@beechcms/api 0.4.0 → 0.4.1

package/src/features/password-reset/request.ts

@@ -2,22 +2,11 @@
 import type { Context } from 'hono'
 import type { Env, Variables } from '../../types'
 import { sendPasswordResetEmail, resolveEmailLocale } from '../email'
+import { sha256hex } from '@beechcms/core'
+import { getClientIp } from '../../shared/request-utils'
 
 const PASSWORD_RESET_TOKEN_EXPIRY_SECONDS = 30 * 60
 
-/**
- * Computes the SHA-256 hash of a string and returns it as a hex string.
- */
-async function computeSha256Hash(text: string): Promise<string> {
-  const encoder = new TextEncoder()
-  const data = encoder.encode(text)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
-  
-  return Array.from(new Uint8Array(hashBuffer))
-    .map(byte => byte.toString(16).padStart(2, '0'))
-    .join('')
-}
-
 /**
  * Handles the password reset request.
  * Generates a reset token, stores its hash in the database, and sends an email to the user.
@@ -46,41 +35,30 @@ export async function requestPasswordReset(
   const normalizedEmail = emailInput.trim().toLowerCase()
   const emailLocale = resolveEmailLocale(payload.locale)
 
-  // Rate limiting based on IP address
-  if (env.FORGOT_PASSWORD_RATE_LIMITER) {
-    const clientIpAddress = req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
-    const { success: isRateLimitAllowed } = await env.FORGOT_PASSWORD_RATE_LIMITER.limit({ key: clientIpAddress })
-    
-    if (!isRateLimitAllowed) {
-      return context.json({ error: 'Too many requests' }, 429)
-    }
+  const clientIpAddress = getClientIp(req)
+  const forgotPasswordRateLimit = await context.get('rateLimiters').getLimiter('forgotPassword').checkLimit(clientIpAddress)
+  if (!forgotPasswordRateLimit.isAllowed) {
+    return context.json({ error: 'Too many requests' }, 429)
   }
 
-  // Find user by email. We always return 200 success even if the user is not found to prevent user enumeration.
-  const registeredUser = await env.DB
-    .prepare('SELECT id FROM users WHERE email = ?')
-    .bind(normalizedEmail)
-    .first<{ id: string }>()
-
+  // Always return 200 even when the user is not found to prevent user enumeration.
+  const registeredUser = await context.get('userRepository').findByEmail(normalizedEmail)
   if (!registeredUser) {
     return context.json({ success: true })
   }
 
-  // Invalidate any existing pending tokens for the same user before issuing a new one.
-  await env.DB
-    .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE user_id = ? AND used_at IS NULL')
-    .bind(registeredUser.id)
-    .run()
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+  await context.get('passwordResetTokenRepository').invalidatePending(registeredUser.id, nowTimestamp)
 
   const resetToken = crypto.randomUUID()
-  const hashedResetToken = await computeSha256Hash(resetToken)
-  const expirationTimestamp = Math.floor(Date.now() / 1000) + PASSWORD_RESET_TOKEN_EXPIRY_SECONDS
+  const tokenHash = await sha256hex(resetToken)
+  const expiresAt = nowTimestamp + PASSWORD_RESET_TOKEN_EXPIRY_SECONDS
 
-  // Store the hashed token in the database
-  await env.DB
-    .prepare('INSERT INTO password_reset_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)')
-    .bind(crypto.randomUUID(), registeredUser.id, hashedResetToken, expirationTimestamp)
-    .run()
+  await context.get('passwordResetTokenRepository').create({
+    userId: registeredUser.id,
+    tokenHash,
+    expiresAt,
+  })
 
   const baseUrl = (env.APP_URL ?? new URL(req.url).origin).replace(/\/$/, '')
   const resetUrl = `${baseUrl}/admin/reset-password?token=${resetToken}`
@@ -95,7 +73,6 @@ export async function requestPasswordReset(
       isDev: env.ENV !== 'production',
     })
   } catch (error) {
-    // Only log errors in non-production environments
     if (env.ENV !== 'production') {
       console.error('[password-reset] Failed to send email:', error)
     }
@@ -103,4 +80,3 @@ export async function requestPasswordReset(
 
   return context.json({ success: true })
 }
-

package/src/features/password-reset/reset.ts

@@ -1,25 +1,13 @@
 /// <reference types="@cloudflare/workers-types" />
 import type { Context } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
+import { sha256hex } from '@beechcms/core'
+import { getClientIp } from '../../shared/request-utils'
 
 const MIN_PASSWORD_LENGTH = 8
 const MAX_PASSWORD_LENGTH = 128
 
-/**
- * Computes the SHA-256 hash of a string and returns it as a hex string.
- */
-async function computeSha256Hash(text: string): Promise<string> {
-  const encoder = new TextEncoder()
-  const data = encoder.encode(text)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
-  
-  return Array.from(new Uint8Array(hashBuffer))
-    .map(byte => byte.toString(16).padStart(2, '0'))
-    .join('')
-}
-
 /**
  * Handles the actual password reset process using a valid token.
  */
@@ -32,14 +20,10 @@ export async function resetPassword(
     return context.json({ error: 'Service not available' }, 503)
   }
 
-  // Rate limiting: e.g., 5 attempts per IP per 60 seconds
-  if (env.RESET_PASSWORD_RATE_LIMITER) {
-    const clientIpAddress = req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
-    const { success: isRateLimitAllowed } = await env.RESET_PASSWORD_RATE_LIMITER.limit({ key: clientIpAddress })
-    
-    if (!isRateLimitAllowed) {
-      return context.json({ error: 'Too many requests' }, 429)
-    }
+  const clientIpAddress = getClientIp(req)
+  const resetPasswordRateLimit = await context.get('rateLimiters').getLimiter('resetPassword').checkLimit(clientIpAddress)
+  if (!resetPasswordRateLimit.isAllowed) {
+    return context.json({ error: 'Too many requests' }, 429)
   }
 
   let payload: Record<string, unknown>
@@ -55,55 +39,36 @@ export async function resetPassword(
   }
 
   const newPassword = payload.password
-  if (
+  const isPasswordInvalid =
     typeof newPassword !== 'string' ||
     newPassword.length < MIN_PASSWORD_LENGTH ||
     newPassword.length > MAX_PASSWORD_LENGTH
-  ) {
+
+  if (isPasswordInvalid) {
     return context.json({
       error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
     }, 400)
   }
 
   const emailLocale = resolveEmailLocale(payload.locale)
-  const hashedResetToken = await computeSha256Hash(resetToken)
-  const currentTimestamp = Math.floor(Date.now() / 1000)
+  const tokenHash = await sha256hex(resetToken as string)
+  const nowTimestamp = Math.floor(Date.now() / 1000)
 
-  // JOIN with users table to retrieve the email in a single query - needed for notification.
-  const resetTokenRecord = await env.DB
-    .prepare(
-      `SELECT prt.id, prt.user_id, u.email
-       FROM password_reset_tokens prt
-       JOIN users u ON u.id = prt.user_id
-       WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`,
-    )
-    .bind(hashedResetToken, currentTimestamp)
-    .first<{ id: string; user_id: string; email: string }>()
-
-  if (!resetTokenRecord) {
+  const tokenRecord = await context.get('passwordResetTokenRepository').findValidByHashWithEmail(tokenHash, nowTimestamp)
+  if (!tokenRecord) {
     return context.json({ error: 'Invalid or expired token' }, 400)
   }
 
-  const hashedNewPassword = await bcrypt.hash(newPassword, 10)
+  const hashedNewPassword = await context.get('hashProvider').hash(newPassword as string)
 
-  // Mark token as used, update user password, and revoke all active sessions - atomically.
-  await env.DB.batch([
-    env.DB
-      .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE id = ?')
-      .bind(resetTokenRecord.id),
-    env.DB
-      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
-      .bind(hashedNewPassword, resetTokenRecord.user_id),
-    env.DB
-      .prepare('UPDATE refresh_tokens SET revoked_at = unixepoch() WHERE user_id = ? AND revoked_at IS NULL')
-      .bind(resetTokenRecord.user_id),
-  ])
+  await context.get('passwordResetTokenRepository').markUsed(tokenRecord.id, nowTimestamp)
+  await context.get('userRepository').updatePasswordHash(tokenRecord.userId, hashedNewPassword)
+  await context.get('sessionRepository').revokeAllForUser(tokenRecord.userId, nowTimestamp)
 
-  // Notify user that password was changed - fire-and-forget via waitUntil, doesn't block response.
   const sendNotification = async () => {
     try {
       await sendPasswordChangedEmail({
-        to: resetTokenRecord.email,
+        to: tokenRecord.email,
         locale: emailLocale,
         apiKey: env.RESEND_API_KEY!,
         from: env.EMAIL_FROM,
@@ -125,4 +90,3 @@ export async function resetPassword(
 
   return context.json({ success: true })
 }
-

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, serializeForDb } from '@beechcms/core'
+import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
 import { publicProblem } from '../../public/problem-details'
 import { rotateFieldRequestSchema } from './rotate-field.schema'
 import type { Env, Variables } from '../../types'
@@ -65,20 +65,19 @@ rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
     })
   }
 
-  const database = context.env.DB
-  
-  // In v0.4.0, the hash value is stored in a dedicated column: contentRecord[targetFieldBranch.alias]
-  const contentRecord = await database.prepare(`SELECT ${targetFieldBranch.alias} FROM content_${seedSlug} WHERE id = ? LIMIT 1`)
-    .bind(entryId)
-    .first<Record<string, unknown>>()
-
-  if (!contentRecord) {
-    return publicProblem(context, { 
-      type: 'content-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: `Entry '${entryId}' not found` 
-    })
+  let contentRecord: Record<string, unknown>
+  try {
+    contentRecord = await context.get('repository').findById(seed, entryId)
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, {
+        type: 'content-not-found',
+        title: 'Not Found',
+        status: 404,
+        detail: `Entry '${entryId}' not found`
+      })
+    }
+    throw error
   }
 
   const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
@@ -118,11 +117,8 @@ rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
   }
 
   const newFieldValueHash = await sha256hex(nextValue)
-  const currentTimestamp = Math.floor(Date.now() / 1000)
 
-  await database.prepare(`UPDATE content_${seedSlug} SET ${targetFieldBranch.alias} = ?, updated_at = ? WHERE id = ?`)
-    .bind(serializeForDb(targetFieldBranch, newFieldValueHash), currentTimestamp, entryId)
-    .run()
+  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
 
   return context.json({ success: true })
 })

package/src/features/schema/schema.handler.ts

@@ -10,7 +10,7 @@ const schemaApp = new Hono<{ Bindings: Env; Variables: Variables }>()
  */
 schemaApp.get('/', async (context) => {
   const registry = context.get('seedRegistry')
-  return context.json(Object.values(registry))
+  return context.json(registry.all())
 })
 
 export { schemaApp }