@beechcms/api 0.4.0-preview.9 → 0.4.1

package/src/shared/d1-notification.repository.test.ts

@@ -0,0 +1,124 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1NotificationRepository } from './d1-notification.repository'
+import { FixedClock } from './fixed-clock'
+import { SequentialIdGenerator } from './sequential-id-generator'
+
+const clock = new FixedClock(1700000000_000)
+const makeIdGen = () => new SequentialIdGenerator()
+
+function makeMockDb(opts: { firstResult?: unknown; allResults?: unknown[] } = {}) {
+  const { firstResult = null, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  const prepareMock = vi.fn(() => ({
+    bind: bindMock,
+    first: firstMock,
+    all: allMock,
+    run: runMock,
+  }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
+}
+
+describe('D1NotificationRepository', () => {
+  describe('list', () => {
+    it('maps rows to NotificationRecord with isRead boolean', async () => {
+      const { db } = makeMockDb({
+        allResults: [
+          {
+            id: 'n-1',
+            title: 'T',
+            message: 'M',
+            type: 'success',
+            is_read: 0,
+            created_at: 100,
+          },
+          {
+            id: 'n-2',
+            title: 'T2',
+            message: 'M2',
+            type: 'info',
+            is_read: 1,
+            created_at: 99,
+          },
+        ],
+      })
+      const records = await new D1NotificationRepository(db, clock, makeIdGen()).list(10)
+      expect(records).toEqual([
+        { id: 'n-1', title: 'T', message: 'M', type: 'success', isRead: false, createdAt: 100 },
+        { id: 'n-2', title: 'T2', message: 'M2', type: 'info', isRead: true, createdAt: 99 },
+      ])
+    })
+
+    it('orders by created_at DESC with LIMIT bound', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1NotificationRepository(db, clock, makeIdGen()).list(25)
+      expect(prepareMock.mock.calls[0][0]).toMatch(/ORDER BY created_at DESC/)
+      expect(bindMock).toHaveBeenCalledWith(25)
+    })
+  })
+
+  describe('stats', () => {
+    it('returns aggregate counters mapped to camelCase', async () => {
+      const { db } = makeMockDb({
+        firstResult: { total_count: 7, latest_created_at: 1234, read_count: 3 },
+      })
+      const stats = await new D1NotificationRepository(db, clock, makeIdGen()).stats()
+      expect(stats).toEqual({ totalCount: 7, latestCreatedAt: 1234, readCount: 3 })
+    })
+
+    it('returns zeros when the table is empty', async () => {
+      const { db } = makeMockDb({
+        firstResult: { total_count: 0, latest_created_at: null, read_count: null },
+      })
+      const stats = await new D1NotificationRepository(db, clock, makeIdGen()).stats()
+      expect(stats).toEqual({ totalCount: 0, latestCreatedAt: 0, readCount: 0 })
+    })
+  })
+
+  describe('create', () => {
+    it('inserts a new notification and returns the generated id', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      const id = await new D1NotificationRepository(db, clock, makeIdGen()).create({
+        title: 'Hello',
+        message: 'World',
+        type: 'info',
+      })
+      expect(typeof id).toBe('string')
+      expect(id.length).toBeGreaterThan(0)
+      expect(prepareMock.mock.calls[0][0]).toMatch(/INSERT INTO notifications/)
+      expect(bindMock).toHaveBeenCalledWith(id, 'Hello', 'World', 'info')
+    })
+  })
+
+  describe('markRead / markUnread / delete / markAllRead', () => {
+    it('markRead binds the given id', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1NotificationRepository(db, clock, makeIdGen()).markRead('n-1')
+      expect(prepareMock.mock.calls[0][0]).toMatch(/UPDATE notifications SET is_read = 1 WHERE id = \?/)
+      expect(bindMock).toHaveBeenCalledWith('n-1')
+    })
+
+    it('markUnread binds the given id', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1NotificationRepository(db, clock, makeIdGen()).markUnread('n-2')
+      expect(prepareMock.mock.calls[0][0]).toMatch(/UPDATE notifications SET is_read = 0 WHERE id = \?/)
+      expect(bindMock).toHaveBeenCalledWith('n-2')
+    })
+
+    it('delete binds the given id', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1NotificationRepository(db, clock, makeIdGen()).delete('n-3')
+      expect(prepareMock.mock.calls[0][0]).toMatch(/DELETE FROM notifications WHERE id = \?/)
+      expect(bindMock).toHaveBeenCalledWith('n-3')
+    })
+
+    it('markAllRead runs without bindings', async () => {
+      const { db, prepareMock, runMock } = makeMockDb()
+      await new D1NotificationRepository(db, clock, makeIdGen()).markAllRead()
+      expect(prepareMock.mock.calls[0][0]).toMatch(/^UPDATE notifications SET is_read = 1$/)
+      expect(runMock).toHaveBeenCalled()
+    })
+  })
+})

package/src/shared/d1-notification.repository.ts

@@ -0,0 +1,114 @@
+/// <reference types="@cloudflare/workers-types" />
+import type {
+  INotificationRepository,
+  NotificationRecord,
+  NotificationStats,
+  NotificationType,
+  IClock,
+  IIdGenerator,
+} from '@beechcms/core'
+
+interface NotificationRow {
+  id: string
+  title: string
+  message: string
+  type: string
+  is_read: number
+  created_at: number
+}
+
+interface NotificationStatsRow {
+  total_count: number | null
+  latest_created_at: number | null
+  read_count: number | null
+}
+
+/**
+ * D1-backed implementation of {@link INotificationRepository}.
+ */
+export class D1NotificationRepository implements INotificationRepository {
+  constructor(
+    private readonly database: D1Database,
+    private readonly clock: IClock,
+    private readonly idGenerator: IIdGenerator,
+  ) {}
+
+  async list(limit: number): Promise<NotificationRecord[]> {
+    const queryResult = await this.database
+      .prepare(
+        `SELECT id, title, message, type, is_read, created_at
+           FROM notifications
+           ORDER BY created_at DESC
+           LIMIT ?`
+      )
+      .bind(limit)
+      .all<NotificationRow>()
+
+    return (queryResult.results ?? []).map(mapRowToRecord)
+  }
+
+  async stats(): Promise<NotificationStats> {
+    const statsRow = await this.database
+      .prepare(
+        `SELECT COUNT(*) as total_count,
+                MAX(created_at) as latest_created_at,
+                SUM(is_read) as read_count
+           FROM notifications`
+      )
+      .first<NotificationStatsRow>()
+
+    return {
+      totalCount: statsRow?.total_count ?? 0,
+      latestCreatedAt: statsRow?.latest_created_at ?? 0,
+      readCount: statsRow?.read_count ?? 0,
+    }
+  }
+
+  async create(record: Omit<NotificationRecord, 'id' | 'createdAt' | 'isRead'>): Promise<string> {
+    const generatedId = this.idGenerator.uuid()
+    await this.database
+      .prepare(
+        `INSERT INTO notifications (id, title, message, type)
+         VALUES (?, ?, ?, ?)`
+      )
+      .bind(generatedId, record.title, record.message, record.type)
+      .run()
+    return generatedId
+  }
+
+  async markRead(notificationId: string): Promise<void> {
+    await this.database
+      .prepare('UPDATE notifications SET is_read = 1 WHERE id = ?')
+      .bind(notificationId)
+      .run()
+  }
+
+  async markUnread(notificationId: string): Promise<void> {
+    await this.database
+      .prepare('UPDATE notifications SET is_read = 0 WHERE id = ?')
+      .bind(notificationId)
+      .run()
+  }
+
+  async markAllRead(): Promise<void> {
+    await this.database.prepare('UPDATE notifications SET is_read = 1').run()
+  }
+
+  async delete(notificationId: string): Promise<void> {
+    await this.database
+      .prepare('DELETE FROM notifications WHERE id = ?')
+      .bind(notificationId)
+      .run()
+  }
+}
+
+function mapRowToRecord(row: NotificationRow): NotificationRecord {
+  return {
+    id: row.id,
+    title: row.title,
+    message: row.message,
+    type: row.type as NotificationType,
+    isRead: row.is_read === 1,
+    createdAt: row.created_at,
+  }
+}

package/src/shared/d1-password-reset-token.repository.test.ts

@@ -0,0 +1,77 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1PasswordResetTokenRepository } from './d1-password-reset-token.repository'
+
+const NOW = Math.floor(Date.now() / 1000)
+const fixedIdGen = { uuid: () => 'prt-1' }
+
+function makeMockDb(opts: { firstResult?: unknown; runChanges?: number } = {}) {
+  const { firstResult = null, runChanges = 1 } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const bindMock = vi.fn(() => ({ first: firstMock, run: runMock }))
+  const prepareMock = vi.fn(() => ({ bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock }
+}
+
+describe('D1PasswordResetTokenRepository', () => {
+  describe('create', () => {
+    it('calls INSERT INTO password_reset_tokens', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).create({
+        userId: 'u1', tokenHash: 'h', expiresAt: NOW + 1800,
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO password_reset_tokens'))
+    })
+
+    it('binds id, userId, tokenHash, and expiresAt in the correct order', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).create({
+        userId: 'u1', tokenHash: 'h', expiresAt: NOW + 1800,
+      })
+      expect(bindMock).toHaveBeenCalledWith('prt-1', 'u1', 'h', NOW + 1800)
+    })
+  })
+
+  describe('findValidByHashWithEmail', () => {
+    it('returns a ValidatedResetToken with the userId and email from the JOIN', async () => {
+      const row = { id: 'prt-1', user_id: 'u1', email: 'user@test.com' }
+      const { db } = makeMockDb({ firstResult: row })
+      const result = await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('h', NOW)
+      expect(result).toEqual({ id: 'prt-1', userId: 'u1', email: 'user@test.com' })
+    })
+
+    it('returns null when the token is not found, expired, or already used', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('bad-hash', NOW)).toBeNull()
+    })
+
+    it('passes tokenHash and nowTimestamp as bound values', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('my-hash', NOW)
+      expect(bindMock).toHaveBeenCalledWith('my-hash', NOW)
+    })
+  })
+
+  describe('markUsed', () => {
+    it('calls UPDATE password_reset_tokens SET used_at', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).markUsed('prt-1', NOW)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('used_at'))
+    })
+
+    it('binds nowTimestamp and tokenId in the correct order', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).markUsed('prt-1', NOW)
+      expect(bindMock).toHaveBeenCalledWith(NOW, 'prt-1')
+    })
+  })
+
+  describe('invalidatePending', () => {
+    it('calls UPDATE password_reset_tokens and includes the userId in the bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1PasswordResetTokenRepository(db, fixedIdGen).invalidatePending('u1', NOW)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE password_reset_tokens'))
+      expect((bindMock.mock.calls[0] as unknown[]).includes('u1')).toBe(true)
+    })
+  })
+})

package/src/shared/d1-password-reset-token.repository.ts

@@ -0,0 +1,52 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { IPasswordResetTokenRepository, NewPasswordResetToken, ValidatedResetToken, IIdGenerator } from '@beechcms/core'
+
+type ValidatedResetTokenRow = {
+  id: string
+  user_id: string
+  email: string
+}
+
+export class D1PasswordResetTokenRepository implements IPasswordResetTokenRepository {
+  constructor(
+    private readonly db: D1Database,
+    private readonly idGenerator: IIdGenerator,
+  ) {}
+
+  async invalidatePending(userId: string, nowTimestamp: number): Promise<void> {
+    await this.db
+      .prepare('UPDATE password_reset_tokens SET used_at = ? WHERE user_id = ? AND used_at IS NULL')
+      .bind(nowTimestamp, userId)
+      .run()
+  }
+
+  async create(record: NewPasswordResetToken): Promise<void> {
+    const generatedId = this.idGenerator.uuid()
+    await this.db
+      .prepare('INSERT INTO password_reset_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)')
+      .bind(generatedId, record.userId, record.tokenHash, record.expiresAt)
+      .run()
+  }
+
+  async findValidByHashWithEmail(tokenHash: string, nowTimestamp: number): Promise<ValidatedResetToken | null> {
+    const row = await this.db
+      .prepare(
+        `SELECT prt.id, prt.user_id, u.email
+         FROM password_reset_tokens prt
+         JOIN users u ON u.id = prt.user_id
+         WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`
+      )
+      .bind(tokenHash, nowTimestamp)
+      .first<ValidatedResetTokenRow>()
+
+    if (!row) return null
+    return { id: row.id, userId: row.user_id, email: row.email }
+  }
+
+  async markUsed(tokenId: string, nowTimestamp: number): Promise<void> {
+    await this.db
+      .prepare('UPDATE password_reset_tokens SET used_at = ? WHERE id = ?')
+      .bind(nowTimestamp, tokenId)
+      .run()
+  }
+}

package/src/shared/d1-search.repository.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect, vi } from 'vitest'
+import type { Seed } from '@beechcms/core'
+import { D1SearchRepository } from './d1-search.repository'
+
+function makeMockDb(allResults: unknown[] = [], firstResult: unknown = null) {
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
+  const prepareMock = vi.fn(() => ({ bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, allMock, firstMock }
+}
+
+const seeds: Seed[] = [
+  {
+    slug: 'posts',
+    label: 'Post',
+    displayNameAlias: 'title',
+    branches: [
+      { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+      { id: 'br_02', alias: 'body',  type: 'richtext', label: 'Body' },
+    ],
+  },
+]
+
+describe('D1SearchRepository', () => {
+  it('maps FtsRow to camelCase SearchResultRow', async () => {
+    const ftsRow = {
+      entry_id: 'e1',
+      schema_slug: 'posts',
+      slug: 'hello',
+      status: 'published',
+      title: 'Hello',
+      excerpt: '<mark>Hi</mark>',
+      rank: -3.2,
+    }
+    const { db } = makeMockDb([ftsRow])
+    const result = await new D1SearchRepository(db).search(
+      { queryText: 'hello world', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
+      seeds,
+    )
+    expect(result).toEqual([
+      {
+        entryId: 'e1',
+        schemaSlug: 'posts',
+        slug: 'hello',
+        status: 'published',
+        title: 'Hello',
+        excerpt: '<mark>Hi</mark>',
+        rank: -3.2,
+      },
+    ])
+  })
+
+  it('returns [] on EMPTY_QUERY (single-character terms)', async () => {
+    const { db, prepareMock } = makeMockDb()
+    const result = await new D1SearchRepository(db).search(
+      { queryText: 'a', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
+      seeds,
+    )
+    expect(result).toEqual([])
+    expect(prepareMock).not.toHaveBeenCalled()
+  })
+
+  it('count returns { total: 0 } on EMPTY_QUERY', async () => {
+    const { db } = makeMockDb()
+    const result = await new D1SearchRepository(db).count(
+      { queryText: 'a', schemaSlug: null, statusFilter: null },
+      seeds,
+    )
+    expect(result).toEqual({ total: 0 })
+  })
+
+  it('count returns total from countSql', async () => {
+    const { db, prepareMock } = makeMockDb([], { total: 17 })
+    const result = await new D1SearchRepository(db).count(
+      { queryText: 'hello', schemaSlug: null, statusFilter: null },
+      seeds,
+    )
+    expect(result).toEqual({ total: 17 })
+    const sql = prepareMock.mock.calls[0]![0] as string
+    expect(sql).toMatch(/SUM\(c\)/)
+  })
+})

package/src/shared/d1-search.repository.ts

@@ -0,0 +1,84 @@
+/// <reference types="@cloudflare/workers-types" />
+import type {
+  Seed,
+  ISearchRepository,
+  SearchQueryOptions,
+  SearchResultRow,
+  SearchCountResult,
+} from '@beechcms/core'
+import { buildFtsQuery, type FtsRow } from '../search-utils'
+
+const EMPTY_QUERY_ERROR = 'EMPTY_QUERY'
+
+/**
+ * D1-backed implementation of {@link ISearchRepository}.
+ *
+ * Delegates SQL composition to the pure `buildFtsQuery` helper to keep this
+ * class focused on D1 wiring. Returns raw rows; the route handler is
+ * responsible for mapping them via `mapFtsRow`.
+ */
+export class D1SearchRepository implements ISearchRepository {
+  constructor(private readonly database: D1Database) {}
+
+  async search(options: SearchQueryOptions, seeds: Seed[]): Promise<SearchResultRow[]> {
+    let queryParts
+    try {
+      queryParts = buildFtsQuery(
+        {
+          q: options.queryText,
+          schemaSlug: options.schemaSlug,
+          status: options.statusFilter,
+          limit: options.limit,
+          cursor: options.cursor,
+        },
+        seeds,
+      )
+    } catch (error) {
+      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return []
+      throw error
+    }
+
+    const result = await this.database.prepare(queryParts.sql).bind(...queryParts.binds).all<FtsRow>()
+    return (result.results ?? []).map(mapFtsRowToResultRow)
+  }
+
+  async count(
+    options: Omit<SearchQueryOptions, 'limit' | 'cursor'>,
+    seeds: Seed[],
+  ): Promise<SearchCountResult> {
+    let queryParts
+    try {
+      queryParts = buildFtsQuery(
+        {
+          q: options.queryText,
+          schemaSlug: options.schemaSlug,
+          status: options.statusFilter,
+          limit: 0,
+          cursor: null,
+        },
+        seeds,
+      )
+    } catch (error) {
+      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return { total: 0 }
+      throw error
+    }
+
+    const row = await this.database
+      .prepare(queryParts.countSql)
+      .bind(...queryParts.countBinds)
+      .first<{ total: number }>()
+    return { total: row?.total ?? 0 }
+  }
+}
+
+function mapFtsRowToResultRow(row: FtsRow): SearchResultRow {
+  return {
+    entryId: row.entry_id,
+    schemaSlug: row.schema_slug,
+    slug: row.slug,
+    status: row.status,
+    title: row.title,
+    excerpt: row.excerpt,
+    rank: row.rank,
+  }
+}

package/src/shared/d1-session.repository.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1SessionRepository } from './d1-session.repository'
+import { FixedClock } from './fixed-clock'
+
+const FIXED_NOW_MS = 1700000000_000
+const NOW = Math.floor(FIXED_NOW_MS / 1000)
+const FUTURE = NOW + 7 * 24 * 3600
+const clock = new FixedClock(FIXED_NOW_MS)
+
+function makeMockDb(opts: {
+  firstResult?: unknown
+  runChanges?: number
+  allResults?: unknown[]
+} = {}) {
+  const { firstResult = null, runChanges = 1, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  const prepareMock = vi.fn(() => ({ bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
+}
+
+describe('D1SessionRepository', () => {
+  describe('saveRefreshToken', () => {
+    it('calls INSERT INTO refresh_tokens with the correct bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).saveRefreshToken({
+        id: 'rt-1', userId: 'u1', tokenHash: 'h', expiresAt: FUTURE,
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO refresh_tokens'))
+      expect(bindMock).toHaveBeenCalledWith('rt-1', 'u1', 'h', FUTURE, NOW)
+    })
+  })
+
+  describe('findActiveByHash', () => {
+    it('returns a RefreshTokenRecord with camelCase keys mapped from the snake_case row', async () => {
+      const row = {
+        id: 'rt-1', user_id: 'u1', token_hash: 'h',
+        expires_at: FUTURE, created_at: NOW, revoked_at: null,
+      }
+      const { db } = makeMockDb({ firstResult: row })
+      const result = await new D1SessionRepository(db, clock).findActiveByHash('h', NOW)
+      expect(result).toEqual({
+        id: 'rt-1', userId: 'u1', tokenHash: 'h',
+        expiresAt: FUTURE, createdAt: NOW, revokedAt: null,
+      })
+    })
+
+    it('returns null when no active token is found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1SessionRepository(db, clock).findActiveByHash('missing', NOW)).toBeNull()
+    })
+
+    it('passes tokenHash and nowTimestamp as bound values', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).findActiveByHash('my-hash', NOW)
+      expect(bindMock).toHaveBeenCalledWith('my-hash', NOW)
+    })
+  })
+
+  describe('revokeByHash', () => {
+    it('returns true when one row is updated (changes = 1)', async () => {
+      const { db } = makeMockDb({ runChanges: 1 })
+      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(true)
+    })
+
+    it('returns false when no row is updated (token already revoked or not found)', async () => {
+      const { db } = makeMockDb({ runChanges: 0 })
+      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(false)
+    })
+  })
+
+  describe('revokeAllForUser', () => {
+    it('calls UPDATE refresh_tokens and includes the userId in the bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).revokeAllForUser('u1', NOW)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE refresh_tokens'))
+      expect((bindMock.mock.calls[0] as unknown[]).includes('u1')).toBe(true)
+    })
+  })
+
+  describe('listActiveForUser', () => {
+    it('returns mapped ActiveSessionSummary objects in the original order', async () => {
+      const rows = [
+        { id: 's1', created_at: NOW - 100, expires_at: FUTURE },
+        { id: 's2', created_at: NOW - 200, expires_at: FUTURE },
+      ]
+      const { db } = makeMockDb({ allResults: rows })
+      const sessions = await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)
+      expect(sessions).toHaveLength(2)
+      expect(sessions[0]).toEqual({ id: 's1', createdAt: NOW - 100, expiresAt: FUTURE })
+      expect(sessions[1]).toEqual({ id: 's2', createdAt: NOW - 200, expiresAt: FUTURE })
+    })
+
+    it('returns an empty array when no active sessions exist', async () => {
+      const { db } = makeMockDb({ allResults: [] })
+      expect(await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)).toEqual([])
+    })
+  })
+
+  describe('revokeById', () => {
+    it('returns true when the session is revoked (changes = 1)', async () => {
+      const { db } = makeMockDb({ runChanges: 1 })
+      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'u1', NOW)).toBe(true)
+    })
+
+    it('returns false when the session is not found or belongs to another user (changes = 0)', async () => {
+      const { db } = makeMockDb({ runChanges: 0 })
+      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'other-user', NOW)).toBe(false)
+    })
+
+    it('binds both sessionId and userId to prevent cross-user revocation', async () => {
+      const { db, bindMock } = makeMockDb({ runChanges: 1 })
+      await new D1SessionRepository(db, clock).revokeById('my-session', 'my-user', NOW)
+      const args = bindMock.mock.calls[0] as unknown[]
+      expect(args).toContain('my-session')
+      expect(args).toContain('my-user')
+    })
+  })
+})