@beechcms/api 0.4.0 → 0.4.1

package/src/features/settings/settings.handler.ts

@@ -1,6 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 
 const settingsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
@@ -8,48 +7,14 @@ const settingsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 const EMAIL_VALIDATION_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 const MIN_PASSWORD_LENGTH = 8
 const MAX_PASSWORD_LENGTH = 128
-const BCRYPT_SALT_ROUNDS = 10
-
-type UserRow = {
-  id: string
-  email: string
-  name: string | null
-  avatar_url: string | null
-  password_hash: string
-  notification_prefs: string
-}
-
-type SessionRow = {
-  id: string
-  created_at: number
-  expires_at: number
-}
-
-type ActivityRow = {
-  id: string
-  action: string
-  entity_type: string
-  entity_slug: string | null
-  details: string | null
-  created_at: number
-}
-
-type MediaFileRow = {
-  key: string
-  filename: string
-  mime_type: string
-  size_bytes: number
-  created_at: number
-}
-
+const SESSION_LIST_LIMIT = 20
+const ACTIVITY_LOG_LIMIT = 30
 
 /**
  * GET /api/settings
  * Retrieves the general site configuration.
  */
 settingsApp.get('/', async (context) => {
-  // General site configuration. 
-  // In the future, these could be loaded from a 'system_settings' table in D1.
   return context.json({
     siteTitle: 'Beech CMS',
     siteLogo: '/beechLogoDark.svg',
@@ -70,18 +35,15 @@ settingsApp.get('/', async (context) => {
  */
 settingsApp.get('/me', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const currentUser = await context.env.DB.prepare(
-    'SELECT id, email, name, avatar_url, notification_prefs FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<Omit<UserRow, 'password_hash'>>()
-  
+
+  const currentUser = await context.get('userRepository').findById(userId)
   if (!currentUser) {
     return context.json({ error: 'User not found' }, 404)
   }
 
   let notificationPreferences: Record<string, boolean>
   try {
-    notificationPreferences = JSON.parse(currentUser.notification_prefs || '{}')
+    notificationPreferences = JSON.parse(currentUser.notificationPreferences || '{}')
   } catch {
     notificationPreferences = {}
   }
@@ -90,7 +52,7 @@ settingsApp.get('/me', async (context) => {
     id: currentUser.id,
     email: currentUser.email,
     name: currentUser.name,
-    avatarUrl: currentUser.avatar_url,
+    avatarUrl: currentUser.avatarUrl,
     notificationPrefs: {
       contentCreate: notificationPreferences.contentCreate ?? true,
       contentUpdate: notificationPreferences.contentUpdate ?? true,
@@ -106,7 +68,7 @@ settingsApp.get('/me', async (context) => {
  */
 settingsApp.put('/profile', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -118,61 +80,30 @@ settingsApp.put('/profile', async (context) => {
   const emailInput = typeof payload.email === 'string' ? payload.email.trim().toLowerCase() : null
 
   if (emailInput !== null && !EMAIL_VALIDATION_REGEX.test(emailInput)) {
-    return context.json({ 
-      type: 'bad-request', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Invalid email format' 
-    }, 400)
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Invalid email format' }, 400)
   }
-  
+
   if (nameInput !== null && nameInput.length > 100) {
-    return context.json({ 
-      type: 'bad-request', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Name is too long (maximum 100 characters)' 
-    }, 400)
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Name is too long (maximum 100 characters)' }, 400)
   }
 
-  const fieldsToUpdate: string[] = []
-  const valuesToUpdate: unknown[] = []
-  
-  if (nameInput !== null) {
-    fieldsToUpdate.push('name = ?')
-    valuesToUpdate.push(nameInput)
-  }
-  
-  if (emailInput !== null) {
-    fieldsToUpdate.push('email = ?')
-    valuesToUpdate.push(emailInput)
-  }
-  
-  if (fieldsToUpdate.length === 0) {
+  const hasNoFields = nameInput === null && emailInput === null
+  if (hasNoFields) {
     return context.json({ error: 'No fields to update' }, 400)
   }
 
-  // Check if the new email is already taken by another user
   if (emailInput !== null) {
-    const existingUserWithEmail = await context.env.DB.prepare(
-      'SELECT id FROM users WHERE email = ? AND id != ? LIMIT 1'
-    ).bind(emailInput, userId).first()
-    
-    if (existingUserWithEmail) {
-      return context.json({ 
-        type: 'conflict', 
-        title: 'Conflict', 
-        status: 409, 
-        detail: 'Email address is already in use' 
-      }, 409)
+    const emailTaken = await context.get('userRepository').emailBelongsToAnotherUser(emailInput, userId)
+    if (emailTaken) {
+      return context.json({ type: 'conflict', title: 'Conflict', status: 409, detail: 'Email address is already in use' }, 409)
     }
   }
 
-  valuesToUpdate.push(userId)
-  await context.env.DB.prepare(
-    `UPDATE users SET ${fieldsToUpdate.join(', ')} WHERE id = ?`
-  ).bind(...valuesToUpdate).run()
-  
+  const fieldsToUpdate: { name?: string; email?: string } = {}
+  if (nameInput !== null) fieldsToUpdate.name = nameInput
+  if (emailInput !== null) fieldsToUpdate.email = emailInput
+
+  await context.get('userRepository').updateProfile(userId, fieldsToUpdate)
   return context.json({ success: true })
 })
 
@@ -182,7 +113,7 @@ settingsApp.put('/profile', async (context) => {
  */
 settingsApp.put('/password', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -196,38 +127,26 @@ settingsApp.put('/password', async (context) => {
   if (!currentPassword || !newPassword) {
     return context.json({ error: 'Both currentPassword and newPassword are required' }, 400)
   }
-  
   if (newPassword.length < MIN_PASSWORD_LENGTH) {
     return context.json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long` }, 400)
   }
-  
   if (newPassword.length > MAX_PASSWORD_LENGTH) {
     return context.json({ error: 'Password is too long' }, 400)
   }
 
-  const userRecord = await context.env.DB.prepare(
-    'SELECT password_hash FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<{ password_hash: string }>()
-  
+  const userRecord = await context.get('userRepository').findById(userId)
   if (!userRecord) {
     return context.json({ error: 'User not found' }, 404)
   }
 
-  const isPasswordCorrect = await bcrypt.compare(currentPassword, userRecord.password_hash)
+  const hashProvider = context.get('hashProvider')
+  const isPasswordCorrect = await hashProvider.verify(currentPassword, userRecord.passwordHash)
   if (!isPasswordCorrect) {
-    return context.json({ 
-      type: 'invalid-credentials', 
-      title: 'Unauthorized', 
-      status: 401, 
-      detail: 'Current password is incorrect' 
-    }, 401)
+    return context.json({ type: 'invalid-credentials', title: 'Unauthorized', status: 401, detail: 'Current password is incorrect' }, 401)
   }
 
-  const hashedNewPassword = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS)
-  await context.env.DB.prepare(
-    'UPDATE users SET password_hash = ? WHERE id = ?'
-  ).bind(hashedNewPassword, userId).run()
-  
+  const hashedNewPassword = await hashProvider.hash(newPassword)
+  await context.get('userRepository').updatePasswordHash(userId, hashedNewPassword)
   return context.json({ success: true })
 })
 
@@ -237,7 +156,7 @@ settingsApp.put('/password', async (context) => {
  */
 settingsApp.put('/avatar', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -246,11 +165,7 @@ settingsApp.put('/avatar', async (context) => {
   }
 
   const avatarUrl = typeof payload.avatarUrl === 'string' ? payload.avatarUrl.trim() : null
-  
-  await context.env.DB.prepare(
-    'UPDATE users SET avatar_url = ? WHERE id = ?'
-  ).bind(avatarUrl, userId).run()
-  
+  await context.get('userRepository').updateAvatarUrl(userId, avatarUrl)
   return context.json({ success: true })
 })
 
@@ -260,15 +175,9 @@ settingsApp.put('/avatar', async (context) => {
  */
 settingsApp.get('/sessions', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  const currentTimestamp = Math.floor(Date.now() / 1000)
-  
-  const sessionsResult = await context.env.DB.prepare(
-    `SELECT id, created_at, expires_at FROM refresh_tokens
-     WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
-     ORDER BY created_at DESC LIMIT 20`
-  ).bind(userId, currentTimestamp).all<SessionRow>()
-  
-  return context.json(sessionsResult.results ?? [])
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+  const sessions = await context.get('sessionRepository').listActiveForUser(userId, nowTimestamp, SESSION_LIST_LIMIT)
+  return context.json(sessions)
 })
 
 /**
@@ -278,18 +187,13 @@ settingsApp.get('/sessions', async (context) => {
 settingsApp.delete('/sessions/:id', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
   const sessionId = context.req.param('id')
-  const currentTimestamp = Math.floor(Date.now() / 1000)
-  
-  const dbUpdateResult = await context.env.DB.prepare(
-    `UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL`
-  ).bind(currentTimestamp, sessionId, userId).run()
-  
-  const affectedRowsCount = (dbUpdateResult as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-  
-  if (affectedRowsCount === 0) {
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+
+  const wasRevoked = await context.get('sessionRepository').revokeById(sessionId, userId, nowTimestamp)
+  if (!wasRevoked) {
     return context.json({ error: 'Session not found or already revoked' }, 404)
   }
-  
+
   return context.json({ success: true })
 })
 
@@ -299,14 +203,23 @@ settingsApp.delete('/sessions/:id', async (context) => {
  */
 settingsApp.get('/activity', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const activityLogsResult = await context.env.DB.prepare(
-    `SELECT id, action, entity_type, entity_slug, details, created_at
-     FROM activity_logs WHERE user_id = ?
-     ORDER BY created_at DESC LIMIT 30`
-  ).bind(userId).all<ActivityRow>()
-  
-  return context.json(activityLogsResult.results ?? [])
+
+  const entries = await context.get('activityLogRepository').list({
+    userId,
+    limit: ACTIVITY_LOG_LIMIT,
+  })
+
+  // Preserve legacy snake_case shape consumed by the dashboard activity tab.
+  const responseEntries = entries.map((entry) => ({
+    id: entry.id,
+    action: entry.action,
+    entity_type: entry.entityType,
+    entity_slug: entry.entitySlug,
+    details: entry.details ? JSON.stringify(entry.details) : null,
+    created_at: entry.createdAt,
+  }))
+
+  return context.json(responseEntries)
 })
 
 /**
@@ -316,31 +229,12 @@ settingsApp.get('/activity', async (context) => {
 settingsApp.get('/storage', async (context) => {
   const mediaRepo = context.get('mediaRepository')
   const statsRepo = context.get('systemStatsRepository')
-  
+
   const totalStorageUsedBytes = await statsRepo.getStorageUsage()
   const totalFileCount = await mediaRepo.count()
 
-  // Collect all media keys referenced in file-type columns across all seeds
-  const referencedMediaKeys = new Set<string>()
-  const registeredSeeds = Object.values(context.get('seedRegistry'))
-  
-  for (const seed of registeredSeeds) {
-    const mediaFields = seed.branches.filter(branch => branch.type === 'file')
-    if (mediaFields.length === 0) continue
-    
-    const mediaColumns = mediaFields.map(field => field.alias).join(', ')
-    const contentData = await context.env.DB.prepare(
-      `SELECT ${mediaColumns} FROM content_${seed.slug}`
-    ).all<Record<string, string | null>>()
-    
-    for (const contentRow of contentData.results ?? []) {
-      const rowContentString = Object.values(contentRow).filter(Boolean).join(' ')
-      // Simple regex to find media keys in stored URLs or strings
-      for (const keyMatch of rowContentString.matchAll(/\/api\/media\/([^"'\s\\,}\]]+)/g)) {
-        referencedMediaKeys.add(decodeURIComponent(keyMatch[1]))
-      }
-    }
-  }
+  const registeredSeeds = context.get('seedRegistry').all()
+  const referencedMediaKeys = await context.get('contentScanRepository').getReferencedMediaKeys(registeredSeeds)
 
   const { items: allMediaRows } = await mediaRepo.list({ limit: 50, offset: 0 })
   const orphanedMediaFiles = allMediaRows.filter(mediaFile => !referencedMediaKeys.has(mediaFile.key))
@@ -358,18 +252,15 @@ settingsApp.get('/storage', async (context) => {
  */
 settingsApp.get('/notifications', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const userRecord = await context.env.DB.prepare(
-    'SELECT notification_prefs FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<{ notification_prefs: string }>()
-  
+
+  const userRecord = await context.get('userRepository').findById(userId)
   if (!userRecord) {
     return context.json({ error: 'User not found' }, 404)
   }
 
   let userPreferences: Record<string, boolean>
   try {
-    userPreferences = JSON.parse(userRecord.notification_prefs || '{}')
+    userPreferences = JSON.parse(userRecord.notificationPreferences || '{}')
   } catch {
     userPreferences = {}
   }
@@ -388,7 +279,7 @@ settingsApp.get('/notifications', async (context) => {
  */
 settingsApp.put('/notifications', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -403,12 +294,8 @@ settingsApp.put('/notifications', async (context) => {
     mediaUpload: payload.mediaUpload === true,
   }
 
-  await context.env.DB.prepare(
-    'UPDATE users SET notification_prefs = ? WHERE id = ?'
-  ).bind(JSON.stringify(newPreferences), userId).run()
-  
+  await context.get('userRepository').updateNotificationPreferences(userId, JSON.stringify(newPreferences))
   return context.json({ success: true })
 })
 
 export { settingsApp }
-

package/src/features/setup/index.ts

@@ -1,6 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 import { publicProblem } from '../../public/problem-details'
 
@@ -11,12 +10,8 @@ const setupApp = new Hono<{ Bindings: Env; Variables: Variables }>()
  * Checks if the application needs an initial setup (i.e., if no users exist).
  */
 setupApp.get('/auth/setup', async (context) => {
-  const userCountResult = await context.env.DB
-    .prepare('SELECT COUNT(*) as count FROM users')
-    .first<{ count: number }>()
-    
-  const needsInitialSetup = (userCountResult?.count ?? 0) === 0
-  return context.json({ needsSetup: needsInitialSetup })
+  const userCount = await context.get('userRepository').countAll()
+  return context.json({ needsSetup: userCount === 0 })
 })
 
 /**
@@ -24,11 +19,9 @@ setupApp.get('/auth/setup', async (context) => {
  * Creates the first administrator account. This endpoint is disabled once at least one user exists.
  */
 setupApp.post('/auth/setup', async (context) => {
-  const userCountResult = await context.env.DB
-    .prepare('SELECT COUNT(*) as count FROM users')
-    .first<{ count: number }>()
+  const userCount = await context.get('userRepository').countAll()
 
-  if ((userCountResult?.count ?? 0) > 0) {
+  if (userCount > 0) {
     return publicProblem(context, {
       type: 'setup-already-done',
       title: 'Setup already completed',
@@ -78,15 +71,17 @@ setupApp.post('/auth/setup', async (context) => {
     })
   }
 
-  const hashedPassword = await bcrypt.hash(password, 12)
-  const newUserId = crypto.randomUUID()
+  const passwordHash = await context.get('hashProvider').hash(password)
   const normalizedEmail = email.trim().toLowerCase()
   const normalizedName = typeof name === 'string' ? name.trim() : null
 
-  await context.env.DB
-    .prepare('INSERT INTO users (id, email, password_hash, role, name) VALUES (?, ?, ?, ?, ?)')
-    .bind(newUserId, normalizedEmail, hashedPassword, 'admin', normalizedName)
-    .run()
+  await context.get('userRepository').create({
+    id: context.get('idGenerator').uuid(),
+    email: normalizedEmail,
+    passwordHash,
+    role: 'admin',
+    name: normalizedName,
+  })
 
   return context.json({ success: true }, 201)
 })