@beechcms/api 0.4.0-preview.9 → 0.4.1

package/src/shared/d1-session.repository.ts

@@ -0,0 +1,98 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { ISessionRepository, NewRefreshToken, RefreshTokenRecord, ActiveSessionSummary, IClock } from '@beechcms/core'
+
+type RefreshTokenRow = {
+  id: string
+  user_id: string
+  token_hash: string
+  expires_at: number
+  created_at: number
+  revoked_at: number | null
+}
+
+type SessionSummaryRow = {
+  id: string
+  created_at: number
+  expires_at: number
+}
+
+function rowToRecord(row: RefreshTokenRow): RefreshTokenRecord {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    tokenHash: row.token_hash,
+    expiresAt: row.expires_at,
+    createdAt: row.created_at,
+    revokedAt: row.revoked_at,
+  }
+}
+
+export class D1SessionRepository implements ISessionRepository {
+  constructor(
+    private readonly db: D1Database,
+    private readonly clock: IClock,
+  ) {}
+
+  async saveRefreshToken(record: NewRefreshToken): Promise<void> {
+    await this.db
+      .prepare('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+      .bind(record.id, record.userId, record.tokenHash, record.expiresAt, this.clock.nowSeconds())
+      .run()
+  }
+
+  async findActiveByHash(tokenHash: string, nowTimestamp: number): Promise<RefreshTokenRecord | null> {
+    const row = await this.db
+      .prepare(
+        `SELECT id, user_id, token_hash, expires_at, created_at, revoked_at
+         FROM refresh_tokens
+         WHERE token_hash = ? AND expires_at > ? AND revoked_at IS NULL
+         LIMIT 1`
+      )
+      .bind(tokenHash, nowTimestamp)
+      .first<RefreshTokenRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async revokeByHash(tokenHash: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        `UPDATE refresh_tokens
+         SET revoked_at = ?
+         WHERE token_hash = ? AND revoked_at IS NULL AND expires_at >= ?`
+      )
+      .bind(nowTimestamp, tokenHash, nowTimestamp)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+
+  async revokeAllForUser(userId: string, nowTimestamp: number): Promise<void> {
+    await this.db
+      .prepare('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL')
+      .bind(nowTimestamp, userId)
+      .run()
+  }
+
+  async listActiveForUser(userId: string, nowTimestamp: number, limit: number): Promise<ActiveSessionSummary[]> {
+    const { results } = await this.db
+      .prepare(
+        `SELECT id, created_at, expires_at FROM refresh_tokens
+         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
+         ORDER BY created_at DESC LIMIT ?`
+      )
+      .bind(userId, nowTimestamp, limit)
+      .all<SessionSummaryRow>()
+    return (results ?? []).map(row => ({ id: row.id, createdAt: row.created_at, expiresAt: row.expires_at }))
+  }
+
+  async revokeById(sessionId: string, userId: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        'UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL'
+      )
+      .bind(nowTimestamp, sessionId, userId)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+}

package/src/shared/d1-user.repository.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1UserRepository } from './d1-user.repository'
+
+const USER_ROW = {
+  id: 'u1',
+  email: 'test@test.com',
+  name: 'Test User',
+  password_hash: 'hash-abc',
+  role: 'admin',
+  avatar_url: null,
+  notification_prefs: '{}',
+}
+
+function makeMockDb(opts: {
+  firstResult?: unknown
+  runChanges?: number
+  allResults?: unknown[]
+} = {}) {
+  const { firstResult = null, runChanges = 1, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  // prepare() may be called without bind() for countAll (which calls .first() directly)
+  const prepareMock = vi.fn(() => ({ bind: bindMock, first: firstMock, run: runMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
+}
+
+describe('D1UserRepository', () => {
+  describe('countAll', () => {
+    it('returns the count value from the database', async () => {
+      const { db, firstMock } = makeMockDb()
+      firstMock.mockResolvedValue({ count: 5 })
+      expect(await new D1UserRepository(db).countAll()).toBe(5)
+    })
+
+    it('returns 0 when the query returns null', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).countAll()).toBe(0)
+    })
+  })
+
+  describe('findByEmail', () => {
+    it('returns a UserRecord with camelCase keys mapped from the snake_case row', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findByEmail('test@test.com')
+      expect(result).toEqual({
+        id: 'u1',
+        email: 'test@test.com',
+        name: 'Test User',
+        passwordHash: 'hash-abc',
+        role: 'admin',
+        avatarUrl: null,
+        notificationPreferences: '{}',
+      })
+    })
+
+    it('returns null when no user is found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findByEmail('nobody@test.com')).toBeNull()
+    })
+  })
+
+  describe('findById', () => {
+    it('returns a mapped UserRecord when found', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findById('u1')
+      expect(result?.id).toBe('u1')
+      expect(result?.passwordHash).toBe('hash-abc')
+    })
+
+    it('returns null when the user is not found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findById('unknown')).toBeNull()
+    })
+  })
+
+  describe('create', () => {
+    it('calls prepare with an INSERT INTO users statement', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO users'))
+    })
+
+    it('binds id, email, passwordHash, role, name in the correct order', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
+      })
+      expect(bindMock).toHaveBeenCalledWith('u1', 'a@b.com', 'hash', 'admin', 'Test')
+    })
+  })
+
+  describe('updateProfile', () => {
+    it('does nothing when no fields are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', {})
+      expect(prepareMock).not.toHaveBeenCalled()
+    })
+
+    it('generates a SET clause containing only the provided field', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'New Name' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).not.toContain('email = ?')
+    })
+
+    it('includes both fields when both name and email are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'N', email: 'e@e.com' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).toContain('email = ?')
+    })
+  })
+
+  describe('updatePasswordHash', () => {
+    it('calls UPDATE users SET password_hash', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updatePasswordHash('u1', 'new-hash')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('password_hash'))
+    })
+  })
+
+  describe('updateAvatarUrl', () => {
+    it('calls UPDATE users SET avatar_url', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateAvatarUrl('u1', 'https://cdn.example.com/avatar.jpg')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('avatar_url'))
+    })
+  })
+
+  describe('emailBelongsToAnotherUser', () => {
+    it('returns true when another user row is found with that email', async () => {
+      const { db } = makeMockDb({ firstResult: { id: 'other-user' } })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('taken@test.com', 'current')).toBe(true)
+    })
+
+    it('returns false when no other user owns the email', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('free@test.com', 'current')).toBe(false)
+    })
+  })
+})

package/src/shared/d1-user.repository.ts

@@ -0,0 +1,109 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { IUserRepository, UserRecord, NewUserInput } from '@beechcms/core'
+
+type UserRow = {
+  id: string
+  email: string
+  name: string | null
+  password_hash: string
+  role: string
+  avatar_url: string | null
+  notification_prefs: string
+}
+
+function rowToRecord(row: UserRow): UserRecord {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    passwordHash: row.password_hash,
+    role: row.role,
+    avatarUrl: row.avatar_url,
+    notificationPreferences: row.notification_prefs,
+  }
+}
+
+export class D1UserRepository implements IUserRepository {
+  constructor(private readonly db: D1Database) {}
+
+  async countAll(): Promise<number> {
+    const result = await this.db
+      .prepare('SELECT COUNT(*) as count FROM users')
+      .first<{ count: number }>()
+    return result?.count ?? 0
+  }
+
+  async findById(userId: string): Promise<UserRecord | null> {
+    const row = await this.db
+      .prepare('SELECT id, email, name, password_hash, role, avatar_url, notification_prefs FROM users WHERE id = ? LIMIT 1')
+      .bind(userId)
+      .first<UserRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async findByEmail(email: string): Promise<UserRecord | null> {
+    const row = await this.db
+      .prepare('SELECT id, email, name, password_hash, role, avatar_url, notification_prefs FROM users WHERE email = ? LIMIT 1')
+      .bind(email)
+      .first<UserRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async create(user: NewUserInput): Promise<void> {
+    await this.db
+      .prepare('INSERT INTO users (id, email, password_hash, role, name) VALUES (?, ?, ?, ?, ?)')
+      .bind(user.id, user.email, user.passwordHash, user.role, user.name)
+      .run()
+  }
+
+  async updateProfile(userId: string, fields: { name?: string; email?: string }): Promise<void> {
+    const columnAssignments: string[] = []
+    const boundValues: unknown[] = []
+
+    if (fields.name !== undefined) {
+      columnAssignments.push('name = ?')
+      boundValues.push(fields.name)
+    }
+    if (fields.email !== undefined) {
+      columnAssignments.push('email = ?')
+      boundValues.push(fields.email)
+    }
+
+    if (columnAssignments.length === 0) return
+
+    boundValues.push(userId)
+    await this.db
+      .prepare(`UPDATE users SET ${columnAssignments.join(', ')} WHERE id = ?`)
+      .bind(...boundValues)
+      .run()
+  }
+
+  async updatePasswordHash(userId: string, newPasswordHash: string): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
+      .bind(newPasswordHash, userId)
+      .run()
+  }
+
+  async updateAvatarUrl(userId: string, avatarUrl: string | null): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET avatar_url = ? WHERE id = ?')
+      .bind(avatarUrl, userId)
+      .run()
+  }
+
+  async updateNotificationPreferences(userId: string, preferencesJson: string): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET notification_prefs = ? WHERE id = ?')
+      .bind(preferencesJson, userId)
+      .run()
+  }
+
+  async emailBelongsToAnotherUser(email: string, currentUserId: string): Promise<boolean> {
+    const row = await this.db
+      .prepare('SELECT id FROM users WHERE email = ? AND id != ? LIMIT 1')
+      .bind(email, currentUserId)
+      .first()
+    return row !== null
+  }
+}

package/src/shared/d1-widget.repository.test.ts

@@ -0,0 +1,217 @@
+import { describe, it, expect, vi } from 'vitest'
+import type { Seed } from '@beechcms/core'
+import { D1WidgetRepository } from './d1-widget.repository'
+
+function makeMockDb(allResults: unknown[] = [], firstResult: unknown = null) {
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
+  const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, allMock, firstMock }
+}
+
+const seed: Seed = {
+  slug: 'posts',
+  label: 'Post',
+  displayNameAlias: 'title',
+  branches: [
+    { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+    { id: 'br_02', alias: 'price', type: 'number', label: 'Price' },
+  ],
+}
+
+describe('D1WidgetRepository', () => {
+  describe('aggregate', () => {
+    it('returns 0 when no rows match', async () => {
+      const { db } = makeMockDb([], null)
+      const value = await new D1WidgetRepository(db).aggregate(seed, { op: 'count' }, 'all')
+      expect(value).toBe(0)
+    })
+
+    it('builds COUNT(*) for op=count', async () => {
+      const { db, prepareMock } = makeMockDb([], { computed_value: 7 })
+      const value = await new D1WidgetRepository(db).aggregate(seed, { op: 'count' }, 'week')
+      expect(value).toBe(7)
+      const sql = prepareMock.mock.calls[0]![0] as string
+      expect(sql).toMatch(/COUNT\(\*\)/)
+      expect(sql).toMatch(/FROM content_posts/)
+      expect(sql).toMatch(/created_at > unixepoch\('now', '-7 days'\)/)
+    })
+
+    it('throws UNSAFE_COLUMN when column alias is unknown', async () => {
+      const { db } = makeMockDb()
+      await expect(
+        new D1WidgetRepository(db).aggregate(seed, { op: 'sum', column: 'unknown' }, 'all'),
+      ).rejects.toThrow('UNSAFE_COLUMN')
+    })
+
+    it('builds SUM(CAST(... AS REAL)) for valid column', async () => {
+      const { db, prepareMock } = makeMockDb([], { computed_value: 42 })
+      await new D1WidgetRepository(db).aggregate(seed, { op: 'sum', column: 'price' }, 'all')
+      expect(prepareMock.mock.calls[0]![0] as string).toMatch(/SUM\(CAST\(price AS REAL\)\)/)
+    })
+  })
+
+  describe('growth', () => {
+    it('runs two queries with current and previous filters', async () => {
+      const allMock = vi.fn().mockResolvedValue({ results: [] })
+      const firstMock = vi
+        .fn()
+        .mockResolvedValueOnce({ computed_value: 10 })
+        .mockResolvedValueOnce({ computed_value: 5 })
+      const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
+      const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
+      const db = { prepare: prepareMock } as any
+
+      const result = await new D1WidgetRepository(db).growth(seed, { op: 'count' }, 'month')
+      expect(result).toEqual({ currentValue: 10, previousValue: 5 })
+      expect(prepareMock).toHaveBeenCalledTimes(2)
+      const sql0 = prepareMock.mock.calls[0]![0] as string
+      const sql1 = prepareMock.mock.calls[1]![0] as string
+      expect(sql0).toMatch(/-1 month/)
+      expect(sql1).toMatch(/-2 months/)
+    })
+
+    it('returns zeros when both queries are empty', async () => {
+      const { db } = makeMockDb([], null)
+      const result = await new D1WidgetRepository(db).growth(seed, { op: 'count' }, 'all')
+      expect(result).toEqual({ currentValue: 0, previousValue: 0 })
+    })
+  })
+
+  describe('leaderboard', () => {
+    it('uses ORDER BY DESC by default and binds only the limit', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb([
+        { id: 'a', label: 'A', score: 9 },
+      ])
+      const entries = await new D1WidgetRepository(db).leaderboard(seed, {
+        scoreColumn: 'price',
+        limit: 5,
+        orderDirection: 'DESC',
+      })
+      expect(entries).toEqual([{ id: 'a', label: 'A', score: 9 }])
+      const sql = prepareMock.mock.calls[0]![0] as string
+      expect(sql).toMatch(/ORDER BY CAST\(price AS REAL\) DESC/)
+      expect(bindMock).toHaveBeenCalledWith(5)
+    })
+
+    it('uses ORDER BY ASC when requested', async () => {
+      const { db, prepareMock } = makeMockDb([])
+      await new D1WidgetRepository(db).leaderboard(seed, {
+        scoreColumn: 'price',
+        limit: 3,
+        orderDirection: 'ASC',
+      })
+      expect(prepareMock.mock.calls[0]![0] as string).toMatch(/ORDER BY CAST\(price AS REAL\) ASC/)
+    })
+
+    it('falls back to id when label is null', async () => {
+      const { db } = makeMockDb([{ id: 'x', label: null, score: 1 }])
+      const [entry] = await new D1WidgetRepository(db).leaderboard(seed, {
+        scoreColumn: 'price',
+        limit: 1,
+        orderDirection: 'DESC',
+      })
+      expect(entry).toEqual({ id: 'x', label: 'x', score: 1 })
+    })
+  })
+
+  describe('list', () => {
+    it('returns raw rows and totalCount', async () => {
+      const allMock = vi.fn().mockResolvedValue({ results: [{ id: '1', slug: 's', status: 'published', created_at: 1, updated_at: 2, title: 'T', price: 10 }] })
+      const firstMock = vi.fn().mockResolvedValue({ total: 7 })
+      const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
+      const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
+      const db = { prepare: prepareMock } as any
+
+      const result = await new D1WidgetRepository(db).list(seed, { limit: 10, offset: 0 })
+      expect(result.totalCount).toBe(7)
+      expect(result.entries[0]?.title).toBe('T')
+    })
+
+    it('appends search LIKE filter against displayNameAlias column', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb([], { total: 0 })
+      await new D1WidgetRepository(db).list(seed, { limit: 5, offset: 0, search: 'hello' })
+      const sql = (prepareMock.mock.calls[1]?.[0] ?? prepareMock.mock.calls[0]![0]) as string
+      expect(sql).toMatch(/title LIKE \?/)
+      expect(bindMock).toHaveBeenCalledWith('%hello%', 5, 0)
+    })
+
+    it('skips filters with unknown operator', async () => {
+      const { db, prepareMock } = makeMockDb([], { total: 0 })
+      await new D1WidgetRepository(db).list(seed, {
+        limit: 5,
+        offset: 0,
+        filters: [{ column: 'price', op: 'haxx', value: 1 }],
+      })
+      const dataSql = prepareMock.mock.calls[1]![0] as string
+      expect(dataSql).not.toMatch(/haxx/)
+    })
+
+    it('skips filters with unsafe column', async () => {
+      const { db, prepareMock } = makeMockDb([], { total: 0 })
+      await new D1WidgetRepository(db).list(seed, {
+        limit: 5,
+        offset: 0,
+        filters: [{ column: 'evil', op: 'eq', value: 1 }],
+      })
+      const dataSql = prepareMock.mock.calls[1]![0] as string
+      expect(dataSql).not.toMatch(/evil/)
+    })
+
+    it('uses ORDER BY DESC branch when requested', async () => {
+      const { db, prepareMock } = makeMockDb([], { total: 0 })
+      await new D1WidgetRepository(db).list(seed, {
+        limit: 5,
+        offset: 0,
+        orderByColumn: 'price',
+        orderDirection: 'DESC',
+      })
+      const dataSql = prepareMock.mock.calls[1]![0] as string
+      expect(dataSql).toMatch(/ORDER BY price DESC/)
+    })
+
+    it('falls back to created_at when orderByColumn is unsafe', async () => {
+      const { db, prepareMock } = makeMockDb([], { total: 0 })
+      await new D1WidgetRepository(db).list(seed, {
+        limit: 5,
+        offset: 0,
+        orderByColumn: 'evil',
+      })
+      const dataSql = prepareMock.mock.calls[1]![0] as string
+      expect(dataSql).toMatch(/ORDER BY created_at/)
+    })
+  })
+
+  describe('timeseries', () => {
+    it('groups by date bucket on created_at', async () => {
+      const { db, prepareMock } = makeMockDb([
+        { bucket_label: '2026-01-01', bucket_value: 3 },
+      ])
+      const points = await new D1WidgetRepository(db).timeseries(
+        seed,
+        { op: 'count' },
+        'all',
+        'created_at',
+      )
+      expect(points).toEqual([{ label: '2026-01-01', value: 3 }])
+      const sql = prepareMock.mock.calls[0]![0] as string
+      expect(sql).toMatch(/strftime\('%Y-%m-%d', created_at, 'unixepoch'\)/)
+      expect(sql).toMatch(/GROUP BY bucket_label/)
+    })
+
+    it('CASTs non-system group columns as INTEGER', async () => {
+      const { db, prepareMock } = makeMockDb([])
+      await new D1WidgetRepository(db).timeseries(seed, { op: 'count' }, 'all', 'price')
+      const sql = prepareMock.mock.calls[0]![0] as string
+      expect(sql).toMatch(/CAST\(price AS INTEGER\)/)
+    })
+
+    it('throws UNSAFE_COLUMN for invalid groupColumn', async () => {
+      const { db } = makeMockDb()
+      await expect(
+        new D1WidgetRepository(db).timeseries(seed, { op: 'count' }, 'all', 'evil'),
+      ).rejects.toThrow('UNSAFE_COLUMN')
+    })
+  })
+})