i18ntk 3.1.2 → 3.3.0

package/utils/admin-auth.js

@@ -544,13 +544,13 @@ class AdminAuth {
         config.lastModified = new Date().toISOString();
         const success = await this.saveConfig(config);
         if (success) {
-          SecurityUtils.logSecurityEvent('pin_protection_disabled', 'info', 'PIN protection disabled (PIN retained)');
+          SecurityUtils.logSecurityEvent('pin_protection_disabled', 'info', { message: 'PIN protection disabled (PIN retained)' });
         }
         return success;
       }
       return true;
     } catch (error) {
-      SecurityUtils.logSecurityEvent('pin_protection_disable_error', 'error', `Failed to disable PIN protection: ${error.message}`);
+      SecurityUtils.logSecurityEvent('pin_protection_disable_error', 'error', { message: `Failed to disable PIN protection: ${error.message}` });
       return false;
     }
   }
@@ -566,13 +566,13 @@ class AdminAuth {
         config.lastModified = new Date().toISOString();
         const success = await this.saveConfig(config);
         if (success) {
-          SecurityUtils.logSecurityEvent('pin_protection_enabled', 'info', 'PIN protection enabled');
+          SecurityUtils.logSecurityEvent('pin_protection_enabled', 'info', { message: 'PIN protection enabled' });
         }
         return success;
       }
       return false;
     } catch (error) {
-      SecurityUtils.logSecurityEvent('pin_protection_enable_error', 'error', `Failed to enable PIN protection: ${error.message}`);
+      SecurityUtils.logSecurityEvent('pin_protection_enable_error', 'error', { message: `Failed to enable PIN protection: ${error.message}` });
       return false;
     }
   }
@@ -618,7 +618,7 @@ class AdminAuth {
   destroySession(sessionId) {
     const deleted = this.activeSessions.delete(sessionId);
     if (deleted) {
-      SecurityUtils.logSecurityEvent('admin_session_destroyed', 'info', 'Admin session destroyed');
+      SecurityUtils.logSecurityEvent('admin_session_destroyed', 'info', { message: 'Admin session destroyed' });
     }
     return deleted;
   }
@@ -643,7 +643,7 @@ class AdminAuth {
     }
     
     if (cleaned > 0) {
-      SecurityUtils.logSecurityEvent('admin_sessions_cleaned', 'info', `Cleaned up ${cleaned} expired sessions`);
+      SecurityUtils.logSecurityEvent('admin_sessions_cleaned', 'info', { message: `Cleaned up ${cleaned} expired sessions` });
     }
   }
 

package/utils/config-manager.js

@@ -720,9 +720,10 @@ async function setConfig(cfg) {
 
 async function updateConfig(patch) {
   const cfg = loadConfig();
-  deepMerge(cfg, patch);
-  // Don't save to disk - use in-memory config only
-  return cfg;
+  const cloned = clone(cfg);
+  deepMerge(cloned, patch);
+  currentConfig = cloned;
+  return cloned;
 }
 
 async function resetToDefaults() {
@@ -764,6 +765,8 @@ module.exports = {
   DEFAULT_CONFIG,
   loadConfig,
   saveConfig,
+  loadSettings: loadConfig,
+  saveSettings: saveConfig,
   getConfig,
   updateConfig,
   setConfig,

package/utils/translate/api.js

@@ -1,37 +1,11 @@
-const https = require('https');
-const http = require('http');
 const { URL } = require('url');
+const { safeHttpGet, safeHttpPost, buildGoogleTranslateUrl } = require('./safe-network');
 
 const DEFAULT_CONCURRENCY = 3;
 const DEFAULT_RETRY_COUNT = 3;
 const DEFAULT_RETRY_DELAY = 1000;
 const MAX_BACKOFF_DELAY = 30000;
 
-function httpGet(urlString, timeout = 15000) {
-  return new Promise((resolve) => {
-    const url = new URL(urlString);
-    const client = url.protocol === 'https:' ? https : http;
-    const req = client.get(urlString, { timeout }, (res) => {
-      let data = '';
-      res.on('data', (chunk) => { data += chunk; });
-      res.on('end', () => {
-        try {
-          const parsed = JSON.parse(data);
-          resolve({ ok: true, data: parsed, status: res.statusCode });
-        } catch (e) {
-          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
-        }
-      });
-    });
-    req.on('error', (e) => {
-      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
-    });
-    req.on('timeout', () => {
-      req.destroy();
-      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
-    });
-  });
-}
 
 function extractTranslation(result) {
   if (result && Array.isArray(result) && result[0]) {
@@ -44,6 +18,154 @@ function extractTranslation(result) {
   return null;
 }
 
+function normalizeProvider(provider) {
+  const value = String(provider || process.env.I18NTK_TRANSLATE_PROVIDER || 'google').trim().toLowerCase();
+  if (value === 'deepl-free' || value === 'deepl-pro') return 'deepl';
+  if (value === 'libre' || value === 'libretranslate') return 'libretranslate';
+  if (value === 'google' || value === 'gtx') return 'google';
+  return value;
+}
+
+function normalizeDeepLLanguage(code) {
+  return String(code || '').replace('-', '_').toUpperCase();
+}
+
+function getDeepLApiUrl(options = {}) {
+  if (options.deeplApiUrl) return options.deeplApiUrl;
+  if (process.env.DEEPL_API_URL) return process.env.DEEPL_API_URL;
+  return 'https://api-free.deepl.com/v2/translate';
+}
+
+function isEnabled(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function getDeepLAllowedHosts(url, options = {}) {
+  const hosts = ['api-free.deepl.com', 'api.deepl.com'];
+  if (options.allowCustomTranslateHosts || isEnabled(process.env.I18NTK_ALLOW_CUSTOM_TRANSLATE_HOSTS)) {
+    hosts.push(new URL(url).hostname);
+  }
+  return [...new Set(hosts)];
+}
+
+function parseProviderUrl(url, provider) {
+  try {
+    return { ok: true, parsed: new URL(url) };
+  } catch (error) {
+    return {
+      ok: false,
+      error: 'InvalidProviderUrl',
+      message: `${provider} provider URL is invalid: ${error.message}`,
+    };
+  }
+}
+
+function extractDeepLTranslation(data) {
+  const value = data && Array.isArray(data.translations) && data.translations[0] && data.translations[0].text;
+  return typeof value === 'string' && value.trim() ? value : null;
+}
+
+function getLibreTranslateUrl(options = {}) {
+  if (options.libreTranslateUrl) return options.libreTranslateUrl;
+  if (process.env.LIBRETRANSLATE_URL) return process.env.LIBRETRANSLATE_URL;
+  return 'https://libretranslate.com/translate';
+}
+
+function getLibreTranslateAllowedHosts(url) {
+  return [...new Set(['libretranslate.com', new URL(url).hostname])];
+}
+
+function extractLibreTranslateTranslation(data) {
+  const value = data && data.translatedText;
+  return typeof value === 'string' && value.trim() ? value : null;
+}
+
+function buildProviderRequest(text, targetLang, options = {}) {
+  const provider = normalizeProvider(options.provider);
+  const sourceLang = options.sourceLang || 'en';
+
+  if (provider === 'google') {
+    return {
+      provider,
+      method: 'GET',
+      url: buildGoogleTranslateUrl(text, sourceLang, targetLang),
+      extract: extractTranslation,
+    };
+  }
+
+  if (provider === 'deepl') {
+    const apiKey = options.deeplApiKey || process.env.DEEPL_API_KEY;
+    if (!apiKey) {
+      return {
+        provider,
+        error: 'MissingApiKey',
+        message: 'DeepL provider requires DEEPL_API_KEY in the environment or deeplApiKey in options.',
+      };
+    }
+
+    const url = getDeepLApiUrl(options);
+    const parsedUrl = parseProviderUrl(url, 'DeepL');
+    if (!parsedUrl.ok) return { provider, error: parsedUrl.error, message: parsedUrl.message };
+
+    return {
+      provider,
+      method: 'POST',
+      url,
+      body: {
+        text: [text],
+        target_lang: normalizeDeepLLanguage(targetLang),
+        source_lang: normalizeDeepLLanguage(sourceLang),
+      },
+      requestOptions: {
+        provider,
+        allowedHosts: getDeepLAllowedHosts(url, options),
+        allowedPaths: ['/v2/translate'],
+        headers: {
+          Authorization: `DeepL-Auth-Key ${apiKey}`,
+        },
+      },
+      extract: extractDeepLTranslation,
+    };
+  }
+
+  if (provider === 'libretranslate') {
+    const apiKey = options.libreTranslateApiKey || process.env.LIBRETRANSLATE_API_KEY || '';
+    const url = getLibreTranslateUrl(options);
+    const parsedUrl = parseProviderUrl(url, 'LibreTranslate');
+    if (!parsedUrl.ok) return { provider, error: parsedUrl.error, message: parsedUrl.message };
+
+    const params = new URLSearchParams({
+      q: text,
+      source: sourceLang,
+      target: targetLang,
+      format: 'text',
+    });
+    if (apiKey) params.set('api_key', apiKey);
+
+    return {
+      provider,
+      method: 'POST',
+      url,
+      body: params.toString(),
+      requestOptions: {
+        provider,
+        allowedHosts: getLibreTranslateAllowedHosts(url),
+        allowedPaths: ['/translate'],
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+      },
+      extract: extractLibreTranslateTranslation,
+    };
+  }
+
+  return {
+    provider,
+    error: 'UnsupportedProvider',
+    message: `Unsupported translation provider "${provider}". Use google, deepl, or libretranslate.`,
+  };
+}
+
 function detectRateLimitError(result) {
   if (!result.ok && result.status === 429) return true;
   if (result.ok && result.status === 429) return true;
@@ -59,6 +181,8 @@ async function translateText(text, targetLang, options = {}) {
     retryDelay = DEFAULT_RETRY_DELAY,
     customFn,
     timeout = 15000,
+    httpGet = safeHttpGet,
+    httpPost = safeHttpPost,
   } = options;
 
   if (!text || text.trim().length === 0) return { ok: true, translated: text };
@@ -72,14 +196,10 @@ async function translateText(text, targetLang, options = {}) {
     }
   }
 
-  const params = new URLSearchParams({
-    client: 'gtx',
-    sl: sourceLang,
-    tl: targetLang,
-    dt: 't',
-    q: text,
-  });
-  const url = `https://translate.googleapis.com/translate_a/single?${params.toString()}`;
+  const request = buildProviderRequest(text, targetLang, { ...options, sourceLang });
+  if (request.error) {
+    return { ok: false, translated: null, error: request.error, message: request.message };
+  }
 
   let lastError = null;
   for (let attempt = 0; attempt < retryCount; attempt++) {
@@ -88,18 +208,20 @@ async function translateText(text, targetLang, options = {}) {
       await new Promise((resolve) => setTimeout(resolve, delay));
     }
 
-    const result = await httpGet(url, timeout);
+    const result = request.method === 'POST'
+      ? await httpPost(request.url, request.body, { ...(request.requestOptions || {}), timeout })
+      : await httpGet(request.url, timeout);
 
     if (result.ok) {
-      const translated = extractTranslation(result.data);
+      const translated = request.extract(result.data);
       if (translated !== null && translated !== text) {
         return { ok: true, translated };
       }
       if (translated === text) {
         return { ok: true, translated: text };
       }
-      if (result.status === 429) {
-        lastError = { error: 'RateLimited', message: 'Google Translate rate limit hit' };
+      if (result.status === 429 || (translated === null && result.status >= 400)) {
+        lastError = { error: 'RateLimited', message: `${request.provider} rate limit hit` };
         continue;
       }
     }
@@ -109,6 +231,11 @@ async function translateText(text, targetLang, options = {}) {
       continue;
     }
 
+    if (result.error === 'TimeoutError' || result.error === 'NetworkError') {
+      lastError = { error: result.error, message: result.message || 'Network request failed, retrying' };
+      continue;
+    }
+
     lastError = { error: result.error || 'UnknownError', message: result.message || 'Request failed' };
   }
 
@@ -149,16 +276,20 @@ async function translateBatch(batch, targetLang, options = {}) {
     }
   }
 
-  const workerCount = Math.min(concurrency, batch.length);
+  const workerCount = Math.min(concurrency > 0 ? concurrency : DEFAULT_CONCURRENCY, batch.length);
   const workers = Array.from({ length: workerCount }, () => worker());
+
   await Promise.all(workers);
 
   return results;
 }
 
 module.exports = {
-  httpGet,
   extractTranslation,
+  extractDeepLTranslation,
+  extractLibreTranslateTranslation,
+  buildProviderRequest,
+  normalizeProvider,
   detectRateLimitError,
   translateText,
   translateBatch,

package/utils/translate/safe-network.js

@@ -0,0 +1,280 @@
+const https = require('https');
+const { URL } = require('url');
+const { logger } = require('../logger');
+
+const MAX_RESPONSE_SIZE = 100 * 1024;
+const ALLOWED_HOSTS = ['translate.googleapis.com', 'api-free.deepl.com', 'api.deepl.com', 'libretranslate.com'];
+const ALLOWED_PATHS = ['/translate_a/single', '/v2/translate', '/translate'];
+const USER_AGENT = 'i18ntk/3.3.0';
+
+function isEnabled(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function isPrivateIPv4(hostname) {
+  const parts = String(hostname || '').split('.');
+  if (parts.length !== 4) return false;
+
+  const bytes = parts.map((part) => {
+    if (!/^\d+$/.test(part)) return null;
+    const value = Number(part);
+    return value >= 0 && value <= 255 ? value : null;
+  });
+  if (bytes.some((part) => part === null)) return false;
+
+  const [a, b] = bytes;
+  return a === 10
+    || a === 127
+    || (a === 172 && b >= 16 && b <= 31)
+    || (a === 192 && b === 168)
+    || (a === 169 && b === 254)
+    || a === 0;
+}
+
+function isPrivateHost(hostname) {
+  const normalized = String(hostname || '').trim().toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+  return normalized === 'localhost'
+    || normalized.endsWith('.localhost')
+    || normalized === '::1'
+    || normalized.startsWith('fe80:')
+    || normalized.startsWith('fc')
+    || normalized.startsWith('fd')
+    || isPrivateIPv4(normalized);
+}
+
+function redactUrlForLog(urlString) {
+  try {
+    const parsed = new URL(urlString);
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString();
+  } catch (e) {
+    return '[invalid-url]';
+  }
+}
+
+function validateUrl(urlString, options = {}) {
+  if (!urlString || typeof urlString !== 'string') {
+    return { valid: false, error: 'InvalidUrl', message: 'URL must be a non-empty string' };
+  }
+
+  try {
+    const parsed = new URL(urlString);
+
+    if (parsed.protocol !== 'https:') {
+      return { valid: false, error: 'ProtocolError', message: 'Only HTTPS protocol is supported' };
+    }
+
+    const allowPrivateHosts = options.allowPrivateHosts || isEnabled(process.env.I18NTK_ALLOW_PRIVATE_TRANSLATE_URLS);
+    if (!allowPrivateHosts && isPrivateHost(parsed.hostname)) {
+      return {
+        valid: false,
+        error: 'PrivateHostNotAllowed',
+        message: `Host "${parsed.hostname}" is private or local. Set I18NTK_ALLOW_PRIVATE_TRANSLATE_URLS=1 only for trusted local testing.`,
+      };
+    }
+
+    const allowedHosts = options.allowedHosts || ALLOWED_HOSTS;
+    const allowedPaths = options.allowedPaths || ALLOWED_PATHS;
+
+    if (!allowedHosts.includes(parsed.hostname)) {
+      return { valid: false, error: 'HostNotAllowed', message: `Host "${parsed.hostname}" is not in the allowed list` };
+    }
+
+    if (!allowedPaths.includes(parsed.pathname)) {
+      return { valid: false, error: 'PathNotAllowed', message: `Path "${parsed.pathname}" is not in the allowed list` };
+    }
+
+    const suspiciousParams = ['redirect', 'callback', 'jsonp', 'script', 'src', 'eval', 'exec', 'url'];
+    for (const key of parsed.searchParams.keys()) {
+      const lower = key.toLowerCase();
+      if (suspiciousParams.some((s) => lower.includes(s))) {
+        return { valid: false, error: 'SuspiciousParam', message: `Query parameter "${key}" is not allowed` };
+      }
+      const value = parsed.searchParams.get(key);
+      if (value && (value.includes('<script') || value.includes('javascript:') || value.includes('data:'))) {
+        return { valid: false, error: 'SuspiciousParamValue', message: `Query parameter "${key}" contains potentially dangerous content` };
+      }
+    }
+
+    return { valid: true, url: parsed };
+  } catch (e) {
+    return { valid: false, error: 'UrlParseError', message: `Failed to parse URL: ${e.message}` };
+  }
+}
+
+function safeHttpGet(urlString, timeout = 15000) {
+  return new Promise((resolve) => {
+    const validation = validateUrl(urlString);
+    if (!validation.valid) {
+      logger.security('warn', 'Network request blocked by safe-network', {
+        url: redactUrlForLog(urlString),
+        reason: validation.error,
+        detail: validation.message,
+      });
+      resolve({ ok: false, error: validation.error, message: validation.message });
+      return;
+    }
+
+    const req = https.get(urlString, { headers: { 'User-Agent': USER_AGENT } }, (res) => {
+      let data = '';
+      let sizeExceeded = false;
+
+      res.on('data', (chunk) => {
+        if (data.length + chunk.length > MAX_RESPONSE_SIZE) {
+          if (!sizeExceeded) {
+            sizeExceeded = true;
+            req.destroy();
+            logger.security('warn', 'Network response size limit exceeded', {
+              url: redactUrlForLog(urlString),
+              limit: MAX_RESPONSE_SIZE,
+            });
+            resolve({ ok: false, error: 'ResponseTooLarge', message: `Response exceeds ${MAX_RESPONSE_SIZE} bytes limit` });
+          }
+          return;
+        }
+        data += chunk;
+      });
+
+      res.on('end', () => {
+        if (sizeExceeded) return;
+        try {
+          const parsed = JSON.parse(data);
+          logger.security('info', 'Network request completed', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: true, data: parsed, status: res.statusCode });
+        } catch (e) {
+          logger.security('warn', 'Network response parse error', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
+        }
+      });
+    });
+
+    req.setTimeout(timeout, () => {
+      req.destroy();
+      logger.security('warn', 'Network request timed out', { timeoutMs: timeout });
+      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
+    });
+
+    req.on('error', (e) => {
+      logger.security('warn', 'Network request error', {
+        code: e.code,
+        message: e.message,
+      });
+      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
+    });
+  });
+}
+
+function safeHttpPost(urlString, body, options = {}) {
+  const timeout = options.timeout || 15000;
+
+  return new Promise((resolve) => {
+    const validation = validateUrl(urlString, {
+      allowedHosts: options.allowedHosts,
+      allowedPaths: options.allowedPaths,
+      allowPrivateHosts: options.allowPrivateHosts,
+    });
+    if (!validation.valid) {
+      logger.security('warn', 'Network request blocked by safe-network', {
+        url: redactUrlForLog(urlString),
+        reason: validation.error,
+        detail: validation.message,
+      });
+      resolve({ ok: false, error: validation.error, message: validation.message });
+      return;
+    }
+
+    const payload = typeof body === 'string' ? body : JSON.stringify(body || {});
+    const headers = {
+      'User-Agent': USER_AGENT,
+      'Content-Type': options.contentType || 'application/json',
+      'Content-Length': Buffer.byteLength(payload),
+      ...(options.headers || {}),
+    };
+
+    const req = https.request(validation.url, { method: 'POST', headers }, (res) => {
+      let data = '';
+      let sizeExceeded = false;
+
+      res.on('data', (chunk) => {
+        if (data.length + chunk.length > MAX_RESPONSE_SIZE) {
+          if (!sizeExceeded) {
+            sizeExceeded = true;
+            req.destroy();
+            logger.security('warn', 'Network response size limit exceeded', {
+              url: redactUrlForLog(urlString),
+              limit: MAX_RESPONSE_SIZE,
+            });
+            resolve({ ok: false, error: 'ResponseTooLarge', message: `Response exceeds ${MAX_RESPONSE_SIZE} bytes limit` });
+          }
+          return;
+        }
+        data += chunk;
+      });
+
+      res.on('end', () => {
+        if (sizeExceeded) return;
+        try {
+          const parsed = JSON.parse(data || '{}');
+          logger.security('info', 'Network request completed', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, data: parsed, status: res.statusCode });
+        } catch (e) {
+          logger.security('warn', 'Network response parse error', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
+        }
+      });
+    });
+
+    req.setTimeout(timeout, () => {
+      req.destroy();
+      logger.security('warn', 'Network request timed out', { timeoutMs: timeout });
+      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
+    });
+
+    req.on('error', (e) => {
+      logger.security('warn', 'Network request error', {
+        code: e.code,
+        message: e.message,
+      });
+      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
+    });
+
+    req.write(payload);
+    req.end();
+  });
+}
+
+function buildGoogleTranslateUrl(text, sourceLang, targetLang) {
+  const params = new URLSearchParams({
+    client: 'gtx',
+    sl: sourceLang,
+    tl: targetLang,
+    dt: 't',
+    q: text,
+  });
+  return `https://translate.googleapis.com/translate_a/single?${params.toString()}`;
+}
+
+module.exports = {
+  safeHttpGet,
+  safeHttpPost,
+  buildGoogleTranslateUrl,
+  validateUrl,
+  isPrivateHost,
+  redactUrlForLog,
+  MAX_RESPONSE_SIZE,
+  ALLOWED_HOSTS,
+  ALLOWED_PATHS,
+};