@beechcms/api 0.4.0-preview.9 → 0.4.0

package/src/features/content/constants.ts

@@ -0,0 +1,10 @@
+export const CONTENT_ERRORS = {
+  INVALID_SLUG: 'Invalid slug',
+  INVALID_SLUG_OR_ID: 'Invalid slug or id',
+  INVALID_JSON_BODY: 'Invalid JSON body',
+  NOT_FOUND: 'Not found',
+  SEED_NOT_FOUND: 'Seed not found',
+  DATABASE_ERROR: 'Database error',
+  SLUG_CONFLICT: 'Slug already exists for this schema',
+  SENSITIVE_FIELD_EDIT: 'Cannot edit sensitive fields',
+} as const

package/src/features/content/handlers/create.ts

@@ -0,0 +1,153 @@
+import { Context } from 'hono'
+import { 
+  slugify, 
+  isValidContentStatus, 
+  validateAndSanitizeSeedPayload,
+  SlugConflictError
+} from '@beechcms/core'
+import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { logActivity } from '../../../shared/activity-logger'
+import { cleanStr } from '../../../shared/query-utils'
+import { AppEnv } from '../../../types'
+
+function normalizeBody(raw: unknown): Record<string, unknown> {
+  return typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : {}
+}
+
+function contentValidationProblem(
+  context: Context,
+  details: Array<{ field: string; expected: string; received: string; message: string }>
+) {
+  return publicProblem(context, { 
+    type: 'content-validation-failed', 
+    title: 'Bad Request', 
+    status: 400, 
+    detail: 'Validation failed', 
+    errors: details 
+  })
+}
+
+export async function createHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = normalizeBody(await context.req.json<unknown>())
+  } catch {
+    return publicProblem(context, { 
+      type: 'content-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_JSON_BODY 
+    })
+  }
+
+  const entrySlug = body.slug ? slugify(String(body.slug)) : null
+  const status = cleanStr(body.status) ?? 'draft'
+  if (!isValidContentStatus(status)) {
+    return publicProblem(context, { 
+      type: 'content-invalid-status', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: 'Invalid status. Allowed values are: draft, review, published' 
+    })
+  }
+
+  const bodyForData = { ...body }
+  delete bodyForData.slug
+  delete bodyForData.status
+
+  const validation = validateAndSanitizeSeedPayload(seed, bodyForData, {
+    operation: 'create', 
+    allowNull: false, 
+    requireAtLeastOneValidField: true, 
+    enforceRequiredFields: true,
+  })
+
+  if (validation.dangerousFields.length > 0) {
+    return publicProblem(context, { 
+      type: 'content-dangerous-content', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Content rejected: dangerous markup detected in field '${validation.dangerousFields[0]}'` 
+    })
+  }
+  
+  if (validation.details.length > 0) return contentValidationProblem(context, validation.details)
+
+  let privacyData: Record<string, unknown>
+  try {
+    privacyData = await applyPrivacy(validation.data, seed)
+  } catch (error) {
+    if (error instanceof PrivacyPolicyError) {
+      return publicProblem(context, { 
+        type: 'content-policy-not-implemented', 
+        title: 'Not Implemented', 
+        status: 501, 
+        detail: error.message 
+      })
+    }
+    throw error
+  }
+
+  const id = crypto.randomUUID()
+  let finalSlug = entrySlug
+  if (!finalSlug) {
+    const fallbackSource = privacyData[seed.displayNameAlias ?? 'title'] || privacyData.title || privacyData.name || id
+    finalSlug = slugify(String(fallbackSource))
+  }
+
+  try {
+    const repository = context.get('repository')
+    await repository.create(seed, id, finalSlug, status, privacyData)
+
+    const userId = context.get('jwtPayload')?.sub
+    const title = privacyData.title || privacyData.name || finalSlug
+    
+    logActivity(context, { 
+      action: 'create', 
+      entityType: 'content', 
+      entityId: id, 
+      entitySlug: slug, 
+      details: { title } 
+    })
+
+    return context.json({ id }, 201)
+  } catch (error) {
+    if (error instanceof SlugConflictError) {
+      return publicProblem(context, { 
+        type: 'content-slug-conflict', 
+        title: 'Conflict', 
+        status: 409, 
+        detail: CONTENT_ERRORS.SLUG_CONFLICT 
+      })
+    }
+    console.error('Content create error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/delete.ts

@@ -0,0 +1,76 @@
+import { Context } from 'hono'
+import { EntryNotFoundError } from '@beechcms/core'
+import { deleteR2Objects } from '../../../upload'
+import { extractMediaKeysFromData } from '../../../media-utils'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { logActivity } from '../../../shared/activity-logger'
+import { AppEnv } from '../../../types'
+
+export async function deleteHandler(context: Context<AppEnv>) {
+  const schemaSlug = context.req.param('slug')
+  const entryId = context.req.param('id')
+  if (!schemaSlug || !entryId) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(schemaSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    // Repository.delete returns the row data for cleanup
+    const { row } = await repository.delete(seed, entryId)
+
+    const userId = context.get('jwtPayload')?.sub
+    const title = row.title || row.name || entryId
+    
+    logActivity(context, { 
+      action: 'delete', 
+      entityType: 'content', 
+      entityId: entryId, 
+      entitySlug: schemaSlug, 
+      details: { title } 
+    })
+
+    
+    const r2ObjectKeys = extractMediaKeysFromData(seed, row)
+    if (r2ObjectKeys.length > 0) {
+      await deleteR2Objects(context, r2ObjectKeys).catch((error) => {
+        if (context.env.ENV !== 'production') {
+          console.warn('R2 cleanup on delete failed (orphaned files):', error)
+        }
+      })
+    }
+
+    return context.json({ success: true })
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { 
+        type: 'content-not-found', 
+        title: 'Not Found', 
+        status: 404, 
+        detail: CONTENT_ERRORS.NOT_FOUND 
+      })
+    }
+    console.error('Content delete error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/facets.ts

@@ -0,0 +1,45 @@
+import { Context } from 'hono'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+
+export async function facetsHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    const { statuses, tagsByColumn } = await repository.getFacets(seed)
+
+    // Legacy format expected by the dashboard
+    return context.json({
+      statuses: Object.keys(statuses).sort((a, b) => a.localeCompare(b, 'it')),
+      tagsByColumnId: tagsByColumn,
+    })
+  } catch (error) {
+    console.error('Content facets error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/get.ts

@@ -0,0 +1,116 @@
+import { Context } from 'hono'
+import { applyVisibility } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+import { EntryNotFoundError } from '@beechcms/core'
+
+export async function getByIdHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  const id = context.req.param('id')
+  if (!slug || !id) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    const item = await repository.findById(seed, id)
+    
+    let hasPendingDraft = false
+    if (seed.allowDrafts) {
+      hasPendingDraft = await repository.hasDraft(seed, id)
+    }
+
+    return context.json({
+      ...item,
+      has_pending_draft: hasPendingDraft,
+      data: applyVisibility(item, seed)
+    })
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { 
+        type: 'content-not-found', 
+        title: 'Not Found', 
+        status: 404, 
+        detail: CONTENT_ERRORS.NOT_FOUND 
+      })
+    }
+    console.error('Content detail error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}
+
+export async function getBySlugHandler(context: Context<AppEnv>) {
+  const schemaSlug = context.req.param('schema_slug')
+  const entrySlug = context.req.param('entry_slug')
+  if (!schemaSlug || !entrySlug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(schemaSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    const item = await repository.findBySlug(seed, entrySlug)
+    
+    let hasPendingDraft = false
+    if (seed.allowDrafts) {
+      hasPendingDraft = await repository.hasDraft(seed, item.id)
+    }
+
+    return context.json({
+      ...item,
+      has_pending_draft: hasPendingDraft,
+      data: applyVisibility(item, seed)
+    })
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { 
+        type: 'content-not-found', 
+        title: 'Not Found', 
+        status: 404, 
+        detail: CONTENT_ERRORS.NOT_FOUND 
+      })
+    }
+    console.error('Content by-slug error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/list.ts

@@ -0,0 +1,88 @@
+import { Context } from 'hono'
+import { parsePositiveInt, parseQueryFilters, cleanStr, toEngineFilters } from '../../../shared/query-utils'
+import { applyVisibility } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+
+export async function listHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const query = context.req.query()
+    const search = cleanStr(query.search) ?? ''
+    const sortBy = cleanStr(query.sortBy) ?? ''
+    const sortDirRaw = cleanStr(query.sortDir)?.toLowerCase() ?? 'asc'
+    const rawFilters = parseQueryFilters(query.filters)
+    const engineFilters = toEngineFilters(rawFilters)
+    
+    // Note: repository doesn't yet support has_pending_draft filter/column natively 
+    // in findMany without SQL manipulation. We'll stick to basic findMany for now
+    // and might need to enhance the repository if this feature is critical for v1 of this refactor.
+    // The legacy code was doing a lot of SQL injection here.
+    
+    const page = parsePositiveInt(query.page, 1)
+    const limit = Math.min(parsePositiveInt(query.limit, 25), 100)
+    const offset = (page - 1) * limit
+
+    const orderBy = sortBy
+      ? { column: sortBy, dir: (sortDirRaw === 'desc' ? 'DESC' : 'ASC') as 'ASC' | 'DESC' }
+      : undefined
+
+    const repository = context.get('repository')
+    const { items, total } = await repository.findMany(seed, {
+      filters: engineFilters,
+      orderBy,
+      search: search || undefined,
+      pagination: { limit, offset },
+    })
+
+    const entries = await Promise.all(items.map(async (item) => {
+      // Check for pending draft if allowed
+      let hasPendingDraft = false
+      if (seed.allowDrafts) {
+        hasPendingDraft = await repository.hasDraft(seed, item.id)
+      }
+
+      return {
+        ...item,
+        has_pending_draft: hasPendingDraft,
+        data: applyVisibility(item, seed) // Repository returns "pure" data including system fields
+      }
+    }))
+
+    // If no query params (except slug), return array directly (legacy compatibility)
+    const hasQueryParams = Boolean(search) || Boolean(sortBy) || Boolean(query.filters) || query.page !== undefined || query.limit !== undefined
+    if (!hasQueryParams) {
+      return context.json(entries)
+    }
+
+    return context.json({ items: entries, total, page, limit })
+  } catch (error) {
+    console.error('Content list error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/update.ts

@@ -0,0 +1,207 @@
+import { Context } from 'hono'
+import { 
+  slugify, 
+  isValidContentStatus, 
+  validateAndSanitizeSeedPayload,
+  resolvePolicies,
+  EntryNotFoundError,
+  SlugConflictError
+} from '@beechcms/core'
+import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { logActivity } from '../../../shared/activity-logger'
+import { cleanStr } from '../../../shared/query-utils'
+import { AppEnv } from '../../../types'
+
+function normalizeBody(raw: unknown): Record<string, unknown> {
+  return typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : {}
+}
+
+function contentValidationProblem(
+  context: Context,
+  details: Array<{ field: string; expected: string; received: string; message: string }>
+) {
+  return publicProblem(context, { 
+    type: 'content-validation-failed', 
+    title: 'Bad Request', 
+    status: 400, 
+    detail: 'Validation failed', 
+    errors: details 
+  })
+}
+
+export async function updateHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  const id = context.req.param('id')
+  if (!slug || !id) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = normalizeBody(await context.req.json<unknown>())
+  } catch {
+    return publicProblem(context, { 
+      type: 'content-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_JSON_BODY 
+    })
+  }
+
+  const bodyForData = { ...body }
+  delete bodyForData.slug
+  delete bodyForData.status
+
+  try {
+    const repository = context.get('repository')
+    // We need current data to handle slug and status if not provided, 
+    // and to verify existence.
+    const current = await repository.findById(seed, id)
+
+    const newSlug = body.slug !== undefined ? slugify(String(body.slug)) : (current.slug as string)
+    const newStatus = body.status !== undefined ? (cleanStr(body.status) ?? current.status as string) : current.status as string
+
+    if (!isValidContentStatus(newStatus)) {
+      return publicProblem(context, { 
+        type: 'content-invalid-status', 
+        title: 'Bad Request', 
+        status: 400, 
+        detail: 'Invalid status. Allowed values are: draft, review, published' 
+      })
+    }
+    
+    if (!newSlug) {
+      return publicProblem(context, { 
+        type: 'content-missing-slug', 
+        title: 'Bad Request', 
+        status: 400, 
+        detail: 'Missing required field: slug' 
+      })
+    }
+
+    let mergedData: Record<string, unknown> = {}
+
+    if (Object.keys(bodyForData).length > 0) {
+      const sensitiveAliases = Object.keys(bodyForData).filter((alias) => {
+        const branch = seed.branches.find((b) => b.alias === alias)
+        return branch != null && resolvePolicies(branch).privacy !== 'plain'
+      })
+      
+      if (sensitiveAliases.length > 0) {
+        return publicProblem(context, { 
+          type: 'content-sensitive-field-edit', 
+          title: 'Unprocessable Entity', 
+          status: 422, 
+          detail: `${CONTENT_ERRORS.SENSITIVE_FIELD_EDIT}: ${sensitiveAliases.join(', ')}` 
+        })
+      }
+
+      const validation = validateAndSanitizeSeedPayload(seed, bodyForData, {
+        operation: 'update', 
+        allowNull: true, 
+        requireAtLeastOneValidField: true, 
+        enforceRequiredFields: true,
+      })
+
+      if (validation.dangerousFields.length > 0) {
+        return publicProblem(context, { 
+          type: 'content-dangerous-content', 
+          title: 'Unprocessable Entity', 
+          status: 422, 
+          detail: `Content rejected: dangerous markup detected in field '${validation.dangerousFields[0]}'` 
+        })
+      }
+      
+      if (validation.details.length > 0) return contentValidationProblem(context, validation.details)
+
+      let privacyPatch: Record<string, unknown>
+      try {
+        privacyPatch = await applyPrivacy(validation.data, seed)
+      } catch (error) {
+        if (error instanceof PrivacyPolicyError) {
+          return publicProblem(context, { 
+            type: 'content-policy-not-implemented', 
+            title: 'Not Implemented', 
+            status: 501, 
+            detail: error.message 
+          })
+        }
+        throw error
+      }
+
+      // Remove null values from patch (patch semantics: null = leave unchanged)
+      for (const [k, v] of Object.entries(privacyPatch)) {
+        if (v !== null) mergedData[k] = v
+      }
+    }
+
+    if (newSlug !== current.slug) {
+      if (await repository.existsSlug(seed, newSlug, id)) {
+        return publicProblem(context, { 
+          type: 'content-slug-conflict', 
+          title: 'Conflict', 
+          status: 409, 
+          detail: CONTENT_ERRORS.SLUG_CONFLICT 
+        })
+      }
+      // Add slug to mergedData if changed
+      mergedData.slug = newSlug
+    }
+
+    await repository.update(seed, id, mergedData, newStatus)
+
+    const userId = context.get('jwtPayload')?.sub
+    const title = mergedData.title || mergedData.name || newSlug
+    
+    logActivity(context, { 
+      action: 'update', 
+      entityType: 'content', 
+      entityId: id, 
+      entitySlug: slug, 
+      details: { title } 
+    })
+
+    return context.json({ success: true })
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { 
+        type: 'content-not-found', 
+        title: 'Not Found', 
+        status: 404, 
+        detail: CONTENT_ERRORS.NOT_FOUND 
+      })
+    }
+    if (error instanceof SlugConflictError) {
+       return publicProblem(context, { 
+        type: 'content-slug-conflict', 
+        title: 'Conflict', 
+        status: 409, 
+        detail: CONTENT_ERRORS.SLUG_CONFLICT 
+      })
+    }
+    console.error('Content update error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}