@beechcms/api 0.4.0-preview.1 → 0.4.0-preview.11

package/src/features/draft/draft.test.ts

@@ -1,315 +0,0 @@
-/// <reference types="@cloudflare/workers-types" />
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import type { Seed } from '@beechcms/core'
-
-// --- Mock jose (auth bypass) ---
-const mockJwtVerify = vi.hoisted(() => vi.fn())
-vi.mock('jose', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('jose')>()
-  return { ...actual, jwtVerify: mockJwtVerify }
-})
-
-// --- Seed di test (hoisted so they're available inside vi.mock factory) ---
-const { DRAFT_SEED, NO_DRAFT_SEED } = vi.hoisted(() => {
-  const DRAFT_SEED = {
-    slug: 'test-articoli',
-    label: 'Articolo',
-    displayNameAlias: 'title',
-    allowDrafts: true,
-    branches: [
-      { id: 'br_01', alias: 'title', label: 'Titolo', type: 'text', requiredOnCreate: true },
-      { id: 'br_02', alias: 'body', label: 'Corpo', type: 'text' },
-    ],
-  }
-  const NO_DRAFT_SEED = {
-    slug: 'test-messaggi',
-    label: 'Messaggio',
-    displayNameAlias: 'name',
-    branches: [
-      { id: 'br_01', alias: 'name', label: 'Nome', type: 'text' },
-    ],
-  }
-  return { DRAFT_SEED, NO_DRAFT_SEED }
-})
-
-vi.mock('@beechcms/core', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@beechcms/core')>()
-  return {
-    ...actual,
-    SEED_REGISTRY: {
-      ...actual.SEED_REGISTRY,
-      'test-articoli': DRAFT_SEED,
-      'test-messaggi': NO_DRAFT_SEED,
-    },
-    getSeed: (slug: string) => {
-      if (slug === 'test-articoli') return DRAFT_SEED
-      if (slug === 'test-messaggi') return NO_DRAFT_SEED
-      return actual.getSeed(slug)
-    },
-  }
-})
-
-import app from '../../index'
-
-// --- Helpers ---
-
-const ENTRY_ID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
-
-function makeAuthHeader() {
-  return { Authorization: 'Bearer test-token' }
-}
-
-/**
- * v0.4.0 Helper: returns a row as it would appear in content_{slug} 
- */
-function makeLiveRow(overrides: Record<string, any> = {}) {
-  return {
-    id: ENTRY_ID,
-    slug: 'test-article',
-    status: 'published',
-    title: 'Titolo live',
-    body: 'Corpo live',
-    created_at: 1_000_000,
-    updated_at: 1_000_000,
-    ...overrides
-  }
-}
-
-/**
- * v0.4.0 Helper: returns a row as it would appear in content_{slug}_drafts
- */
-function makeDraftRow(overrides: Record<string, any> = {}) {
-  return {
-    entry_id: ENTRY_ID,
-    title: 'Titolo in bozza',
-    body: 'Corpo in bozza',
-    updated_at: 1_000_001,
-    ...overrides
-  }
-}
-
-function makeMockDB(options: { 
-  liveRow?: object | null, 
-  draftRow?: object | null,
-  bindCalls?: Array<{ sql: string; args: unknown[] }>
-} = {}) {
-  const { liveRow = null, draftRow = null, bindCalls = [] } = options
-
-  const prepare = vi.fn((sql: string) => ({
-    bind: vi.fn((...args: unknown[]) => {
-      bindCalls.push({ sql, args })
-      return {
-        first: vi.fn(async () => {
-          if (sql.includes('_drafts')) return draftRow
-          return liveRow
-        }),
-        run: vi.fn(async () => ({ success: true, meta: { changes: 1 } })),
-        all: vi.fn(async () => ({ results: [] })),
-      }
-    }),
-    first: vi.fn(async () => {
-       if (sql.includes('_drafts')) return draftRow
-       return liveRow
-    }),
-    run: vi.fn(async () => ({ success: true, meta: { changes: 1 } })),
-  }))
-
-  return {
-    prepare,
-    batch: vi.fn(async (stmts: any[]) => {
-      // In tests, we just assume they run fine
-      return stmts.map(() => ({ success: true }))
-    })
-  } as unknown as D1Database
-}
-
-// --- Suite ---
-
-describe('Draft feature — PUT /:slug/:id/draft', () => {
-  beforeEach(() => {
-    mockJwtVerify.mockReset()
-    mockJwtVerify.mockResolvedValue({
-      payload: { sub: 'user-1', email: 'admin@beech.local' },
-      protectedHeader: { alg: 'HS256', typ: 'JWT' },
-    })
-  })
-
-  it('returns 200 when draft is saved', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ title: 'Bozza titolo' }),
-      },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow() }) }
-    )
-    expect(res.status).toBe(200)
-    const json = await res.json<{ success: boolean }>()
-    expect(json.success).toBe(true)
-  })
-
-  it('stores aliases as column names in content_{slug}_drafts', async () => {
-    const bindCalls: Array<{ sql: string; args: unknown[] }> = []
-    const mockDB = makeMockDB({ liveRow: makeLiveRow(), bindCalls })
-
-    await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ title: 'Titolo in bozza' }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    const upsertCall = bindCalls.find((c) => c.sql.includes('INSERT INTO content_test-articoli_drafts'))
-    expect(upsertCall).toBeDefined()
-    // Column 'title' should be present in the SQL
-    expect(upsertCall!.sql).toContain('title')
-    // The value should be the second bind (first is ID)
-    expect(upsertCall!.args[1]).toBe('Titolo in bozza')
-  })
-
-  it('returns 405 when seed does not allow drafts', async () => {
-    const res = await app.request(
-      `/api/content/test-messaggi/${ENTRY_ID}/draft`,
-      {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ name: 'test' }),
-      },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow() }) }
-    )
-    expect(res.status).toBe(405)
-  })
-
-  it('returns 404 when entry does not exist', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ title: 'Test' }),
-      },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: null }) }
-    )
-    expect(res.status).toBe(404)
-  })
-})
-
-describe('Draft feature — GET /:slug/:id/draft', () => {
-  beforeEach(() => {
-    mockJwtVerify.mockReset()
-    mockJwtVerify.mockResolvedValue({
-      payload: { sub: 'user-1', email: 'admin@beech.local' },
-      protectedHeader: { alg: 'HS256', typ: 'JWT' },
-    })
-  })
-
-  it('returns draft data with aliases', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      { headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow(), draftRow: makeDraftRow() }) }
-    )
-    expect(res.status).toBe(200)
-    const json = await res.json<{ data: Record<string, unknown> }>()
-    expect(json.data.title).toBe('Titolo in bozza')
-    expect(json.data.body).toBe('Corpo in bozza')
-  })
-
-  it('returns 404 when no draft exists', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      { headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow(), draftRow: null }) }
-    )
-    expect(res.status).toBe(404)
-  })
-
-  it('returns 404 when entry does not exist', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      { headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: null }) }
-    )
-    expect(res.status).toBe(404)
-  })
-})
-
-describe('Draft feature — POST /:slug/:id/draft/publish', () => {
-  beforeEach(() => {
-    mockJwtVerify.mockReset()
-    mockJwtVerify.mockResolvedValue({
-      payload: { sub: 'user-1', email: 'admin@beech.local' },
-      protectedHeader: { alg: 'HS256', typ: 'JWT' },
-    })
-  })
-
-  it('returns 200 and promotes draft to live', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft/publish`,
-      { method: 'POST', headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow(), draftRow: makeDraftRow() }) }
-    )
-    expect(res.status).toBe(200)
-    const json = await res.json<{ success: boolean }>()
-    expect(json.success).toBe(true)
-  })
-
-  it('uses DB.batch to update live table and delete draft', async () => {
-    const mockDB = makeMockDB({ liveRow: makeLiveRow(), draftRow: makeDraftRow() })
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft/publish`,
-      { method: 'POST', headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-    expect(res.status).toBe(200)
-    expect(mockDB.batch).toHaveBeenCalled()
-  })
-
-  it('returns 404 when no pending draft exists', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft/publish`,
-      { method: 'POST', headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow(), draftRow: null }) }
-    )
-    expect(res.status).toBe(404)
-  })
-})
-
-describe('Draft feature — DELETE /:slug/:id/draft', () => {
-  beforeEach(() => {
-    mockJwtVerify.mockReset()
-    mockJwtVerify.mockResolvedValue({
-      payload: { sub: 'user-1', email: 'admin@beech.local' },
-      protectedHeader: { alg: 'HS256', typ: 'JWT' },
-    })
-  })
-
-  it('returns 200 when draft is discarded', async () => {
-    const res = await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      { method: 'DELETE', headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: makeMockDB({ liveRow: makeLiveRow(), draftRow: makeDraftRow() }) }
-    )
-    expect(res.status).toBe(200)
-    const json = await res.json<{ success: boolean }>()
-    expect(json.success).toBe(true)
-  })
-
-  it('issues DELETE FROM content_{slug}_drafts', async () => {
-    const bindCalls: Array<{ sql: string; args: unknown[] }> = []
-    const mockDB = makeMockDB({ liveRow: makeLiveRow(), bindCalls })
-
-    await app.request(
-      `/api/content/test-articoli/${ENTRY_ID}/draft`,
-      { method: 'DELETE', headers: makeAuthHeader() },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    const deleteCall = bindCalls.find((c) => c.sql.includes('DELETE FROM content_test-articoli_drafts'))
-    expect(deleteCall).toBeDefined()
-  })
-})

package/src/features/rotate-field/rotate-field.test.ts

@@ -1,297 +0,0 @@
-/// <reference types="@cloudflare/workers-types" />
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import type { Seed } from '@beechcms/core'
-
-// --- Mock jose (auth bypass) ---
-const mockJwtVerify = vi.hoisted(() => vi.fn())
-vi.mock('jose', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('jose')>()
-  return { ...actual, jwtVerify: mockJwtVerify }
-})
-
-// --- Test seed with a privacy:hash field (hoisted so it's available inside vi.mock factory) ---
-const { HASH_SEED } = vi.hoisted(() => {
-  const HASH_SEED = {
-    slug: 'test-members',
-    label: 'Member',
-    displayNameAlias: 'name',
-    branches: [
-      { id: 'br_01', alias: 'name', label: 'Name', type: 'text', requiredOnCreate: true },
-      {
-        id: 'br_02',
-        alias: 'password',
-        label: 'Password',
-        type: 'text',
-        policies: { privacy: 'hash' },
-      },
-    ],
-  }
-  return { HASH_SEED }
-})
-
-// Override getSeed and SEED_REGISTRY for the test slug only
-vi.mock('@beechcms/core', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@beechcms/core')>()
-  return {
-    ...actual,
-    SEED_REGISTRY: {
-      ...actual.SEED_REGISTRY,
-      'test-members': HASH_SEED,
-    },
-    getSeed: (slug: string) => (slug === 'test-members' ? HASH_SEED : actual.getSeed(slug)),
-  }
-})
-
-import app from '../../index'
-
-// --- Helpers ---
-
-async function sha256hex(value: string): Promise<string> {
-  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))
-  return Array.from(new Uint8Array(buf))
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('')
-}
-
-function makeAuthHeader() {
-  return { Authorization: 'Bearer test-token' }
-}
-
-// v0.4.0: entry has real columns (no JSON blob)
-function makeEntry(id: string, dbData: Record<string, unknown>) {
-  return {
-    id,
-    slug: 'member-1',
-    status: 'published',
-    name: dbData.name ?? null,
-    password: dbData.password ?? dbData.br_02 ?? null,  // accept both alias and old id for compat
-    created_at: 1000000,
-    updated_at: 1000000,
-  }
-}
-
-function makeMockDB(row: object | null, updateCapture?: { called: boolean }) {
-  return {
-    prepare: vi.fn((sql: string) => ({
-      bind: vi.fn(() => ({
-        first: vi.fn(() => Promise.resolve(row)),
-        run: vi.fn(() => {
-          if (updateCapture && sql.includes('UPDATE')) updateCapture.called = true
-          return Promise.resolve({ success: true, meta: { changes: 1 } })
-        }),
-        all: vi.fn(() => Promise.resolve({ results: row ? [row] : [] })),
-      })),
-      first: vi.fn(() => Promise.resolve(row)),
-      run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
-    })),
-  }
-}
-
-const ENTRY_ID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
-const CURRENT_PLAINTEXT = 'old-secret'
-const NEXT_PLAINTEXT = 'new-secret'
-
-// --- Tests ---
-
-describe('POST /:slug/:id/rotate-field', () => {
-  beforeEach(() => {
-    mockJwtVerify.mockReset()
-    mockJwtVerify.mockResolvedValue({
-      payload: { sub: 'user-1', email: 'admin@beech.local' },
-      protectedHeader: { alg: 'HS256', typ: 'JWT' },
-    })
-  })
-
-  it('returns 200 and updates the field when current matches', async () => {
-    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
-    const updateCapture = { called: false }
-    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }), updateCapture)
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(200)
-    const json = await res.json<{ success: boolean }>()
-    expect(json.success).toBe(true)
-    expect(updateCapture.called).toBe(true)
-  })
-
-  it('returns 403 when current does not match stored hash', async () => {
-    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
-    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }))
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: 'wrong-value', next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(403)
-  })
-
-  it('returns 404 when entry does not exist', async () => {
-    const mockDB = makeMockDB(null)
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(404)
-  })
-
-  it('returns 404 when seed does not exist', async () => {
-    const mockDB = makeMockDB(null)
-
-    const res = await app.request(
-      `/api/content/unknown-seed/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(404)
-  })
-
-  it('returns 400 when field does not exist in the seed', async () => {
-    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
-    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }))
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'nonexistent', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(400)
-  })
-
-  it('returns 422 when field does not use hash privacy', async () => {
-    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_01: 'Alice' }))
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'name', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(422)
-  })
-
-  it('returns 422 when the field has no stored value', async () => {
-    // Entry exists but br_02 is not in data
-    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_01: 'Alice' }))
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(422)
-  })
-
-  it('returns 400 when body is missing required fields', async () => {
-    const mockDB = makeMockDB(null)
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password' }), // missing current and next
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(400)
-  })
-
-  it('returns 401 when not authenticated', async () => {
-    mockJwtVerify.mockRejectedValueOnce(new Error('invalid token'))
-    const mockDB = makeMockDB(null)
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(401)
-  })
-
-  it('stores a new SHA-256 hash (not the plaintext) after rotation', async () => {
-    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
-    const bindCalls: Array<{ sql: string; args: unknown[] }> = []
-
-    const mockDB = {
-      prepare: vi.fn((sql: string) => ({
-        bind: vi.fn((...args: unknown[]) => {
-          bindCalls.push({ sql, args })
-          return {
-            first: vi.fn(() => Promise.resolve(makeEntry(ENTRY_ID, { br_02: storedHash }))),
-            run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
-            all: vi.fn(() => Promise.resolve({ results: [] })),
-          }
-        }),
-        first: vi.fn(() => Promise.resolve(makeEntry(ENTRY_ID, { br_02: storedHash }))),
-        run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
-      })),
-    }
-
-    const res = await app.request(
-      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
-        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
-      },
-      { JWT_SECRET: 'test-secret', DB: mockDB }
-    )
-
-    expect(res.status).toBe(200)
-    // v0.4.0: UPDATE content_test-members SET password = ?, updated_at = ? WHERE id = ?
-    const updateCall = bindCalls.find((c) => c.sql.includes('UPDATE content_test-members'))
-    expect(updateCall).toBeDefined()
-    // args[0] = password hash value (real column, not JSON blob)
-    const savedHash = updateCall!.args[0] as string
-    expect(savedHash).not.toBe(NEXT_PLAINTEXT)
-    expect(savedHash).toMatch(/^[0-9a-f]{64}$/)
-    expect(savedHash).toBe(await sha256hex(NEXT_PLAINTEXT))
-  })
-})