glashjs 0.14.2 → 0.15.0

package/bin/glash.mjs

@@ -124,6 +124,8 @@ async function main() {
         auth: optionBool('--no-auth', undefined),
         sqlRunner: optionBool('--no-sql-runner', undefined),
         aiPrompts: optionBool('--no-ai-prompts', undefined),
+        translate: optionBool('--no-translate', undefined),
+        animation: flag('--animation') ? true : undefined,
       });
       break;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glashjs",
-  "version": "0.14.2",
+  "version": "0.15.0",
   "description": "glashjs — The Postgres-native full-stack framework for builders who want to ship without DevOps. Framework, hosting, database, auth, and deploy in one GlashDB-native runtime.",
   "type": "module",
   "bin": {

package/src/create.mjs

@@ -111,7 +111,7 @@ function projectFiles(answers) {
     '.env.local': envLocal(answers),
     'glash.config.mjs': configFile(answers, hasCss),
     'README.md': projectReadme(answers),
-    'routes/_layout.jsx': layoutRoute(answers),
+    'routes/_layout.jsx': layoutRoute(),
     'routes/index.jsx': indexRoute(answers),
     'routes/api/health.mjs': healthRoute(),
     'db/schema.sql': schemaSql(answers),
@@ -119,7 +119,6 @@ function projectFiles(answers) {
     ...(answers.css === 'tailwind' ? { 'styles/input.css': tailwindInput() } : {}),
     ...(answers.auth ? authRoutes() : {}),
     ...(answers.sqlRunner ? sqlRunnerRoutes() : {}),
-    ...(answers.translate ? { 'routes/api/_glash/geo.mjs': geoRoute() } : {}),
     ...(answers.animation ? { 'routes/demo/motion.jsx': motionDemoRoute() } : {}),
     ...(answers.aiPrompts ? { '.glash/prompts/deploy.md': aiDeployPrompt(answers) } : {}),
     'public/favicon.svg': faviconSvg(),
@@ -136,6 +135,11 @@ export default defineConfig({
   publicDir: 'public',
   outDir: '.glash/out',
   offline: true,
+  // Built-in IP auto-translation: detect the visitor's country and offer a
+  // one-tap in-place translation into their native language. The framework
+  // serves the runtime + geo endpoint and relaxes the CSP for the translate
+  // widget automatically — no route or layout wiring needed.
+  i18n: ${answers.translate ? 'true' : 'false'},
   favicon: 'node_modules/glashjs/templates/glash_favicon.svg',
   animatedFavicon: false,
   stylesheets: ${hasCss ? "['/app.css']" : '[]'},
@@ -149,19 +153,10 @@ export default defineConfig({
 `;
 }
 
-function layoutRoute(answers = {}) {
-  const t = answers.translate;
-  const imports = [`import { Link } from 'glashjs/link';`];
-  if (t) {
-    imports.push(`import { useEffect } from 'preact/hooks';`);
-    imports.push(`import { glashAutoTranslate } from 'glashjs/i18n';`);
-  }
-  return `${imports.join('\n')}
+function layoutRoute() {
+  return `import { Link } from 'glashjs/link';
 
-export default function RootLayout({ children }) {${t ? `
-  // Built-in IP auto-translation: detect the visitor's country and offer to
-  // translate the page into their native language. Reads /api/_glash/geo.
-  useEffect(() => { glashAutoTranslate(); }, []);` : ''}
+export default function RootLayout({ children }) {
   return (
     <div className="shell">
       <header className="nav">
@@ -178,16 +173,6 @@ export default function RootLayout({ children }) {${t ? `
 `;
 }
 
-function geoRoute() {
-  return `// IP -> country -> native language, read from the edge geo header
-// (CF-IPCountry / X-Glash-Country on glashDB hosting). The client i18n runtime
-// calls this to decide whether to offer auto-translation.
-import { geoRouteHandler } from 'glashjs/i18n';
-
-export const GET = geoRouteHandler;
-`;
-}
-
 function motionDemoRoute() {
   return `import { useEffect, useRef } from 'preact/hooks';
 import { animate } from 'motion';

package/src/security/headers.mjs

@@ -11,14 +11,37 @@ import { createHash } from 'node:crypto';
  * builds hash/nonce-based, so XSS via injected <script> is blocked by default.
  * Pass `connectSrc` to allow your API/realtime origins.
  */
+// Google Translate widget origins used by the built-in i18n auto-translation.
+// Scripts stay nonce-based (no 'unsafe-inline'): GT's element.js loads as an
+// EXTERNAL script from these origins and fetches translations over XHR, so the
+// framework's strict, nonce-based script CSP is preserved. Only style-src gains
+// 'unsafe-inline' (low-risk) for the inline styles GT applies to translated text.
+const I18N_CSP = {
+  script: ['https://translate.google.com', 'https://translate.googleapis.com', 'https://www.gstatic.com'],
+  style: ["'unsafe-inline'", 'https://www.gstatic.com'],
+  img: ['https://translate.google.com', 'https://translate.googleapis.com', 'https://www.gstatic.com'],
+  connect: ['https://translate.googleapis.com', 'https://ipapi.co'],
+  frame: ['https://translate.google.com'],
+};
+const merge = (base, extra) => [...new Set([...base, ...extra])];
+
 export function buildCsp({
   connectSrc = ["'self'"],
   imgSrc = ["'self'", 'data:', 'blob:'],
   mediaSrc = ["'self'", 'blob:'],
   styleSrc = ["'self'"],
   scriptSrc = ["'self'"],
+  frameSrc = ["'self'"],
   nonce,
+  i18n = false,
 } = {}) {
+  if (i18n) {
+    scriptSrc = merge(scriptSrc, I18N_CSP.script);
+    styleSrc = merge(styleSrc, I18N_CSP.style);
+    imgSrc = merge(imgSrc, I18N_CSP.img);
+    connectSrc = merge(connectSrc, I18N_CSP.connect);
+    frameSrc = merge(frameSrc, I18N_CSP.frame);
+  }
   const script = nonce ? [...scriptSrc, `'nonce-${nonce}'`] : scriptSrc;
   const directives = {
     'default-src': ["'self'"],
@@ -31,6 +54,7 @@ export function buildCsp({
     'img-src': imgSrc,
     'media-src': mediaSrc,
     'connect-src': connectSrc,
+    'frame-src': frameSrc,
     'worker-src': ["'self'"],
     'manifest-src': ["'self'"],
     'upgrade-insecure-requests': [],

package/src/server/server.mjs

@@ -76,6 +76,17 @@ export async function createGlashServer({ root = process.cwd(), dev = false } =
       if (pathname === '/_glash/nav.js') {
         return send(res, 200, 'text/javascript; charset=utf-8', NAV_CLIENT, { ...secHeaders, 'cache-control': dev ? 'no-store' : 'public, max-age=31536000, immutable' });
       }
+      // Built-in IP auto-translation runtime + geo endpoint (config: i18n).
+      if (cfg.i18n) {
+        if (pathname === '/_glash/i18n.js') {
+          return send(res, 200, 'text/javascript; charset=utf-8', I18N_CLIENT, { ...secHeaders, 'cache-control': dev ? 'no-store' : 'public, max-age=31536000, immutable' });
+        }
+        // Geo endpoint: an app-defined routes/api/_glash/geo.mjs wins; otherwise
+        // the framework answers from the edge country header.
+        if (pathname === '/api/_glash/geo' && !matchRoute(routes, pathname)) {
+          return send(res, 200, 'application/json', JSON.stringify(geoRouteHandler({ headers: req.headers })), { ...secHeaders, 'cache-control': 'no-store' });
+        }
+      }
       // Static first: in production this serves prebuilt /_glash/<id>.js bundles
       // (written by `glash build`) — no runtime esbuild needed.
       if (await serveStatic(res, outDir, pathname, req, secHeaders)) return;
@@ -182,6 +193,7 @@ async function handlePage(res, mod, ctx, cfg, secHeaders, dev) {
     body: page.body ?? '',
     offline: cfg.offline,
     animatedFavicon: !!cfg.animatedFavicon,
+    i18n: cfg.i18n,
     nonce, dev,
   });
   send(res, page.status || 200, 'text/html; charset=utf-8', docHtml, { ...pageHeaders(cfg, secHeaders, nonce), ...(page.headers || {}) });
@@ -207,7 +219,7 @@ async function handleComponentPage(res, route, ctx, cfg, secHeaders, root, route
   // external 'self' module — both pass the strict CSP without 'unsafe-inline'.
   const head = renderStylesheets(cfg) + renderMeta(meta) + `<script type="application/json" id="glash-props">${safeJson(props)}</script>`;
   const { open, tail } = documentParts({
-    title, head, offline: cfg.offline, animatedFavicon: !!cfg.animatedFavicon, nonce, dev,
+    title, head, offline: cfg.offline, animatedFavicon: !!cfg.animatedFavicon, i18n: cfg.i18n, nonce, dev,
   });
   const bundleTag = `</div><script type="module" src="/_glash/${id}.js"></script>`;
   res.writeHead(200, { ...pageHeaders(cfg, secHeaders, nonce), 'content-type': 'text/html; charset=utf-8' });
@@ -256,7 +268,7 @@ async function resolveMeta(metadata, ctx) {
 // Per-request page headers: a fresh CSP carrying this request's script nonce, so
 // the framework's own inline <script>s run while injected scripts stay blocked.
 function pageHeaders(cfg, secHeaders, nonce) {
-  const csp = securityHeaders({ ...(cfg.security || {}), csp: { ...((cfg.security || {}).csp || {}), nonce } })['Content-Security-Policy'];
+  const csp = securityHeaders({ ...(cfg.security || {}), csp: { ...((cfg.security || {}).csp || {}), nonce, i18n: !!cfg.i18n } })['Content-Security-Policy'];
   return { ...secHeaders, 'Content-Security-Policy': csp };
 }