@beechcms/api 0.4.0 → 0.4.1

package/src/shared/d1-search.repository.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect, vi } from 'vitest'
+import type { Seed } from '@beechcms/core'
+import { D1SearchRepository } from './d1-search.repository'
+
+function makeMockDb(allResults: unknown[] = [], firstResult: unknown = null) {
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
+  const prepareMock = vi.fn(() => ({ bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, allMock, firstMock }
+}
+
+const seeds: Seed[] = [
+  {
+    slug: 'posts',
+    label: 'Post',
+    displayNameAlias: 'title',
+    branches: [
+      { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+      { id: 'br_02', alias: 'body',  type: 'richtext', label: 'Body' },
+    ],
+  },
+]
+
+describe('D1SearchRepository', () => {
+  it('maps FtsRow to camelCase SearchResultRow', async () => {
+    const ftsRow = {
+      entry_id: 'e1',
+      schema_slug: 'posts',
+      slug: 'hello',
+      status: 'published',
+      title: 'Hello',
+      excerpt: '<mark>Hi</mark>',
+      rank: -3.2,
+    }
+    const { db } = makeMockDb([ftsRow])
+    const result = await new D1SearchRepository(db).search(
+      { queryText: 'hello world', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
+      seeds,
+    )
+    expect(result).toEqual([
+      {
+        entryId: 'e1',
+        schemaSlug: 'posts',
+        slug: 'hello',
+        status: 'published',
+        title: 'Hello',
+        excerpt: '<mark>Hi</mark>',
+        rank: -3.2,
+      },
+    ])
+  })
+
+  it('returns [] on EMPTY_QUERY (single-character terms)', async () => {
+    const { db, prepareMock } = makeMockDb()
+    const result = await new D1SearchRepository(db).search(
+      { queryText: 'a', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
+      seeds,
+    )
+    expect(result).toEqual([])
+    expect(prepareMock).not.toHaveBeenCalled()
+  })
+
+  it('count returns { total: 0 } on EMPTY_QUERY', async () => {
+    const { db } = makeMockDb()
+    const result = await new D1SearchRepository(db).count(
+      { queryText: 'a', schemaSlug: null, statusFilter: null },
+      seeds,
+    )
+    expect(result).toEqual({ total: 0 })
+  })
+
+  it('count returns total from countSql', async () => {
+    const { db, prepareMock } = makeMockDb([], { total: 17 })
+    const result = await new D1SearchRepository(db).count(
+      { queryText: 'hello', schemaSlug: null, statusFilter: null },
+      seeds,
+    )
+    expect(result).toEqual({ total: 17 })
+    const sql = prepareMock.mock.calls[0]![0] as string
+    expect(sql).toMatch(/SUM\(c\)/)
+  })
+})

package/src/shared/d1-search.repository.ts

@@ -0,0 +1,84 @@
+/// <reference types="@cloudflare/workers-types" />
+import type {
+  Seed,
+  ISearchRepository,
+  SearchQueryOptions,
+  SearchResultRow,
+  SearchCountResult,
+} from '@beechcms/core'
+import { buildFtsQuery, type FtsRow } from '../search-utils'
+
+const EMPTY_QUERY_ERROR = 'EMPTY_QUERY'
+
+/**
+ * D1-backed implementation of {@link ISearchRepository}.
+ *
+ * Delegates SQL composition to the pure `buildFtsQuery` helper to keep this
+ * class focused on D1 wiring. Returns raw rows; the route handler is
+ * responsible for mapping them via `mapFtsRow`.
+ */
+export class D1SearchRepository implements ISearchRepository {
+  constructor(private readonly database: D1Database) {}
+
+  async search(options: SearchQueryOptions, seeds: Seed[]): Promise<SearchResultRow[]> {
+    let queryParts
+    try {
+      queryParts = buildFtsQuery(
+        {
+          q: options.queryText,
+          schemaSlug: options.schemaSlug,
+          status: options.statusFilter,
+          limit: options.limit,
+          cursor: options.cursor,
+        },
+        seeds,
+      )
+    } catch (error) {
+      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return []
+      throw error
+    }
+
+    const result = await this.database.prepare(queryParts.sql).bind(...queryParts.binds).all<FtsRow>()
+    return (result.results ?? []).map(mapFtsRowToResultRow)
+  }
+
+  async count(
+    options: Omit<SearchQueryOptions, 'limit' | 'cursor'>,
+    seeds: Seed[],
+  ): Promise<SearchCountResult> {
+    let queryParts
+    try {
+      queryParts = buildFtsQuery(
+        {
+          q: options.queryText,
+          schemaSlug: options.schemaSlug,
+          status: options.statusFilter,
+          limit: 0,
+          cursor: null,
+        },
+        seeds,
+      )
+    } catch (error) {
+      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return { total: 0 }
+      throw error
+    }
+
+    const row = await this.database
+      .prepare(queryParts.countSql)
+      .bind(...queryParts.countBinds)
+      .first<{ total: number }>()
+    return { total: row?.total ?? 0 }
+  }
+}
+
+function mapFtsRowToResultRow(row: FtsRow): SearchResultRow {
+  return {
+    entryId: row.entry_id,
+    schemaSlug: row.schema_slug,
+    slug: row.slug,
+    status: row.status,
+    title: row.title,
+    excerpt: row.excerpt,
+    rank: row.rank,
+  }
+}

package/src/shared/d1-session.repository.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1SessionRepository } from './d1-session.repository'
+import { FixedClock } from './fixed-clock'
+
+const FIXED_NOW_MS = 1700000000_000
+const NOW = Math.floor(FIXED_NOW_MS / 1000)
+const FUTURE = NOW + 7 * 24 * 3600
+const clock = new FixedClock(FIXED_NOW_MS)
+
+function makeMockDb(opts: {
+  firstResult?: unknown
+  runChanges?: number
+  allResults?: unknown[]
+} = {}) {
+  const { firstResult = null, runChanges = 1, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  const prepareMock = vi.fn(() => ({ bind: bindMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
+}
+
+describe('D1SessionRepository', () => {
+  describe('saveRefreshToken', () => {
+    it('calls INSERT INTO refresh_tokens with the correct bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).saveRefreshToken({
+        id: 'rt-1', userId: 'u1', tokenHash: 'h', expiresAt: FUTURE,
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO refresh_tokens'))
+      expect(bindMock).toHaveBeenCalledWith('rt-1', 'u1', 'h', FUTURE, NOW)
+    })
+  })
+
+  describe('findActiveByHash', () => {
+    it('returns a RefreshTokenRecord with camelCase keys mapped from the snake_case row', async () => {
+      const row = {
+        id: 'rt-1', user_id: 'u1', token_hash: 'h',
+        expires_at: FUTURE, created_at: NOW, revoked_at: null,
+      }
+      const { db } = makeMockDb({ firstResult: row })
+      const result = await new D1SessionRepository(db, clock).findActiveByHash('h', NOW)
+      expect(result).toEqual({
+        id: 'rt-1', userId: 'u1', tokenHash: 'h',
+        expiresAt: FUTURE, createdAt: NOW, revokedAt: null,
+      })
+    })
+
+    it('returns null when no active token is found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1SessionRepository(db, clock).findActiveByHash('missing', NOW)).toBeNull()
+    })
+
+    it('passes tokenHash and nowTimestamp as bound values', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).findActiveByHash('my-hash', NOW)
+      expect(bindMock).toHaveBeenCalledWith('my-hash', NOW)
+    })
+  })
+
+  describe('revokeByHash', () => {
+    it('returns true when one row is updated (changes = 1)', async () => {
+      const { db } = makeMockDb({ runChanges: 1 })
+      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(true)
+    })
+
+    it('returns false when no row is updated (token already revoked or not found)', async () => {
+      const { db } = makeMockDb({ runChanges: 0 })
+      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(false)
+    })
+  })
+
+  describe('revokeAllForUser', () => {
+    it('calls UPDATE refresh_tokens and includes the userId in the bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SessionRepository(db, clock).revokeAllForUser('u1', NOW)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE refresh_tokens'))
+      expect((bindMock.mock.calls[0] as unknown[]).includes('u1')).toBe(true)
+    })
+  })
+
+  describe('listActiveForUser', () => {
+    it('returns mapped ActiveSessionSummary objects in the original order', async () => {
+      const rows = [
+        { id: 's1', created_at: NOW - 100, expires_at: FUTURE },
+        { id: 's2', created_at: NOW - 200, expires_at: FUTURE },
+      ]
+      const { db } = makeMockDb({ allResults: rows })
+      const sessions = await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)
+      expect(sessions).toHaveLength(2)
+      expect(sessions[0]).toEqual({ id: 's1', createdAt: NOW - 100, expiresAt: FUTURE })
+      expect(sessions[1]).toEqual({ id: 's2', createdAt: NOW - 200, expiresAt: FUTURE })
+    })
+
+    it('returns an empty array when no active sessions exist', async () => {
+      const { db } = makeMockDb({ allResults: [] })
+      expect(await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)).toEqual([])
+    })
+  })
+
+  describe('revokeById', () => {
+    it('returns true when the session is revoked (changes = 1)', async () => {
+      const { db } = makeMockDb({ runChanges: 1 })
+      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'u1', NOW)).toBe(true)
+    })
+
+    it('returns false when the session is not found or belongs to another user (changes = 0)', async () => {
+      const { db } = makeMockDb({ runChanges: 0 })
+      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'other-user', NOW)).toBe(false)
+    })
+
+    it('binds both sessionId and userId to prevent cross-user revocation', async () => {
+      const { db, bindMock } = makeMockDb({ runChanges: 1 })
+      await new D1SessionRepository(db, clock).revokeById('my-session', 'my-user', NOW)
+      const args = bindMock.mock.calls[0] as unknown[]
+      expect(args).toContain('my-session')
+      expect(args).toContain('my-user')
+    })
+  })
+})

package/src/shared/d1-session.repository.ts

@@ -0,0 +1,98 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { ISessionRepository, NewRefreshToken, RefreshTokenRecord, ActiveSessionSummary, IClock } from '@beechcms/core'
+
+type RefreshTokenRow = {
+  id: string
+  user_id: string
+  token_hash: string
+  expires_at: number
+  created_at: number
+  revoked_at: number | null
+}
+
+type SessionSummaryRow = {
+  id: string
+  created_at: number
+  expires_at: number
+}
+
+function rowToRecord(row: RefreshTokenRow): RefreshTokenRecord {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    tokenHash: row.token_hash,
+    expiresAt: row.expires_at,
+    createdAt: row.created_at,
+    revokedAt: row.revoked_at,
+  }
+}
+
+export class D1SessionRepository implements ISessionRepository {
+  constructor(
+    private readonly db: D1Database,
+    private readonly clock: IClock,
+  ) {}
+
+  async saveRefreshToken(record: NewRefreshToken): Promise<void> {
+    await this.db
+      .prepare('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+      .bind(record.id, record.userId, record.tokenHash, record.expiresAt, this.clock.nowSeconds())
+      .run()
+  }
+
+  async findActiveByHash(tokenHash: string, nowTimestamp: number): Promise<RefreshTokenRecord | null> {
+    const row = await this.db
+      .prepare(
+        `SELECT id, user_id, token_hash, expires_at, created_at, revoked_at
+         FROM refresh_tokens
+         WHERE token_hash = ? AND expires_at > ? AND revoked_at IS NULL
+         LIMIT 1`
+      )
+      .bind(tokenHash, nowTimestamp)
+      .first<RefreshTokenRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async revokeByHash(tokenHash: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        `UPDATE refresh_tokens
+         SET revoked_at = ?
+         WHERE token_hash = ? AND revoked_at IS NULL AND expires_at >= ?`
+      )
+      .bind(nowTimestamp, tokenHash, nowTimestamp)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+
+  async revokeAllForUser(userId: string, nowTimestamp: number): Promise<void> {
+    await this.db
+      .prepare('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL')
+      .bind(nowTimestamp, userId)
+      .run()
+  }
+
+  async listActiveForUser(userId: string, nowTimestamp: number, limit: number): Promise<ActiveSessionSummary[]> {
+    const { results } = await this.db
+      .prepare(
+        `SELECT id, created_at, expires_at FROM refresh_tokens
+         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
+         ORDER BY created_at DESC LIMIT ?`
+      )
+      .bind(userId, nowTimestamp, limit)
+      .all<SessionSummaryRow>()
+    return (results ?? []).map(row => ({ id: row.id, createdAt: row.created_at, expiresAt: row.expires_at }))
+  }
+
+  async revokeById(sessionId: string, userId: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        'UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL'
+      )
+      .bind(nowTimestamp, sessionId, userId)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+}

package/src/shared/d1-user.repository.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1UserRepository } from './d1-user.repository'
+
+const USER_ROW = {
+  id: 'u1',
+  email: 'test@test.com',
+  name: 'Test User',
+  password_hash: 'hash-abc',
+  role: 'admin',
+  avatar_url: null,
+  notification_prefs: '{}',
+}
+
+function makeMockDb(opts: {
+  firstResult?: unknown
+  runChanges?: number
+  allResults?: unknown[]
+} = {}) {
+  const { firstResult = null, runChanges = 1, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  // prepare() may be called without bind() for countAll (which calls .first() directly)
+  const prepareMock = vi.fn(() => ({ bind: bindMock, first: firstMock, run: runMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
+}
+
+describe('D1UserRepository', () => {
+  describe('countAll', () => {
+    it('returns the count value from the database', async () => {
+      const { db, firstMock } = makeMockDb()
+      firstMock.mockResolvedValue({ count: 5 })
+      expect(await new D1UserRepository(db).countAll()).toBe(5)
+    })
+
+    it('returns 0 when the query returns null', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).countAll()).toBe(0)
+    })
+  })
+
+  describe('findByEmail', () => {
+    it('returns a UserRecord with camelCase keys mapped from the snake_case row', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findByEmail('test@test.com')
+      expect(result).toEqual({
+        id: 'u1',
+        email: 'test@test.com',
+        name: 'Test User',
+        passwordHash: 'hash-abc',
+        role: 'admin',
+        avatarUrl: null,
+        notificationPreferences: '{}',
+      })
+    })
+
+    it('returns null when no user is found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findByEmail('nobody@test.com')).toBeNull()
+    })
+  })
+
+  describe('findById', () => {
+    it('returns a mapped UserRecord when found', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findById('u1')
+      expect(result?.id).toBe('u1')
+      expect(result?.passwordHash).toBe('hash-abc')
+    })
+
+    it('returns null when the user is not found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findById('unknown')).toBeNull()
+    })
+  })
+
+  describe('create', () => {
+    it('calls prepare with an INSERT INTO users statement', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO users'))
+    })
+
+    it('binds id, email, passwordHash, role, name in the correct order', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
+      })
+      expect(bindMock).toHaveBeenCalledWith('u1', 'a@b.com', 'hash', 'admin', 'Test')
+    })
+  })
+
+  describe('updateProfile', () => {
+    it('does nothing when no fields are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', {})
+      expect(prepareMock).not.toHaveBeenCalled()
+    })
+
+    it('generates a SET clause containing only the provided field', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'New Name' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).not.toContain('email = ?')
+    })
+
+    it('includes both fields when both name and email are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'N', email: 'e@e.com' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).toContain('email = ?')
+    })
+  })
+
+  describe('updatePasswordHash', () => {
+    it('calls UPDATE users SET password_hash', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updatePasswordHash('u1', 'new-hash')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('password_hash'))
+    })
+  })
+
+  describe('updateAvatarUrl', () => {
+    it('calls UPDATE users SET avatar_url', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateAvatarUrl('u1', 'https://cdn.example.com/avatar.jpg')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('avatar_url'))
+    })
+  })
+
+  describe('emailBelongsToAnotherUser', () => {
+    it('returns true when another user row is found with that email', async () => {
+      const { db } = makeMockDb({ firstResult: { id: 'other-user' } })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('taken@test.com', 'current')).toBe(true)
+    })
+
+    it('returns false when no other user owns the email', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('free@test.com', 'current')).toBe(false)
+    })
+  })
+})

package/src/shared/d1-user.repository.ts

@@ -0,0 +1,109 @@
+/// <reference types="@cloudflare/workers-types" />
+import type { IUserRepository, UserRecord, NewUserInput } from '@beechcms/core'
+
+type UserRow = {
+  id: string
+  email: string
+  name: string | null
+  password_hash: string
+  role: string
+  avatar_url: string | null
+  notification_prefs: string
+}
+
+function rowToRecord(row: UserRow): UserRecord {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    passwordHash: row.password_hash,
+    role: row.role,
+    avatarUrl: row.avatar_url,
+    notificationPreferences: row.notification_prefs,
+  }
+}
+
+export class D1UserRepository implements IUserRepository {
+  constructor(private readonly db: D1Database) {}
+
+  async countAll(): Promise<number> {
+    const result = await this.db
+      .prepare('SELECT COUNT(*) as count FROM users')
+      .first<{ count: number }>()
+    return result?.count ?? 0
+  }
+
+  async findById(userId: string): Promise<UserRecord | null> {
+    const row = await this.db
+      .prepare('SELECT id, email, name, password_hash, role, avatar_url, notification_prefs FROM users WHERE id = ? LIMIT 1')
+      .bind(userId)
+      .first<UserRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async findByEmail(email: string): Promise<UserRecord | null> {
+    const row = await this.db
+      .prepare('SELECT id, email, name, password_hash, role, avatar_url, notification_prefs FROM users WHERE email = ? LIMIT 1')
+      .bind(email)
+      .first<UserRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async create(user: NewUserInput): Promise<void> {
+    await this.db
+      .prepare('INSERT INTO users (id, email, password_hash, role, name) VALUES (?, ?, ?, ?, ?)')
+      .bind(user.id, user.email, user.passwordHash, user.role, user.name)
+      .run()
+  }
+
+  async updateProfile(userId: string, fields: { name?: string; email?: string }): Promise<void> {
+    const columnAssignments: string[] = []
+    const boundValues: unknown[] = []
+
+    if (fields.name !== undefined) {
+      columnAssignments.push('name = ?')
+      boundValues.push(fields.name)
+    }
+    if (fields.email !== undefined) {
+      columnAssignments.push('email = ?')
+      boundValues.push(fields.email)
+    }
+
+    if (columnAssignments.length === 0) return
+
+    boundValues.push(userId)
+    await this.db
+      .prepare(`UPDATE users SET ${columnAssignments.join(', ')} WHERE id = ?`)
+      .bind(...boundValues)
+      .run()
+  }
+
+  async updatePasswordHash(userId: string, newPasswordHash: string): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
+      .bind(newPasswordHash, userId)
+      .run()
+  }
+
+  async updateAvatarUrl(userId: string, avatarUrl: string | null): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET avatar_url = ? WHERE id = ?')
+      .bind(avatarUrl, userId)
+      .run()
+  }
+
+  async updateNotificationPreferences(userId: string, preferencesJson: string): Promise<void> {
+    await this.db
+      .prepare('UPDATE users SET notification_prefs = ? WHERE id = ?')
+      .bind(preferencesJson, userId)
+      .run()
+  }
+
+  async emailBelongsToAnotherUser(email: string, currentUserId: string): Promise<boolean> {
+    const row = await this.db
+      .prepare('SELECT id FROM users WHERE email = ? AND id != ? LIMIT 1')
+      .bind(email, currentUserId)
+      .first()
+    return row !== null
+  }
+}