@beechcms/api 0.4.0-preview.1 → 0.4.0-preview.11

package/src/index.ts

@@ -1,344 +1,24 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import type { Context } from 'hono'
-import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
 import { createBeechApp } from './factory'
-import { SEED_REGISTRY } from '@beechcms/core'
-import { AUTH_ERRORS } from './auth/constants'
-import {
-  parseLoginBody,
-  validateLoginInput,
-  findUserByEmail,
-  verifyPassword,
-  DUMMY_PASSWORD_HASH,
-} from './auth/login'
-import {
-  generateRefreshToken,
-  saveRefreshToken,
-  generateAccessToken,
-  validateRefreshToken,
-  revokeRefreshToken,
-} from './auth/refresh'
-import { authMiddleware } from './middleware'
-import { contentRoutes } from './content'
-import { widgetApp } from './widget'
-// TODO: refactor — rotate-field è una VSA slice. Il resto di index.ts (auth inline, content monolith)
-// va migrato a slices dedicati sotto src/features/ seguendo lo stesso pattern.
-import { rotateFieldApp } from './features/rotate-field'
-import { passwordResetApp } from './features/password-reset'
-import { setupApp } from './features/setup'
-import { draftApp } from './features/draft'
-import { settingsApp } from './features/settings/settings.handler'
-import { notificationsApp } from './features/notifications'
-import { statsApp } from './features/stats'
-import { uploadRoutes, serveMediaHandler } from './upload'
-import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
-import { searchRouter } from "./search"
-import type { Env, Variables } from './types'
 
-// --- Costanti e helper ---
-
-/** Giorni di validità del refresh token */
-const REFRESH_TOKEN_EXPIRY_DAYS = 7
-
-/** Secondi in un giorno (per maxAge cookie) */
-const SECONDS_PER_DAY = 24 * 60 * 60
-
-/** Restituisce true se la richiesta è su HTTPS */
-function isRequestSecure(url: string): boolean {
-  return new URL(url).protocol === 'https:'
-}
-
-/** Estrae l'IP del client (header Cloudflare) o 'unknown' se non disponibile */
-function getClientIp(headers: Headers): string {
-  return headers.get('cf-connecting-ip') ?? 'unknown'
-}
-
-/** Opzioni comuni per il cookie refresh_token */
-function getRefreshTokenCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    maxAge: REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
-    path: '/auth',
-  }
-}
-
-function getRefreshTokenDeleteCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    path: '/auth',
-  }
-}
-
-/** Logga l'errore solo in sviluppo e restituisce risposta 500 generica */
-function handleAuthError(
-  c: Context<{ Bindings: Env; Variables: Variables }>,
-  err: unknown,
-  operationName: string
-): Response {
-  if (c.env.ENV !== 'production') {
-    console.error(`${operationName} error:`, err)
-  }
-  return c.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
-}
-
-// --- App ---
-
-const app = createBeechApp({ seeds: Object.values(SEED_REGISTRY) })
-
-// Rota root di test
-app.get('/', (c) => c.text('Beech API is running!'))
-
-/** Estrae il seed slug dalle route pubbliche (/api/v1/public/:seed).
- *  Restituisce '' per tutte le altre route (metrica globale). */
-function extractPublicSeed(path: string): string {
-  const match = path.match(/^\/api\/v1\/public\/([^/?]+)/)
-  return match ? match[1] : ''
+/**
+ * Entry point per lo sviluppo locale del monorepo.
+ * Carica dinamicamente seed.ts o seeds.ts dalla root di apps/api se presenti.
+ */
+let seeds: any = []
+
+try {
+  // @ts-ignore
+  const mod = await import('../seed.ts')
+  const registry = mod.default || mod.SEED_REGISTRY || mod
+  seeds = (typeof registry === 'object' && !Array.isArray(registry)) 
+    ? Object.values(registry) 
+    : registry
+} catch (e) {
+  // Fallback se seed.ts non esiste
 }
 
-// Middleware Analytics: traccia le richieste per la dashboard (Cloudflare-style metrics)
-app.use('/api/*', async (c, next) => {
-  await next()
-  
-  // Tracciamo solo richieste andate a buon fine (2xx) e non OPTIONS
-  if (c.req.method !== 'OPTIONS' && c.res.status >= 200 && c.res.status < 300) {
-    const db = c.env.DB
-    // Protezione per ambienti (es. test) dove executionCtx non è definito
-    let executionCtx: { waitUntil: (p: Promise<any>) => void } | undefined
-    try {
-      executionCtx = c.executionCtx
-    } catch {
-      // In ambiente di test Hono lancia se non presente
-    }
-
-    if (db && executionCtx) {
-      // Usa waitUntil per non bloccare la risposta al client
-      const seed = extractPublicSeed(c.req.path)
-      executionCtx.waitUntil((async () => {
-        try {
-          const today = Math.floor(new Date().setHours(0, 0, 0, 0) / 1000)
-
-          // Incrementa contatore richieste: seed='' per route interne, seed='articoli' per public API
-          await db.prepare(
-            `INSERT INTO analytics (day_ts, metric, seed, value)
-             VALUES (?, 'requests', ?, 1)
-             ON CONFLICT(day_ts, metric, seed) DO UPDATE SET value = value + 1`
-          ).bind(today, seed).run()
-        } catch (err) {
-          console.error('Analytics middleware error:', err)
-        }
-      })())
-    }
-  }
-})
-
-// POST /auth/login: autenticazione con email e password + refresh token
-app.post('/auth/login', async (c) => {
-  try {
-    let body: unknown
-    try {
-      body = await c.req.json()
-    } catch {
-      return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-    }
-
-    const credentials = parseLoginBody(body)
-    if (!credentials) {
-      return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-    }
-
-    const { email, password } = credentials
-    if (!validateLoginInput(email, password)) {
-      return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-    }
-
-    // Rate limiting: 5 tentativi per IP+email ogni 60 secondi
-    const loginLimiter = c.env.LOGIN_RATE_LIMITER
-    if (loginLimiter) {
-      const clientIp = getClientIp(c.req.raw.headers)
-      const { success } = await loginLimiter.limit({ key: `${clientIp}:${email}` })
-      if (!success) {
-        return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
-    }
-
-    const { DB, JWT_SECRET } = c.env
-    const user = await findUserByEmail(DB, email)
-    // Sempre verifyPassword per evitare timing attack (utente non trovato vs password errata)
-    const hashToCompare = user?.password_hash ?? DUMMY_PASSWORD_HASH
-    const isValid = await verifyPassword(password, hashToCompare)
-
-    if (!user || !isValid) {
-      return c.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
-    }
-
-    // Recupera name per includerlo nel JWT
-    const userProfile = await DB.prepare('SELECT name FROM users WHERE id = ? LIMIT 1').bind(user.id).first<{ name: string | null }>()
-
-    // Genera access token (15min) e refresh token (7 giorni)
-    const accessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-      issuer: c.env.JWT_ISSUER,
-      audience: c.env.JWT_AUDIENCE,
-    }, userProfile?.name ?? undefined)
-    const refreshToken = generateRefreshToken()
-
-    // Salva refresh token in DB (hashed)
-    await saveRefreshToken(DB, user.id, refreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-
-    setCookie(c, 'refresh_token', refreshToken, {
-      ...getRefreshTokenCookieOptions(isRequestSecure(c.req.url)),
-    })
-
-    // Restituisci solo access token nel body
-    return c.json({ token: accessToken, expiresIn: '15m' }, 200)
-  } catch (err) {
-    return handleAuthError(c, err, 'Login')
-  }
-})
-
-// POST /auth/refresh: ottieni nuovo access token usando refresh token
-app.post('/auth/refresh', async (c) => {
-  try {
-    // Rate limiting: 20 richieste per IP ogni 60 secondi
-    const refreshLimiter = c.env.REFRESH_RATE_LIMITER
-    if (refreshLimiter) {
-      const clientIp = getClientIp(c.req.raw.headers)
-      const { success } = await refreshLimiter.limit({ key: clientIp })
-      if (!success) {
-        return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
-    }
-
-    // Leggi refresh token dal cookie usando helper Hono
-    const refreshToken = getCookie(c, 'refresh_token')
-
-    if (!refreshToken) {
-      return c.json({ error: 'Refresh token missing' }, 401)
-    }
-
-    const { DB, JWT_SECRET } = c.env
-
-    // Valida refresh token
-    const validation = await validateRefreshToken(DB, refreshToken)
-    if (!validation.valid || !validation.userId) {
-      return c.json({ error: 'Invalid refresh token' }, 401)
-    }
-
-    // Ottieni info utente per generare nuovo access token
-    const user = await DB.prepare(
-      'SELECT id, email, name FROM users WHERE id = ? LIMIT 1'
-    ).bind(validation.userId).first<{ id: string; email: string; name: string | null }>()
-
-    if (!user) {
-      return c.json({ error: 'User not found' }, 401)
-    }
-
-    // ROTAZIONE: Invalida vecchio refresh token
-    const revoked = await revokeRefreshToken(DB, refreshToken)
-    if (!revoked) {
-      // Token già consumato/revocato (race) o appena scaduto: tratta come invalido.
-      return c.json({ error: 'Invalid refresh token' }, 401)
-    }
-
-    // Genera NUOVO access token e NUOVO refresh token
-    const newAccessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-      issuer: c.env.JWT_ISSUER,
-      audience: c.env.JWT_AUDIENCE,
-    }, user.name ?? undefined)
-    const newRefreshToken = generateRefreshToken()
-
-    // Salva nuovo refresh token in DB
-    await saveRefreshToken(DB, user.id, newRefreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-
-    setCookie(c, 'refresh_token', newRefreshToken, {
-      ...getRefreshTokenCookieOptions(isRequestSecure(c.req.url)),
-    })
-
-    // Restituisci nuovo access token
-    return c.json({ token: newAccessToken, expiresIn: '15m' }, 200)
-  } catch (err) {
-    return handleAuthError(c, err, 'Refresh')
-  }
-})
-
-// POST /auth/logout: invalida refresh token e cancella cookie
-app.post('/auth/logout', async (c) => {
-  try {
-    // Leggi refresh token dal cookie usando helper Hono
-    const refreshToken = getCookie(c, 'refresh_token')
-
-    if (refreshToken) {
-      await revokeRefreshToken(c.env.DB, refreshToken)
-    }
-
-    deleteCookie(c, 'refresh_token', {
-      ...getRefreshTokenDeleteCookieOptions(isRequestSecure(c.req.url)),
-    })
-
-    return c.json({ message: 'Logged out' }, 200)
-  } catch (err) {
-    return handleAuthError(c, err, 'Logout')
-  }
-})
-
-// First-run setup: GET /auth/setup, POST /auth/setup (pubblici, bloccati dopo il primo utente)
-app.route('/', setupApp)
-
-// Password reset: GET /auth/features, POST /auth/forgot-password, POST /auth/reset-password (pubblici)
-app.route('/', passwordResetApp)
-
-// API Settings: gestione profilo e preferenze utente, protetto da JWT
-const apiSettings = new Hono<{ Bindings: Env; Variables: Variables }>()
-apiSettings.use('*', async (c, next) => {
-  await authMiddleware(c.env.JWT_SECRET, {
-    issuer: c.env.JWT_ISSUER,
-    audience: c.env.JWT_AUDIENCE,
-  })(c, next)
-})
-apiSettings.route('/', settingsApp)
-app.route('/api/settings', apiSettings)
-
-// API Content: CRUD universale protetto da JWT
-const apiContent = new Hono<{ Bindings: Env; Variables: Variables }>()
-apiContent.use('*', async (c, next) => {
-  await authMiddleware(c.env.JWT_SECRET, {
-    issuer: c.env.JWT_ISSUER,
-    audience: c.env.JWT_AUDIENCE,
-  })(c, next)
-})
-// Specific routes before wildcard content routes to avoid pattern conflicts
-apiContent.route('/', notificationsApp)
-apiContent.route('/', statsApp)
-apiContent.route('/', rotateFieldApp)
-apiContent.route('/', draftApp)
-apiContent.route('/', contentRoutes)
-app.route('/api/content', apiContent)
-app.route('/api/search', searchRouter)
-
-// API Widget: endpoint aggregati per i widget della dashboard, protetti da JWT
-const apiWidget = new Hono<{ Bindings: Env; Variables: Variables }>()
-apiWidget.use('*', async (c, next) => {
-  await authMiddleware(c.env.JWT_SECRET, {
-    issuer: c.env.JWT_ISSUER,
-    audience: c.env.JWT_AUDIENCE,
-  })(c, next)
-})
-apiWidget.route('/', widgetApp)
-app.route('/api/widget', apiWidget)
-
-// API Upload: POST /api/upload (JWT) + GET /api/media/:key (pubblico)
-app.route('/api', uploadRoutes)
-app.get('/api/media/:key', (c) => serveMediaHandler(c))
+const app = createBeechApp({ seeds })
 
-// API Pubblica: endpoint per consumatori esterni, protetti da API Key
-const apiPublic = new Hono<{ Bindings: Env; Variables: Variables }>()
-apiPublic.use('*', publicRateLimitMiddleware())
-apiPublic.use('*', apiKeyMiddleware())
-apiPublic.route('/', publicRoutes)
-app.route('/api/v1/public', apiPublic)
+app.get('/', (c) => c.text('Beech API is running (Local Dev Mode)'))
 
 export default app

package/src/middleware/repository.middleware.ts

@@ -0,0 +1,18 @@
+import { createMiddleware } from 'hono/factory'
+import { D1ContentRepository } from '../shared/content.repository.d1'
+import { D1IdempotencyRepository } from '../shared/idempotency.repository.d1'
+import type { ContentRepository, IdempotencyRepository } from '@beechcms/core'
+import type { Env, Variables } from '../types'
+
+interface RepositoryOverrides {
+  repository?: ContentRepository
+  idempotencyRepository?: IdempotencyRepository
+}
+
+export const repositoryMiddleware = (overrides?: RepositoryOverrides) => {
+  return createMiddleware<{ Bindings: Env; Variables: Variables }>(async (context, next) => {
+    context.set('repository', overrides?.repository ?? new D1ContentRepository(context.env.DB))
+    context.set('idempotencyRepository', overrides?.idempotencyRepository ?? new D1IdempotencyRepository(context.env.DB))
+    await next()
+  })
+}

package/src/public/public-add.ts

@@ -1,30 +1,15 @@
-import { isValidContentStatus } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
+import { isValidContentStatus, SlugConflictError } from '@beechcms/core'
 import type { Context } from 'hono'
 import { cleanStr } from '../shared/query-utils'
-import { buildInsertBindings } from '../shared/content-utils'
 import { checkPublicOperation } from './access-policy'
 import { publicProblem } from './problem-details'
 import { generateEntrySlug, slugify } from './slug-utils'
 import { sanitizePublicPayload } from './sanitize'
 import { createNotification } from '../shared/notification-service'
+import { AppEnv } from '../types'
 
-type Bindings = {
-  DB: D1Database
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  PUBLIC_IDEMPOTENCY_TTL_SECONDS?: string
-  ENV?: string
-}
-
-type Variables = {
-  jwtPayload: { sub: string; email?: string }
-  getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
-}
-
-function errorMessage(c: Context<{ Bindings: Bindings; Variables: Variables }>, err: unknown): string {
-  if (c.env.ENV !== 'production' && err instanceof Error) return err.message
+function errorMessage(context: Context<AppEnv>, error: unknown): string {
+  if (context.env.ENV !== 'production' && error instanceof Error) return error.message
   return 'An unexpected error occurred.'
 }
 
@@ -57,127 +42,125 @@ async function sha256Hex(input: string): Promise<string> {
   return toHex(digest)
 }
 
-type StoredIdempotencyRecord = {
-  idempotency_key: string
-  request_fingerprint: string
-  response_status: number
-  response_body: string
-  expires_at: number
-}
-
-async function lookupIdempotency(db: D1Database, key: string): Promise<StoredIdempotencyRecord | null> {
-  return db.prepare(
-    `SELECT idempotency_key, request_fingerprint, response_status, response_body, expires_at
-     FROM public_idempotency_keys WHERE idempotency_key = ? LIMIT 1`
-  ).bind(key).first<StoredIdempotencyRecord>()
-}
-
-async function storeIdempotency(db: D1Database, input: {
-  key: string; fingerprint: string; responseStatus: number
-  responseBody: string; expiresAt: number; createdAt: number
-}): Promise<void> {
-  await db.prepare(
-    `INSERT INTO public_idempotency_keys (idempotency_key, request_fingerprint, response_status, response_body, created_at, expires_at)
-     VALUES (?, ?, ?, ?, ?, ?)
-     ON CONFLICT(idempotency_key) DO UPDATE SET
-       request_fingerprint = excluded.request_fingerprint,
-       response_status = excluded.response_status,
-       response_body = excluded.response_body,
-       created_at = excluded.created_at,
-       expires_at = excluded.expires_at`
-  ).bind(input.key, input.fingerprint, input.responseStatus, input.responseBody, input.createdAt, input.expiresAt).run()
-}
-
-export async function publicAddHandler(c: Context<{ Bindings: Bindings; Variables: Variables }>) {
-  const seedSlug = c.req.param('seed') ?? ''
-  const seed = c.get('getSeed')(seedSlug)
+export async function publicAddHandler(context: Context<AppEnv>) {
+  const seedSlug = context.req.param('seed') ?? ''
+  const seed = context.get('getSeed')(seedSlug)
   if (!seed) {
-    return publicProblem(c, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
+    return publicProblem(context, { 
+      type: 'seed-not-found', 
+      title: 'Seed Not Found', 
+      status: 404, 
+      detail: `The content type '${seedSlug}' does not exist.` 
+    })
   }
+  
   const access = checkPublicOperation(seed, 'add')
   if (!access.ok) {
-    return publicProblem(c, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
+    return publicProblem(context, { 
+      type: 'operation-not-allowed', 
+      title: access.error.error, 
+      status: 403, 
+      detail: access.error.message 
+    })
   }
 
   let body: Record<string, unknown>
   try {
-    const parsed = await c.req.json<unknown>()
+    const parsed = await context.req.json<unknown>()
     body = asRecord(parsed) ?? {}
   } catch {
-    return publicProblem(c, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
+    return publicProblem(context, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
   }
 
   const rawData = asRecord(body.data)
   if (!rawData || Object.keys(rawData).length === 0) {
-    return publicProblem(c, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
+    return publicProblem(context, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
   }
 
   const statusValue = body.status ?? 'draft'
   if (!isValidContentStatus(statusValue)) {
-    return publicProblem(c, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
+    return publicProblem(context, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
   }
 
   const sanitized = sanitizePublicPayload(seed, rawData, {
-    operation: 'create', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true,
+    operation: 'create', 
+    allowNull: false, 
+    requireAtLeastOneValidField: true, 
+    enforceRequiredFields: true,
   })
+  
   if (!sanitized.ok) {
     if (sanitized.status === 422) {
-      return publicProblem(c, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
+      return publicProblem(context, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
     }
-    return publicProblem(c, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
+    return publicProblem(context, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
   }
 
-  const idempotencyKey = parseIdempotencyKey(c.req.header('Idempotency-Key'))
+  const idempotencyKey = parseIdempotencyKey(context.req.header('Idempotency-Key'))
   const entrySlug = pickSlugFromBody(body, sanitized.data)
   const finalSlug = entrySlug || crypto.randomUUID().slice(0, 8)
-  const table = `content_${seedSlug}`
+  const repository = context.get('repository')
+  const idempotencyRepository = context.get('idempotencyRepository')
 
   try {
-    const { DB } = c.env
     const now = Math.floor(Date.now() / 1000)
     const fingerprintPayload = JSON.stringify({ seedSlug, statusValue, slug: cleanStr(body.slug) ?? null, data: sanitized.data })
     const fingerprint = await sha256Hex(fingerprintPayload)
-    const idempotencyTtlSeconds = Math.max(60, Number.parseInt(c.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
+    const idempotencyTtlSeconds = Math.max(60, Number.parseInt(context.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
 
     if (idempotencyKey) {
-      const existing = await lookupIdempotency(DB, idempotencyKey)
-      if (existing && existing.expires_at >= now) {
-        if (existing.request_fingerprint !== fingerprint) {
-          return publicProblem(c, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
+      const existing = await idempotencyRepository.lookup(idempotencyKey)
+      if (existing && existing.expiresAt >= now) {
+        if (existing.fingerprint !== fingerprint) {
+          return publicProblem(context, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
         }
         let parsedBody: unknown = null
-        try { parsedBody = JSON.parse(existing.response_body) } catch { parsedBody = { success: true } }
-        return c.json(parsedBody, existing.response_status as 201)
+        try { parsedBody = JSON.parse(existing.responseBody) } catch { parsedBody = { success: true } }
+        return context.json(parsedBody, existing.responseStatus as 201)
       }
     }
 
-    const slugExisting = await DB.prepare(`SELECT id FROM ${table} WHERE slug = ? LIMIT 1`).bind(finalSlug).first<{ id: string }>()
-    if (slugExisting) {
-      return publicProblem(c, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` })
-    }
-
     const id = crypto.randomUUID()
-    const { cols, placeholders, bindings } = buildInsertBindings(seed, sanitized.data)
-    const systemCols = ['id', 'slug', 'status', 'created_at', 'updated_at']
-    const systemVals = [id, finalSlug, statusValue, now, now]
-    const allCols = [...systemCols, ...cols].join(', ')
-    const allPlaceholders = [...systemVals.map(() => '?'), ...placeholders].join(', ')
-
-    await DB.prepare(`INSERT INTO ${table} (${allCols}) VALUES (${allPlaceholders})`).bind(...systemVals, ...bindings).run()
+    
+    try {
+      await repository.create(seed, id, finalSlug, statusValue as any, sanitized.data)
+    } catch (error) {
+      if (error instanceof SlugConflictError) {
+        return publicProblem(context, { 
+          type: 'slug-conflict', 
+          title: 'Conflict', 
+          status: 409, 
+          detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` 
+        })
+      }
+      throw error
+    }
 
     const responseBody = { success: true, id, slug: finalSlug }
     if (idempotencyKey) {
-      await storeIdempotency(DB, { key: idempotencyKey, fingerprint, responseStatus: 201, responseBody: JSON.stringify(responseBody), createdAt: now, expiresAt: now + idempotencyTtlSeconds })
+      await idempotencyRepository.store({ 
+        key: idempotencyKey, 
+        fingerprint, 
+        responseStatus: 201, 
+        responseBody: JSON.stringify(responseBody), 
+        expiresAt: now + idempotencyTtlSeconds 
+      })
     }
 
-    await createNotification(c, {
+    await createNotification(context, {
       title: `${seed.label}: Nuovo inserimento`,
       message: `Una nuova entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") è stata aggiunta via API pubblica.`,
       type: 'success',
     })
 
-    return c.json(responseBody, 201)
-  } catch (err) {
-    return publicProblem(c, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: errorMessage(c, err) })
+    return context.json(responseBody, 201)
+  } catch (error) {
+    console.error('Public add error:', error)
+    return publicProblem(context, { 
+      type: 'internal-server-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: errorMessage(context, error) 
+    })
   }
 }