@beechcms/api 0.4.0 → 0.4.1

package/src/factory.ts

@@ -3,24 +3,19 @@ import { Hono } from 'hono'
 import { cors } from 'hono/cors'
 import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
 import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
+import { sha256hex, SystemClock, SystemIdGenerator, SeedRegistry } from '@beechcms/core'
 import type { Env, Variables } from './types'
+import { getClientIp } from './shared/request-utils'
 
 // Imports delle rotte e middleware
 import { AUTH_ERRORS } from './auth/constants'
 import {
   parseLoginBody,
   validateLoginInput,
-  findUserByEmail,
   verifyPassword,
   DUMMY_PASSWORD_HASH,
 } from './auth/login'
-import {
-  generateRefreshToken,
-  saveRefreshToken,
-  generateAccessToken,
-  validateRefreshToken,
-  revokeRefreshToken,
-} from './auth/refresh'
+import { generateRefreshToken } from './auth/refresh'
 import { authMiddleware } from './middleware'
 import contentFeature from './features/content'
 import { widgetApp } from './widget'
@@ -37,6 +32,9 @@ import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './pub
 import { searchRouter } from "./search"
 import { repositoryMiddleware } from './middleware/repository.middleware'
 import { storageMiddleware } from './middleware/storage.middleware'
+import { authProvidersMiddleware } from './middleware/auth-providers.middleware'
+import { rateLimiterMiddleware } from './middleware/rate-limit.middleware'
+import { observabilityMiddleware } from './middleware/observability.middleware'
 
 export interface BeechConfig {
   seeds: Seed[] | Record<string, Seed>
@@ -55,10 +53,6 @@ function isRequestSecure(url: string): boolean {
   return new URL(url).protocol === 'https:'
 }
 
-function getClientIp(headers: Headers): string {
-  return headers.get('cf-connecting-ip') ?? 'unknown'
-}
-
 function getRefreshTokenCookieOptions(secure: boolean) {
   return {
     httpOnly: true,
@@ -98,15 +92,14 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
   // Filter out any invalid objects that might have leaked into the registry (e.g. module exports)
   const validSeeds = seedsArray.filter(s => s && typeof s === 'object' && 'slug' in s)
-  const registry: Record<string, Seed> = Object.fromEntries(validSeeds.map(s => [s.slug, s]))
-  const getSeedFn = (slug: string): Seed | null => registry[slug] ?? null
+  const seedRegistry = new SeedRegistry(validSeeds)
 
   const app = new Hono<{ Bindings: Env; Variables: Variables }>()
 
   // 1. Core Middleware (Seeds, CORS, Security)
   app.use('*', async (context, next) => {
-    context.set('getSeed', getSeedFn)
-    context.set('seedRegistry', registry)
+    context.set('getSeed', (slug: string) => seedRegistry.get(slug))
+    context.set('seedRegistry', seedRegistry)
     await next()
   })
 
@@ -122,6 +115,10 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
     bucket: config.bucket,
   }))
 
+  app.use('*', authProvidersMiddleware())
+  app.use('*', rateLimiterMiddleware())
+  app.use('*', observabilityMiddleware())
+
   app.use('*', async (context, next) => {
     const isDev = context.env.ENV !== 'production'
 
@@ -174,27 +171,23 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   // 2. Analytics Middleware
   app.use('/api/*', async (context, next) => {
     await next()
-    if (context.req.method !== 'OPTIONS' && context.res.status >= 200 && context.res.status < 300) {
-      const db = context.env.DB
-      let executionCtx: any
-      try { executionCtx = context.executionCtx } catch {}
-
-      if (db && executionCtx) {
-        const seed = extractPublicSeed(context.req.path)
-        executionCtx.waitUntil((async () => {
-          try {
-            const today = Math.floor(new Date().setHours(0, 0, 0, 0) / 1000)
-            await db.prepare(
-              `INSERT INTO analytics (day_ts, metric, seed, value)
-               VALUES (?, 'requests', ?, 1)
-               ON CONFLICT(day_ts, metric, seed) DO UPDATE SET value = value + 1`
-            ).bind(today, seed).run()
-          } catch (error) {
-            console.error('Analytics middleware error:', error)
-          }
-        })())
-      }
-    }
+    if (context.req.method === 'OPTIONS') return
+    if (context.res.status < 200 || context.res.status >= 300) return
+
+    let executionCtx: any
+    try { executionCtx = context.executionCtx } catch {}
+    if (!executionCtx) return
+
+    const analyticsRepository = context.get('analyticsRepository')
+    if (!analyticsRepository) return
+
+    const seedSlug = extractPublicSeed(context.req.path)
+
+    executionCtx.waitUntil(
+      analyticsRepository.recordRequest(seedSlug).catch((error: unknown) => {
+        console.error('Analytics middleware error:', error)
+      })
+    )
   })
 
   // 3. Auth Routes
@@ -207,28 +200,27 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
       const { email, password } = credentials
       if (!validateLoginInput(email, password)) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
 
-      const loginLimiter = context.env.LOGIN_RATE_LIMITER
-      if (loginLimiter) {
-        const clientIp = getClientIp(context.req.raw.headers)
-        const { success } = await loginLimiter.limit({ key: `${clientIp}:${email}` })
-        if (!success) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
+      const clientIp = getClientIp(context.req)
+      const loginRateLimit = await context.get('rateLimiters').getLimiter('login').checkLimit(clientIp)
+      if (!loginRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
 
-      const { DB, JWT_SECRET } = context.env
-      const user = await findUserByEmail(DB, email)
-      const hashToCompare = user?.password_hash ?? DUMMY_PASSWORD_HASH
-      const isValid = await verifyPassword(password, hashToCompare)
+      const user = await context.get('userRepository').findByEmail(email)
+      const hashToCompare = user?.passwordHash ?? DUMMY_PASSWORD_HASH
+      const isValid = await verifyPassword(password, hashToCompare, context.get('hashProvider'))
 
       if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
 
-      const userProfile = await DB.prepare('SELECT name FROM users WHERE id = ? LIMIT 1').bind(user.id).first<{ name: string | null }>()
-      const accessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: context.env.JWT_ISSUER,
-        audience: context.env.JWT_AUDIENCE,
-      }, userProfile?.name ?? undefined)
+      const accessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
       const refreshToken = generateRefreshToken()
-
-      await saveRefreshToken(DB, user.id, refreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
+      const refreshTokenHash = await sha256hex(refreshToken)
+      const nowSeconds = SystemClock.nowSeconds()
+
+      await context.get('sessionRepository').saveRefreshToken({
+        id: SystemIdGenerator.uuid(),
+        userId: user.id,
+        tokenHash: refreshTokenHash,
+        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
+      })
       setCookie(context, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
       return context.json({ token: accessToken, expiresIn: '15m' }, 200)
     } catch (error) {
@@ -238,33 +230,34 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   app.post('/auth/refresh', async (context) => {
     try {
-      const refreshLimiter = context.env.REFRESH_RATE_LIMITER
-      if (refreshLimiter) {
-        const clientIp = getClientIp(context.req.raw.headers)
-        const { success } = await refreshLimiter.limit({ key: clientIp })
-        if (!success) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
-      }
+      const refreshClientIp = getClientIp(context.req)
+      const refreshRateLimit = await context.get('rateLimiters').getLimiter('tokenRefresh').checkLimit(refreshClientIp)
+      if (!refreshRateLimit.isAllowed) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
 
       const refreshToken = getCookie(context, 'refresh_token')
       if (!refreshToken) return context.json({ error: 'Refresh token missing' }, 401)
 
-      const { DB, JWT_SECRET } = context.env
-      const validation = await validateRefreshToken(DB, refreshToken)
-      if (!validation.valid || !validation.userId) return context.json({ error: 'Invalid refresh token' }, 401)
+      const nowSeconds = SystemClock.nowSeconds()
+      const tokenHash = await sha256hex(refreshToken)
+      const activeSession = await context.get('sessionRepository').findActiveByHash(tokenHash, nowSeconds)
+      if (!activeSession) return context.json({ error: 'Invalid refresh token' }, 401)
 
-      const user = await DB.prepare('SELECT id, email, name FROM users WHERE id = ? LIMIT 1').bind(validation.userId).first<{ id: string; email: string; name: string | null }>()
+      const user = await context.get('userRepository').findById(activeSession.userId)
       if (!user) return context.json({ error: 'User not found' }, 401)
 
-      const revoked = await revokeRefreshToken(DB, refreshToken)
+      const revoked = await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
       if (!revoked) return context.json({ error: 'Invalid refresh token' }, 401)
 
-      const newAccessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: context.env.JWT_ISSUER,
-        audience: context.env.JWT_AUDIENCE,
-      }, user.name ?? undefined)
+      const newAccessToken = await context.get('tokenService').issue({ sub: user.id, email: user.email, name: user.name ?? undefined })
       const newRefreshToken = generateRefreshToken()
-
-      await saveRefreshToken(DB, user.id, newRefreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
+      const newRefreshTokenHash = await sha256hex(newRefreshToken)
+
+      await context.get('sessionRepository').saveRefreshToken({
+        id: SystemIdGenerator.uuid(),
+        userId: user.id,
+        tokenHash: newRefreshTokenHash,
+        expiresAt: nowSeconds + REFRESH_TOKEN_EXPIRY_DAYS * SECONDS_PER_DAY,
+      })
       setCookie(context, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
       return context.json({ token: newAccessToken, expiresIn: '15m' }, 200)
     } catch (error) {
@@ -275,7 +268,11 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   app.post('/auth/logout', async (context) => {
     try {
       const refreshToken = getCookie(context, 'refresh_token')
-      if (refreshToken) await revokeRefreshToken(context.env.DB, refreshToken)
+      if (refreshToken) {
+        const nowSeconds = SystemClock.nowSeconds()
+        const tokenHash = await sha256hex(refreshToken)
+        await context.get('sessionRepository').revokeByHash(tokenHash, nowSeconds)
+      }
       deleteCookie(context, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(context.req.url)))
       return context.json({ message: 'Logged out' }, 200)
     } catch (error) {
@@ -289,12 +286,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   // 5. Protected CMS API
   const apiProtected = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiProtected.use('*', async (context, next) => {
-    await authMiddleware(context.env.JWT_SECRET, {
-      issuer: context.env.JWT_ISSUER,
-      audience: context.env.JWT_AUDIENCE,
-    })(context, next)
-  })
+  apiProtected.use('*', authMiddleware())
 
   apiProtected.route('/settings', settingsApp)
   apiProtected.route('/schema', schemaApp)

package/src/features/content/handlers/create.ts

@@ -8,7 +8,6 @@ import {
 import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
 import { publicProblem } from '../../../public/problem-details'
 import { CONTENT_ERRORS } from '../constants'
-import { logActivity } from '../../../shared/activity-logger'
 import { cleanStr } from '../../../shared/query-utils'
 import { AppEnv } from '../../../types'
 
@@ -110,7 +109,7 @@ export async function createHandler(context: Context<AppEnv>) {
     throw error
   }
 
-  const id = crypto.randomUUID()
+  const id = context.get('idGenerator').uuid()
   let finalSlug = entrySlug
   if (!finalSlug) {
     const fallbackSource = privacyData[seed.displayNameAlias ?? 'title'] || privacyData.title || privacyData.name || id
@@ -121,15 +120,20 @@ export async function createHandler(context: Context<AppEnv>) {
     const repository = context.get('repository')
     await repository.create(seed, id, finalSlug, status, privacyData)
 
-    const userId = context.get('jwtPayload')?.sub
+    const jwtPayload = context.get('jwtPayload')
     const title = privacyData.title || privacyData.name || finalSlug
-    
-    logActivity(context, { 
-      action: 'create', 
-      entityType: 'content', 
-      entityId: id, 
-      entitySlug: slug, 
-      details: { title } 
+
+    context.get('activityLogger').log({
+      action: 'create',
+      entityType: 'content',
+      entityId: id,
+      entitySlug: slug,
+      details: { title },
+      actor: {
+        id: jwtPayload.sub,
+        email: jwtPayload.email ?? 'unknown',
+        name: jwtPayload.name ?? null,
+      },
     })
 
     return context.json({ id }, 201)

package/src/features/content/handlers/delete.ts

@@ -4,7 +4,6 @@ import { deleteR2Objects } from '../../../upload'
 import { extractMediaKeysFromData } from '../../../media-utils'
 import { publicProblem } from '../../../public/problem-details'
 import { CONTENT_ERRORS } from '../constants'
-import { logActivity } from '../../../shared/activity-logger'
 import { AppEnv } from '../../../types'
 
 export async function deleteHandler(context: Context<AppEnv>) {
@@ -34,15 +33,20 @@ export async function deleteHandler(context: Context<AppEnv>) {
     // Repository.delete returns the row data for cleanup
     const { row } = await repository.delete(seed, entryId)
 
-    const userId = context.get('jwtPayload')?.sub
+    const jwtPayload = context.get('jwtPayload')
     const title = row.title || row.name || entryId
-    
-    logActivity(context, { 
-      action: 'delete', 
-      entityType: 'content', 
-      entityId: entryId, 
-      entitySlug: schemaSlug, 
-      details: { title } 
+
+    context.get('activityLogger').log({
+      action: 'delete',
+      entityType: 'content',
+      entityId: entryId,
+      entitySlug: schemaSlug,
+      details: { title },
+      actor: {
+        id: jwtPayload.sub,
+        email: jwtPayload.email ?? 'unknown',
+        name: jwtPayload.name ?? null,
+      },
     })
 
     

package/src/features/content/handlers/update.ts

@@ -10,7 +10,6 @@ import {
 import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
 import { publicProblem } from '../../../public/problem-details'
 import { CONTENT_ERRORS } from '../constants'
-import { logActivity } from '../../../shared/activity-logger'
 import { cleanStr } from '../../../shared/query-utils'
 import { AppEnv } from '../../../types'
 
@@ -167,15 +166,20 @@ export async function updateHandler(context: Context<AppEnv>) {
 
     await repository.update(seed, id, mergedData, newStatus)
 
-    const userId = context.get('jwtPayload')?.sub
+    const jwtPayload = context.get('jwtPayload')
     const title = mergedData.title || mergedData.name || newSlug
-    
-    logActivity(context, { 
-      action: 'update', 
-      entityType: 'content', 
-      entityId: id, 
-      entitySlug: slug, 
-      details: { title } 
+
+    context.get('activityLogger').log({
+      action: 'update',
+      entityType: 'content',
+      entityId: id,
+      entitySlug: slug,
+      details: { title },
+      actor: {
+        id: jwtPayload.sub,
+        email: jwtPayload.email ?? 'unknown',
+        name: jwtPayload.name ?? null,
+      },
     })
 
     return context.json({ success: true })

package/src/features/draft/draft.handler.ts

@@ -6,7 +6,6 @@ import {
   EntryNotFoundError 
 } from '@beechcms/core'
 import { publicProblem } from '../../public/problem-details'
-import { logActivity } from '../../shared/activity-logger'
 import { cleanStr } from '../../shared/query-utils'
 import { applyVisibility } from '../../shared/apply-policies'
 import { AppEnv } from '../../types'
@@ -114,14 +113,20 @@ draftApp.put('/:slug/:id/draft', async (context) => {
 
   await repository.saveDraft(seed, id, validation.data)
 
-  logActivity(context, {
-    action: 'update', 
-    entityType: 'content', 
-    entityId: id, 
+  const draftSaveActor = context.get('jwtPayload')
+  context.get('activityLogger').log({
+    action: 'update',
+    entityType: 'content',
+    entityId: id,
     entitySlug: slug,
-    details: { 
-      title: cleanStr(validation.data[seed.displayNameAlias]) ?? id, 
-      note: 'draft saved' 
+    details: {
+      title: cleanStr(validation.data[seed.displayNameAlias]) ?? id,
+      note: 'draft saved',
+    },
+    actor: {
+      id: draftSaveActor.sub,
+      email: draftSaveActor.email ?? 'unknown',
+      name: draftSaveActor.name ?? null,
     },
   })
 
@@ -220,12 +225,18 @@ draftApp.post('/:slug/:id/draft/publish', async (context) => {
   const displayValue = draft[seed.displayNameAlias]
   const displayStr = typeof displayValue === 'string' ? displayValue : id
 
-  logActivity(context, {
-    action: 'update', 
-    entityType: 'content', 
-    entityId: id, 
+  const draftPublishActor = context.get('jwtPayload')
+  context.get('activityLogger').log({
+    action: 'update',
+    entityType: 'content',
+    entityId: id,
     entitySlug: slug,
     details: { title: displayStr, note: 'draft published' },
+    actor: {
+      id: draftPublishActor.sub,
+      email: draftPublishActor.email ?? 'unknown',
+      name: draftPublishActor.name ?? null,
+    },
   })
 
   return context.json({ success: true })

package/src/features/notifications/notifications.handler.ts

@@ -3,47 +3,40 @@ import { Hono } from 'hono'
 import type { Env, Variables } from '../../types'
 
 /**
- * Notifications Feature Handler
+ * Notifications Feature Handler.
  *
- * Manages the retrieval, marking as read/unread, and deletion of system notifications.
- * Uses ETags for efficient client-side caching of the notification list.
+ * Manages retrieval, mark read/unread, and deletion of system notifications.
+ * All persistence goes through the {@link INotificationRepository} injected
+ * by `repositoryMiddleware`. The handler owns the HTTP concerns only:
+ * ETag negotiation, status codes, error mapping.
  */
 const notificationsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 
+const NOTIFICATION_LIST_LIMIT = 50
+
 /**
  * GET /notifications
- * Fetches the latest 50 notifications.
- * Implements ETag/304 Not Modified caching based on count and last update.
+ *
+ * Returns the most recent notifications. The ETag is built from aggregate
+ * stats so unchanged inboxes return 304 without serialising the full list.
  */
 notificationsApp.get('/notifications', async (context) => {
   try {
-    const { DB } = context.env
-
-    // Fetch aggregate stats to generate a robust ETag
-    const stats = await DB.prepare(
-      'SELECT COUNT(*) as count, MAX(created_at) as latest, SUM(is_read) as read_sum FROM notifications'
-    ).first<{ count: number; latest: number | null; read_sum: number | null }>()
-
-    const totalCount = stats?.count ?? 0
-    const lastUpdateTimestamp = stats?.latest ?? 0
-    const totalReadCount = stats?.read_sum ?? 0
-
-    // ETag is derived from count, latest timestamp, and read status to ensure freshness
-    const etag = `W/"${totalCount}-${lastUpdateTimestamp}-${totalReadCount}"`
+    const notificationRepository = context.get('notificationRepository')
+    const notificationStats = await notificationRepository.stats()
+    const etagValue = `W/"${notificationStats.totalCount}-${notificationStats.latestCreatedAt}-${notificationStats.readCount}"`
 
     const ifNoneMatch = context.req.header('If-None-Match')
-    if (ifNoneMatch === etag) {
+    if (ifNoneMatch === etagValue) {
       return new Response(null, { status: 304 })
     }
 
-    const dbResult = await DB.prepare(
-      'SELECT id, title, message, type, is_read, created_at FROM notifications ORDER BY created_at DESC LIMIT 50'
-    ).all()
+    const notifications = await notificationRepository.list(NOTIFICATION_LIST_LIMIT)
 
-    context.header('ETag', etag)
+    context.header('ETag', etagValue)
     context.header('Cache-Control', 'no-cache, must-revalidate')
 
-    return context.json(dbResult.results ?? [])
+    return context.json(notifications)
   } catch (error) {
     console.error('[Notifications] Fetch error:', error)
     return context.json({ error: 'Failed to fetch notifications' }, 500)
@@ -51,18 +44,12 @@ notificationsApp.get('/notifications', async (context) => {
 })
 
 /**
- * PATCH /notifications/:id/read
- * Marks a specific notification as read.
+ * PATCH /notifications/:id/read — mark a single notification as read.
  */
 notificationsApp.patch('/notifications/:id/read', async (context) => {
   try {
     const notificationId = context.req.param('id')
-    const { DB } = context.env
-
-    await DB.prepare('UPDATE notifications SET is_read = 1 WHERE id = ?')
-      .bind(notificationId)
-      .run()
-
+    await context.get('notificationRepository').markRead(notificationId)
     return context.json({ success: true })
   } catch (error) {
     console.error('[Notifications] Mark read error:', error)
@@ -71,18 +58,12 @@ notificationsApp.patch('/notifications/:id/read', async (context) => {
 })
 
 /**
- * PATCH /notifications/:id/unread
- * Marks a specific notification as unread.
+ * PATCH /notifications/:id/unread — mark a single notification as unread.
  */
 notificationsApp.patch('/notifications/:id/unread', async (context) => {
   try {
     const notificationId = context.req.param('id')
-    const { DB } = context.env
-
-    await DB.prepare('UPDATE notifications SET is_read = 0 WHERE id = ?')
-      .bind(notificationId)
-      .run()
-
+    await context.get('notificationRepository').markUnread(notificationId)
     return context.json({ success: true })
   } catch (error) {
     console.error('[Notifications] Mark unread error:', error)
@@ -91,18 +72,12 @@ notificationsApp.patch('/notifications/:id/unread', async (context) => {
 })
 
 /**
- * DELETE /notifications/:id
- * Permanently deletes a notification.
+ * DELETE /notifications/:id — permanently remove a notification.
  */
 notificationsApp.delete('/notifications/:id', async (context) => {
   try {
     const notificationId = context.req.param('id')
-    const { DB } = context.env
-
-    await DB.prepare('DELETE FROM notifications WHERE id = ?')
-      .bind(notificationId)
-      .run()
-
+    await context.get('notificationRepository').delete(notificationId)
     return context.json({ success: true })
   } catch (error) {
     console.error('[Notifications] Delete error:', error)
@@ -111,15 +86,11 @@ notificationsApp.delete('/notifications/:id', async (context) => {
 })
 
 /**
- * POST /notifications/mark-all-read
- * Marks all notifications in the database as read.
+ * POST /notifications/mark-all-read — mark every notification as read.
  */
 notificationsApp.post('/notifications/mark-all-read', async (context) => {
   try {
-    const { DB } = context.env
-
-    await DB.prepare('UPDATE notifications SET is_read = 1').run()
-
+    await context.get('notificationRepository').markAllRead()
     return context.json({ success: true })
   } catch (error) {
     console.error('[Notifications] Mark all read error:', error)