@beechcms/api 0.4.0-preview.1

package/src/features/password-reset/reset.ts

@@ -0,0 +1,110 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { Context } from 'hono'
+import bcrypt from 'bcryptjs'
+import type { Env, Variables } from '../../types'
+import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
+
+const MIN_PASSWORD_LENGTH = 8
+const MAX_PASSWORD_LENGTH = 128
+
+async function sha256hex(text: string): Promise<string> {
+  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
+  return Array.from(new Uint8Array(buf))
+    .map(b => b.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+export async function resetPassword(
+  c: Context<{ Bindings: Env; Variables: Variables }>
+): Promise<Response> {
+  if (!c.env.RESEND_API_KEY) {
+    return c.json({ error: 'Not available' }, 503)
+  }
+
+  // Rate limiting: 5 tentativi per IP per 60 secondi
+  if (c.env.RESET_PASSWORD_RATE_LIMITER) {
+    const ip = c.req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
+    const { success } = await c.env.RESET_PASSWORD_RATE_LIMITER.limit({ key: ip })
+    if (!success) {
+      return c.json({ error: 'Too many requests' }, 429)
+    }
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid request body' }, 400)
+  }
+
+  if (typeof body.token !== 'string' || !body.token) {
+    return c.json({ error: 'Invalid or expired token' }, 400)
+  }
+
+  if (
+    typeof body.password !== 'string' ||
+    body.password.length < MIN_PASSWORD_LENGTH ||
+    body.password.length > MAX_PASSWORD_LENGTH
+  ) {
+    return c.json({
+      error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
+    }, 400)
+  }
+
+  const locale = resolveEmailLocale(body.locale)
+  const tokenHash = await sha256hex(body.token)
+  const now = Math.floor(Date.now() / 1000)
+
+  // JOIN users per recuperare l'email in un'unica query — serve per la notifica
+  const record = await c.env.DB
+    .prepare(
+      `SELECT prt.id, prt.user_id, u.email
+       FROM password_reset_tokens prt
+       JOIN users u ON u.id = prt.user_id
+       WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`,
+    )
+    .bind(tokenHash, now)
+    .first<{ id: string; user_id: string; email: string }>()
+
+  if (!record) {
+    return c.json({ error: 'Invalid or expired token' }, 400)
+  }
+
+  const newHash = await bcrypt.hash(body.password, 10)
+
+  // Segna token usato, aggiorna password, revoca tutte le sessioni — atomicamente
+  await c.env.DB.batch([
+    c.env.DB
+      .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE id = ?')
+      .bind(record.id),
+    c.env.DB
+      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
+      .bind(newHash, record.user_id),
+    c.env.DB
+      .prepare('UPDATE refresh_tokens SET revoked_at = unixepoch() WHERE user_id = ? AND revoked_at IS NULL')
+      .bind(record.user_id),
+  ])
+
+  // Notifica "password modificata" — fire-and-forget via waitUntil, non blocca il 200
+  const notify = () =>
+    sendPasswordChangedEmail({
+      to: record.email,
+      locale,
+      apiKey: c.env.RESEND_API_KEY!,
+      from: c.env.EMAIL_FROM,
+      isDev: c.env.ENV !== 'production',
+    }).catch((err) => {
+      if (c.env.ENV !== 'production') {
+        console.error('[password-reset] notifica email fallita:', err)
+      }
+    })
+
+  try {
+    c.executionCtx.waitUntil(notify())
+  } catch {
+    // executionCtx non disponibile in ambiente di test
+    void notify()
+  }
+
+  return c.json({ success: true })
+}

package/src/features/rotate-field/index.ts

@@ -0,0 +1 @@
+export { rotateFieldApp } from './rotate-field.handler'

package/src/features/rotate-field/rotate-field.handler.ts

@@ -0,0 +1,82 @@
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, serializeForDb } from '@beechcms/core'
+import { publicProblem } from '../../public/problem-details'
+import { rotateFieldBodySchema } from './rotate-field.schema'
+import type { Env, Variables } from '../../types'
+
+const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+rotateFieldApp.post('/:slug/:id/rotate-field', async (c) => {
+  const slug = c.req.param('slug')
+  const id = c.req.param('id')
+
+  const seed = c.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(c, { type: 'content-seed-not-found', title: 'Not Found', status: 404, detail: `Seed '${slug}' not found` })
+  }
+
+  let rawBody: unknown
+  try {
+    rawBody = await c.req.json()
+  } catch {
+    return publicProblem(c, { type: 'rotate-field-invalid-json', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
+  }
+
+  const parsed = rotateFieldBodySchema.safeParse(rawBody)
+  if (!parsed.success) {
+    return publicProblem(c, { type: 'rotate-field-invalid-body', title: 'Bad Request', status: 400, detail: parsed.error.issues[0]?.message ?? 'Invalid body' })
+  }
+
+  const { field, current, next } = parsed.data
+
+  const branch = seed.branches.find((b) => b.alias === field)
+  if (!branch) {
+    return publicProblem(c, { type: 'rotate-field-unknown-field', title: 'Bad Request', status: 400, detail: `Field '${field}' does not exist in seed '${slug}'` })
+  }
+
+  const { privacy } = resolvePolicies(branch)
+  if (privacy !== 'hash') {
+    return publicProblem(c, { type: 'rotate-field-not-hashable', title: 'Unprocessable Entity', status: 422, detail: `Field '${field}' does not use hash privacy and cannot be rotated with this endpoint` })
+  }
+
+  const { DB } = c.env
+  // In v0.4.0 il valore hash è in una colonna reale: row[branch.alias]
+  const row = await DB.prepare(`SELECT ${branch.alias} FROM content_${slug} WHERE id = ? LIMIT 1`)
+    .bind(id)
+    .first<Record<string, unknown>>()
+
+  if (!row) {
+    return publicProblem(c, { type: 'content-not-found', title: 'Not Found', status: 404, detail: `Entry '${id}' not found` })
+  }
+
+  const storedHash = row[branch.alias]
+
+  if (typeof storedHash !== 'string' || storedHash.length === 0) {
+    return publicProblem(c, { type: 'rotate-field-not-set', title: 'Unprocessable Entity', status: 422, detail: `Field '${field}' has no stored value to rotate` })
+  }
+
+  const matches = await verifyHashField(storedHash, current)
+  if (!matches) {
+    return publicProblem(c, { type: 'rotate-field-current-mismatch', title: 'Forbidden', status: 403, detail: 'Current value does not match stored value' })
+  }
+
+  const validation = validateAndSanitizeSeedPayload(
+    seed, { [field]: next },
+    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
+  )
+  if (validation.details.length > 0) {
+    return publicProblem(c, { type: 'rotate-field-invalid-next', title: 'Bad Request', status: 400, detail: `Invalid value for field '${field}': ${validation.details[0]?.message ?? 'validation failed'}` })
+  }
+
+  const nextHash = await sha256hex(next)
+  const now = Math.floor(Date.now() / 1000)
+
+  await DB.prepare(`UPDATE content_${slug} SET ${branch.alias} = ?, updated_at = ? WHERE id = ?`)
+    .bind(serializeForDb(branch, nextHash), now, id)
+    .run()
+
+  return c.json({ success: true })
+})
+
+export { rotateFieldApp }

package/src/features/rotate-field/rotate-field.schema.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod'
+
+export const rotateFieldBodySchema = z.object({
+  field: z.string().min(1, "field is required"),
+  current: z.string().min(1, "current is required"),
+  next: z.string().min(1, "next is required"),
+})
+
+export type RotateFieldBody = z.infer<typeof rotateFieldBodySchema>

package/src/features/rotate-field/rotate-field.test.ts

@@ -0,0 +1,297 @@
+/// <reference types="@cloudflare/workers-types" />
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { Seed } from '@beechcms/core'
+
+// --- Mock jose (auth bypass) ---
+const mockJwtVerify = vi.hoisted(() => vi.fn())
+vi.mock('jose', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('jose')>()
+  return { ...actual, jwtVerify: mockJwtVerify }
+})
+
+// --- Test seed with a privacy:hash field (hoisted so it's available inside vi.mock factory) ---
+const { HASH_SEED } = vi.hoisted(() => {
+  const HASH_SEED = {
+    slug: 'test-members',
+    label: 'Member',
+    displayNameAlias: 'name',
+    branches: [
+      { id: 'br_01', alias: 'name', label: 'Name', type: 'text', requiredOnCreate: true },
+      {
+        id: 'br_02',
+        alias: 'password',
+        label: 'Password',
+        type: 'text',
+        policies: { privacy: 'hash' },
+      },
+    ],
+  }
+  return { HASH_SEED }
+})
+
+// Override getSeed and SEED_REGISTRY for the test slug only
+vi.mock('@beechcms/core', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@beechcms/core')>()
+  return {
+    ...actual,
+    SEED_REGISTRY: {
+      ...actual.SEED_REGISTRY,
+      'test-members': HASH_SEED,
+    },
+    getSeed: (slug: string) => (slug === 'test-members' ? HASH_SEED : actual.getSeed(slug)),
+  }
+})
+
+import app from '../../index'
+
+// --- Helpers ---
+
+async function sha256hex(value: string): Promise<string> {
+  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))
+  return Array.from(new Uint8Array(buf))
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+function makeAuthHeader() {
+  return { Authorization: 'Bearer test-token' }
+}
+
+// v0.4.0: entry has real columns (no JSON blob)
+function makeEntry(id: string, dbData: Record<string, unknown>) {
+  return {
+    id,
+    slug: 'member-1',
+    status: 'published',
+    name: dbData.name ?? null,
+    password: dbData.password ?? dbData.br_02 ?? null,  // accept both alias and old id for compat
+    created_at: 1000000,
+    updated_at: 1000000,
+  }
+}
+
+function makeMockDB(row: object | null, updateCapture?: { called: boolean }) {
+  return {
+    prepare: vi.fn((sql: string) => ({
+      bind: vi.fn(() => ({
+        first: vi.fn(() => Promise.resolve(row)),
+        run: vi.fn(() => {
+          if (updateCapture && sql.includes('UPDATE')) updateCapture.called = true
+          return Promise.resolve({ success: true, meta: { changes: 1 } })
+        }),
+        all: vi.fn(() => Promise.resolve({ results: row ? [row] : [] })),
+      })),
+      first: vi.fn(() => Promise.resolve(row)),
+      run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
+    })),
+  }
+}
+
+const ENTRY_ID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
+const CURRENT_PLAINTEXT = 'old-secret'
+const NEXT_PLAINTEXT = 'new-secret'
+
+// --- Tests ---
+
+describe('POST /:slug/:id/rotate-field', () => {
+  beforeEach(() => {
+    mockJwtVerify.mockReset()
+    mockJwtVerify.mockResolvedValue({
+      payload: { sub: 'user-1', email: 'admin@beech.local' },
+      protectedHeader: { alg: 'HS256', typ: 'JWT' },
+    })
+  })
+
+  it('returns 200 and updates the field when current matches', async () => {
+    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
+    const updateCapture = { called: false }
+    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }), updateCapture)
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(200)
+    const json = await res.json<{ success: boolean }>()
+    expect(json.success).toBe(true)
+    expect(updateCapture.called).toBe(true)
+  })
+
+  it('returns 403 when current does not match stored hash', async () => {
+    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
+    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }))
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: 'wrong-value', next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(403)
+  })
+
+  it('returns 404 when entry does not exist', async () => {
+    const mockDB = makeMockDB(null)
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 404 when seed does not exist', async () => {
+    const mockDB = makeMockDB(null)
+
+    const res = await app.request(
+      `/api/content/unknown-seed/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 400 when field does not exist in the seed', async () => {
+    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
+    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_02: storedHash }))
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'nonexistent', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 422 when field does not use hash privacy', async () => {
+    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_01: 'Alice' }))
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'name', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(422)
+  })
+
+  it('returns 422 when the field has no stored value', async () => {
+    // Entry exists but br_02 is not in data
+    const mockDB = makeMockDB(makeEntry(ENTRY_ID, { br_01: 'Alice' }))
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(422)
+  })
+
+  it('returns 400 when body is missing required fields', async () => {
+    const mockDB = makeMockDB(null)
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password' }), // missing current and next
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 401 when not authenticated', async () => {
+    mockJwtVerify.mockRejectedValueOnce(new Error('invalid token'))
+    const mockDB = makeMockDB(null)
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(401)
+  })
+
+  it('stores a new SHA-256 hash (not the plaintext) after rotation', async () => {
+    const storedHash = await sha256hex(CURRENT_PLAINTEXT)
+    const bindCalls: Array<{ sql: string; args: unknown[] }> = []
+
+    const mockDB = {
+      prepare: vi.fn((sql: string) => ({
+        bind: vi.fn((...args: unknown[]) => {
+          bindCalls.push({ sql, args })
+          return {
+            first: vi.fn(() => Promise.resolve(makeEntry(ENTRY_ID, { br_02: storedHash }))),
+            run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
+            all: vi.fn(() => Promise.resolve({ results: [] })),
+          }
+        }),
+        first: vi.fn(() => Promise.resolve(makeEntry(ENTRY_ID, { br_02: storedHash }))),
+        run: vi.fn(() => Promise.resolve({ success: true, meta: { changes: 1 } })),
+      })),
+    }
+
+    const res = await app.request(
+      `/api/content/test-members/${ENTRY_ID}/rotate-field`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...makeAuthHeader() },
+        body: JSON.stringify({ field: 'password', current: CURRENT_PLAINTEXT, next: NEXT_PLAINTEXT }),
+      },
+      { JWT_SECRET: 'test-secret', DB: mockDB }
+    )
+
+    expect(res.status).toBe(200)
+    // v0.4.0: UPDATE content_test-members SET password = ?, updated_at = ? WHERE id = ?
+    const updateCall = bindCalls.find((c) => c.sql.includes('UPDATE content_test-members'))
+    expect(updateCall).toBeDefined()
+    // args[0] = password hash value (real column, not JSON blob)
+    const savedHash = updateCall!.args[0] as string
+    expect(savedHash).not.toBe(NEXT_PLAINTEXT)
+    expect(savedHash).toMatch(/^[0-9a-f]{64}$/)
+    expect(savedHash).toBe(await sha256hex(NEXT_PLAINTEXT))
+  })
+})