@beechcms/api 0.4.0-preview.9 → 0.4.0

package/src/public/public-read.ts

@@ -1,217 +1,216 @@
-import { resolvePolicies } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
-import type { Context } from 'hono'
-import { cleanStr } from '../shared/query-utils'
-import { rowToApiData } from '../shared/content-utils'
-import { checkPublicOperation } from './access-policy'
-import { publicProblem } from './problem-details'
-import { buildPublicListMeta, buildPublicSingleMeta } from './response-builder'
-import {
-  buildPublicFilterWhereClause,
-  parseLatestCount,
-  parsePublicFilter,
-  parsePublicPagination,
-} from './query-builder'
-
-type Bindings = {
-  DB: D1Database
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  PUBLIC_PUBLISHED_ONLY?: string
-  ENV?: string
-}
-
-type Variables = {
-  jwtPayload: { sub: string; email?: string }
-  getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
-}
-
-function buildSeedNotFoundMessage(seed: string, seedRegistry: Record<string, Seed>): string {
-  const available = Object.keys(seedRegistry).join(', ')
-  return `The content type '${seed}' does not exist. Available types: ${available}.`
-}
-
-/** Applica policy public/visibility per la Public API. */
-function applyPublicPolicies(aliasData: Record<string, unknown>, seed: Seed): Record<string, unknown> {
-  const result: Record<string, unknown> = {}
-  for (const branch of seed.branches) {
-    const value = aliasData[branch.alias]
-    const { public: isPublic, visibility } = resolvePolicies(branch)
-    if (!isPublic) continue
-    if (visibility === 'hidden') continue
-    if (visibility === 'masked') {
-      result[branch.alias] = typeof value === 'string' && value.length > 0 ? '••••••••' : null
-    } else {
-      result[branch.alias] = value
-    }
-  }
-  return result
-}
-
-function toFlatPublicEntry(row: Record<string, unknown>, seed: Seed, fieldsParam?: string): Record<string, unknown> {
-  const aliasData = applyPublicPolicies(rowToApiData(seed, row), seed)
-  const base: Record<string, unknown> = {
-    id: row.id,
-    slug: row.slug,
-    status: row.status,
-    created_at: row.created_at,
-    updated_at: row.updated_at,
-  }
-  const requestedFields = (fieldsParam ?? '').split(',').map((f) => f.trim()).filter(Boolean)
-  if (requestedFields.length === 0) return { ...base, ...aliasData }
-  const filteredData: Record<string, unknown> = {}
-  for (const field of requestedFields) {
-    if (field in aliasData) filteredData[field] = aliasData[field]
-  }
-  return { ...base, ...filteredData }
-}
-
-function withCache(
-  cache: Cache | undefined,
-  executionCtx: { waitUntil: (p: Promise<unknown>) => void } | undefined,
-  cacheKey: Request,
-  response: Response
-): Response {
-  if (cache && executionCtx) {
-    const cloned = response.clone()
-    const headers = new Headers(cloned.headers)
-    headers.set('Cache-Control', 'public, max-age=60')
-    executionCtx.waitUntil(cache.put(cacheKey, new Response(cloned.body, { status: cloned.status, headers })))
-  }
-  return response
-}
-
-function buildInternalErrorMessage(c: Context<{ Bindings: Bindings; Variables: Variables }>, err: unknown): string {
-  if (c.env.ENV !== 'production' && err instanceof Error) return err.message
-  return 'An unexpected error occurred.'
-}
-
-function buildOrderSql(seed: Seed, query: Record<string, string | undefined>, hasLatest: boolean): string {
-  if (hasLatest) return 'ORDER BY created_at DESC'
-  const orderBy = cleanStr(query.orderBy) ?? ''
-  const orderDir = (cleanStr(query.orderDir) ?? 'desc').toLowerCase()
-  if (orderBy === 'created_at' || orderBy === 'updated_at') {
-    return `ORDER BY ${orderBy} ${orderDir === 'asc' ? 'ASC' : 'DESC'}`
-  }
-  // Branch column — always a real column in v0.4.0
-  const branch = seed.branches.find((b) => b.alias === orderBy)
-  if (branch) {
-    const dir = orderDir === 'asc' ? 'ASC' : 'DESC'
-    return `ORDER BY ${branch.alias} ${dir} NULLS LAST`
-  }
-  return 'ORDER BY created_at DESC'
-}
-
-export async function publicReadHandler(c: Context<{ Bindings: Bindings; Variables: Variables }>) {
-  const seedSlug = c.req.param('seed') ?? ''
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) {
-    return publicProblem(c, {
-      type: 'seed-not-found', title: 'Seed Not Found', status: 404,
-      detail: buildSeedNotFoundMessage(seedSlug, c.get('seedRegistry')),
-    })
-  }
-  const access = checkPublicOperation(seed, 'read')
-  if (!access.ok) {
-    return publicProblem(c, { type: 'operation-not-allowed', title: access.error.error, status: 403, detail: access.error.message })
-  }
-
-  let cache: Cache | undefined
-  let executionCtx: { waitUntil: (p: Promise<unknown>) => void } | undefined
-  try {
-    cache = caches.default
-    executionCtx = c.executionCtx as typeof executionCtx
-  } catch {}
-
-  const cacheKey = c.req.raw
-  if (cache) {
-    const hit = await cache.match(cacheKey)
-    if (hit) return hit
-  }
-
-  const query = c.req.query()
-  const id = cleanStr(query.id)
-  const table = `content_${seedSlug}`
-  const publishedOnly = c.env.PUBLIC_PUBLISHED_ONLY !== 'false'
-
-  try {
-    const { DB } = c.env
-
-    if (id) {
-      const row = await DB.prepare(
-        `SELECT * FROM ${table} WHERE id = ? ${publishedOnly ? "AND status = 'published'" : ''} LIMIT 1`
-      ).bind(id).first<Record<string, unknown>>()
-
-      if (!row) {
-        return publicProblem(c, { type: 'entry-not-found', title: 'Not Found', status: 404, detail: `Entry '${id}' not found for content type '${seedSlug}'.` })
-      }
-
-      return withCache(cache, executionCtx, cacheKey,
-        c.json({ data: toFlatPublicEntry(row, seed, query.fields), meta: buildPublicSingleMeta(seedSlug) }, 200)
-      )
-    }
-
-    const parsedFilter = parsePublicFilter(query.filter)
-    const allMode = cleanStr(query.all)?.toLowerCase() === 'true'
-    const latestMode = cleanStr(query.latest) !== null
-    const latestCount = latestMode ? parseLatestCount(query.latest ?? '') : null
-    const pagination = allMode ? { page: 1, limit: 100 } : parsePublicPagination(query)
-    const offset = (pagination.page - 1) * pagination.limit
-    const search = cleanStr(query.search) ?? ''
-
-    const whereParts: string[] = []
-    const whereBindings: Array<string | number> = []
-    if (publishedOnly) whereParts.push("status = 'published'")
-
-    if (search) {
-      // Search against slug and text/richtext columns
-      const searchableBranches = seed.branches.filter((b) => ['text', 'richtext'].includes(b.type))
-      const term = `%${search}%`
-      const searchExprs = ['slug LIKE ?', ...searchableBranches.map((b) => `${b.alias} LIKE ?`)]
-      whereParts.push(`(${searchExprs.join(' OR ')})`)
-      whereBindings.push(term, ...searchableBranches.map(() => term))
-    }
-
-    const filterClause = buildPublicFilterWhereClause(seed, parsedFilter)
-    if (filterClause.clause) {
-      whereParts.push(`(${filterClause.clause})`)
-      whereBindings.push(...filterClause.bindings)
-    }
-
-    const whereSql = whereParts.length > 0 ? `WHERE ${whereParts.join(' AND ')}` : ''
-    const countRow = await DB.prepare(`SELECT COUNT(*) as total FROM ${table} ${whereSql}`)
-      .bind(...whereBindings)
-      .first<{ total: number }>()
-    const total = countRow?.total ?? 0
-
-    const orderSql = buildOrderSql(seed, query, latestMode)
-    const effectiveLimit = latestMode ? (latestCount ?? 10) : pagination.limit
-    const effectiveOffset = latestMode ? 0 : offset
-
-    const rowsResult = await DB.prepare(`SELECT * FROM ${table} ${whereSql} ${orderSql} LIMIT ? OFFSET ?`)
-      .bind(...whereBindings, effectiveLimit, effectiveOffset)
-      .all<Record<string, unknown>>()
-
-    const rows = rowsResult.results ?? []
-    const data = rows.map((row) => toFlatPublicEntry(row, seed, query.fields))
-
-    if (latestMode) {
-      return withCache(cache, executionCtx, cacheKey,
-        c.json({ data, meta: { total, returned: data.length, seed: seedSlug } }, 200)
-      )
-    }
-
-    return withCache(cache, executionCtx, cacheKey,
-      c.json({
-        data,
-        meta: buildPublicListMeta({ total, page: pagination.page, limit: effectiveLimit, returned: data.length, seed: seedSlug }),
-      }, 200)
-    )
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith('Invalid filter:')) {
-      return publicProblem(c, { type: 'invalid-filter', title: 'Bad Request', status: 400, detail: err.message })
-    }
-    return publicProblem(c, { type: 'internal-server-error', title: 'Internal Server Error', status: 500, detail: buildInternalErrorMessage(c, err) })
-  }
-}
+import { resolvePolicies, EntryNotFoundError } from '@beechcms/core'
+import type { Seed } from '@beechcms/core'
+import type { Context } from 'hono'
+import { cleanStr } from '../shared/query-utils'
+import { checkPublicOperation } from './access-policy'
+import { publicProblem } from './problem-details'
+import { buildPublicListMeta, buildPublicSingleMeta } from './response-builder'
+import {
+  parseLatestCount,
+  parsePublicFilter,
+  parsePublicPagination,
+  toEngineFilters,
+} from './query-builder'
+import { AppEnv } from '../types'
+
+function buildSeedNotFoundMessage(seed: string, seedRegistry: Record<string, Seed>): string {
+  const available = Object.keys(seedRegistry).join(', ')
+  return `The content type '${seed}' does not exist. Available types: ${available}.`
+}
+
+/** Applies public/visibility policies for the Public API. */
+function applyPublicPolicies(data: Record<string, unknown>, seed: Seed): Record<string, unknown> {
+  const result: Record<string, unknown> = {}
+  
+  // System fields are mapped to top-level for public API
+  const system = ['id', 'slug', 'status', 'created_at', 'updated_at']
+  for (const key of system) {
+    if (key in data) result[key] = data[key]
+  }
+
+  for (const branch of seed.branches) {
+    const value = data[branch.alias]
+    const { public: isPublic, visibility } = resolvePolicies(branch)
+    if (!isPublic) continue
+    if (visibility === 'hidden') continue
+    if (visibility === 'masked') {
+      result[branch.alias] = typeof value === 'string' && value.length > 0 ? '••••••••' : null
+    } else {
+      result[branch.alias] = value
+    }
+  }
+  return result
+}
+
+function toFlatPublicEntry(data: Record<string, unknown>, seed: Seed, fieldsParam?: string): Record<string, unknown> {
+  const aliasData = applyPublicPolicies(data, seed)
+  const requestedFields = (fieldsParam ?? '').split(',').map((f) => f.trim()).filter(Boolean)
+  
+  if (requestedFields.length === 0) return aliasData
+  
+  const filteredData: Record<string, unknown> = {}
+  for (const field of requestedFields) {
+    if (field in aliasData) filteredData[field] = aliasData[field]
+  }
+  
+  // Always include basic identity fields if they exist in filtered data or if requested
+  const identity = ['id', 'slug']
+  for (const key of identity) {
+    if (key in aliasData && !filteredData[key]) filteredData[key] = aliasData[key]
+  }
+  
+  return filteredData
+}
+
+function withCache(
+  cache: Cache | undefined,
+  executionCtx: { waitUntil: (p: Promise<unknown>) => void } | undefined,
+  cacheKey: Request,
+  response: Response
+): Response {
+  if (cache && executionCtx) {
+    const cloned = response.clone()
+    const headers = new Headers(cloned.headers)
+    headers.set('Cache-Control', 'public, max-age=60')
+    executionCtx.waitUntil(cache.put(cacheKey, new Response(cloned.body, { status: cloned.status, headers })))
+  }
+  return response
+}
+
+function buildInternalErrorMessage(context: Context<AppEnv>, error: unknown): string {
+  if (context.env.ENV !== 'production' && error instanceof Error) return error.message
+  return 'An unexpected error occurred.'
+}
+
+export async function publicReadHandler(context: Context<AppEnv>) {
+  const seedSlug = context.req.param('seed') ?? ''
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) {
+    return publicProblem(context, {
+      type: 'seed-not-found', 
+      title: 'Seed Not Found', 
+      status: 404,
+      detail: buildSeedNotFoundMessage(seedSlug, context.get('seedRegistry')),
+    })
+  }
+  
+  const access = checkPublicOperation(seed, 'read')
+  if (!access.ok) {
+    return publicProblem(context, { 
+      type: 'operation-not-allowed', 
+      title: access.error.error, 
+      status: 403, 
+      detail: access.error.message 
+    })
+  }
+
+  let cache: Cache | undefined
+  let executionCtx: { waitUntil: (p: Promise<unknown>) => void } | undefined
+  try {
+    cache = caches.default
+    executionCtx = context.executionCtx as typeof executionCtx
+  } catch {}
+
+  const cacheKey = context.req.raw
+  if (cache) {
+    const hit = await cache.match(cacheKey)
+    if (hit) return hit
+  }
+
+  const query = context.req.query()
+  const id = cleanStr(query.id)
+  const slug = cleanStr(query.slug)
+  const publishedOnly = context.env.PUBLIC_PUBLISHED_ONLY !== 'false'
+  const repository = context.get('repository')
+
+  try {
+    if (id || slug) {
+      try {
+        const entry = id 
+          ? await repository.findById(seed, id)
+          : await repository.findBySlug(seed, slug!)
+        
+        if (publishedOnly && entry.status !== 'published') {
+          return publicProblem(context, { 
+            type: 'entry-not-found', 
+            title: 'Not Found', 
+            status: 404, 
+            detail: `Entry '${id || slug}' not found or not published.` 
+          })
+        }
+
+        return withCache(cache, executionCtx, cacheKey,
+          context.json({ 
+            data: toFlatPublicEntry(entry, seed, query.fields), 
+            meta: buildPublicSingleMeta(seedSlug) 
+          }, 200)
+        )
+      } catch (error) {
+        if (error instanceof EntryNotFoundError) {
+          return publicProblem(context, { 
+            type: 'entry-not-found', 
+            title: 'Not Found', 
+            status: 404, 
+            detail: `Entry '${id || slug}' not found for content type '${seedSlug}'.` 
+          })
+        }
+        throw error
+      }
+    }
+
+    const parsedFilter = parsePublicFilter(query.filter)
+    const allMode = cleanStr(query.all)?.toLowerCase() === 'true'
+    const latestMode = cleanStr(query.latest) !== null
+    const latestCount = latestMode ? parseLatestCount(query.latest ?? '') : null
+    const pagination = allMode ? { page: 1, limit: 100 } : parsePublicPagination(query)
+    const offset = (pagination.page - 1) * pagination.limit
+    const search = cleanStr(query.search) ?? ''
+
+    const engineFilters = toEngineFilters(seed, parsedFilter)
+    const sortBy = cleanStr(query.orderBy) ?? 'created_at'
+    const sortDir = (cleanStr(query.orderDir) ?? 'desc').toLowerCase() === 'asc' ? 'ASC' : 'DESC'
+
+    const { items, total } = await repository.findMany(seed, {
+      filters: engineFilters,
+      search: search || undefined,
+      status: publishedOnly ? 'published' : null,
+      pagination: { 
+        limit: latestMode ? (latestCount ?? 10) : pagination.limit, 
+        offset: latestMode ? 0 : offset 
+      },
+      orderBy: latestMode ? { column: 'created_at', dir: 'DESC' } : { column: sortBy, dir: sortDir }
+    })
+
+    const data = items.map((item) => toFlatPublicEntry(item, seed, query.fields))
+
+    if (latestMode) {
+      return withCache(cache, executionCtx, cacheKey,
+        context.json({ data, meta: { total, returned: data.length, seed: seedSlug } }, 200)
+      )
+    }
+
+    return withCache(cache, executionCtx, cacheKey,
+      context.json({
+        data,
+        meta: buildPublicListMeta({ 
+          total, 
+          page: pagination.page, 
+          limit: latestMode ? (latestCount ?? 10) : pagination.limit, 
+          returned: data.length, 
+          seed: seedSlug 
+        }),
+      }, 200)
+    )
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith('Invalid filter:')) {
+      return publicProblem(context, { type: 'invalid-filter', title: 'Bad Request', status: 400, detail: error.message })
+    }
+    console.error('Public read error:', error)
+    return publicProblem(context, { 
+      type: 'internal-server-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: buildInternalErrorMessage(context, error) 
+    })
+  }
+}

package/src/public/public-routes.ts

@@ -1,31 +1,84 @@
-import { Hono } from 'hono'
-import { publicReadHandler } from './public-read'
-import { publicAddHandler } from './public-add'
-import { publicEditHandler } from './public-edit'
-
-type Bindings = {
-  DB: D1Database
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  ENV?: string
-}
-
-type Variables = {
-  jwtPayload: { sub: string; email?: string }
-}
-
-const publicApp = new Hono<{ Bindings: Bindings; Variables: Variables }>()
-
-/**
- * Step 1 smoke endpoint to validate API key middleware flow.
- */
-publicApp.get('/health', (c) => {
-  return c.json({ ok: true, service: 'public-api' }, 200)
-})
-
-publicApp.get('/:seed', publicReadHandler)
-publicApp.post('/:seed/add', publicAddHandler)
-publicApp.put('/:seed/edit/:id', publicEditHandler)
-
-export const publicRoutes = publicApp
-
+import { Hono } from 'hono'
+import type { AppEnv } from '../types'
+import { publicReadHandler } from './public-read'
+import { publicAddHandler } from './public-add'
+import { publicEditHandler } from './public-edit'
+
+const publicApp = new Hono<AppEnv>()
+
+publicApp.get('/health', (c) => {
+  return c.json({ ok: true, service: 'public-api' }, 200)
+})
+
+/** Returns the public-facing schema: only seeds with public read or post enabled. */
+publicApp.get('/schema', (c) => {
+  const registry = c.get('seedRegistry')
+  const publicSeeds = Object.values(registry)
+    .filter(seed => seed.allowPublicRead === true || seed.allowPublicPost === true || seed.allowPublicEdit === true)
+    .map(seed => ({
+      slug: seed.slug,
+      label: seed.label,
+      labelPlural: seed.labelPlural,
+      allowPublicRead: seed.allowPublicRead ?? false,
+      allowPublicPost: seed.allowPublicPost ?? false,
+      allowPublicEdit: seed.allowPublicEdit ?? false,
+      branches: (seed.branches ?? []).map(branch => ({
+        alias: branch.alias,
+        type: branch.type,
+        label: branch.label,
+        requiredOnCreate: branch.requiredOnCreate ?? false,
+        policies: {
+          public: branch.policies?.public ?? true,
+          visibility: branch.policies?.visibility ?? 'full',
+        },
+      })),
+    }))
+  return c.json({ seeds: publicSeeds })
+})
+
+/** HTML render of the public schema for quick browser inspection. */
+publicApp.get('/schema.html', (c) => {
+  const registry = c.get('seedRegistry')
+  const publicSeeds = Object.values(registry)
+    .filter(seed => seed.allowPublicRead === true || seed.allowPublicPost === true || seed.allowPublicEdit === true)
+
+  const seedHtml = publicSeeds.map(seed => {
+    const ops = [
+      seed.allowPublicRead && 'GET /:seed',
+      seed.allowPublicPost && 'POST /:seed/add',
+      seed.allowPublicEdit && 'PUT /:seed/edit/:id',
+    ].filter(Boolean).join(', ')
+
+    const branchRows = (seed.branches ?? []).map(b =>
+      `<tr><td>${b.alias}</td><td>${b.type}</td><td>${b.label}</td><td>${b.requiredOnCreate ? 'yes' : ''}</td><td>${(b.policies?.public ?? true) ? 'readable' : 'hidden'}</td></tr>`
+    ).join('')
+
+    return `<section>
+      <h2>${seed.label} <code>${seed.slug}</code></h2>
+      <p><strong>Allowed operations:</strong> ${ops || 'none'}</p>
+      <table><thead><tr><th>alias</th><th>type</th><th>label</th><th>required</th><th>public access</th></tr></thead>
+      <tbody>${branchRows}</tbody></table>
+    </section>`
+  }).join('\n')
+
+  const html = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
+<title>BeechCMS Public Schema</title>
+<style>body{font-family:system-ui,sans-serif;max-width:900px;margin:2rem auto;padding:0 1rem;color:#222}
+code{background:#f3f4f6;padding:2px 6px;border-radius:4px}
+table{border-collapse:collapse;width:100%}th,td{text-align:left;padding:6px 10px;border:1px solid #e5e7eb}
+th{background:#f9fafb}h2{margin-top:2rem}section{margin-bottom:2rem}</style>
+</head><body>
+<h1>BeechCMS — Public API Schema</h1>
+<p>Only content types with public access enabled are listed here.</p>
+${seedHtml || '<p><em>No content types with public access configured.</em></p>'}
+</body></html>`
+
+  return c.html(html)
+})
+
+publicApp.get('/:seed', publicReadHandler)
+publicApp.post('/:seed/add', publicAddHandler)
+publicApp.put('/:seed/edit/:id', publicEditHandler)
+
+export const publicRoutes = publicApp
+