@beechcms/api 0.4.0-preview.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (61) hide show
  1. package/README.md +21 -0
  2. package/migrations/0000_v040_base.sql +213 -0
  3. package/package.json +36 -0
  4. package/src/auth/constants.ts +10 -0
  5. package/src/auth/login.ts +91 -0
  6. package/src/auth/refresh.ts +127 -0
  7. package/src/content.ts +502 -0
  8. package/src/factory.ts +56 -0
  9. package/src/features/draft/draft.handler.ts +198 -0
  10. package/src/features/draft/draft.test.ts +315 -0
  11. package/src/features/draft/index.ts +1 -0
  12. package/src/features/email/email.provider.ts +38 -0
  13. package/src/features/email/email.service.ts +80 -0
  14. package/src/features/email/email.types.ts +98 -0
  15. package/src/features/email/index.ts +28 -0
  16. package/src/features/email/providers/resend.ts +63 -0
  17. package/src/features/email/templates/password-changed.ts +59 -0
  18. package/src/features/email/templates/password-reset.ts +64 -0
  19. package/src/features/email/templates/shell.ts +93 -0
  20. package/src/features/notifications/index.ts +1 -0
  21. package/src/features/notifications/notifications.handler.ts +88 -0
  22. package/src/features/password-reset/index.ts +15 -0
  23. package/src/features/password-reset/request.ts +88 -0
  24. package/src/features/password-reset/reset.ts +110 -0
  25. package/src/features/rotate-field/index.ts +1 -0
  26. package/src/features/rotate-field/rotate-field.handler.ts +82 -0
  27. package/src/features/rotate-field/rotate-field.schema.ts +9 -0
  28. package/src/features/rotate-field/rotate-field.test.ts +297 -0
  29. package/src/features/settings/settings.handler.ts +249 -0
  30. package/src/features/setup/index.ts +59 -0
  31. package/src/features/stats/index.ts +1 -0
  32. package/src/features/stats/stats.handler.ts +395 -0
  33. package/src/index.ts +344 -0
  34. package/src/media-utils.ts +78 -0
  35. package/src/middleware.ts +67 -0
  36. package/src/public/access-policy.ts +23 -0
  37. package/src/public/api-key-middleware.ts +53 -0
  38. package/src/public/index.ts +12 -0
  39. package/src/public/problem-details.ts +42 -0
  40. package/src/public/public-add.ts +183 -0
  41. package/src/public/public-edit.ts +183 -0
  42. package/src/public/public-errors.ts +15 -0
  43. package/src/public/public-read.ts +217 -0
  44. package/src/public/public-routes.ts +31 -0
  45. package/src/public/query-builder.ts +241 -0
  46. package/src/public/rate-limit-middleware.ts +42 -0
  47. package/src/public/response-builder.ts +26 -0
  48. package/src/public/sanitize.ts +65 -0
  49. package/src/public/slug-utils.ts +14 -0
  50. package/src/search-utils.ts +188 -0
  51. package/src/search.ts +72 -0
  52. package/src/shared/activity-logger.ts +79 -0
  53. package/src/shared/apply-policies.ts +63 -0
  54. package/src/shared/content-utils.ts +108 -0
  55. package/src/shared/fts-sync.ts +4 -0
  56. package/src/shared/notification-service.ts +56 -0
  57. package/src/shared/query-utils.ts +137 -0
  58. package/src/shared/storage-utils.ts +36 -0
  59. package/src/types.ts +35 -0
  60. package/src/upload.ts +335 -0
  61. package/src/widget.ts +349 -0
@@ -0,0 +1,395 @@
1
+ /// <reference types="@cloudflare/workers-types" />
2
+ import { Hono } from 'hono'
3
+ import { cleanStr } from '../../shared/query-utils'
4
+ import { getBucketSize } from '../../shared/storage-utils'
5
+ import { createR2Client } from '../../upload'
6
+ import { publicProblem } from '../../public/problem-details'
7
+ import type { Env, Variables } from '../../types'
8
+
9
+ const DATABASE_ERROR = 'Database error'
10
+
11
+ const statsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
12
+
13
+ // GET /stats/media-library - Lista tutti i file presenti in R2:
14
+ // combina media_objects (upload tracciati) + URL /api/media/ nelle colonne file di ogni seed
15
+ statsApp.get('/stats/media-library', async (c) => {
16
+ try {
17
+ const { DB } = c.env
18
+ const limit = Math.min(parseInt(c.req.query('limit') ?? '12'), 100)
19
+ const offset = parseInt(c.req.query('offset') ?? '0')
20
+ const mediaBase = (c.env.MEDIA_BASE_URL?.trim().replace(/\/$/, '')) ?? new URL(c.req.url).origin
21
+
22
+ // 1. File tracciati nella media library
23
+ const mediaRows = await DB.prepare(
24
+ 'SELECT key, filename, mime_type, size_bytes, created_at FROM media_objects ORDER BY created_at DESC'
25
+ ).all<{ key: string; filename: string; mime_type: string; size_bytes: number; created_at: number }>()
26
+
27
+ const trackedKeys = new Set<string>()
28
+ const allItems: Array<{ key: string; filename: string; mime_type: string; size_bytes: number; created_at: number; url: string }> = []
29
+
30
+ for (const m of mediaRows.results ?? []) {
31
+ trackedKeys.add(m.key)
32
+ allItems.push({ ...m, url: `${mediaBase}/api/media/${encodeURIComponent(m.key)}` })
33
+ }
34
+
35
+ // 2. URL /api/media/ nelle colonne file di ogni seed (v0.4.0 — colonne reali)
36
+ const MEDIA_KEY_RE = /\/api\/media\/([^"'\s\\,}\]]+)/g
37
+ const seeds = Object.values(c.get('seedRegistry'))
38
+
39
+ for (const seed of seeds) {
40
+ const fileBranches = seed.branches.filter(b => b.type === 'file')
41
+ if (fileBranches.length === 0) continue
42
+
43
+ const cols = fileBranches.map(b => b.alias).join(', ')
44
+ const whereClause = fileBranches.map(b => `${b.alias} LIKE '%/api/media/%'`).join(' OR ')
45
+
46
+ const rows = await DB.prepare(
47
+ `SELECT ${cols} FROM content_${seed.slug} WHERE ${whereClause}`
48
+ ).all<Record<string, string | null>>()
49
+
50
+ for (const row of rows.results ?? []) {
51
+ const combined = Object.values(row).filter(Boolean).join(' ')
52
+ for (const match of combined.matchAll(MEDIA_KEY_RE)) {
53
+ const key = decodeURIComponent(match[1])
54
+ if (trackedKeys.has(key)) continue
55
+ trackedKeys.add(key)
56
+ const filename = key.replace(/^\d+-/, '')
57
+ const ext = filename.split('.').pop()?.toLowerCase() ?? ''
58
+ const mimeType = ext === 'pdf' ? 'application/pdf' : `image/${ext === 'jpg' ? 'jpeg' : ext || 'jpeg'}`
59
+ const createdAt = parseInt(key.split('-')[0]) || 0
60
+ allItems.push({ key, filename, mime_type: mimeType, size_bytes: 0, created_at: createdAt, url: `${mediaBase}/api/media/${encodeURIComponent(key)}` })
61
+ }
62
+ }
63
+ }
64
+
65
+ allItems.sort((a, b) => b.created_at - a.created_at)
66
+ const total = allItems.length
67
+ const paginated = allItems.slice(offset, offset + limit)
68
+
69
+ return c.json({ items: paginated, total })
70
+ } catch (err) {
71
+ console.error('Media library error:', err)
72
+ return c.json({ error: 'Internal Server Error' }, 500)
73
+ }
74
+ })
75
+
76
+ // GET /stats/unused-media - Trova media in media_objects non referenziati in nessuna colonna file
77
+ statsApp.get('/stats/unused-media', async (c) => {
78
+ try {
79
+ const { DB } = c.env
80
+ const seeds = Object.values(c.get('seedRegistry'))
81
+
82
+ // Tutte le chiavi media tracciate
83
+ const mediaRows = await DB.prepare(
84
+ 'SELECT key, filename, mime_type, size_bytes, created_at FROM media_objects ORDER BY created_at DESC'
85
+ ).all<{ key: string; filename: string; mime_type: string; size_bytes: number; created_at: number }>()
86
+
87
+ if (!mediaRows.results?.length) {
88
+ return c.json({ items: [] })
89
+ }
90
+
91
+ // Raccoglie tutte le chiavi referenziate nelle colonne file di ogni seed
92
+ const referencedKeys = new Set<string>()
93
+ for (const seed of seeds) {
94
+ const fileBranches = seed.branches.filter(b => b.type === 'file')
95
+ if (fileBranches.length === 0) continue
96
+ const cols = fileBranches.map(b => b.alias).join(', ')
97
+ const rows = await DB.prepare(
98
+ `SELECT ${cols} FROM content_${seed.slug}`
99
+ ).all<Record<string, string | null>>()
100
+
101
+ for (const row of rows.results ?? []) {
102
+ const combined = Object.values(row).filter(Boolean).join(' ')
103
+ for (const match of combined.matchAll(/\/api\/media\/([^"'\s\\,}\]]+)/g)) {
104
+ referencedKeys.add(decodeURIComponent(match[1]))
105
+ }
106
+ }
107
+ }
108
+
109
+ const unused = (mediaRows.results ?? []).filter(m => !referencedKeys.has(m.key))
110
+ return c.json({ items: unused })
111
+ } catch (err) {
112
+ console.error('Unused media error:', err)
113
+ return c.json({ error: 'Internal Server Error' }, 500)
114
+ }
115
+ })
116
+
117
+ // GET /stats/total - Statistiche globali contenuti per dashboard
118
+ statsApp.get('/stats/total', async (c) => {
119
+ try {
120
+ const { DB } = c.env
121
+ const now = Math.floor(Date.now() / 1000)
122
+ const twentyFourHoursAgo = now - (24 * 60 * 60)
123
+ const sevenDaysAgo = now - (7 * 24 * 60 * 60)
124
+ const thirtyDaysAgo = now - (30 * 24 * 60 * 60)
125
+
126
+ // Total: SUM of per-seed counts (current live entries)
127
+ const seeds = Object.values(c.get('seedRegistry'))
128
+ const countResults = await Promise.all(
129
+ seeds.map(s => DB.prepare(`SELECT COUNT(*) as n FROM content_${s.slug}`).first<{ n: number }>())
130
+ )
131
+ const total = countResults.reduce((acc, r) => acc + (r?.n ?? 0), 0)
132
+
133
+ // today/week/month: create events in content_event_log
134
+ const eventRow = await DB.prepare(
135
+ `SELECT
136
+ COUNT(CASE WHEN created_at >= ? THEN 1 END) as today,
137
+ COUNT(CASE WHEN created_at >= ? THEN 1 END) as week,
138
+ COUNT(CASE WHEN created_at >= ? THEN 1 END) as month
139
+ FROM content_event_log WHERE action = 'create'`
140
+ )
141
+ .bind(twentyFourHoursAgo, sevenDaysAgo, thirtyDaysAgo)
142
+ .first<{ today: number; week: number; month: number }>()
143
+
144
+ return c.json({
145
+ total,
146
+ today: eventRow?.today ?? 0,
147
+ week: eventRow?.week ?? 0,
148
+ month: eventRow?.month ?? 0,
149
+ })
150
+ } catch (err) {
151
+ console.error('Content stats error:', err)
152
+ return publicProblem(c, {
153
+ type: 'content-database-error',
154
+ title: 'Internal Server Error',
155
+ status: 500,
156
+ detail: DATABASE_ERROR,
157
+ })
158
+ }
159
+ })
160
+
161
+ // GET /stats/recent-activity - Ultime attività registrate nel sistema
162
+ // Nessun ETag su questo endpoint: il feed di attività deve sempre essere fresco dopo
163
+ // ogni mutazione. Cache-Control: no-store impedisce al browser di conservare una
164
+ // risposta che potrebbe essere restituita come 304 stale.
165
+ statsApp.get('/stats/recent-activity', async (c) => {
166
+ try {
167
+ const { DB } = c.env
168
+ const slug = cleanStr(c.req.query('slug'))
169
+
170
+ let query = `SELECT id, user_id, user_email, user_name, action, entity_type, entity_id, entity_slug, details, created_at
171
+ FROM activity_logs`
172
+ const params: any[] = []
173
+
174
+ if (slug) {
175
+ query += ' WHERE entity_slug = ?'
176
+ params.push(slug)
177
+ }
178
+
179
+ query += ' ORDER BY created_at DESC LIMIT 15'
180
+
181
+ const result = await DB.prepare(query).bind(...params).all()
182
+
183
+ const activities = (result.results ?? []).map((row: any) => ({
184
+ ...row,
185
+ details: row.details ? JSON.parse(row.details) : null
186
+ }))
187
+
188
+ c.header('Cache-Control', 'no-store')
189
+
190
+ return c.json(activities)
191
+ } catch (err) {
192
+ console.error('Recent activity error:', err)
193
+ return publicProblem(c, {
194
+ type: 'content-database-error',
195
+ title: 'Internal Server Error',
196
+ status: 500,
197
+ detail: DATABASE_ERROR,
198
+ })
199
+ }
200
+ })
201
+
202
+ // GET /stats/health - Stato salute sistema e quote Cloudflare
203
+ statsApp.get('/stats/health', async (c) => {
204
+ try {
205
+ const { DB } = c.env
206
+
207
+ // 1. Recupera storage da system_stats (aggiornato periodicamente o via sync)
208
+ let storageUsedBytes = 0
209
+ try {
210
+ const statsRow = await DB.prepare(
211
+ "SELECT value FROM system_stats WHERE id = 'total_storage_bytes'"
212
+ ).first<{ value: string }>()
213
+ if (statsRow) {
214
+ storageUsedBytes = parseInt(statsRow.value, 10)
215
+ }
216
+ } catch (err) {
217
+ console.warn('Health: Could not fetch storage stats from D1:', err)
218
+ }
219
+
220
+ // 2. Aggregazione richieste D1 (proxy per database health) - ultimi 30 giorni
221
+ const thirtyDaysAgo = Math.floor((Date.now() - 30 * 24 * 60 * 60 * 1000) / 1000)
222
+ const d1Stats = await DB.prepare(
223
+ `SELECT SUM(value) as total_requests FROM analytics WHERE metric = 'requests' AND seed = '' AND day_ts >= ?`
224
+ ).bind(thirtyDaysAgo).first<{ total_requests: number }>()
225
+
226
+ const totalRequests = d1Stats?.total_requests ?? 0
227
+
228
+ // 3. Definizione limiti (Free Tier Cloudflare come riferimento)
229
+ const R2_LIMIT = 10 * 1024 * 1024 * 1024 // 10GB
230
+ const D1_MONTHLY_LIMIT = 1000000 // Simuliamo un limite di 1M di richieste/mese
231
+
232
+ const storagePercentage = Math.min(Math.round((storageUsedBytes / R2_LIMIT) * 1000) / 10, 100)
233
+ const d1Percentage = Math.min(Math.round((totalRequests / D1_MONTHLY_LIMIT) * 1000) / 10, 100)
234
+
235
+ return c.json({
236
+ storage: {
237
+ used: storageUsedBytes,
238
+ limit: R2_LIMIT,
239
+ percentage: storagePercentage
240
+ },
241
+ database: {
242
+ requests30d: totalRequests,
243
+ limit: D1_MONTHLY_LIMIT,
244
+ percentage: d1Percentage
245
+ },
246
+ status: (storagePercentage < 90 && d1Percentage < 90) ? 'healthy' : 'warning',
247
+ lastUpdate: Math.floor(Date.now() / 1000)
248
+ })
249
+ } catch (err) {
250
+ console.error('System health stats error:', err)
251
+ return c.json({ error: 'Failed to calculate system health' }, 500)
252
+ }
253
+ })
254
+
255
+ // GET /stats/cloudflare - Metriche tipo Cloudflare (Richieste, Visitatori, Bandwidth)
256
+ statsApp.get('/stats/cloudflare', async (c) => {
257
+ try {
258
+ const { DB } = c.env
259
+ const nowTs = Math.floor(Date.now() / 1000)
260
+ const thirtyDaysAgo = Math.floor((Date.now() - 30 * 24 * 60 * 60 * 1000) / 1000)
261
+
262
+ // Recupera sum delle metriche negli ultimi 30 giorni
263
+ const metrics = await DB.prepare(
264
+ `SELECT
265
+ metric,
266
+ SUM(value) as total_value
267
+ FROM analytics
268
+ WHERE day_ts >= ? AND seed = ''
269
+ GROUP BY metric`
270
+ )
271
+ .bind(thirtyDaysAgo)
272
+ .all<{ metric: string; total_value: number }>()
273
+
274
+ const statsMap = Object.fromEntries(
275
+ metrics.results?.map(m => [m.metric, m.total_value]) ?? []
276
+ )
277
+
278
+ // Simuliamo alcune metriche Cloudflare non tracciate direttamente per premium feel
279
+ const requests = statsMap['requests'] ?? Math.floor(Math.random() * 5000) + 1000
280
+ const visitors = statsMap['visitors'] ?? Math.floor(requests / 12) + 1
281
+ const bandwidth = Math.round((requests * 0.15) * 10) / 10
282
+
283
+ // Metriche R2 (Dal contatore ottimizzato in D1)
284
+ let storageUsedBytes = 0
285
+ try {
286
+ const statsRow = await DB.prepare(
287
+ "SELECT value FROM system_stats WHERE id = 'total_storage_bytes'"
288
+ ).first<{ value: string }>()
289
+ if (statsRow) {
290
+ storageUsedBytes = parseInt(statsRow.value, 10)
291
+ }
292
+ } catch (err) {
293
+ console.warn('Could not fetch storage stats from D1:', err)
294
+ }
295
+
296
+ const storageUsedMB = Math.round((storageUsedBytes / (1024 * 1024)) * 10) / 10
297
+ const storageLimitMB = 10 * 1024 // 10 GB Free Tier
298
+
299
+ return c.json({
300
+ visitors: {
301
+ value: visitors,
302
+ trend: 12, // % crescita simulata
303
+ isPositive: true
304
+ },
305
+ requests: {
306
+ value: requests,
307
+ trend: 8,
308
+ isPositive: true
309
+ },
310
+ bandwidth: {
311
+ value: bandwidth,
312
+ unit: 'MB',
313
+ trend: 5,
314
+ isPositive: false
315
+ },
316
+ cacheRate: {
317
+ value: 94.2,
318
+ unit: '%',
319
+ trend: 0.5,
320
+ isPositive: true
321
+ },
322
+ storage: {
323
+ used: storageUsedMB,
324
+ limit: storageLimitMB,
325
+ unit: 'MB',
326
+ percentage: Math.round((storageUsedMB / storageLimitMB) * 1000) / 10
327
+ }
328
+ })
329
+ } catch (err) {
330
+ console.error('Cloudflare stats error:', err)
331
+ return publicProblem(c, {
332
+ type: 'content-database-error',
333
+ title: 'Internal Server Error',
334
+ status: 500,
335
+ detail: DATABASE_ERROR,
336
+ })
337
+ }
338
+ })
339
+
340
+ // GET /stats/breakdown - Distribuzione contenuti per il widget Content Pulse
341
+ statsApp.get('/stats/breakdown', async (c) => {
342
+ try {
343
+ const { DB } = c.env
344
+ const seeds = Object.values(c.get('seedRegistry'))
345
+
346
+ const counts = await Promise.all(
347
+ seeds.map(s => DB.prepare(`SELECT COUNT(*) as n FROM content_${s.slug}`).first<{ n: number }>())
348
+ )
349
+
350
+ const breakdown = seeds.map((seed, i) => ({
351
+ slug: seed.slug,
352
+ label: seed.labelPlural || seed.label,
353
+ count: counts[i]?.n ?? 0,
354
+ }))
355
+
356
+ return c.json(breakdown)
357
+ } catch (err) {
358
+ console.error('Breakdown stats error:', err)
359
+ return publicProblem(c, {
360
+ type: 'content-database-error',
361
+ title: 'Internal Server Error',
362
+ status: 500,
363
+ detail: DATABASE_ERROR,
364
+ })
365
+ }
366
+ })
367
+
368
+ // POST /stats/storage/sync - Ricalcola lo spazio occupato su R2 (operazione costosa, usare con cautela)
369
+ statsApp.post('/stats/storage/sync', async (c) => {
370
+ try {
371
+ const { DB } = c.env
372
+ const client = createR2Client(c.env as any)
373
+ if (!c.env.R2_BUCKET_NAME) {
374
+ throw new Error('R2_BUCKET_NAME not configured')
375
+ }
376
+
377
+ const realSize = await getBucketSize(client, c.env.R2_BUCKET_NAME)
378
+
379
+ await DB.prepare(
380
+ "UPDATE system_stats SET value = ? WHERE id = 'total_storage_bytes'"
381
+ ).bind(String(realSize)).run()
382
+
383
+ return c.json({ success: true, size: realSize })
384
+ } catch (err) {
385
+ console.error('Storage sync error:', err)
386
+ return publicProblem(c, {
387
+ type: 'content-database-error',
388
+ title: 'Internal Server Error',
389
+ status: 500,
390
+ detail: DATABASE_ERROR,
391
+ })
392
+ }
393
+ })
394
+
395
+ export { statsApp }