@beechcms/api 0.4.0 → 0.4.1

package/src/shared/media.repository.d1.test.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1MediaRepository } from './media.repository.d1'
+
+function makeMockDb(opts: { firstResult?: unknown; allResults?: unknown[] } = {}) {
+  const { firstResult = null, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  // bind() returns the same interface so chains like prepare().bind().all() work.
+  // The statement also exposes first/all/run directly for queries that skip bind().
+  const bindMock = vi.fn(() => ({ run: runMock, first: firstMock, all: allMock }))
+  const stmt = { bind: bindMock, run: runMock, first: firstMock, all: allMock }
+  const prepareMock = vi.fn(() => stmt)
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
+}
+
+describe('D1MediaRepository', () => {
+  describe('trackUpload', () => {
+    it('calls INSERT INTO media_objects with correct bound values', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      const obj = { key: 'k1', filename: 'img.png', mime_type: 'image/png', size_bytes: 1024, uploaded_by: 'user-1' }
+      await new D1MediaRepository(db).trackUpload(obj)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO media_objects'))
+      expect(bindMock).toHaveBeenCalledWith('k1', 'img.png', 'image/png', 1024, 'user-1')
+    })
+  })
+
+  describe('getByKey', () => {
+    it('returns the media object when found', async () => {
+      const row = { key: 'k1', filename: 'img.png', mime_type: 'image/png', size_bytes: 512, uploaded_by: 'u1', created_at: 1000 }
+      const { db } = makeMockDb({ firstResult: row })
+      const result = await new D1MediaRepository(db).getByKey('k1')
+      expect(result).toEqual(row)
+    })
+
+    it('returns null when the key is not found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1MediaRepository(db).getByKey('ghost')).toBeNull()
+    })
+
+    it('passes the key as bound value', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1MediaRepository(db).getByKey('my-key')
+      expect(bindMock).toHaveBeenCalledWith('my-key')
+    })
+  })
+
+  describe('untrack', () => {
+    it('calls DELETE FROM media_objects with the key', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1MediaRepository(db).untrack('k1')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('DELETE FROM media_objects'))
+      expect(bindMock).toHaveBeenCalledWith('k1')
+    })
+  })
+
+  describe('list', () => {
+    it('returns items and total from D1', async () => {
+      const rows = [
+        { key: 'k1', filename: 'a.png', mime_type: 'image/png', size_bytes: 100, uploaded_by: 'u1', created_at: 1000 },
+      ]
+      const { db, allMock, firstMock } = makeMockDb()
+      // list() calls all() for items then first() for count (without bind)
+      allMock.mockResolvedValueOnce({ results: rows })
+      firstMock.mockResolvedValueOnce({ total: 1 })
+
+      const result = await new D1MediaRepository(db).list({ limit: 10, offset: 0 })
+      expect(result.items).toHaveLength(1)
+      expect(result.total).toBe(1)
+    })
+
+    it('returns empty items and 0 total when D1 returns nothing', async () => {
+      const { db, allMock, firstMock } = makeMockDb()
+      allMock.mockResolvedValueOnce({ results: [] })
+      firstMock.mockResolvedValueOnce(null) // count row is null → 0
+
+      const result = await new D1MediaRepository(db).list({ limit: 10, offset: 0 })
+      expect(result.items).toEqual([])
+      expect(result.total).toBe(0)
+    })
+
+    it('passes limit and offset as bound values for the list query', async () => {
+      const { db, bindMock, allMock, firstMock } = makeMockDb()
+      allMock.mockResolvedValueOnce({ results: [] })
+      firstMock.mockResolvedValueOnce({ total: 0 })
+
+      await new D1MediaRepository(db).list({ limit: 5, offset: 10 })
+      expect(bindMock).toHaveBeenCalledWith(5, 10)
+    })
+  })
+
+  describe('count', () => {
+    it('returns the count from D1', async () => {
+      const { db } = makeMockDb({ firstResult: { total: 42 } })
+      expect(await new D1MediaRepository(db).count()).toBe(42)
+    })
+
+    it('returns 0 when D1 returns null', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1MediaRepository(db).count()).toBe(0)
+    })
+  })
+})

package/src/shared/media.repository.d1.ts

@@ -10,7 +10,7 @@ export class D1MediaRepository implements MediaRepository {
   /**
    * Registers a new media upload in the database.
    */
-  async trackUpload(mediaObject: MediaObject): Promise<void> {
+  async trackUpload(mediaObject: Omit<MediaObject, 'created_at'>): Promise<void> {
     await this.database.prepare(
       'INSERT INTO media_objects (key, filename, mime_type, size_bytes, uploaded_by) VALUES (?, ?, ?, ?, ?)'
     ).bind(

package/src/shared/request-utils.ts

@@ -0,0 +1,22 @@
+import type { HonoRequest } from "hono"
+
+/** The header Cloudflare sets on every incoming request to the Worker. */
+const CLOUDFLARE_CLIENT_IP_HEADER = "cf-connecting-ip"
+
+/** The fallback value used when the IP header is absent (local dev, unit tests). */
+const UNKNOWN_IP = "unknown"
+
+/**
+ * Extracts the real client IP address from a Cloudflare Worker request.
+ *
+ * Cloudflare injects the cf-connecting-ip header on every request that
+ * passes through the edge. In local development (wrangler dev) or in
+ * unit tests the header may be absent, in which case the string "unknown"
+ * is returned so that rate-limiter keys remain non-empty and safe to use.
+ *
+ * Never derive security decisions from this value alone; treat it as a
+ * best-effort hint for rate-limiting and logging purposes only.
+ */
+export function getClientIp(request: HonoRequest): string {
+  return request.raw.headers.get(CLOUDFLARE_CLIENT_IP_HEADER) ?? UNKNOWN_IP
+}

package/src/shared/sequential-id-generator.ts

@@ -0,0 +1,22 @@
+import type { IIdGenerator } from '@beechcms/core'
+
+const ID_PADDING_WIDTH = 4
+
+/**
+ * Test-only IIdGenerator implementation. Each call returns a stable,
+ * monotonically increasing identifier (`test-id-0001`, `test-id-0002`, …)
+ * so snapshot assertions and insert-order checks remain deterministic
+ * across runs.
+ */
+export class SequentialIdGenerator implements IIdGenerator {
+  private counter = 0
+
+  uuid(): string {
+    this.counter += 1
+    return `test-id-${String(this.counter).padStart(ID_PADDING_WIDTH, '0')}`
+  }
+
+  reset(): void {
+    this.counter = 0
+  }
+}

package/src/shared/system-stats.repository.d1.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1SystemStatsRepository } from './system-stats.repository.d1'
+
+function makeMockDb(firstResult: unknown = null) {
+  const runMock = vi.fn().mockResolvedValue({ success: true })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  // bind() returns the same statement interface for chained calls.
+  // The statement also exposes first() directly for queries without bind (e.g. getStorageUsage).
+  const bindMock = vi.fn(() => ({ run: runMock, first: firstMock }))
+  const stmt = { bind: bindMock, run: runMock, first: firstMock }
+  const prepareMock = vi.fn(() => stmt)
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
+}
+
+describe('D1SystemStatsRepository', () => {
+  describe('incrementStorage', () => {
+    it('calls UPDATE system_stats with the byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).incrementStorage(512)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
+      expect(bindMock).toHaveBeenCalledWith(512)
+    })
+  })
+
+  describe('decrementStorage', () => {
+    it('calls UPDATE system_stats with MAX(0, ...) and the byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).decrementStorage(256)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('MAX(0'))
+      expect(bindMock).toHaveBeenCalledWith(256)
+    })
+  })
+
+  describe('setStorage', () => {
+    it('calls UPDATE system_stats with the stringified byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).setStorage(1024)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
+      expect(bindMock).toHaveBeenCalledWith('1024')
+    })
+  })
+
+  describe('getStorageUsage', () => {
+    it('parses and returns the integer value from D1', async () => {
+      const { db } = makeMockDb({ value: '2048' })
+      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(2048)
+    })
+
+    it('returns 0 when D1 returns null (stat not initialised)', async () => {
+      const { db } = makeMockDb(null)
+      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(0)
+    })
+  })
+})

package/src/types.ts

@@ -1,5 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
+import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository, IHashProvider, ITokenService, IUserRepository, ISessionRepository, IPasswordResetTokenRepository, IActivityLogger, IActivityLogRepository, INotificationRepository, INotificationService, IWidgetRepository, ISearchRepository, IAnalyticsRepository, IContentScanRepository, ISeedRegistry, IClock, IIdGenerator } from '@beechcms/core'
+import type { IRateLimiterRegistry } from './middleware/rate-limit.middleware'
 
 export interface Env {
   DB: D1Database
@@ -33,14 +34,30 @@ export interface Env {
 }
 
 export interface Variables {
-  jwtPayload: { sub: string; email?: string }
+  jwtPayload: { sub: string; email?: string; name?: string | null }
   getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
+  seedRegistry: ISeedRegistry
   repository: ContentRepository
   idempotencyRepository: IdempotencyRepository
   bucket: BeechBucket
   mediaRepository: MediaRepository
   systemStatsRepository: SystemStatsRepository
+  hashProvider: IHashProvider
+  tokenService: ITokenService
+  userRepository: IUserRepository
+  sessionRepository: ISessionRepository
+  passwordResetTokenRepository: IPasswordResetTokenRepository
+  rateLimiters: IRateLimiterRegistry
+  activityLogger: IActivityLogger
+  activityLogRepository: IActivityLogRepository
+  notificationRepository: INotificationRepository
+  notificationService: INotificationService
+  widgetRepository: IWidgetRepository
+  searchRepository: ISearchRepository
+  analyticsRepository: IAnalyticsRepository
+  contentScanRepository: IContentScanRepository
+  clock: IClock
+  idGenerator: IIdGenerator
 }
 
 export type AppEnv = { Bindings: Env; Variables: Variables }

package/src/upload.ts

@@ -5,7 +5,6 @@
  * e facilità di sviluppo locale.
  */
 import { Hono } from 'hono'
-import { logActivity } from './shared/activity-logger'
 import { AppEnv } from './types'
 
 /** Prefissi MIME consentiti (immagini e PDF) */
@@ -133,12 +132,20 @@ uploadRoutes.post('/upload', async (c) => {
 
     const publicUrl = bucket.getUrl(objectKey)
 
-    logActivity(c, {
-      action: 'upload',
-      entityType: 'media',
-      entityId: objectKey,
-      details: { name: file.name, size: file.size, type: file.type }
-    })
+    const jwtPayload = c.get('jwtPayload')
+    if (jwtPayload) {
+      c.get('activityLogger').log({
+        action: 'upload',
+        entityType: 'media',
+        entityId: objectKey,
+        details: { name: file.name, size: file.size, type: file.type },
+        actor: {
+          id: jwtPayload.sub,
+          email: jwtPayload.email ?? 'unknown',
+          name: jwtPayload.name ?? null,
+        },
+      })
+    }
 
     return c.json({ url: publicUrl }, 200)
   } catch (err) {