@beechcms/api 0.4.0-preview.10 → 0.4.0-preview.11

package/src/public/public-add.ts

@@ -1,30 +1,15 @@
-import { isValidContentStatus } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
+import { isValidContentStatus, SlugConflictError } from '@beechcms/core'
 import type { Context } from 'hono'
 import { cleanStr } from '../shared/query-utils'
-import { buildInsertBindings } from '../shared/content-utils'
 import { checkPublicOperation } from './access-policy'
 import { publicProblem } from './problem-details'
 import { generateEntrySlug, slugify } from './slug-utils'
 import { sanitizePublicPayload } from './sanitize'
 import { createNotification } from '../shared/notification-service'
+import { AppEnv } from '../types'
 
-type Bindings = {
-  DB: D1Database
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  PUBLIC_IDEMPOTENCY_TTL_SECONDS?: string
-  ENV?: string
-}
-
-type Variables = {
-  jwtPayload: { sub: string; email?: string }
-  getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
-}
-
-function errorMessage(c: Context<{ Bindings: Bindings; Variables: Variables }>, err: unknown): string {
-  if (c.env.ENV !== 'production' && err instanceof Error) return err.message
+function errorMessage(context: Context<AppEnv>, error: unknown): string {
+  if (context.env.ENV !== 'production' && error instanceof Error) return error.message
   return 'An unexpected error occurred.'
 }
 
@@ -57,127 +42,125 @@ async function sha256Hex(input: string): Promise<string> {
   return toHex(digest)
 }
 
-type StoredIdempotencyRecord = {
-  idempotency_key: string
-  request_fingerprint: string
-  response_status: number
-  response_body: string
-  expires_at: number
-}
-
-async function lookupIdempotency(db: D1Database, key: string): Promise<StoredIdempotencyRecord | null> {
-  return db.prepare(
-    `SELECT idempotency_key, request_fingerprint, response_status, response_body, expires_at
-     FROM public_idempotency_keys WHERE idempotency_key = ? LIMIT 1`
-  ).bind(key).first<StoredIdempotencyRecord>()
-}
-
-async function storeIdempotency(db: D1Database, input: {
-  key: string; fingerprint: string; responseStatus: number
-  responseBody: string; expiresAt: number; createdAt: number
-}): Promise<void> {
-  await db.prepare(
-    `INSERT INTO public_idempotency_keys (idempotency_key, request_fingerprint, response_status, response_body, created_at, expires_at)
-     VALUES (?, ?, ?, ?, ?, ?)
-     ON CONFLICT(idempotency_key) DO UPDATE SET
-       request_fingerprint = excluded.request_fingerprint,
-       response_status = excluded.response_status,
-       response_body = excluded.response_body,
-       created_at = excluded.created_at,
-       expires_at = excluded.expires_at`
-  ).bind(input.key, input.fingerprint, input.responseStatus, input.responseBody, input.createdAt, input.expiresAt).run()
-}
-
-export async function publicAddHandler(c: Context<{ Bindings: Bindings; Variables: Variables }>) {
-  const seedSlug = c.req.param('seed') ?? ''
-  const seed = c.get('getSeed')(seedSlug)
+export async function publicAddHandler(context: Context<AppEnv>) {
+  const seedSlug = context.req.param('seed') ?? ''
+  const seed = context.get('getSeed')(seedSlug)
   if (!seed) {
-    return publicProblem(c, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
+    return publicProblem(context, { 
+      type: 'seed-not-found', 
+      title: 'Seed Not Found', 
+      status: 404, 
+      detail: `The content type '${seedSlug}' does not exist.` 
+    })
   }
+  
   const access = checkPublicOperation(seed, 'add')
   if (!access.ok) {
-    return publicProblem(c, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
+    return publicProblem(context, { 
+      type: 'operation-not-allowed', 
+      title: access.error.error, 
+      status: 403, 
+      detail: access.error.message 
+    })
   }
 
   let body: Record<string, unknown>
   try {
-    const parsed = await c.req.json<unknown>()
+    const parsed = await context.req.json<unknown>()
     body = asRecord(parsed) ?? {}
   } catch {
-    return publicProblem(c, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
+    return publicProblem(context, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
   }
 
   const rawData = asRecord(body.data)
   if (!rawData || Object.keys(rawData).length === 0) {
-    return publicProblem(c, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
+    return publicProblem(context, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' is required and must be a non-empty object" })
   }
 
   const statusValue = body.status ?? 'draft'
   if (!isValidContentStatus(statusValue)) {
-    return publicProblem(c, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
+    return publicProblem(context, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' })
   }
 
   const sanitized = sanitizePublicPayload(seed, rawData, {
-    operation: 'create', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true,
+    operation: 'create', 
+    allowNull: false, 
+    requireAtLeastOneValidField: true, 
+    enforceRequiredFields: true,
   })
+  
   if (!sanitized.ok) {
     if (sanitized.status === 422) {
-      return publicProblem(c, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
+      return publicProblem(context, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message })
     }
-    return publicProblem(c, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
+    return publicProblem(context, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details })
   }
 
-  const idempotencyKey = parseIdempotencyKey(c.req.header('Idempotency-Key'))
+  const idempotencyKey = parseIdempotencyKey(context.req.header('Idempotency-Key'))
   const entrySlug = pickSlugFromBody(body, sanitized.data)
   const finalSlug = entrySlug || crypto.randomUUID().slice(0, 8)
-  const table = `content_${seedSlug}`
+  const repository = context.get('repository')
+  const idempotencyRepository = context.get('idempotencyRepository')
 
   try {
-    const { DB } = c.env
     const now = Math.floor(Date.now() / 1000)
     const fingerprintPayload = JSON.stringify({ seedSlug, statusValue, slug: cleanStr(body.slug) ?? null, data: sanitized.data })
     const fingerprint = await sha256Hex(fingerprintPayload)
-    const idempotencyTtlSeconds = Math.max(60, Number.parseInt(c.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
+    const idempotencyTtlSeconds = Math.max(60, Number.parseInt(context.env.PUBLIC_IDEMPOTENCY_TTL_SECONDS ?? '86400', 10) || 86400)
 
     if (idempotencyKey) {
-      const existing = await lookupIdempotency(DB, idempotencyKey)
-      if (existing && existing.expires_at >= now) {
-        if (existing.request_fingerprint !== fingerprint) {
-          return publicProblem(c, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
+      const existing = await idempotencyRepository.lookup(idempotencyKey)
+      if (existing && existing.expiresAt >= now) {
+        if (existing.fingerprint !== fingerprint) {
+          return publicProblem(context, { type: 'idempotency-key-conflict', title: 'Conflict', status: 409, detail: 'Idempotency-Key was already used with a different request payload.' })
         }
         let parsedBody: unknown = null
-        try { parsedBody = JSON.parse(existing.response_body) } catch { parsedBody = { success: true } }
-        return c.json(parsedBody, existing.response_status as 201)
+        try { parsedBody = JSON.parse(existing.responseBody) } catch { parsedBody = { success: true } }
+        return context.json(parsedBody, existing.responseStatus as 201)
       }
     }
 
-    const slugExisting = await DB.prepare(`SELECT id FROM ${table} WHERE slug = ? LIMIT 1`).bind(finalSlug).first<{ id: string }>()
-    if (slugExisting) {
-      return publicProblem(c, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` })
-    }
-
     const id = crypto.randomUUID()
-    const { cols, placeholders, bindings } = buildInsertBindings(seed, sanitized.data)
-    const systemCols = ['id', 'slug', 'status', 'created_at', 'updated_at']
-    const systemVals = [id, finalSlug, statusValue, now, now]
-    const allCols = [...systemCols, ...cols].join(', ')
-    const allPlaceholders = [...systemVals.map(() => '?'), ...placeholders].join(', ')
-
-    await DB.prepare(`INSERT INTO ${table} (${allCols}) VALUES (${allPlaceholders})`).bind(...systemVals, ...bindings).run()
+    
+    try {
+      await repository.create(seed, id, finalSlug, statusValue as any, sanitized.data)
+    } catch (error) {
+      if (error instanceof SlugConflictError) {
+        return publicProblem(context, { 
+          type: 'slug-conflict', 
+          title: 'Conflict', 
+          status: 409, 
+          detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` 
+        })
+      }
+      throw error
+    }
 
     const responseBody = { success: true, id, slug: finalSlug }
     if (idempotencyKey) {
-      await storeIdempotency(DB, { key: idempotencyKey, fingerprint, responseStatus: 201, responseBody: JSON.stringify(responseBody), createdAt: now, expiresAt: now + idempotencyTtlSeconds })
+      await idempotencyRepository.store({ 
+        key: idempotencyKey, 
+        fingerprint, 
+        responseStatus: 201, 
+        responseBody: JSON.stringify(responseBody), 
+        expiresAt: now + idempotencyTtlSeconds 
+      })
     }
 
-    await createNotification(c, {
+    await createNotification(context, {
       title: `${seed.label}: Nuovo inserimento`,
       message: `Una nuova entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") è stata aggiunta via API pubblica.`,
       type: 'success',
     })
 
-    return c.json(responseBody, 201)
-  } catch (err) {
-    return publicProblem(c, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: errorMessage(c, err) })
+    return context.json(responseBody, 201)
+  } catch (error) {
+    console.error('Public add error:', error)
+    return publicProblem(context, { 
+      type: 'internal-server-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: errorMessage(context, error) 
+    })
   }
 }

package/src/public/public-edit.ts

@@ -1,33 +1,20 @@
-import { isValidContentStatus, resolvePolicies } from '@beechcms/core'
+import { isValidContentStatus, resolvePolicies, EntryNotFoundError } from '@beechcms/core'
 import type { Seed } from '@beechcms/core'
 import type { Context } from 'hono'
 import { cleanStr } from '../shared/query-utils'
-import { rowToApiData, buildUpdateBindings } from '../shared/content-utils'
 import { checkPublicOperation } from './access-policy'
 import { publicProblem } from './problem-details'
 import { slugify } from './slug-utils'
 import { sanitizePublicPayload } from './sanitize'
 import { createNotification } from '../shared/notification-service'
-
-type Bindings = {
-  DB: D1Database
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  ENV?: string
-}
-
-type Variables = {
-  jwtPayload: { sub: string; email?: string }
-  getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
-}
+import { AppEnv } from '../types'
 
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-type PublicCtx = Context<{ Bindings: Bindings; Variables: Variables }>
+type PublicCtx = Context<AppEnv>
 type ResolveResult<T> = { ok: true; value: T } | { ok: false; response: Response }
 
-function errorMessage(c: PublicCtx, err: unknown): string {
-  if (c.env.ENV !== 'production' && err instanceof Error) return err.message
+function errorMessage(context: PublicCtx, error: unknown): string {
+  if (context.env.ENV !== 'production' && error instanceof Error) return error.message
   return 'An unexpected error occurred.'
 }
 
@@ -45,48 +32,47 @@ function removeNullishFields(data: Record<string, unknown>): Record<string, unkn
   return next
 }
 
-function parseBody(c: PublicCtx): Promise<ResolveResult<Record<string, unknown>>> {
-  return c.req.json<unknown>()
+function parseBody(context: PublicCtx): Promise<ResolveResult<Record<string, unknown>>> {
+  return context.req.json<unknown>()
     .then((parsed) => ({ ok: true, value: asRecord(parsed) ?? {} }) as const)
     .catch(() => ({
       ok: false,
-      response: publicProblem(c, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' }),
+      response: publicProblem(context, { type: 'invalid-json-body', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' }),
     }))
 }
 
-function resolveSlug(c: PublicCtx, body: Record<string, unknown>, currentSlug: string): ResolveResult<{ slugRequested: boolean; nextSlug: string }> {
+function resolveSlug(context: PublicCtx, body: Record<string, unknown>, currentSlug: string): ResolveResult<{ slugRequested: boolean; nextSlug: string }> {
   const slugRequested = Object.hasOwn(body, 'slug')
   if (!slugRequested) return { ok: true, value: { slugRequested, nextSlug: currentSlug } }
   const requestedSlug = cleanStr(body.slug)
   if (!requestedSlug) {
-    return { ok: false, response: publicProblem(c, { type: 'invalid-slug', title: 'Bad Request', status: 400, detail: "Field 'slug' must be a non-empty string" }) }
+    return { ok: false, response: publicProblem(context, { type: 'invalid-slug', title: 'Bad Request', status: 400, detail: "Field 'slug' must be a non-empty string" }) }
   }
   return { ok: true, value: { slugRequested, nextSlug: slugify(requestedSlug) } }
 }
 
-function resolveStatus(c: PublicCtx, body: Record<string, unknown>, currentStatus: string): ResolveResult<string> {
+function resolveStatus(context: PublicCtx, body: Record<string, unknown>, currentStatus: string): ResolveResult<string> {
   if (!Object.hasOwn(body, 'status')) return { ok: true, value: currentStatus }
   const statusValue = body.status
   if (!isValidContentStatus(statusValue)) {
-    return { ok: false, response: publicProblem(c, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' }) }
+    return { ok: false, response: publicProblem(context, { type: 'invalid-status', title: 'Bad Request', status: 400, detail: 'Invalid status. Allowed values are: draft, review, published' }) }
   }
-  return { ok: true, value: statusValue }
+  return { ok: true, value: statusValue as string }
 }
 
 function resolveData(
-  c: PublicCtx,
+  context: PublicCtx,
   seed: Seed,
-  body: Record<string, unknown>,
-  currentRow: Record<string, unknown>
+  body: Record<string, unknown>
 ): ResolveResult<Record<string, unknown>> {
   if (!Object.hasOwn(body, 'data')) {
-    // No data update — return empty patch (caller keeps existing columns)
+    // No data update — return empty patch
     return { ok: true, value: {} }
   }
 
   const rawData = asRecord(body.data)
   if (!rawData) {
-    return { ok: false, response: publicProblem(c, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' must be an object when provided" }) }
+    return { ok: false, response: publicProblem(context, { type: 'invalid-data-object', title: 'Bad Request', status: 400, detail: "Field 'data' must be an object when provided" }) }
   }
 
   const sensitiveAliases = Object.keys(rawData).filter((alias) => {
@@ -94,90 +80,79 @@ function resolveData(
     return branch != null && resolvePolicies(branch).privacy !== 'plain'
   })
   if (sensitiveAliases.length > 0) {
-    return { ok: false, response: publicProblem(c, { type: 'sensitive-field-edit', title: 'Unprocessable Entity', status: 422, detail: `Cannot edit sensitive fields: ${sensitiveAliases.join(', ')}` }) }
+    return { ok: false, response: publicProblem(context, { type: 'sensitive-field-edit', title: 'Unprocessable Entity', status: 422, detail: `Cannot edit sensitive fields: ${sensitiveAliases.join(', ')}` }) }
   }
 
   const sanitized = sanitizePublicPayload(seed, rawData, { allowNull: true, operation: 'update', requireAtLeastOneValidField: true, enforceRequiredFields: true })
   if (!sanitized.ok) {
     if (sanitized.status === 422) {
-      return { ok: false, response: publicProblem(c, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message }) }
+      return { ok: false, response: publicProblem(context, { type: sanitized.code, title: 'Unprocessable Entity', status: 422, detail: sanitized.message }) }
     }
-    return { ok: false, response: publicProblem(c, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details }) }
+    return { ok: false, response: publicProblem(context, { type: sanitized.code, title: 'Bad Request', status: 400, detail: sanitized.message, errors: sanitized.details }) }
   }
 
-  // Merge: current columns + patch, remove nulls
-  const currentAliasData = rowToApiData(seed, currentRow)
-  const merged = removeNullishFields({ ...currentAliasData, ...sanitized.data })
-  return { ok: true, value: merged }
+  return { ok: true, value: removeNullishFields(sanitized.data) }
 }
 
-export async function publicEditHandler(c: PublicCtx) {
-  const seedSlug = c.req.param('seed') ?? ''
-  const id = c.req.param('id') ?? ''
-  const seed = c.get('getSeed')(seedSlug)
+export async function publicEditHandler(context: PublicCtx) {
+  const seedSlug = context.req.param('seed') ?? ''
+  const id = context.req.param('id') ?? ''
+  const seed = context.get('getSeed')(seedSlug)
   if (!seed) {
-    return publicProblem(c, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
+    return publicProblem(context, { type: 'seed-not-found', title: 'Seed Not Found', status: 404, detail: `The content type '${seedSlug}' does not exist.` })
   }
   const access = checkPublicOperation(seed, 'edit')
   if (!access.ok) {
-    return publicProblem(c, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
+    return publicProblem(context, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
   }
 
   if (!UUID_REGEX.test(id)) {
-    return publicProblem(c, { type: 'invalid-entry-id', title: 'Bad Request', status: 400, detail: 'Invalid entry ID format' })
+    return publicProblem(context, { type: 'invalid-entry-id', title: 'Bad Request', status: 400, detail: 'Invalid entry ID format' })
   }
 
-  const table = `content_${seedSlug}`
+  const repository = context.get('repository')
 
   try {
-    const { DB } = c.env
-    const currentRow = await DB.prepare(`SELECT * FROM ${table} WHERE id = ? LIMIT 1`)
-      .bind(id)
-      .first<Record<string, unknown>>()
-
-    if (!currentRow) {
-      return publicProblem(c, { type: 'entry-not-found', title: 'Not Found', status: 404, detail: `Entry '${id}' not found for content type '${seedSlug}'.` })
-    }
+    const entry = await repository.findById(seed, id)
 
-    const bodyResult = await parseBody(c)
+    const bodyResult = await parseBody(context)
     if (!bodyResult.ok) return bodyResult.response
 
-    const slugResult = resolveSlug(c, bodyResult.value, (currentRow.slug as string) ?? '')
+    const slugResult = resolveSlug(context, bodyResult.value, (entry.slug as string) ?? '')
     if (!slugResult.ok) return slugResult.response
 
-    const statusResult = resolveStatus(c, bodyResult.value, (currentRow.status as string) ?? 'draft')
+    const statusResult = resolveStatus(context, bodyResult.value, (entry.status as string) ?? 'draft')
     if (!statusResult.ok) return statusResult.response
 
-    const dataResult = resolveData(c, seed, bodyResult.value, currentRow)
+    const dataResult = resolveData(context, seed, bodyResult.value)
     if (!dataResult.ok) return dataResult.response
 
-    if (slugResult.value.slugRequested) {
-      const slugExisting = await DB.prepare(`SELECT id FROM ${table} WHERE slug = ? AND id != ? LIMIT 1`)
-        .bind(slugResult.value.nextSlug, id)
-        .first<{ id: string }>()
-
-      if (slugExisting) {
-        return publicProblem(c, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${slugResult.value.nextSlug}' already exists for content type '${seedSlug}'.` })
+    if (slugResult.value.slugRequested && slugResult.value.nextSlug !== entry.slug) {
+      const exists = await repository.existsSlug(seed, slugResult.value.nextSlug, id)
+      if (exists) {
+        return publicProblem(context, { type: 'slug-conflict', title: 'Conflict', status: 409, detail: `An entry with slug '${slugResult.value.nextSlug}' already exists for content type '${seedSlug}'.` })
       }
     }
 
-    const now = Math.floor(Date.now() / 1000)
-    const { setClause, bindings } = buildUpdateBindings(seed, dataResult.value)
-    const systemSet = `slug = ?, status = ?, updated_at = ?`
-    const fullSet = setClause ? `${systemSet}, ${setClause}` : systemSet
+    const updateData = { ...dataResult.value }
+    if (slugResult.value.slugRequested) {
+      (updateData as any).slug = slugResult.value.nextSlug
+    }
 
-    await DB.prepare(`UPDATE ${table} SET ${fullSet} WHERE id = ?`)
-      .bind(slugResult.value.nextSlug, statusResult.value, now, ...bindings, id)
-      .run()
+    await repository.update(seed, id, updateData, statusResult.value)
 
-    await createNotification(c, {
+    await createNotification(context, {
       title: `${seed.label}: Modifica`,
       message: `L'entry "${slugResult.value.nextSlug}" è stata modificata via API pubblica.`,
       type: 'info',
     })
 
-    return c.json({ success: true, id, slug: slugResult.value.nextSlug }, 200)
-  } catch (err) {
-    return publicProblem(c, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: errorMessage(c, err) })
+    return context.json({ success: true, id, slug: slugResult.value.nextSlug }, 200)
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { type: 'entry-not-found', title: 'Not Found', status: 404, detail: `Entry '${id}' not found for content type '${seedSlug}'.` })
+    }
+    console.error('Public edit error:', error)
+    return publicProblem(context, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: errorMessage(context, error) })
   }
 }