;
+
+/**
+ * Strip dangerous characters from filename.
+ * Removes null bytes, URL-encoded nulls, Unicode bidi/invisible chars, control chars.
+ * Returns "unnamed" if result is empty.
+ */
+export function sanitizeFilename(filename) {
+    if (!filename) return "unnamed";
+
+    const cleaned = filename.replace(UNSAFE_CHARS, "");
+
+    return cleaned || "unnamed";
+}