@nitronjs/framework 0.2.27 → 0.3.1

package/lib/Session/Manager.js

@@ -142,6 +142,10 @@ class SessionManager {
     get cookieConfig() {
         const config = { ...this.#config.cookie, signed: true };
 
+        if (!config.sameSite) {
+            config.sameSite = "Lax";
+        }
+
         if (config.maxAge) {
             config.maxAge = Math.floor(config.maxAge / 1000);
         }
@@ -228,8 +232,9 @@ class SessionManager {
 
         server.addHook("preHandler", async (request, response) => {
             const lastSegment = request.url.split("/").pop().split("?")[0];
+            const dotIndex = lastSegment.lastIndexOf(".");
 
-            if (lastSegment.includes(".")) {
+            if (dotIndex > 0 && STATIC_EXTENSIONS.has(lastSegment.slice(dotIndex + 1).toLowerCase())) {
                 return;
             }
 
@@ -258,4 +263,101 @@ class SessionManager {
     }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Private Constants
+// ─────────────────────────────────────────────────────────────────────────────
+
+const STATIC_EXTENSIONS = new Set([
+    // ── Styles ──────────────────────────────────────────────────────────────
+    "css", "less", "scss", "sass", "styl", "stylus", "pcss", "postcss", "sss",
+
+    // ── Scripts & Source Maps ───────────────────────────────────────────────
+    "js", "mjs", "cjs", "ts", "mts", "cts", "jsx", "tsx",
+    "map", "coffee", "litcoffee", "elm", "dart", "vue", "svelte",
+
+    // ── Images (Raster) ────────────────────────────────────────────────────
+    "png", "jpg", "jpeg", "jpe", "jfif", "gif", "bmp", "dib",
+    "tiff", "tif", "webp", "avif", "heic", "heif", "ico", "cur",
+    "psd", "psb", "ai", "eps", "raw", "cr2", "nef", "orf", "sr2", "arw",
+    "dng", "raf", "rw2", "pef", "srw", "x3f", "jxl", "qoi", "hdr", "exr",
+
+    // ── Images (Vector) ────────────────────────────────────────────────────
+    "svg", "svgz", "cgm", "emf", "wmf",
+
+    // ── Fonts ───────────────────────────────────────────────────────────────
+    "woff", "woff2", "ttf", "otf", "eot", "pfb", "pfm",
+
+    // ── Video ───────────────────────────────────────────────────────────────
+    "mp4", "m4v", "webm", "ogv", "ogg", "avi", "mov", "mkv", "flv", "wmv",
+    "mpg", "mpeg", "mpe", "3gp", "3g2", "ts", "mts", "m2ts", "vob", "divx",
+    "asf", "rm", "rmvb", "f4v", "swf", "hevc", "av1",
+
+    // ── Audio ───────────────────────────────────────────────────────────────
+    "mp3", "wav", "flac", "aac", "m4a", "wma", "opus", "oga",
+    "aiff", "aif", "aifc", "mid", "midi", "amr", "ape", "dsf", "dff",
+    "ac3", "dts", "pcm", "au", "snd", "ra", "tak", "tta", "wv", "caf",
+
+    // ── Documents & Office ──────────────────────────────────────────────────
+    "pdf", "doc", "docx", "docm", "dot", "dotx", "dotm",
+    "xls", "xlsx", "xlsm", "xlsb", "xlt", "xltx", "xltm",
+    "ppt", "pptx", "pptm", "pot", "potx", "potm", "pps", "ppsx",
+    "odt", "ods", "odp", "odg", "odf", "odb", "odc",
+    "rtf", "tex", "latex", "bib", "epub", "mobi", "azw", "azw3",
+    "djvu", "djv", "xps", "oxps", "pages", "numbers", "key", "keynote",
+
+    // ── Data & Config ───────────────────────────────────────────────────────
+    "xml", "json", "jsonl", "ndjson", "json5", "jsonc",
+    "yaml", "yml", "toml", "ini", "cfg", "conf", "properties",
+    "csv", "tsv", "dsv", "parquet", "avro", "arrow", "feather",
+    "sql", "sqlite", "db", "mdb", "accdb",
+
+    // ── Text & Markup ───────────────────────────────────────────────────────
+    "txt", "text", "md", "markdown", "rst", "adoc", "asciidoc",
+    "log", "diff", "patch", "nfo", "diz",
+    "htm", "html", "xhtml", "mhtml", "mht", "shtml",
+    "ics", "ical", "vcf", "vcard", "ldif",
+
+    // ── Archives & Compression ──────────────────────────────────────────────
+    "zip", "rar", "7z", "tar", "gz", "gzip", "bz2", "bzip2",
+    "xz", "lzma", "lz", "lz4", "zst", "zstd", "br", "brotli",
+    "cab", "arj", "ace", "lzh", "lha", "cpio", "rpm", "deb",
+    "pkg", "dmg", "iso", "img", "vhd", "vhdx", "vmdk", "ova", "ovf",
+    "apk", "ipa", "xpi", "crx", "nupkg", "snap", "flatpak", "appimage",
+    "jar", "war", "ear",
+
+    // ── Executables & Libraries ─────────────────────────────────────────────
+    "exe", "msi", "dll", "sys", "so", "dylib", "lib", "a", "o", "obj",
+    "bin", "dat", "com", "bat", "cmd", "sh", "bash", "ps1", "psm1",
+
+    // ── 3D & CAD & Design ───────────────────────────────────────────────────
+    "glb", "gltf", "obj", "stl", "fbx", "dae", "3ds", "blend", "max",
+    "c4d", "ma", "mb", "lwo", "lws", "ply", "wrl", "vrml", "x3d",
+    "dwg", "dxf", "dgn", "step", "stp", "iges", "igs", "sat",
+    "skp", "3dm", "usd", "usda", "usdc", "usdz",
+
+    // ── GIS & Mapping ───────────────────────────────────────────────────────
+    "shp", "shx", "dbf", "prj", "cpg", "geojson", "topojson",
+    "kml", "kmz", "gpx", "osm", "pbf", "mbtiles",
+
+    // ── Scientific & Research ───────────────────────────────────────────────
+    "hdf5", "h5", "hdf", "nc", "netcdf", "fits", "mat", "sav",
+
+    // ── WebAssembly & Runtime ───────────────────────────────────────────────
+    "wasm", "wat", "swc",
+
+    // ── Certificates & Keys ─────────────────────────────────────────────────
+    "pem", "crt", "cer", "der", "p12", "pfx", "p7b", "p7c",
+    "csr", "key", "pub", "asc", "gpg", "sig",
+
+    // ── Web Manifests & PWA ─────────────────────────────────────────────────
+    "webmanifest", "manifest", "browserconfig",
+
+    // ── Misc ────────────────────────────────────────────────────────────────
+    "ani", "icns", "lnk", "url", "webloc", "desktop",
+    "torrent", "metalink", "magnet",
+    "sub", "srt", "ass", "ssa", "vtt", "sbv", "dfxp", "ttml",
+    "bak", "tmp", "temp", "swp", "swo", "lock",
+    "pid", "socket", "fifo"
+]);
+
 export default SessionManager;

package/lib/Session/Session.js

@@ -31,10 +31,6 @@ class Session {
         return this.#createdAt;
     }
 
-    get lastActivity() {
-        return this.#lastActivity;
-    }
-
     /**
      * Gets a session value.
      * @param {string} key

package/lib/Support/Str.js

@@ -1,24 +1,26 @@
+import { randomBytes } from "crypto";
+
 /**
  * String utility class with helper methods.
  * Provides Laravel-style string manipulation functions.
- * 
+ *
  * @example
  * Str.slug("Hello World"); // "hello-world"
  * Str.camel("user_name");  // "userName"
  */
 class Str {
     /**
-     * Generates a random alphanumeric string.
+     * Generates a cryptographically secure random alphanumeric string.
      * @param {number} length - Desired string length
      * @returns {string} Random string
      */
     static random(length) {
         const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        const bytes = randomBytes(length);
         let result = "";
-        const charactersLength = characters.length;
 
         for (let i = 0; i < length; i++) {
-            result += characters.charAt(Math.floor(Math.random() * charactersLength));
+            result += characters.charAt(bytes[i] % characters.length);
         }
 
         return result;

package/lib/Translation/Lang.js

@@ -1,54 +1,398 @@
 import fs from "node:fs";
 import path from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
 import Paths from "../Core/Paths.js";
+import Config from "../Core/Config.js";
+import Environment from "../Core/Environment.js";
+import { pluralize, replaceParams } from "./pluralize.js";
+
+const LangStore = new AsyncLocalStorage();
+
+// Safety cap — prevents DoS via arbitrary locale strings in setLocale
+const MAX_LOCALES = 50;
 
-/**
- * Translation manager for multi-language support.
- * Loads translations from JSON files and supports parameter replacement.
- */
 class Lang {
-    static #cache = new Map();
+    static #translations = {};
+    static #flatCache = {};
+    static #mtimes = {};
+    static #fallbackLocale = null;
+
+    static setup(server) {
+        const rawLocale = Config.get("app.locale", "en");
+        const rawFallback = Config.get("app.fallback_locale") || null;
+        const defaultLocale = isValidLocale(rawLocale) ? rawLocale : "en";
+
+        Lang.#fallbackLocale = (rawFallback && isValidLocale(rawFallback)) ? rawFallback : null;
+
+        if (Environment.isDev) {
+            if (rawLocale !== defaultLocale) console.warn(`Lang: Invalid app.locale "${rawLocale}", falling back to "en"`);
+            if (rawFallback && !Lang.#fallbackLocale) console.warn(`Lang: Invalid app.fallback_locale "${rawFallback}", ignoring`);
+        }
+
+        server.addHook("onRequest", async (req) => {
+            LangStore.enterWith({ locale: defaultLocale, req, langChecked: new Set() });
+            req.locale = defaultLocale;
+        });
+
+        globalThis.__nitron_lang_get = (key, params) => Lang.get(key, params);
+    }
+
+    static get(key, params = {}) {
+        const value = this.#resolveWithFallback(key);
+
+        if (!isResolvable(value)) return key;
+
+        let result = String(value);
+
+        // Pluralize only when count is provided and value has pipe-separated segments
+        if (params && typeof params === "object" && params.count !== undefined && result.includes("|")) {
+            result = pluralize(result, params.count);
+        }
+
+        return replaceParams(result, params);
+    }
+
+    static has(key) {
+        return isResolvable(this.#resolveWithFallback(key));
+    }
+
+    static locale() {
+        const store = LangStore.getStore();
+
+        if (store) return store.locale;
+
+        return Config.get("app.locale", "en");
+    }
+
+    static setLocale(locale) {
+        if (!isValidLocale(locale)) {
+            if (Environment.isDev) {
+                console.warn(`Lang.setLocale: Invalid locale format "${locale}"`);
+            }
+            return;
+        }
+
+        const store = LangStore.getStore();
+
+        if (!store) return;
+
+        store.locale = locale;
+
+        if (store.req) {
+            store.req.locale = locale;
+        }
+    }
+
+    static getFilteredTranslations(locale, keys) {
+        this.#ensureLoaded(locale);
+
+        const flat = this.#getFlat(locale);
+
+        const fallback = Lang.#fallbackLocale;
+        let fallbackFlat = null;
+
+        if (fallback && fallback !== locale) {
+            this.#ensureLoaded(fallback);
+            fallbackFlat = this.#getFlat(fallback);
+        }
+
+        if (keys === null || keys === undefined) {
+            if (fallbackFlat) {
+                return { ...fallbackFlat, ...flat };
+            }
+            return flat;
+        }
+
+        if (keys.length === 0) {
+            return {};
+        }
+
+        const result = {};
+
+        for (const key of keys) {
+            if (flat[key] !== undefined) {
+                result[key] = flat[key];
+            }
+            else if (fallbackFlat && fallbackFlat[key] !== undefined) {
+                result[key] = fallbackFlat[key];
+            }
+        }
+
+        return result;
+    }
+
+    // --- Internal: resolve + fallback ---
+
+    static #resolveWithFallback(key) {
+        const locale = this.locale();
+
+        this.#ensureLoaded(locale);
+
+        const value = this.#resolveKey(locale, key);
+
+        if (isResolvable(value)) return value;
+
+        const fallback = Lang.#fallbackLocale;
+
+        if (fallback && fallback !== locale) {
+            this.#ensureLoaded(fallback);
+            return this.#resolveKey(fallback, key);
+        }
+
+        return value;
+    }
+
+    static #ensureLoaded(locale) {
+        if (Environment.isDev) {
+            const store = LangStore.getStore();
+
+            if (store && !store.langChecked.has(locale)) {
+                store.langChecked.add(locale);
+                this.#checkAndReload(locale);
+            }
+            else if (!this.#translations[locale]) {
+                this.#loadTranslations(locale);
+            }
+
+            return;
+        }
+
+        if (!this.#translations[locale]) {
+            if (Object.keys(this.#translations).length >= MAX_LOCALES) return;
+            this.#loadTranslations(locale);
+        }
+    }
+
+    // --- Internal: dev-mode hot reload ---
+
+    static #checkAndReload(locale) {
+        const langsDir = Paths.langs;
+
+        if (!fs.existsSync(langsDir)) {
+            if (!this.#translations[locale]) {
+                this.#translations[locale] = {};
+            }
+            return;
+        }
+
+        const singleFile = path.join(langsDir, locale + ".json");
+        const folderDir = path.join(langsDir, locale);
+
+        let changed = false;
+        const currentPaths = new Set();
+
+        // Check single file mtime
+        if (fs.existsSync(singleFile)) {
+            currentPaths.add(singleFile);
+
+            try {
+                const mtime = fs.statSync(singleFile).mtimeMs;
+                if (this.#mtimes[singleFile] !== mtime) changed = true;
+            }
+            catch {}
+        }
+
+        // Check folder files mtime (always scan to keep currentPaths complete for deletion detection)
+        if (fs.existsSync(folderDir)) {
+            try {
+                if (fs.statSync(folderDir).isDirectory()) {
+                    for (const file of fs.readdirSync(folderDir)) {
+                        if (!file.endsWith(".json")) continue;
 
-    /**
-     * Gets a translated string for the current request language.
-     * @param {import("fastify").FastifyRequest} req - Fastify request with language property
-     * @param {string} key - Translation key to look up
-     * @param {Object|null} params - Optional parameters to replace in translation (e.g., { name: "John" } for ":name")
-     * @returns {string} Translated string or the key if not found
-     */
-    static get(req, key, params = null) {
-        const currentLang = req.language;
-        const langPath = path.join(Paths.langs, currentLang + ".json");
+                        const fullPath = path.join(folderDir, file);
 
-        if (!fs.existsSync(langPath)) {
-            return key;
+                        currentPaths.add(fullPath);
+
+                        if (!changed) {
+                            try {
+                                const mtime = fs.statSync(fullPath).mtimeMs;
+                                if (this.#mtimes[fullPath] !== mtime) changed = true;
+                            }
+                            catch {}
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                if (Environment.isDev) console.warn(`Lang: Failed to scan ${folderDir}: ${err.message}`);
+            }
         }
 
-        let translations = this.#cache.get(currentLang);
+        // Detect deleted files — tracked in #mtimes but no longer on disk
+        if (!changed) {
+            for (const tracked of Object.keys(this.#mtimes)) {
+                if (isLocalePath(tracked, singleFile, folderDir) && !currentPaths.has(tracked)) {
+                    changed = true;
+                    break;
+                }
+            }
+        }
+
+        if (changed || !this.#translations[locale]) {
+            this.#loadTranslations(locale);
+        }
+    }
+
+    // --- Internal: file loading ---
+
+    static #loadTranslations(locale) {
+        const langsDir = Paths.langs;
+        const result = {};
+
+        if (!fs.existsSync(langsDir)) {
+            this.#translations[locale] = result;
+            delete this.#flatCache[locale];
+            return;
+        }
+
+        const singleFile = path.join(langsDir, locale + ".json");
+        const folderDir = path.join(langsDir, locale);
+
+        // Purge stale mtime entries for this locale before repopulating
+        for (const tracked of Object.keys(this.#mtimes)) {
+            if (isLocalePath(tracked, singleFile, folderDir)) {
+                delete this.#mtimes[tracked];
+            }
+        }
+
+        // 1. Single file: resources/langs/tr.json
+        if (fs.existsSync(singleFile)) {
+            try {
+                const mtime = fs.statSync(singleFile).mtimeMs;
+                const content = fs.readFileSync(singleFile, "utf-8");
+                const data = JSON.parse(content);
+
+                this.#mtimes[singleFile] = mtime;
+                this.#deepMerge(result, data);
+            }
+            catch (err) {
+                console.warn(`Lang: Failed to parse ${singleFile}: ${err.message}`);
+            }
+        }
+
+        // 2. Folder structure: resources/langs/tr/messages.json (wins over single file keys)
+        if (fs.existsSync(folderDir)) {
+            try {
+                if (fs.statSync(folderDir).isDirectory()) {
+                    for (const file of fs.readdirSync(folderDir)) {
+                        if (!file.endsWith(".json")) continue;
+
+                        const fullPath = path.join(folderDir, file);
+                        const namespace = file.replace(/\.json$/, "");
+
+                        try {
+                            const mtime = fs.statSync(fullPath).mtimeMs;
+                            const content = fs.readFileSync(fullPath, "utf-8");
+                            const data = JSON.parse(content);
+
+                            this.#mtimes[fullPath] = mtime;
+
+                            if (Environment.isDev && result[namespace]) {
+                                console.warn(`Lang: Key "${namespace}" in ${fullPath} overrides single file`);
+                            }
 
-        if (!translations) {
-            const langFile = fs.readFileSync(langPath, { encoding: "utf-8", flag: "r" });
-            translations = JSON.parse(langFile);
-            this.#cache.set(currentLang, translations);
+                            result[namespace] = data;
+                        }
+                        catch (err) {
+                            console.warn(`Lang: Failed to parse ${fullPath}: ${err.message}`);
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                if (Environment.isDev) console.warn(`Lang: Failed to scan ${folderDir}: ${err.message}`);
+            }
         }
 
-        let translation = translations[key] || key;
+        this.#translations[locale] = result;
+        delete this.#flatCache[locale];
+    }
+
+    // --- Internal: cache + key resolution ---
+
+    static #getFlat(locale) {
+        if (this.#flatCache[locale]) return this.#flatCache[locale];
+
+        const tree = this.#translations[locale];
+        const flat = tree ? this.#flattenTree(tree, "") : {};
+
+        this.#flatCache[locale] = flat;
+        return flat;
+    }
+
+    static #resolveKey(locale, key) {
+        const tree = this.#translations[locale];
 
-        if (params) {
-            for (const [paramKey, paramValue] of Object.entries(params)) {
-                translation = translation.replaceAll(":" + paramKey, paramValue);
+        if (!tree) return undefined;
+
+        const parts = key.split(".");
+        let current = tree;
+
+        for (const part of parts) {
+            if (current === undefined || current === null || typeof current !== "object") {
+                return undefined;
             }
+
+            if (!Object.prototype.hasOwnProperty.call(current, part)) {
+                return undefined;
+            }
+
+            current = current[part];
         }
 
-        return translation;
+        return current;
     }
 
-    /**
-     * Clears the translation cache. Useful for development hot reload.
-     */
-    static clearCache() {
-        this.#cache.clear();
+    // --- Internal: tree utilities (input is always from JSON.parse — no circular refs) ---
+
+    static #deepMerge(target, source) {
+        for (const key of Object.keys(source)) {
+            if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+
+            if (
+                typeof source[key] === "object" && source[key] !== null && !Array.isArray(source[key]) &&
+                typeof target[key] === "object" && target[key] !== null && !Array.isArray(target[key])
+            ) {
+                this.#deepMerge(target[key], source[key]);
+            }
+            else {
+                target[key] = source[key];
+            }
+        }
+    }
+
+    static #flattenTree(tree, prefix) {
+        const result = {};
+
+        for (const [key, value] of Object.entries(tree)) {
+            const fullKey = prefix ? prefix + "." + key : key;
+
+            if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+                Object.assign(result, this.#flattenTree(value, fullKey));
+            }
+            else {
+                result[fullKey] = value;
+            }
+        }
+
+        return result;
     }
 }
 
+// --- Module-level helpers ---
+
+function isResolvable(value) {
+    return value !== undefined && value !== null && typeof value !== "object";
+}
+
+function isLocalePath(tracked, singleFile, folderDir) {
+    return tracked === singleFile || tracked.startsWith(folderDir + path.sep);
+}
+
+const LOCALE_RE = /^[a-z]{2,3}(-[a-zA-Z0-9]{1,8})*$/i;
+
+function isValidLocale(locale) {
+    return typeof locale === "string" && LOCALE_RE.test(locale);
+}
+
 export default Lang;

package/lib/Translation/pluralize.js

@@ -0,0 +1,81 @@
+/**
+ * Shared translation utilities — single source of truth.
+ * Used by Lang.js (server) and jsxRuntime.js (SSR + client via .toString() embedding).
+ *
+ * IMPORTANT: These functions are embedded client-side via .toString().
+ * Do NOT use arrow functions, template literals, const/let, or modern syntax.
+ */
+
+export function pluralize(value, count) {
+    count = typeof count === "number" ? count : Number(count) || 0;
+    if (count < 0) count = 0;
+    count = Math.floor(count);
+
+    var segments = value.split("|");
+
+    // Try explicit syntax first: {0} zero items | {1} one item | [2,*] many items
+    for (var i = 0; i < segments.length; i++) {
+        var trimmed = segments[i].trim();
+
+        // Exact match: {3} exactly three
+        var exactMatch = trimmed.match(/^\{(\d+)\}\s*(.*)/);
+
+        if (exactMatch) {
+            if (parseInt(exactMatch[1]) === count) return exactMatch[2];
+            continue;
+        }
+
+        // Range match: [2,5] between two and five | [6,*] six or more
+        var rangeMatch = trimmed.match(/^\[(\d+),(\d+|\*)\]\s*(.*)/);
+
+        if (rangeMatch) {
+            var min = parseInt(rangeMatch[1]);
+            var max = rangeMatch[2] === "*" ? Infinity : parseInt(rangeMatch[2]);
+
+            if (count >= min && count <= max) return rangeMatch[3];
+            continue;
+        }
+    }
+
+    // Simple fallback: "one item|many items" (no explicit ranges)
+    if (segments.length >= 2 && !hasExplicitRanges(segments)) {
+        return count === 1 ? segments[0].trim() : segments[1].trim();
+    }
+
+    return value;
+}
+
+export function replaceParams(value, params) {
+    if (!params || typeof params !== "object") return value;
+
+    var keys = Object.keys(params);
+
+    if (keys.length === 0) return value;
+
+    // Escape regex special chars in param names
+    var escaped = [];
+
+    for (var i = 0; i < keys.length; i++) {
+        escaped.push(keys[i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    }
+
+    // Sort longest-first so :name_full matches before :name
+    escaped.sort(function(a, b) { return b.length - a.length; });
+
+    var pattern = new RegExp(":(" + escaped.join("|") + ")", "g");
+
+    return value.replace(pattern, function(match, k) {
+        if (!Object.prototype.hasOwnProperty.call(params, k)) return match;
+        var v = params[k];
+        return (v !== null && v !== undefined) ? String(v) : match;
+    });
+}
+
+// --- Internal helpers ---
+
+function hasExplicitRanges(segments) {
+    for (var i = 0; i < segments.length; i++) {
+        if (/^\s*(\{\d+\}|\[\d+,(\d+|\*)\])/.test(segments[i])) return true;
+    }
+    return false;
+}