@beechcms/api 0.4.3 → 0.6.0-preview.1

package/src/features/notifications/index.ts

@@ -1 +1,5 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 export { notificationsApp } from './notifications.handler'

package/src/features/notifications/notifications.handler.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import type { Env, Variables } from '../../types'

package/src/features/password-reset/index.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import type { Env, Variables } from '../../types'
@@ -8,7 +12,7 @@ export const passwordResetApp = new Hono<{ Bindings: Env; Variables: Variables }
 
 // Feature flag: lets the dashboard know whether to show the forgot-password link
 passwordResetApp.get('/auth/features', (context) => {
-  return context.json({ passwordReset: Boolean(context.env.RESEND_API_KEY) })
+  return context.json({ passwordReset: context.env.EMAIL_PROVIDER === 'smtp' || Boolean(context.env.RESEND_API_KEY) })
 })
 
 passwordResetApp.post('/auth/forgot-password', requestPasswordReset)

package/src/features/password-reset/request.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import type { Context } from 'hono'
 import type { Env, Variables } from '../../types'
@@ -16,7 +20,8 @@ export async function requestPasswordReset(
 ): Promise<Response> {
   const { env, req } = context
 
-  if (!env.RESEND_API_KEY) {
+  const useSmtp = env.EMAIL_PROVIDER === 'smtp'
+  if (!useSmtp && !env.RESEND_API_KEY) {
     return context.json({ error: 'Service not available' }, 503)
   }
 
@@ -63,14 +68,19 @@ export async function requestPasswordReset(
   const baseUrl = (env.APP_URL ?? new URL(req.url).origin).replace(/\/$/, '')
   const resetUrl = `${baseUrl}/admin/reset-password?token=${resetToken}`
 
+  const smtpBaseUrl = env.SMTP_HOST
+    ? `http://${env.SMTP_HOST}:${env.SMTP_PORT ?? '8025'}`
+    : undefined
   try {
     await sendPasswordResetEmail({
       to: normalizedEmail,
       resetUrl,
       locale: emailLocale,
-      apiKey: env.RESEND_API_KEY,
+      apiKey: env.RESEND_API_KEY ?? '',
       from: env.EMAIL_FROM,
       isDev: env.ENV !== 'production',
+      provider: env.EMAIL_PROVIDER as 'smtp' | 'resend' | undefined,
+      smtpBaseUrl,
     })
   } catch (error) {
     if (env.ENV !== 'production') {

package/src/features/password-reset/reset.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import type { Context } from 'hono'
 import type { Env, Variables } from '../../types'
@@ -16,7 +20,8 @@ export async function resetPassword(
 ): Promise<Response> {
   const { env, req, executionCtx } = context
 
-  if (!env.RESEND_API_KEY) {
+  const useSmtp = env.EMAIL_PROVIDER === 'smtp'
+  if (!useSmtp && !env.RESEND_API_KEY) {
     return context.json({ error: 'Service not available' }, 503)
   }
 
@@ -65,14 +70,19 @@ export async function resetPassword(
   await context.get('userRepository').updatePasswordHash(tokenRecord.userId, hashedNewPassword)
   await context.get('sessionRepository').revokeAllForUser(tokenRecord.userId, nowTimestamp)
 
+  const smtpBaseUrl = env.SMTP_HOST
+    ? `http://${env.SMTP_HOST}:${env.SMTP_PORT ?? '8025'}`
+    : undefined
   const sendNotification = async () => {
     try {
       await sendPasswordChangedEmail({
         to: tokenRecord.email,
         locale: emailLocale,
-        apiKey: env.RESEND_API_KEY!,
+        apiKey: env.RESEND_API_KEY ?? '',
         from: env.EMAIL_FROM,
         isDev: env.ENV !== 'production',
+        provider: env.EMAIL_PROVIDER as 'smtp' | 'resend' | undefined,
+        smtpBaseUrl,
       })
     } catch (error) {
       if (env.ENV !== 'production') {

package/src/features/rotate-field/index.ts

@@ -1 +1,5 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 export { rotateFieldApp } from './rotate-field.handler'

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'

package/src/features/rotate-field/rotate-field.schema.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { z } from 'zod'
 
 /**

package/src/features/schema/schema.handler.ts

@@ -1,16 +1,131 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
+import { canEditLayout, formLayoutSchema, validateLayoutAgainstSeed } from '@beechcms/core'
+import { publicProblem } from '../../public/problem-details'
+import type { Context } from 'hono'
 import type { Env, Variables } from '../../types'
 
+type AppContext = Context<{ Bindings: Env; Variables: Variables }>
+
+/** Returns a 403 response if the caller lacks layout-edit permission, otherwise undefined. */
+function requireLayoutEditPermission(context: AppContext) {
+  const role = context.get('jwtPayload')?.role
+  if (!canEditLayout(role)) {
+    return publicProblem(context, {
+      type: 'forbidden',
+      title: 'Forbidden',
+      status: 403,
+      detail: 'Layout edit requires admin role.',
+    })
+  }
+  return undefined
+}
+
+/** Resolves the seed by slug. Returns a 404 response if not found, otherwise the seed. */
+function requireSeedBySlug(context: AppContext, slug: string) {
+  const seed = context.get('seedRegistry').get(slug)
+  if (!seed) {
+    return {
+      seed: null,
+      error: publicProblem(context, {
+        type: 'seed-not-found',
+        title: 'Seed not found',
+        status: 404,
+        detail: `No seed with slug '${slug}'.`,
+      }),
+    }
+  }
+  return { seed, error: null }
+}
+
 const schemaApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 
 /**
- * Ritorna l'intero schema del CMS (la lista dei Seed configurati).
- * Usato dalla Dashboard per generare dinamicamente il menu e le form.
+ * Returns the full CMS schema (all configured Seeds), each optionally enriched
+ * with a stored custom FormLayout. Used by the Dashboard to drive menus and forms.
  */
 schemaApp.get('/', async (context) => {
   const registry = context.get('seedRegistry')
-  return context.json(registry.all())
+  const layouts = await context.get('seedLayoutRepository').getAllAsMap()
+
+  const enriched = registry.all().map((seed) => {
+    const stored = layouts.get(seed.slug)
+    if (!stored) return seed
+    const result = validateLayoutAgainstSeed(stored, seed)
+    return { ...seed, layout: result.cleaned }
+  })
+
+  return context.json(enriched)
+})
+
+/**
+ * Upserts a custom FormLayout for a Seed.
+ * Admin-only. Validates shape (Zod) then semantic constraints against the Seed.
+ */
+schemaApp.put('/:slug/layout', async (context) => {
+  const forbidden = requireLayoutEditPermission(context)
+  if (forbidden) return forbidden
+
+  const slug = context.req.param('slug')
+  const { seed, error: seedError } = requireSeedBySlug(context, slug)
+  if (seedError) return seedError
+
+  let body: unknown
+  try {
+    body = await context.req.json()
+  } catch {
+    return publicProblem(context, {
+      type: 'invalid-json',
+      title: 'Invalid JSON',
+      status: 400,
+      detail: 'Body must be valid JSON.',
+    })
+  }
+
+  const parsed = formLayoutSchema.safeParse(body)
+  if (!parsed.success) {
+    return publicProblem(context, {
+      type: 'invalid-layout',
+      title: 'Invalid layout',
+      status: 422,
+      detail: parsed.error.message,
+    })
+  }
+
+  const semantic = validateLayoutAgainstSeed(parsed.data, seed!)
+  if (!semantic.ok) {
+    return publicProblem(context, {
+      type: 'invalid-layout',
+      title: 'Invalid layout',
+      status: 422,
+      detail: semantic.errors.join('; '),
+    })
+  }
+
+  const userId = context.get('jwtPayload')?.sub ?? 'unknown'
+  await context.get('seedLayoutRepository').upsert(slug, semantic.cleaned, userId)
+
+  return context.json({ ok: true, layout: semantic.cleaned })
+})
+
+/**
+ * Removes the stored layout for a Seed, reverting to the generated default.
+ * Admin-only. The "Reset" action in the Layout Builder calls this endpoint.
+ */
+schemaApp.delete('/:slug/layout', async (context) => {
+  const forbidden = requireLayoutEditPermission(context)
+  if (forbidden) return forbidden
+
+  const slug = context.req.param('slug')
+  const { error: seedError } = requireSeedBySlug(context, slug)
+  if (seedError) return seedError
+
+  await context.get('seedLayoutRepository').remove(slug)
+  return context.json({ ok: true })
 })
 
 export { schemaApp }

package/src/features/seeds/index.ts

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+export { seedsApp } from './seeds.handler'