@beechcms/api 0.4.0-preview.9 → 0.4.1

package/src/features/password-reset/index.ts

@@ -1,15 +1,15 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import type { Env, Variables } from '../../types'
-import { requestPasswordReset } from './request'
-import { resetPassword } from './reset'
-
-export const passwordResetApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-// Feature flag: lets the dashboard know whether to show the forgot-password link
-passwordResetApp.get('/auth/features', (c) => {
-  return c.json({ passwordReset: Boolean(c.env.RESEND_API_KEY) })
-})
-
-passwordResetApp.post('/auth/forgot-password', requestPasswordReset)
-passwordResetApp.post('/auth/reset-password', resetPassword)
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import type { Env, Variables } from '../../types'
+import { requestPasswordReset } from './request'
+import { resetPassword } from './reset'
+
+export const passwordResetApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+// Feature flag: lets the dashboard know whether to show the forgot-password link
+passwordResetApp.get('/auth/features', (context) => {
+  return context.json({ passwordReset: Boolean(context.env.RESEND_API_KEY) })
+})
+
+passwordResetApp.post('/auth/forgot-password', requestPasswordReset)
+passwordResetApp.post('/auth/reset-password', resetPassword)

package/src/features/password-reset/request.ts

@@ -1,88 +1,82 @@
-/// <reference types="@cloudflare/workers-types" />
-import type { Context } from 'hono'
-import type { Env, Variables } from '../../types'
-import { sendPasswordResetEmail, resolveEmailLocale } from '../email'
-
-const TOKEN_EXPIRY_SECONDS = 30 * 60
-
-async function sha256hex(text: string): Promise<string> {
-  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
-  return Array.from(new Uint8Array(buf))
-    .map(b => b.toString(16).padStart(2, '0'))
-    .join('')
-}
-
-export async function requestPasswordReset(
-  c: Context<{ Bindings: Env; Variables: Variables }>
-): Promise<Response> {
-  if (!c.env.RESEND_API_KEY) {
-    return c.json({ error: 'Not available' }, 503)
-  }
-
-  let body: Record<string, unknown>
-  try {
-    body = await c.req.json()
-  } catch {
-    return c.json({ error: 'Invalid request body' }, 400)
-  }
-
-  if (typeof body.email !== 'string' || !body.email.trim()) {
-    return c.json({ error: 'Invalid request' }, 400)
-  }
-
-  const email = body.email.trim().toLowerCase()
-  const locale = resolveEmailLocale(body.locale)
-
-  if (c.env.FORGOT_PASSWORD_RATE_LIMITER) {
-    const ip = c.req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
-    const { success } = await c.env.FORGOT_PASSWORD_RATE_LIMITER.limit({ key: ip })
-    if (!success) {
-      return c.json({ error: 'Too many requests' }, 429)
-    }
-  }
-
-  // Sempre 200 per evitare user enumeration
-  const user = await c.env.DB
-    .prepare('SELECT id FROM users WHERE email = ?')
-    .bind(email)
-    .first<{ id: string }>()
-
-  if (!user) {
-    return c.json({ success: true })
-  }
-
-  // Invalida eventuali token pendenti per lo stesso utente prima di emetterne uno nuovo
-  await c.env.DB
-    .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE user_id = ? AND used_at IS NULL')
-    .bind(user.id)
-    .run()
-
-  const token = crypto.randomUUID()
-  const tokenHash = await sha256hex(token)
-  const expiresAt = Math.floor(Date.now() / 1000) + TOKEN_EXPIRY_SECONDS
-
-  await c.env.DB
-    .prepare('INSERT INTO password_reset_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)')
-    .bind(crypto.randomUUID(), user.id, tokenHash, expiresAt)
-    .run()
-
-  const appUrl = (c.env.APP_URL ?? new URL(c.req.url).origin).replace(/\/$/, '')
-  const resetUrl = `${appUrl}/admin/reset-password?token=${token}`
-
-  try {
-    await sendPasswordResetEmail({
-      to: email,
-      resetUrl,
-      locale,
-      apiKey: c.env.RESEND_API_KEY,
-      from: c.env.EMAIL_FROM,
-      isDev: c.env.ENV !== 'production',
-    })
-  } catch (err) {
-    if (c.env.ENV !== 'production') {
-      console.error('[password-reset] invio email fallito:', err)
-    }
-  }
-
-  return c.json({ success: true })
-}
+/// <reference types="@cloudflare/workers-types" />
+import type { Context } from 'hono'
+import type { Env, Variables } from '../../types'
+import { sendPasswordResetEmail, resolveEmailLocale } from '../email'
+import { sha256hex } from '@beechcms/core'
+import { getClientIp } from '../../shared/request-utils'
+
+const PASSWORD_RESET_TOKEN_EXPIRY_SECONDS = 30 * 60
+
+/**
+ * Handles the password reset request.
+ * Generates a reset token, stores its hash in the database, and sends an email to the user.
+ */
+export async function requestPasswordReset(
+  context: Context<{ Bindings: Env; Variables: Variables }>
+): Promise<Response> {
+  const { env, req } = context
+
+  if (!env.RESEND_API_KEY) {
+    return context.json({ error: 'Service not available' }, 503)
+  }
+
+  let payload: Record<string, unknown>
+  try {
+    payload = await req.json()
+  } catch {
+    return context.json({ error: 'Invalid request body' }, 400)
+  }
+
+  const emailInput = payload.email
+  if (typeof emailInput !== 'string' || !emailInput.trim()) {
+    return context.json({ error: 'Invalid request' }, 400)
+  }
+
+  const normalizedEmail = emailInput.trim().toLowerCase()
+  const emailLocale = resolveEmailLocale(payload.locale)
+
+  const clientIpAddress = getClientIp(req)
+  const forgotPasswordRateLimit = await context.get('rateLimiters').getLimiter('forgotPassword').checkLimit(clientIpAddress)
+  if (!forgotPasswordRateLimit.isAllowed) {
+    return context.json({ error: 'Too many requests' }, 429)
+  }
+
+  // Always return 200 even when the user is not found to prevent user enumeration.
+  const registeredUser = await context.get('userRepository').findByEmail(normalizedEmail)
+  if (!registeredUser) {
+    return context.json({ success: true })
+  }
+
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+  await context.get('passwordResetTokenRepository').invalidatePending(registeredUser.id, nowTimestamp)
+
+  const resetToken = crypto.randomUUID()
+  const tokenHash = await sha256hex(resetToken)
+  const expiresAt = nowTimestamp + PASSWORD_RESET_TOKEN_EXPIRY_SECONDS
+
+  await context.get('passwordResetTokenRepository').create({
+    userId: registeredUser.id,
+    tokenHash,
+    expiresAt,
+  })
+
+  const baseUrl = (env.APP_URL ?? new URL(req.url).origin).replace(/\/$/, '')
+  const resetUrl = `${baseUrl}/admin/reset-password?token=${resetToken}`
+
+  try {
+    await sendPasswordResetEmail({
+      to: normalizedEmail,
+      resetUrl,
+      locale: emailLocale,
+      apiKey: env.RESEND_API_KEY,
+      from: env.EMAIL_FROM,
+      isDev: env.ENV !== 'production',
+    })
+  } catch (error) {
+    if (env.ENV !== 'production') {
+      console.error('[password-reset] Failed to send email:', error)
+    }
+  }
+
+  return context.json({ success: true })
+}

package/src/features/password-reset/reset.ts

@@ -1,110 +1,92 @@
-/// <reference types="@cloudflare/workers-types" />
-import type { Context } from 'hono'
-import bcrypt from 'bcryptjs'
-import type { Env, Variables } from '../../types'
-import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
-
-const MIN_PASSWORD_LENGTH = 8
-const MAX_PASSWORD_LENGTH = 128
-
-async function sha256hex(text: string): Promise<string> {
-  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
-  return Array.from(new Uint8Array(buf))
-    .map(b => b.toString(16).padStart(2, '0'))
-    .join('')
-}
-
-export async function resetPassword(
-  c: Context<{ Bindings: Env; Variables: Variables }>
-): Promise<Response> {
-  if (!c.env.RESEND_API_KEY) {
-    return c.json({ error: 'Not available' }, 503)
-  }
-
-  // Rate limiting: 5 tentativi per IP per 60 secondi
-  if (c.env.RESET_PASSWORD_RATE_LIMITER) {
-    const ip = c.req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
-    const { success } = await c.env.RESET_PASSWORD_RATE_LIMITER.limit({ key: ip })
-    if (!success) {
-      return c.json({ error: 'Too many requests' }, 429)
-    }
-  }
-
-  let body: Record<string, unknown>
-  try {
-    body = await c.req.json()
-  } catch {
-    return c.json({ error: 'Invalid request body' }, 400)
-  }
-
-  if (typeof body.token !== 'string' || !body.token) {
-    return c.json({ error: 'Invalid or expired token' }, 400)
-  }
-
-  if (
-    typeof body.password !== 'string' ||
-    body.password.length < MIN_PASSWORD_LENGTH ||
-    body.password.length > MAX_PASSWORD_LENGTH
-  ) {
-    return c.json({
-      error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
-    }, 400)
-  }
-
-  const locale = resolveEmailLocale(body.locale)
-  const tokenHash = await sha256hex(body.token)
-  const now = Math.floor(Date.now() / 1000)
-
-  // JOIN users per recuperare l'email in un'unica query — serve per la notifica
-  const record = await c.env.DB
-    .prepare(
-      `SELECT prt.id, prt.user_id, u.email
-       FROM password_reset_tokens prt
-       JOIN users u ON u.id = prt.user_id
-       WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`,
-    )
-    .bind(tokenHash, now)
-    .first<{ id: string; user_id: string; email: string }>()
-
-  if (!record) {
-    return c.json({ error: 'Invalid or expired token' }, 400)
-  }
-
-  const newHash = await bcrypt.hash(body.password, 10)
-
-  // Segna token usato, aggiorna password, revoca tutte le sessioni — atomicamente
-  await c.env.DB.batch([
-    c.env.DB
-      .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE id = ?')
-      .bind(record.id),
-    c.env.DB
-      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
-      .bind(newHash, record.user_id),
-    c.env.DB
-      .prepare('UPDATE refresh_tokens SET revoked_at = unixepoch() WHERE user_id = ? AND revoked_at IS NULL')
-      .bind(record.user_id),
-  ])
-
-  // Notifica "password modificata" — fire-and-forget via waitUntil, non blocca il 200
-  const notify = () =>
-    sendPasswordChangedEmail({
-      to: record.email,
-      locale,
-      apiKey: c.env.RESEND_API_KEY!,
-      from: c.env.EMAIL_FROM,
-      isDev: c.env.ENV !== 'production',
-    }).catch((err) => {
-      if (c.env.ENV !== 'production') {
-        console.error('[password-reset] notifica email fallita:', err)
-      }
-    })
-
-  try {
-    c.executionCtx.waitUntil(notify())
-  } catch {
-    // executionCtx non disponibile in ambiente di test
-    void notify()
-  }
-
-  return c.json({ success: true })
-}
+/// <reference types="@cloudflare/workers-types" />
+import type { Context } from 'hono'
+import type { Env, Variables } from '../../types'
+import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
+import { sha256hex } from '@beechcms/core'
+import { getClientIp } from '../../shared/request-utils'
+
+const MIN_PASSWORD_LENGTH = 8
+const MAX_PASSWORD_LENGTH = 128
+
+/**
+ * Handles the actual password reset process using a valid token.
+ */
+export async function resetPassword(
+  context: Context<{ Bindings: Env; Variables: Variables }>
+): Promise<Response> {
+  const { env, req, executionCtx } = context
+
+  if (!env.RESEND_API_KEY) {
+    return context.json({ error: 'Service not available' }, 503)
+  }
+
+  const clientIpAddress = getClientIp(req)
+  const resetPasswordRateLimit = await context.get('rateLimiters').getLimiter('resetPassword').checkLimit(clientIpAddress)
+  if (!resetPasswordRateLimit.isAllowed) {
+    return context.json({ error: 'Too many requests' }, 429)
+  }
+
+  let payload: Record<string, unknown>
+  try {
+    payload = await req.json()
+  } catch {
+    return context.json({ error: 'Invalid request body' }, 400)
+  }
+
+  const resetToken = payload.token
+  if (typeof resetToken !== 'string' || !resetToken) {
+    return context.json({ error: 'Invalid or expired token' }, 400)
+  }
+
+  const newPassword = payload.password
+  const isPasswordInvalid =
+    typeof newPassword !== 'string' ||
+    newPassword.length < MIN_PASSWORD_LENGTH ||
+    newPassword.length > MAX_PASSWORD_LENGTH
+
+  if (isPasswordInvalid) {
+    return context.json({
+      error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
+    }, 400)
+  }
+
+  const emailLocale = resolveEmailLocale(payload.locale)
+  const tokenHash = await sha256hex(resetToken as string)
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+
+  const tokenRecord = await context.get('passwordResetTokenRepository').findValidByHashWithEmail(tokenHash, nowTimestamp)
+  if (!tokenRecord) {
+    return context.json({ error: 'Invalid or expired token' }, 400)
+  }
+
+  const hashedNewPassword = await context.get('hashProvider').hash(newPassword as string)
+
+  await context.get('passwordResetTokenRepository').markUsed(tokenRecord.id, nowTimestamp)
+  await context.get('userRepository').updatePasswordHash(tokenRecord.userId, hashedNewPassword)
+  await context.get('sessionRepository').revokeAllForUser(tokenRecord.userId, nowTimestamp)
+
+  const sendNotification = async () => {
+    try {
+      await sendPasswordChangedEmail({
+        to: tokenRecord.email,
+        locale: emailLocale,
+        apiKey: env.RESEND_API_KEY!,
+        from: env.EMAIL_FROM,
+        isDev: env.ENV !== 'production',
+      })
+    } catch (error) {
+      if (env.ENV !== 'production') {
+        console.error('[password-reset] Failed to send password change notification:', error)
+      }
+    }
+  }
+
+  try {
+    executionCtx.waitUntil(sendNotification())
+  } catch {
+    // executionCtx might not be available in some testing environments
+    void sendNotification()
+  }
+
+  return context.json({ success: true })
+}

package/src/features/rotate-field/index.ts

@@ -1 +1 @@
-export { rotateFieldApp } from './rotate-field.handler'
+export { rotateFieldApp } from './rotate-field.handler'

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,82 +1,128 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, serializeForDb } from '@beechcms/core'
-import { publicProblem } from '../../public/problem-details'
-import { rotateFieldBodySchema } from './rotate-field.schema'
-import type { Env, Variables } from '../../types'
-
-const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-rotateFieldApp.post('/:slug/:id/rotate-field', async (c) => {
-  const slug = c.req.param('slug')
-  const id = c.req.param('id')
-
-  const seed = c.get('getSeed')(slug)
-  if (!seed) {
-    return publicProblem(c, { type: 'content-seed-not-found', title: 'Not Found', status: 404, detail: `Seed '${slug}' not found` })
-  }
-
-  let rawBody: unknown
-  try {
-    rawBody = await c.req.json()
-  } catch {
-    return publicProblem(c, { type: 'rotate-field-invalid-json', title: 'Bad Request', status: 400, detail: 'Invalid JSON body' })
-  }
-
-  const parsed = rotateFieldBodySchema.safeParse(rawBody)
-  if (!parsed.success) {
-    return publicProblem(c, { type: 'rotate-field-invalid-body', title: 'Bad Request', status: 400, detail: parsed.error.issues[0]?.message ?? 'Invalid body' })
-  }
-
-  const { field, current, next } = parsed.data
-
-  const branch = seed.branches.find((b) => b.alias === field)
-  if (!branch) {
-    return publicProblem(c, { type: 'rotate-field-unknown-field', title: 'Bad Request', status: 400, detail: `Field '${field}' does not exist in seed '${slug}'` })
-  }
-
-  const { privacy } = resolvePolicies(branch)
-  if (privacy !== 'hash') {
-    return publicProblem(c, { type: 'rotate-field-not-hashable', title: 'Unprocessable Entity', status: 422, detail: `Field '${field}' does not use hash privacy and cannot be rotated with this endpoint` })
-  }
-
-  const { DB } = c.env
-  // In v0.4.0 il valore hash è in una colonna reale: row[branch.alias]
-  const row = await DB.prepare(`SELECT ${branch.alias} FROM content_${slug} WHERE id = ? LIMIT 1`)
-    .bind(id)
-    .first<Record<string, unknown>>()
-
-  if (!row) {
-    return publicProblem(c, { type: 'content-not-found', title: 'Not Found', status: 404, detail: `Entry '${id}' not found` })
-  }
-
-  const storedHash = row[branch.alias]
-
-  if (typeof storedHash !== 'string' || storedHash.length === 0) {
-    return publicProblem(c, { type: 'rotate-field-not-set', title: 'Unprocessable Entity', status: 422, detail: `Field '${field}' has no stored value to rotate` })
-  }
-
-  const matches = await verifyHashField(storedHash, current)
-  if (!matches) {
-    return publicProblem(c, { type: 'rotate-field-current-mismatch', title: 'Forbidden', status: 403, detail: 'Current value does not match stored value' })
-  }
-
-  const validation = validateAndSanitizeSeedPayload(
-    seed, { [field]: next },
-    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
-  )
-  if (validation.details.length > 0) {
-    return publicProblem(c, { type: 'rotate-field-invalid-next', title: 'Bad Request', status: 400, detail: `Invalid value for field '${field}': ${validation.details[0]?.message ?? 'validation failed'}` })
-  }
-
-  const nextHash = await sha256hex(next)
-  const now = Math.floor(Date.now() / 1000)
-
-  await DB.prepare(`UPDATE content_${slug} SET ${branch.alias} = ?, updated_at = ? WHERE id = ?`)
-    .bind(serializeForDb(branch, nextHash), now, id)
-    .run()
-
-  return c.json({ success: true })
-})
-
-export { rotateFieldApp }
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
+import { publicProblem } from '../../public/problem-details'
+import { rotateFieldRequestSchema } from './rotate-field.schema'
+import type { Env, Variables } from '../../types'
+
+const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
+  const seedSlug = context.req.param('slug')
+  const entryId = context.req.param('id')
+
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: `Seed '${seedSlug}' not found` 
+    })
+  }
+
+  let requestBody: unknown
+  try {
+    requestBody = await context.req.json()
+  } catch {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: 'Invalid JSON body' 
+    })
+  }
+
+  const parsedRequestBody = rotateFieldRequestSchema.safeParse(requestBody)
+  if (!parsedRequestBody.success) {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-body', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: parsedRequestBody.error.issues[0]?.message ?? 'Invalid body' 
+    })
+  }
+
+  const { fieldAlias, currentValue, nextValue } = parsedRequestBody.data
+
+  const targetFieldBranch = seed.branches.find((branch) => branch.alias === fieldAlias)
+  if (!targetFieldBranch) {
+    return publicProblem(context, { 
+      type: 'rotate-field-unknown-field', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: `Field '${fieldAlias}' does not exist in seed '${seedSlug}'` 
+    })
+  }
+
+  const { privacy } = resolvePolicies(targetFieldBranch)
+  if (privacy !== 'hash') {
+    return publicProblem(context, { 
+      type: 'rotate-field-not-hashable', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Field '${fieldAlias}' does not use hash privacy and cannot be rotated with this endpoint` 
+    })
+  }
+
+  let contentRecord: Record<string, unknown>
+  try {
+    contentRecord = await context.get('repository').findById(seed, entryId)
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, {
+        type: 'content-not-found',
+        title: 'Not Found',
+        status: 404,
+        detail: `Entry '${entryId}' not found`
+      })
+    }
+    throw error
+  }
+
+  const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
+
+  if (typeof storedFieldValueHash !== 'string' || storedFieldValueHash.length === 0) {
+    return publicProblem(context, { 
+      type: 'rotate-field-not-set', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Field '${fieldAlias}' has no stored value to rotate` 
+    })
+  }
+
+  const isCurrentValueValid = await verifyHashField(storedFieldValueHash, currentValue)
+  if (!isCurrentValueValid) {
+    return publicProblem(context, { 
+      type: 'rotate-field-current-mismatch', 
+      title: 'Forbidden', 
+      status: 403, 
+      detail: 'Current value does not match stored value' 
+    })
+  }
+
+  const fieldValidationResult = validateAndSanitizeSeedPayload(
+    seed, 
+    { [fieldAlias]: nextValue },
+    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
+  )
+
+  if (fieldValidationResult.details.length > 0) {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-next', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: `Invalid value for field '${fieldAlias}': ${fieldValidationResult.details[0]?.message ?? 'validation failed'}` 
+    })
+  }
+
+  const newFieldValueHash = await sha256hex(nextValue)
+
+  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
+
+  return context.json({ success: true })
+})
+
+
+export { rotateFieldApp }
+

package/src/features/rotate-field/rotate-field.schema.ts

@@ -1,9 +1,13 @@
-import { z } from 'zod'
-
-export const rotateFieldBodySchema = z.object({
-  field: z.string().min(1, "field is required"),
-  current: z.string().min(1, "current is required"),
-  next: z.string().min(1, "next is required"),
-})
-
-export type RotateFieldBody = z.infer<typeof rotateFieldBodySchema>
+import { z } from 'zod'
+
+/**
+ * Schema for rotating a hashed field value.
+ * Used to update fields that have 'hash' privacy (e.g., passwords, PINs).
+ */
+export const rotateFieldRequestSchema = z.object({
+  fieldAlias: z.string().min(1, "The field alias is required"),
+  currentValue: z.string().min(1, "The current value is required"),
+  nextValue: z.string().min(1, "The new value is required"),
+})
+
+export type RotateFieldRequest = z.infer<typeof rotateFieldRequestSchema>