@beechcms/api 0.4.0 → 0.4.2

package/src/features/password-reset/reset.ts

@@ -1,25 +1,13 @@
 /// <reference types="@cloudflare/workers-types" />
 import type { Context } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 import { sendPasswordChangedEmail, resolveEmailLocale } from '../email'
+import { sha256hex } from '@beechcms/core'
+import { getClientIp } from '../../shared/request-utils'
 
 const MIN_PASSWORD_LENGTH = 8
 const MAX_PASSWORD_LENGTH = 128
 
-/**
- * Computes the SHA-256 hash of a string and returns it as a hex string.
- */
-async function computeSha256Hash(text: string): Promise<string> {
-  const encoder = new TextEncoder()
-  const data = encoder.encode(text)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
-  
-  return Array.from(new Uint8Array(hashBuffer))
-    .map(byte => byte.toString(16).padStart(2, '0'))
-    .join('')
-}
-
 /**
  * Handles the actual password reset process using a valid token.
  */
@@ -32,14 +20,10 @@ export async function resetPassword(
     return context.json({ error: 'Service not available' }, 503)
   }
 
-  // Rate limiting: e.g., 5 attempts per IP per 60 seconds
-  if (env.RESET_PASSWORD_RATE_LIMITER) {
-    const clientIpAddress = req.raw.headers.get('cf-connecting-ip') ?? 'unknown'
-    const { success: isRateLimitAllowed } = await env.RESET_PASSWORD_RATE_LIMITER.limit({ key: clientIpAddress })
-    
-    if (!isRateLimitAllowed) {
-      return context.json({ error: 'Too many requests' }, 429)
-    }
+  const clientIpAddress = getClientIp(req)
+  const resetPasswordRateLimit = await context.get('rateLimiters').getLimiter('resetPassword').checkLimit(clientIpAddress)
+  if (!resetPasswordRateLimit.isAllowed) {
+    return context.json({ error: 'Too many requests' }, 429)
   }
 
   let payload: Record<string, unknown>
@@ -55,55 +39,36 @@ export async function resetPassword(
   }
 
   const newPassword = payload.password
-  if (
+  const isPasswordInvalid =
     typeof newPassword !== 'string' ||
     newPassword.length < MIN_PASSWORD_LENGTH ||
     newPassword.length > MAX_PASSWORD_LENGTH
-  ) {
+
+  if (isPasswordInvalid) {
     return context.json({
       error: `Password must be between ${MIN_PASSWORD_LENGTH} and ${MAX_PASSWORD_LENGTH} characters`,
     }, 400)
   }
 
   const emailLocale = resolveEmailLocale(payload.locale)
-  const hashedResetToken = await computeSha256Hash(resetToken)
-  const currentTimestamp = Math.floor(Date.now() / 1000)
+  const tokenHash = await sha256hex(resetToken as string)
+  const nowTimestamp = Math.floor(Date.now() / 1000)
 
-  // JOIN with users table to retrieve the email in a single query - needed for notification.
-  const resetTokenRecord = await env.DB
-    .prepare(
-      `SELECT prt.id, prt.user_id, u.email
-       FROM password_reset_tokens prt
-       JOIN users u ON u.id = prt.user_id
-       WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`,
-    )
-    .bind(hashedResetToken, currentTimestamp)
-    .first<{ id: string; user_id: string; email: string }>()
-
-  if (!resetTokenRecord) {
+  const tokenRecord = await context.get('passwordResetTokenRepository').findValidByHashWithEmail(tokenHash, nowTimestamp)
+  if (!tokenRecord) {
     return context.json({ error: 'Invalid or expired token' }, 400)
   }
 
-  const hashedNewPassword = await bcrypt.hash(newPassword, 10)
+  const hashedNewPassword = await context.get('hashProvider').hash(newPassword as string)
 
-  // Mark token as used, update user password, and revoke all active sessions - atomically.
-  await env.DB.batch([
-    env.DB
-      .prepare('UPDATE password_reset_tokens SET used_at = unixepoch() WHERE id = ?')
-      .bind(resetTokenRecord.id),
-    env.DB
-      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
-      .bind(hashedNewPassword, resetTokenRecord.user_id),
-    env.DB
-      .prepare('UPDATE refresh_tokens SET revoked_at = unixepoch() WHERE user_id = ? AND revoked_at IS NULL')
-      .bind(resetTokenRecord.user_id),
-  ])
+  await context.get('passwordResetTokenRepository').markUsed(tokenRecord.id, nowTimestamp)
+  await context.get('userRepository').updatePasswordHash(tokenRecord.userId, hashedNewPassword)
+  await context.get('sessionRepository').revokeAllForUser(tokenRecord.userId, nowTimestamp)
 
-  // Notify user that password was changed - fire-and-forget via waitUntil, doesn't block response.
   const sendNotification = async () => {
     try {
       await sendPasswordChangedEmail({
-        to: resetTokenRecord.email,
+        to: tokenRecord.email,
         locale: emailLocale,
         apiKey: env.RESEND_API_KEY!,
         from: env.EMAIL_FROM,
@@ -125,4 +90,3 @@ export async function resetPassword(
 
   return context.json({ success: true })
 }
-

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, serializeForDb } from '@beechcms/core'
+import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
 import { publicProblem } from '../../public/problem-details'
 import { rotateFieldRequestSchema } from './rotate-field.schema'
 import type { Env, Variables } from '../../types'
@@ -65,20 +65,19 @@ rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
     })
   }
 
-  const database = context.env.DB
-  
-  // In v0.4.0, the hash value is stored in a dedicated column: contentRecord[targetFieldBranch.alias]
-  const contentRecord = await database.prepare(`SELECT ${targetFieldBranch.alias} FROM content_${seedSlug} WHERE id = ? LIMIT 1`)
-    .bind(entryId)
-    .first<Record<string, unknown>>()
-
-  if (!contentRecord) {
-    return publicProblem(context, { 
-      type: 'content-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: `Entry '${entryId}' not found` 
-    })
+  let contentRecord: Record<string, unknown>
+  try {
+    contentRecord = await context.get('repository').findById(seed, entryId)
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, {
+        type: 'content-not-found',
+        title: 'Not Found',
+        status: 404,
+        detail: `Entry '${entryId}' not found`
+      })
+    }
+    throw error
   }
 
   const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
@@ -118,11 +117,8 @@ rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
   }
 
   const newFieldValueHash = await sha256hex(nextValue)
-  const currentTimestamp = Math.floor(Date.now() / 1000)
 
-  await database.prepare(`UPDATE content_${seedSlug} SET ${targetFieldBranch.alias} = ?, updated_at = ? WHERE id = ?`)
-    .bind(serializeForDb(targetFieldBranch, newFieldValueHash), currentTimestamp, entryId)
-    .run()
+  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
 
   return context.json({ success: true })
 })

package/src/features/schema/schema.handler.ts

@@ -10,7 +10,7 @@ const schemaApp = new Hono<{ Bindings: Env; Variables: Variables }>()
  */
 schemaApp.get('/', async (context) => {
   const registry = context.get('seedRegistry')
-  return context.json(Object.values(registry))
+  return context.json(registry.all())
 })
 
 export { schemaApp }

package/src/features/settings/settings.handler.ts

@@ -1,6 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 
 const settingsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
@@ -8,48 +7,14 @@ const settingsApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 const EMAIL_VALIDATION_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 const MIN_PASSWORD_LENGTH = 8
 const MAX_PASSWORD_LENGTH = 128
-const BCRYPT_SALT_ROUNDS = 10
-
-type UserRow = {
-  id: string
-  email: string
-  name: string | null
-  avatar_url: string | null
-  password_hash: string
-  notification_prefs: string
-}
-
-type SessionRow = {
-  id: string
-  created_at: number
-  expires_at: number
-}
-
-type ActivityRow = {
-  id: string
-  action: string
-  entity_type: string
-  entity_slug: string | null
-  details: string | null
-  created_at: number
-}
-
-type MediaFileRow = {
-  key: string
-  filename: string
-  mime_type: string
-  size_bytes: number
-  created_at: number
-}
-
+const SESSION_LIST_LIMIT = 20
+const ACTIVITY_LOG_LIMIT = 30
 
 /**
  * GET /api/settings
  * Retrieves the general site configuration.
  */
 settingsApp.get('/', async (context) => {
-  // General site configuration. 
-  // In the future, these could be loaded from a 'system_settings' table in D1.
   return context.json({
     siteTitle: 'Beech CMS',
     siteLogo: '/beechLogoDark.svg',
@@ -59,7 +24,8 @@ settingsApp.get('/', async (context) => {
       drafts: true,
       media: true,
       search: true,
-      activityLog: true
+      activityLog: true,
+      email: !!(context.env.EMAIL_API_KEY || context.env.RESEND_API_KEY),
     }
   })
 })
@@ -70,18 +36,15 @@ settingsApp.get('/', async (context) => {
  */
 settingsApp.get('/me', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const currentUser = await context.env.DB.prepare(
-    'SELECT id, email, name, avatar_url, notification_prefs FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<Omit<UserRow, 'password_hash'>>()
-  
+
+  const currentUser = await context.get('userRepository').findById(userId)
   if (!currentUser) {
     return context.json({ error: 'User not found' }, 404)
   }
 
   let notificationPreferences: Record<string, boolean>
   try {
-    notificationPreferences = JSON.parse(currentUser.notification_prefs || '{}')
+    notificationPreferences = JSON.parse(currentUser.notificationPreferences || '{}')
   } catch {
     notificationPreferences = {}
   }
@@ -90,7 +53,7 @@ settingsApp.get('/me', async (context) => {
     id: currentUser.id,
     email: currentUser.email,
     name: currentUser.name,
-    avatarUrl: currentUser.avatar_url,
+    avatarUrl: currentUser.avatarUrl,
     notificationPrefs: {
       contentCreate: notificationPreferences.contentCreate ?? true,
       contentUpdate: notificationPreferences.contentUpdate ?? true,
@@ -106,7 +69,7 @@ settingsApp.get('/me', async (context) => {
  */
 settingsApp.put('/profile', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -118,61 +81,30 @@ settingsApp.put('/profile', async (context) => {
   const emailInput = typeof payload.email === 'string' ? payload.email.trim().toLowerCase() : null
 
   if (emailInput !== null && !EMAIL_VALIDATION_REGEX.test(emailInput)) {
-    return context.json({ 
-      type: 'bad-request', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Invalid email format' 
-    }, 400)
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Invalid email format' }, 400)
   }
-  
+
   if (nameInput !== null && nameInput.length > 100) {
-    return context.json({ 
-      type: 'bad-request', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Name is too long (maximum 100 characters)' 
-    }, 400)
+    return context.json({ type: 'bad-request', title: 'Bad Request', status: 400, detail: 'Name is too long (maximum 100 characters)' }, 400)
   }
 
-  const fieldsToUpdate: string[] = []
-  const valuesToUpdate: unknown[] = []
-  
-  if (nameInput !== null) {
-    fieldsToUpdate.push('name = ?')
-    valuesToUpdate.push(nameInput)
-  }
-  
-  if (emailInput !== null) {
-    fieldsToUpdate.push('email = ?')
-    valuesToUpdate.push(emailInput)
-  }
-  
-  if (fieldsToUpdate.length === 0) {
+  const hasNoFields = nameInput === null && emailInput === null
+  if (hasNoFields) {
     return context.json({ error: 'No fields to update' }, 400)
   }
 
-  // Check if the new email is already taken by another user
   if (emailInput !== null) {
-    const existingUserWithEmail = await context.env.DB.prepare(
-      'SELECT id FROM users WHERE email = ? AND id != ? LIMIT 1'
-    ).bind(emailInput, userId).first()
-    
-    if (existingUserWithEmail) {
-      return context.json({ 
-        type: 'conflict', 
-        title: 'Conflict', 
-        status: 409, 
-        detail: 'Email address is already in use' 
-      }, 409)
+    const emailTaken = await context.get('userRepository').emailBelongsToAnotherUser(emailInput, userId)
+    if (emailTaken) {
+      return context.json({ type: 'conflict', title: 'Conflict', status: 409, detail: 'Email address is already in use' }, 409)
     }
   }
 
-  valuesToUpdate.push(userId)
-  await context.env.DB.prepare(
-    `UPDATE users SET ${fieldsToUpdate.join(', ')} WHERE id = ?`
-  ).bind(...valuesToUpdate).run()
-  
+  const fieldsToUpdate: { name?: string; email?: string } = {}
+  if (nameInput !== null) fieldsToUpdate.name = nameInput
+  if (emailInput !== null) fieldsToUpdate.email = emailInput
+
+  await context.get('userRepository').updateProfile(userId, fieldsToUpdate)
   return context.json({ success: true })
 })
 
@@ -182,7 +114,7 @@ settingsApp.put('/profile', async (context) => {
  */
 settingsApp.put('/password', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -196,38 +128,26 @@ settingsApp.put('/password', async (context) => {
   if (!currentPassword || !newPassword) {
     return context.json({ error: 'Both currentPassword and newPassword are required' }, 400)
   }
-  
   if (newPassword.length < MIN_PASSWORD_LENGTH) {
     return context.json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long` }, 400)
   }
-  
   if (newPassword.length > MAX_PASSWORD_LENGTH) {
     return context.json({ error: 'Password is too long' }, 400)
   }
 
-  const userRecord = await context.env.DB.prepare(
-    'SELECT password_hash FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<{ password_hash: string }>()
-  
+  const userRecord = await context.get('userRepository').findById(userId)
   if (!userRecord) {
     return context.json({ error: 'User not found' }, 404)
   }
 
-  const isPasswordCorrect = await bcrypt.compare(currentPassword, userRecord.password_hash)
+  const hashProvider = context.get('hashProvider')
+  const isPasswordCorrect = await hashProvider.verify(currentPassword, userRecord.passwordHash)
   if (!isPasswordCorrect) {
-    return context.json({ 
-      type: 'invalid-credentials', 
-      title: 'Unauthorized', 
-      status: 401, 
-      detail: 'Current password is incorrect' 
-    }, 401)
+    return context.json({ type: 'invalid-credentials', title: 'Unauthorized', status: 401, detail: 'Current password is incorrect' }, 401)
   }
 
-  const hashedNewPassword = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS)
-  await context.env.DB.prepare(
-    'UPDATE users SET password_hash = ? WHERE id = ?'
-  ).bind(hashedNewPassword, userId).run()
-  
+  const hashedNewPassword = await hashProvider.hash(newPassword)
+  await context.get('userRepository').updatePasswordHash(userId, hashedNewPassword)
   return context.json({ success: true })
 })
 
@@ -237,7 +157,7 @@ settingsApp.put('/password', async (context) => {
  */
 settingsApp.put('/avatar', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -246,11 +166,7 @@ settingsApp.put('/avatar', async (context) => {
   }
 
   const avatarUrl = typeof payload.avatarUrl === 'string' ? payload.avatarUrl.trim() : null
-  
-  await context.env.DB.prepare(
-    'UPDATE users SET avatar_url = ? WHERE id = ?'
-  ).bind(avatarUrl, userId).run()
-  
+  await context.get('userRepository').updateAvatarUrl(userId, avatarUrl)
   return context.json({ success: true })
 })
 
@@ -260,15 +176,9 @@ settingsApp.put('/avatar', async (context) => {
  */
 settingsApp.get('/sessions', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  const currentTimestamp = Math.floor(Date.now() / 1000)
-  
-  const sessionsResult = await context.env.DB.prepare(
-    `SELECT id, created_at, expires_at FROM refresh_tokens
-     WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
-     ORDER BY created_at DESC LIMIT 20`
-  ).bind(userId, currentTimestamp).all<SessionRow>()
-  
-  return context.json(sessionsResult.results ?? [])
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+  const sessions = await context.get('sessionRepository').listActiveForUser(userId, nowTimestamp, SESSION_LIST_LIMIT)
+  return context.json(sessions)
 })
 
 /**
@@ -278,18 +188,13 @@ settingsApp.get('/sessions', async (context) => {
 settingsApp.delete('/sessions/:id', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
   const sessionId = context.req.param('id')
-  const currentTimestamp = Math.floor(Date.now() / 1000)
-  
-  const dbUpdateResult = await context.env.DB.prepare(
-    `UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL`
-  ).bind(currentTimestamp, sessionId, userId).run()
-  
-  const affectedRowsCount = (dbUpdateResult as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-  
-  if (affectedRowsCount === 0) {
+  const nowTimestamp = Math.floor(Date.now() / 1000)
+
+  const wasRevoked = await context.get('sessionRepository').revokeById(sessionId, userId, nowTimestamp)
+  if (!wasRevoked) {
     return context.json({ error: 'Session not found or already revoked' }, 404)
   }
-  
+
   return context.json({ success: true })
 })
 
@@ -299,14 +204,23 @@ settingsApp.delete('/sessions/:id', async (context) => {
  */
 settingsApp.get('/activity', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const activityLogsResult = await context.env.DB.prepare(
-    `SELECT id, action, entity_type, entity_slug, details, created_at
-     FROM activity_logs WHERE user_id = ?
-     ORDER BY created_at DESC LIMIT 30`
-  ).bind(userId).all<ActivityRow>()
-  
-  return context.json(activityLogsResult.results ?? [])
+
+  const entries = await context.get('activityLogRepository').list({
+    userId,
+    limit: ACTIVITY_LOG_LIMIT,
+  })
+
+  // Preserve legacy snake_case shape consumed by the dashboard activity tab.
+  const responseEntries = entries.map((entry) => ({
+    id: entry.id,
+    action: entry.action,
+    entity_type: entry.entityType,
+    entity_slug: entry.entitySlug,
+    details: entry.details ? JSON.stringify(entry.details) : null,
+    created_at: entry.createdAt,
+  }))
+
+  return context.json(responseEntries)
 })
 
 /**
@@ -316,31 +230,12 @@ settingsApp.get('/activity', async (context) => {
 settingsApp.get('/storage', async (context) => {
   const mediaRepo = context.get('mediaRepository')
   const statsRepo = context.get('systemStatsRepository')
-  
+
   const totalStorageUsedBytes = await statsRepo.getStorageUsage()
   const totalFileCount = await mediaRepo.count()
 
-  // Collect all media keys referenced in file-type columns across all seeds
-  const referencedMediaKeys = new Set<string>()
-  const registeredSeeds = Object.values(context.get('seedRegistry'))
-  
-  for (const seed of registeredSeeds) {
-    const mediaFields = seed.branches.filter(branch => branch.type === 'file')
-    if (mediaFields.length === 0) continue
-    
-    const mediaColumns = mediaFields.map(field => field.alias).join(', ')
-    const contentData = await context.env.DB.prepare(
-      `SELECT ${mediaColumns} FROM content_${seed.slug}`
-    ).all<Record<string, string | null>>()
-    
-    for (const contentRow of contentData.results ?? []) {
-      const rowContentString = Object.values(contentRow).filter(Boolean).join(' ')
-      // Simple regex to find media keys in stored URLs or strings
-      for (const keyMatch of rowContentString.matchAll(/\/api\/media\/([^"'\s\\,}\]]+)/g)) {
-        referencedMediaKeys.add(decodeURIComponent(keyMatch[1]))
-      }
-    }
-  }
+  const registeredSeeds = context.get('seedRegistry').all()
+  const referencedMediaKeys = await context.get('contentScanRepository').getReferencedMediaKeys(registeredSeeds)
 
   const { items: allMediaRows } = await mediaRepo.list({ limit: 50, offset: 0 })
   const orphanedMediaFiles = allMediaRows.filter(mediaFile => !referencedMediaKeys.has(mediaFile.key))
@@ -358,18 +253,15 @@ settingsApp.get('/storage', async (context) => {
  */
 settingsApp.get('/notifications', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
-  const userRecord = await context.env.DB.prepare(
-    'SELECT notification_prefs FROM users WHERE id = ? LIMIT 1'
-  ).bind(userId).first<{ notification_prefs: string }>()
-  
+
+  const userRecord = await context.get('userRepository').findById(userId)
   if (!userRecord) {
     return context.json({ error: 'User not found' }, 404)
   }
 
   let userPreferences: Record<string, boolean>
   try {
-    userPreferences = JSON.parse(userRecord.notification_prefs || '{}')
+    userPreferences = JSON.parse(userRecord.notificationPreferences || '{}')
   } catch {
     userPreferences = {}
   }
@@ -388,7 +280,7 @@ settingsApp.get('/notifications', async (context) => {
  */
 settingsApp.put('/notifications', async (context) => {
   const { sub: userId } = context.get('jwtPayload')
-  
+
   let payload: Record<string, unknown>
   try {
     payload = await context.req.json()
@@ -403,12 +295,8 @@ settingsApp.put('/notifications', async (context) => {
     mediaUpload: payload.mediaUpload === true,
   }
 
-  await context.env.DB.prepare(
-    'UPDATE users SET notification_prefs = ? WHERE id = ?'
-  ).bind(JSON.stringify(newPreferences), userId).run()
-  
+  await context.get('userRepository').updateNotificationPreferences(userId, JSON.stringify(newPreferences))
   return context.json({ success: true })
 })
 
 export { settingsApp }
-

package/src/features/setup/index.ts

@@ -1,6 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
-import bcrypt from 'bcryptjs'
 import type { Env, Variables } from '../../types'
 import { publicProblem } from '../../public/problem-details'
 
@@ -11,12 +10,8 @@ const setupApp = new Hono<{ Bindings: Env; Variables: Variables }>()
  * Checks if the application needs an initial setup (i.e., if no users exist).
  */
 setupApp.get('/auth/setup', async (context) => {
-  const userCountResult = await context.env.DB
-    .prepare('SELECT COUNT(*) as count FROM users')
-    .first<{ count: number }>()
-    
-  const needsInitialSetup = (userCountResult?.count ?? 0) === 0
-  return context.json({ needsSetup: needsInitialSetup })
+  const userCount = await context.get('userRepository').countAll()
+  return context.json({ needsSetup: userCount === 0 })
 })
 
 /**
@@ -24,11 +19,9 @@ setupApp.get('/auth/setup', async (context) => {
  * Creates the first administrator account. This endpoint is disabled once at least one user exists.
  */
 setupApp.post('/auth/setup', async (context) => {
-  const userCountResult = await context.env.DB
-    .prepare('SELECT COUNT(*) as count FROM users')
-    .first<{ count: number }>()
+  const userCount = await context.get('userRepository').countAll()
 
-  if ((userCountResult?.count ?? 0) > 0) {
+  if (userCount > 0) {
     return publicProblem(context, {
       type: 'setup-already-done',
       title: 'Setup already completed',
@@ -78,15 +71,17 @@ setupApp.post('/auth/setup', async (context) => {
     })
   }
 
-  const hashedPassword = await bcrypt.hash(password, 12)
-  const newUserId = crypto.randomUUID()
+  const passwordHash = await context.get('hashProvider').hash(password)
   const normalizedEmail = email.trim().toLowerCase()
   const normalizedName = typeof name === 'string' ? name.trim() : null
 
-  await context.env.DB
-    .prepare('INSERT INTO users (id, email, password_hash, role, name) VALUES (?, ?, ?, ?, ?)')
-    .bind(newUserId, normalizedEmail, hashedPassword, 'admin', normalizedName)
-    .run()
+  await context.get('userRepository').create({
+    id: context.get('idGenerator').uuid(),
+    email: normalizedEmail,
+    passwordHash,
+    role: 'admin',
+    name: normalizedName,
+  })
 
   return context.json({ success: true }, 201)
 })