@beechcms/api 0.4.0-preview.9 → 0.4.1

package/src/factory.ts

@@ -1,303 +1,339 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import { cors } from 'hono/cors'
-import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
-import type { Seed } from '@beechcms/core'
-import type { Env, Variables } from './types'
-
-// Imports delle rotte e middleware
-import { AUTH_ERRORS } from './auth/constants'
-import {
-  parseLoginBody,
-  validateLoginInput,
-  findUserByEmail,
-  verifyPassword,
-  DUMMY_PASSWORD_HASH,
-} from './auth/login'
-import {
-  generateRefreshToken,
-  saveRefreshToken,
-  generateAccessToken,
-  validateRefreshToken,
-  revokeRefreshToken,
-} from './auth/refresh'
-import { authMiddleware } from './middleware'
-import { contentRoutes } from './content'
-import { widgetApp } from './widget'
-import { rotateFieldApp } from './features/rotate-field'
-import { passwordResetApp } from './features/password-reset'
-import { setupApp } from './features/setup'
-import { draftApp } from './features/draft'
-import { settingsApp } from './features/settings/settings.handler'
-import { schemaApp } from './features/schema/schema.handler'
-import { notificationsApp } from './features/notifications'
-import { statsApp } from './features/stats'
-import { uploadRoutes, serveMediaHandler } from './upload'
-import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
-import { searchRouter } from "./search"
-
-export interface BeechConfig {
-  seeds: Seed[] | Record<string, Seed>
-}
-
-// --- Costanti e helper ---
-const REFRESH_TOKEN_EXPIRY_DAYS = 7
-const SECONDS_PER_DAY = 24 * 60 * 60
-
-function isRequestSecure(url: string): boolean {
-  return new URL(url).protocol === 'https:'
-}
-
-function getClientIp(headers: Headers): string {
-  return headers.get('cf-connecting-ip') ?? 'unknown'
-}
-
-function getRefreshTokenCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    maxAge: REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
-    path: '/auth',
-  }
-}
-
-function getRefreshTokenDeleteCookieOptions(secure: boolean) {
-  return {
-    httpOnly: true,
-    secure,
-    sameSite: 'Strict' as const,
-    path: '/auth',
-  }
-}
-
-function handleAuthError(c: any, err: unknown, operationName: string): Response {
-  if (c.env.ENV !== 'production') {
-    console.error(`${operationName} error:`, err)
-  }
-  return c.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
-}
-
-function extractPublicSeed(path: string): string {
-  const match = path.match(/^\/api\/v1\/public\/([^/?]+)/)
-  return match ? match[1] : ''
-}
-
-/**
- * Builds a fully configured Hono app with the given seeds injected into context.
- * This is the main entry point for a BeechCMS project.
- */
-export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
-  const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
-  const registry: Record<string, Seed> = Object.fromEntries(seedsArray.map(s => [s.slug, s]))
-  const getSeedFn = (slug: string): Seed | null => registry[slug] ?? null
-
-  const app = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-  // 1. Core Middleware (Seeds, CORS, Security)
-  app.use('*', async (c, next) => {
-    c.set('getSeed', getSeedFn)
-    c.set('seedRegistry', registry)
-    await next()
-  })
-
-  app.use('*', async (c, next) => {
-    const origins = (c.env.CORS_ORIGINS ?? 'http://localhost:5173')
-      .split(',')
-      .map((o) => o.trim())
-      .filter(Boolean)
-    return cors({
-      origin: (origin) => {
-        if (!origin) return origins[0] ?? null
-        return origins.includes(origin) ? origin : null
-      },
-      allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-      allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
-      credentials: true,
-    })(c, next)
-  })
-
-  app.use('*', async (c, next) => {
-    await next()
-    if (c.req.path.startsWith('/admin')) return
-    c.header('X-Frame-Options', 'DENY')
-    c.header('X-Content-Type-Options', 'nosniff')
-    c.header('Referrer-Policy', 'strict-origin-when-cross-origin')
-    c.header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
-    c.header('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'")
-  })
-
-  // 2. Analytics Middleware
-  app.use('/api/*', async (c, next) => {
-    await next()
-    if (c.req.method !== 'OPTIONS' && c.res.status >= 200 && c.res.status < 300) {
-      const db = c.env.DB
-      let executionCtx: any
-      try { executionCtx = c.executionCtx } catch {}
-
-      if (db && executionCtx) {
-        const seed = extractPublicSeed(c.req.path)
-        executionCtx.waitUntil((async () => {
-          try {
-            const today = Math.floor(new Date().setHours(0, 0, 0, 0) / 1000)
-            await db.prepare(
-              `INSERT INTO analytics (day_ts, metric, seed, value)
-               VALUES (?, 'requests', ?, 1)
-               ON CONFLICT(day_ts, metric, seed) DO UPDATE SET value = value + 1`
-            ).bind(today, seed).run()
-          } catch (err) {
-            console.error('Analytics middleware error:', err)
-          }
-        })())
-      }
-    }
-  })
-
-  // 3. Auth Routes
-  app.post('/auth/login', async (c) => {
-    try {
-      let body: any
-      try { body = await c.req.json() } catch { return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400) }
-      const credentials = parseLoginBody(body)
-      if (!credentials) return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-      const { email, password } = credentials
-      if (!validateLoginInput(email, password)) return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
-
-      const loginLimiter = c.env.LOGIN_RATE_LIMITER
-      if (loginLimiter) {
-        const clientIp = getClientIp(c.req.raw.headers)
-        const { success } = await loginLimiter.limit({ key: `${clientIp}:${email}` })
-        if (!success) return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
-
-      const { DB, JWT_SECRET } = c.env
-      const user = await findUserByEmail(DB, email)
-      const hashToCompare = user?.password_hash ?? DUMMY_PASSWORD_HASH
-      const isValid = await verifyPassword(password, hashToCompare)
-
-      if (!user || !isValid) return c.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
-
-      const userProfile = await DB.prepare('SELECT name FROM users WHERE id = ? LIMIT 1').bind(user.id).first<{ name: string | null }>()
-      const accessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: c.env.JWT_ISSUER,
-        audience: c.env.JWT_AUDIENCE,
-      }, userProfile?.name ?? undefined)
-      const refreshToken = generateRefreshToken()
-
-      await saveRefreshToken(DB, user.id, refreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-      setCookie(c, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ token: accessToken, expiresIn: '15m' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Login')
-    }
-  })
-
-  app.post('/auth/refresh', async (c) => {
-    try {
-      const refreshLimiter = c.env.REFRESH_RATE_LIMITER
-      if (refreshLimiter) {
-        const clientIp = getClientIp(c.req.raw.headers)
-        const { success } = await refreshLimiter.limit({ key: clientIp })
-        if (!success) return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
-
-      const refreshToken = getCookie(c, 'refresh_token')
-      if (!refreshToken) return c.json({ error: 'Refresh token missing' }, 401)
-
-      const { DB, JWT_SECRET } = c.env
-      const validation = await validateRefreshToken(DB, refreshToken)
-      if (!validation.valid || !validation.userId) return c.json({ error: 'Invalid refresh token' }, 401)
-
-      const user = await DB.prepare('SELECT id, email, name FROM users WHERE id = ? LIMIT 1').bind(validation.userId).first<{ id: string; email: string; name: string | null }>()
-      if (!user) return c.json({ error: 'User not found' }, 401)
-
-      const revoked = await revokeRefreshToken(DB, refreshToken)
-      if (!revoked) return c.json({ error: 'Invalid refresh token' }, 401)
-
-      const newAccessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: c.env.JWT_ISSUER,
-        audience: c.env.JWT_AUDIENCE,
-      }, user.name ?? undefined)
-      const newRefreshToken = generateRefreshToken()
-
-      await saveRefreshToken(DB, user.id, newRefreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-      setCookie(c, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ token: newAccessToken, expiresIn: '15m' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Refresh')
-    }
-  })
-
-  app.post('/auth/logout', async (c) => {
-    try {
-      const refreshToken = getCookie(c, 'refresh_token')
-      if (refreshToken) await revokeRefreshToken(c.env.DB, refreshToken)
-      deleteCookie(c, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ message: 'Logged out' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Logout')
-    }
-  })
-
-  // 4. Setup & Password Reset
-  app.route('/', setupApp)
-  app.route('/', passwordResetApp)
-
-  // 5. Protected CMS API
-  const apiProtected = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiProtected.use('*', async (c, next) => {
-    await authMiddleware(c.env.JWT_SECRET, {
-      issuer: c.env.JWT_ISSUER,
-      audience: c.env.JWT_AUDIENCE,
-    })(c, next)
-  })
-
-  apiProtected.route('/settings', settingsApp)
-  apiProtected.route('/schema', schemaApp)
-  apiProtected.route('/content', notificationsApp)
-  apiProtected.route('/content', statsApp)
-  apiProtected.route('/content', rotateFieldApp)
-  apiProtected.route('/content', draftApp)
-  apiProtected.route('/content', contentRoutes)
-  apiProtected.route('/widget', widgetApp)
-  
-  app.route('/api', apiProtected)
-  app.route('/api/search', searchRouter)
-  app.route('/api', uploadRoutes)
-  app.get('/api/media/:key', (c) => serveMediaHandler(c))
-
-  // 6. Public API
-  const apiPublic = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiPublic.use('*', publicRateLimitMiddleware())
-  apiPublic.use('*', apiKeyMiddleware())
-  apiPublic.route('/', publicRoutes)
-  app.route('/api/v1/public', apiPublic)
-
-  // 7. Dashboard SPA — serve static assets from Workers Assets binding
-  app.get('/admin', (c) => c.redirect('/admin/', 301))
-  app.get('/admin/*', async (c) => {
-    if (!c.env.ASSETS) {
-      return c.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to node_modules/@beechcms/api/assets/dashboard', 503)
-    }
-    const url = new URL(c.req.url)
-    const originalPath = url.pathname
-    url.pathname = originalPath.replace(/^\/admin/, '') || '/'
-    
-    let assetResponse = await c.env.ASSETS.fetch(new Request(url.toString(), c.req.raw))
-    if (assetResponse.status === 404) {
-      // SPA fallback: any unmatched /admin/* route serves index.html
-      assetResponse = await c.env.ASSETS.fetch(new Request(new URL('/index.html', c.req.url)))
-    }
-    // ASSETS returns an immutable Response — wrap it to inject security headers
-    const headers = new Headers(assetResponse.headers)
-    headers.set('Content-Security-Policy',
-      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self'; frame-ancestors 'none'"
-    )
-    headers.set('X-Frame-Options', 'DENY')
-    headers.set('X-Content-Type-Options', 'nosniff')
-    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
-    return new Response(assetResponse.body, { status: assetResponse.status, headers })
-  })
-
-  return app
-}
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
+import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
+import { sha256hex, SystemClock, SystemIdGenerator, SeedRegistry } from '@beechcms/core'
+import type { Env, Variables } from './types'
+import { getClientIp } from './shared/request-utils'
+
+// Imports delle rotte e middleware
+import { AUTH_ERRORS } from './auth/constants'
+import {
+  parseLoginBody,
+  validateLoginInput,
+  verifyPassword,
+  DUMMY_PASSWORD_HASH,
+} from './auth/login'
+import { generateRefreshToken } from './auth/refresh'
+import { authMiddleware } from './middleware'
+import contentFeature from './features/content'
+import { widgetApp } from './widget'
+import { rotateFieldApp } from './features/rotate-field'
+import { passwordResetApp } from './features/password-reset'
+import { setupApp } from './features/setup'
+import { draftApp } from './features/draft'
+import { settingsApp } from './features/settings/settings.handler'
+import { schemaApp } from './features/schema/schema.handler'
+import { notificationsApp } from './features/notifications'
+import { statsApp } from './features/stats'
+import { uploadRoutes, serveMediaHandler } from './upload'
+import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
+import { searchRouter } from "./search"
+import { repositoryMiddleware } from './middleware/repository.middleware'
+import { storageMiddleware } from './middleware/storage.middleware'
+import { authProvidersMiddleware } from './middleware/auth-providers.middleware'
+import { rateLimiterMiddleware } from './middleware/rate-limit.middleware'
+import { observabilityMiddleware } from './middleware/observability.middleware'
+
+export interface BeechConfig {
+  seeds: Seed[] | Record<string, Seed>
+  repository?: ContentRepository
+  idempotencyRepository?: IdempotencyRepository
+  bucket?: BeechBucket
+  mediaRepository?: MediaRepository
+  systemStatsRepository?: SystemStatsRepository
+}
+
+// --- Costanti e helper ---
+const REFRESH_TOKEN_EXPIRY_DAYS = 7
+const SECONDS_PER_DAY = 24 * 60 * 60
+
+function isRequestSecure(url: string): boolean {
+  return new URL(url).protocol === 'https:'
+}
+
+function getRefreshTokenCookieOptions(secure: boolean) {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'Strict' as const,
+    maxAge: REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
+    path: '/auth',
+  }
+}
+
+function getRefreshTokenDeleteCookieOptions(secure: boolean) {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'Strict' as const,
+    path: '/auth',
+  }
+}
+
+function handleAuthError(context: any, error: unknown, operationName: string): Response {
+  if (context.env.ENV !== 'production') {
+    console.error(`${operationName} error:`, error)
+  }
+  return context.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
+}
+
+function extractPublicSeed(path: string): string {
+  const match = path.match(/^\/api\/v1\/public\/([^/?]+)/)
+  return match ? match[1] : ''
+}
+
+/**
+ * Builds a fully configured Hono app with the given seeds injected into context.
+ * This is the main entry point for a BeechCMS project.
+ */
+export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
+  const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
+  // Filter out any invalid objects that might have leaked into the registry (e.g. module exports)
+  const validSeeds = seedsArray.filter(s => s && typeof s === 'object' && 'slug' in s)
+  const seedRegistry = new SeedRegistry(validSeeds)
+
+  const app = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+  // 1. Core Middleware (Seeds, CORS, Security)
+  app.use('*', async (context, next) => {
+    context.set('getSeed', (slug: string) => seedRegistry.get(slug))
+    context.set('seedRegistry', seedRegistry)
+    await next()
+  })
+
+  // 1.1 Repository Injection
+  app.use('*', repositoryMiddleware({
+    repository: config.repository,
+    idempotencyRepository: config.idempotencyRepository,
+    mediaRepository: config.mediaRepository,
+    systemStatsRepository: config.systemStatsRepository,
+  }))
+
+  app.use('*', storageMiddleware({
+    bucket: config.bucket,
+  }))
+
+  app.use('*', authProvidersMiddleware())
+  app.use('*', rateLimiterMiddleware())
+  app.use('*', observabilityMiddleware())
+
+  app.use('*', async (context, next) => {
+    const isDev = context.env.ENV !== 'production'
+
+    return cors({
+      origin: (origin) => {
+        if (!origin) return origin ?? ''
+
+        // In dev, allow all localhost/127.0.0.1 origins regardless of port
+        if (isDev) {
+          try {
+            const { hostname } = new URL(origin)
+            if (hostname === 'localhost' || hostname === '127.0.0.1') return origin
+          } catch {}
+        }
+
+        const origins = (context.env.CORS_ORIGINS ?? 'http://localhost:5173')
+          .split(',')
+          .map((o) => o.trim())
+          .filter(Boolean)
+
+        if (origins.includes(origin)) return origin
+
+        // Allow same-origin requests
+        try {
+          const originUrl = new URL(origin)
+          const requestUrl = new URL(context.req.url)
+          if (originUrl.hostname === requestUrl.hostname && originUrl.port === requestUrl.port) {
+            return origin
+          }
+        } catch {}
+
+        return null
+      },
+      allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+      allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
+      credentials: true,
+    })(context, next)
+  })
+
+  app.use('*', async (context, next) => {
+    await next()
+    if (context.req.path.startsWith('/admin')) return
+    context.header('X-Frame-Options', 'DENY')
+    context.header('X-Content-Type-Options', 'nosniff')
+    context.header('Referrer-Policy', 'strict-origin-when-cross-origin')
+    context.header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
+    context.header('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'")
+  })
+
+  // 2. Analytics Middleware
+  app.use('/api/*', async (context, next) => {
+    await next()
+    if (context.req.method === 'OPTIONS') return
+    if (context.res.status < 200 || context.res.status >= 300) return
+
+    let executionCtx: any
+    try { executionCtx = context.executionCtx } catch {}
+    if (!executionCtx) return
+
+    const analyticsRepository = context.get('analyticsRepository')
+    if (!analyticsRepository) return
+
+    const seedSlug = extractPublicSeed(context.req.path)
+
+    executionCtx.waitUntil(
+      analyticsRepository.recordRequest(seedSlug).catch((error: unknown) => {
+        console.error('Analytics middleware error:', error)
+      })
+    )
+  })
+
+  // 3. Auth Routes
+  app.post('/auth/login', async (context) => {
+    try {
+      let body: any
+      try { body = await context.req.json() } catch { return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400) }
+      const credentials = parseLoginBody(body)
+      if (!credentials) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
+      const { email, password } = credentials
+      if (!validateLoginInput(email, password)) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
+
+      const clientIp = getClientIp(context.req)
+      const loginRateLimit = await context.get('rateLimiters').getLimiter('login').checkLimit(clientIp)
+      if (!loginRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
+
+      const user = await context.get('userRepository').findByEmail(email)
+      const hashToCompare = user?.passwordHash ?? DUMMY_PASSWORD_HASH
+      const isValid = await verifyPassword(password, hashToCompare, context.get('hashProvider'))
+
+      if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
+
+      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const refreshToken = generateRefreshToken()
+      const refreshTokenHash = await sha256hex(refreshToken)
+      const nowSeconds = SystemClock.nowSeconds()
+
+      await context.get('sessionRepository').saveRefreshToken({
+        id: SystemIdGenerator.uuid(),
+        userId: user.id,
+        tokenHash: refreshTokenHash,
+        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
+      })
+      setCookie(context, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ token: accessToken, expiresIn: '15m' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Login')
+    }
+  })
+
+  app.post('/auth/refresh', async (context) => {
+    try {
+      const refreshClientIp = getClientIp(context.req)
+      const refreshRateLimit = await context.get('rateLimiters').getLimiter('tokenRefresh').checkLimit(refreshClientIp)
+      if (!refreshRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
+
+      const refreshToken = getCookie(context, 'refresh_token')
+      if (!refreshToken) return context.json({ error: 'Refresh token missing' }, 401)
+
+      const nowSeconds = SystemClock.nowSeconds()
+      const tokenHash = await sha256hex(refreshToken)
+      const activeSession = await context.get('sessionRepository').findActiveByHash(tokenHash, nowSeconds)
+      if (!activeSession) return context.json({ error: 'Invalid refresh token' }, 401)
+
+      const user = await context.get('userRepository').findById(activeSession.userId)
+      if (!user) return context.json({ error: 'User not found' }, 401)
+
+      const revoked = await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
+      if (!revoked) return context.json({ error: 'Invalid refresh token' }, 401)
+
+      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
+      const newRefreshToken = generateRefreshToken()
+      const newRefreshTokenHash = await sha256hex(newRefreshToken)
+
+      await context.get('sessionRepository').saveRefreshToken({
+        id: SystemIdGenerator.uuid(),
+        userId: user.id,
+        tokenHash: newRefreshTokenHash,
+        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
+      })
+      setCookie(context, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ token: newAccessToken, expiresIn: '15m' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Refresh')
+    }
+  })
+
+  app.post('/auth/logout', async (context) => {
+    try {
+      const refreshToken = getCookie(context, 'refresh_token')
+      if (refreshToken) {
+        const nowSeconds = SystemClock.nowSeconds()
+        const tokenHash = await sha256hex(refreshToken)
+        await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
+      }
+      deleteCookie(context, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ message: 'Logged out' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Logout')
+    }
+  })
+
+  // 4. Setup & Password Reset
+  app.route('/', setupApp)
+  app.route('/', passwordResetApp)
+
+  // 5. Protected CMS API
+  const apiProtected = new Hono<{ Bindings: Env; Variables: Variables }>()
+  apiProtected.use('*', authMiddleware())
+
+  apiProtected.route('/settings', settingsApp)
+  apiProtected.route('/schema', schemaApp)
+  apiProtected.route('/content', notificationsApp)
+  apiProtected.route('/content', statsApp)
+  apiProtected.route('/content', rotateFieldApp)
+  apiProtected.route('/content', draftApp)
+  apiProtected.route('/content', contentFeature)
+  apiProtected.route('/widget', widgetApp)
+  apiProtected.route('/', uploadRoutes)
+  
+  // 6. Public API (must be registered before apiProtected to avoid auth middleware interception)
+  const apiPublic = new Hono<{ Bindings: Env; Variables: Variables }>()
+  apiPublic.use('*', publicRateLimitMiddleware())
+  apiPublic.use('*', apiKeyMiddleware())
+  apiPublic.route('/', publicRoutes)
+  app.route('/api/v1/public', apiPublic)
+
+  app.get('/api/media/:key', (context) => serveMediaHandler(context))
+  app.route('/api', apiProtected)
+  app.route('/api/search', searchRouter)
+
+  // 7. Dashboard SPA — serve static assets from Workers Assets binding
+  app.get('/admin', (context) => context.redirect('/admin/', 301))
+  app.get('/admin/*', async (context) => {
+    if (!context.env.ASSETS) {
+      return context.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to node_modules/@beechcms/api/assets/dashboard', 503)
+    }
+    const url = new URL(context.req.url)
+    const originalPath = url.pathname
+    url.pathname = originalPath.replace(/^\/admin/, '') || '/'
+    
+    let assetResponse = await context.env.ASSETS.fetch(new Request(url.toString(), context.req.raw))
+    if (assetResponse.status === 404) {
+      // SPA fallback: any unmatched /admin/* route serves index.html
+      assetResponse = await context.env.ASSETS.fetch(new Request(new URL('/index.html', context.req.url)))
+    }
+    // ASSETS returns an immutable Response — wrap it to inject security headers
+    const headers = new Headers(assetResponse.headers)
+    headers.set('Content-Security-Policy',
+      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self'; frame-ancestors 'none'"
+    )
+    headers.set('X-Frame-Options', 'DENY')
+    headers.set('X-Content-Type-Options', 'nosniff')
+    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+    return new Response(assetResponse.body, { status: assetResponse.status, headers })
+  })
+
+  return app
+}