@beechcms/api 0.5.0 → 0.6.0-preview.1

package/src/features/automations/__tests__/action-executors.test.ts

@@ -1,7 +1,13 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { executeAction } from '../action-executors'
 import type { ActionContext } from '../action-executors'
 import type { ContentRepository, Seed, IIdGenerator } from '@beechcms/core'
+import { deleteAllMessages, listMessages, waitForMessage, getMessageHtml } from '../../../../test/helpers/mailpit-client'
+import { newBucket, waitForRequest } from '../../../../test/helpers/webhook-tester-client'
 
 // ── Shared mock context factory ───────────────────────────────────────────────
 
@@ -41,74 +47,55 @@ function makeCtx(overrides: Partial<ActionContext> = {}): ActionContext {
 // ── webhook ───────────────────────────────────────────────────────────────────
 
 describe('webhook executor', () => {
-  beforeEach(() => { vi.restoreAllMocks() })
-
-  it('POSTs to URL with JSON body derived from entry when no body_template', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 })
-    vi.stubGlobal('fetch', fetchMock)
-
+  it('POSTs to URL with interpolated body_template', async () => {
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://example.com/hook' }, ctx)
-
-    expect(fetchMock).toHaveBeenCalledOnce()
-    const [url, init] = fetchMock.mock.calls[0]
-    expect(url).toBe('https://example.com/hook')
-    expect(init.method).toBe('POST')
-    expect(JSON.parse(init.body)).toMatchObject({ id: 'entry-1', title: 'Test Entry' })
+    await executeAction({ type: 'webhook', url, body_template: '{"id":"{{id}}","title":"{{title}}"}' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.method).toBe('POST')
+    expect(JSON.parse(req.body)).toMatchObject({ id: 'entry-1', title: 'Test Entry' })
   })
 
   it('interpolates body_template with entry values', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
-
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://example.com/hook', body_template: '{"t":"{{title}}"}' }, ctx)
-
-    const [, init] = fetchMock.mock.calls[0]
-    expect(init.body).toBe('{"t":"Test Entry"}')
+    await executeAction({ type: 'webhook', url, body_template: '{"t":"{{title}}"}' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.body).toBe('{"t":"Test Entry"}')
   })
 
   it('merges custom headers', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
-
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://x.com', headers: { 'X-Token': 'abc' } }, ctx)
-
-    const [, init] = fetchMock.mock.calls[0]
-    expect(init.headers['X-Token']).toBe('abc')
+    await executeAction({ type: 'webhook', url, headers: { 'X-Token': 'abc' } }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.headers['x-token']).toBe('abc')
   })
 
-  it('throws when response is not ok', async () => {
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false, status: 500 }))
+  it('throws when webhook endpoint is unreachable', async () => {
     const ctx = makeCtx()
-    await expect(executeAction({ type: 'webhook', url: 'https://x.com' }, ctx)).rejects.toThrow('500')
+    await expect(executeAction({ type: 'webhook', url: 'http://localhost:19999/nope' }, ctx)).rejects.toThrow()
   })
 
   it('uses custom HTTP method', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true })
-    vi.stubGlobal('fetch', fetchMock)
+    const { url, uuid } = await newBucket()
     const ctx = makeCtx()
-    await executeAction({ type: 'webhook', url: 'https://x.com', method: 'PUT' }, ctx)
-    expect(fetchMock.mock.calls[0][1].method).toBe('PUT')
+    await executeAction({ type: 'webhook', url, method: 'PUT' }, ctx)
+    const req = await waitForRequest(uuid)
+    expect(req.method).toBe('PUT')
   })
 })
 
 // ── send_mail ─────────────────────────────────────────────────────────────────
 
-vi.mock('../../email', () => ({
-  sendAutomationMail: vi.fn().mockResolvedValue(undefined),
-}))
-
 describe('send_mail executor', () => {
-  beforeEach(async () => {
-    const { sendAutomationMail } = await import('../../email')
-    vi.mocked(sendAutomationMail).mockClear()
-  })
+  beforeEach(() => deleteAllMessages())
 
-  it('interpolates to/subject/body and calls sendAutomationMail', async () => {
-    const { sendAutomationMail } = await import('../../email')
-    const ctx = makeCtx({ entry: { id: '1', email: 'user@example.com', title: 'Hello' } })
+  it('interpolates to/subject/body and delivers to Mailpit', async () => {
+    const ctx = makeCtx({
+      entry: { id: '1', email: 'user@example.com', title: 'Hello' },
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await executeAction(
       {
@@ -120,19 +107,19 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: 'user@example.com',
-        subject: 'Re: Hello',
-        body: 'Your entry Hello was created.',
-      }),
-    )
+    const msg = await waitForMessage(m => m.To.some(t => t.Address === 'user@example.com'))
+    expect(msg.Subject).toBe('Re: Hello')
+    const html = await getMessageHtml(msg.ID)
+    expect(html).toContain('Hello')
   })
 
-  it('substitutes default value [missing] and logs a warning when concrete data is absent', async () => {
-    const { sendAutomationMail } = await import('../../email')
+  it('substitutes [missing] for absent fields and logs a warning', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const ctx = makeCtx({ entry: { id: '1' } })
+    // email is present (needed for a valid To address) but title and desc are absent
+    const ctx = makeCtx({
+      entry: { id: '1', email: 'warn-test@example.com' },
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '8025', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await executeAction(
       {
@@ -144,23 +131,20 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: '[missing]',
-        subject: 'Re: [missing]',
-        body: 'Content: [missing]',
-      }),
-    )
     expect(warnSpy).toHaveBeenCalledWith(
       expect.stringContaining('missing concrete data'),
-      ['email', 'title', 'desc'],
+      expect.arrayContaining(['title', 'desc']),
     )
+    const msg = await waitForMessage(m => m.Subject === 'Re: [missing]')
+    expect(msg.Subject).toBe('Re: [missing]')
+    const html = await getMessageHtml(msg.ID)
+    expect(html).toContain('[missing]')
+    warnSpy.mockRestore()
   })
 
-  it('skips execution gracefully and logs an error without calling sendAutomationMail if apiKey is missing', async () => {
-    const { sendAutomationMail } = await import('../../email')
+  it('skips execution and logs an error when provider is resend and apiKey is missing', async () => {
     const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx({ env: {} }) // missing email/resend api keys
+    const ctx = makeCtx({ env: {} })
 
     await executeAction(
       {
@@ -172,15 +156,17 @@ describe('send_mail executor', () => {
       ctx,
     )
 
-    expect(sendAutomationMail).not.toHaveBeenCalled()
     expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('Execution skipped'))
+    const msgs = await listMessages()
+    expect(msgs).toHaveLength(0)
+    errSpy.mockRestore()
   })
 
-  it('logs error and rethrows when sendAutomationMail fails', async () => {
-    const { sendAutomationMail } = await import('../../email')
-    vi.mocked(sendAutomationMail).mockRejectedValueOnce(new Error('provider error'))
+  it('logs error and rethrows when SMTP provider is unreachable', async () => {
     const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    const ctx = makeCtx()
+    const ctx = makeCtx({
+      env: { EMAIL_PROVIDER: 'smtp', SMTP_HOST: 'localhost', SMTP_PORT: '19999', EMAIL_FROM: 'Beech <test@beech.local>' },
+    })
 
     await expect(
       executeAction(
@@ -192,12 +178,13 @@ describe('send_mail executor', () => {
         },
         ctx,
       ),
-    ).rejects.toThrow('provider error')
+    ).rejects.toThrow()
 
     expect(errSpy).toHaveBeenCalledWith(
       expect.stringContaining('failed to send automation email'),
       expect.any(Error),
     )
+    errSpy.mockRestore()
   })
 })
 

package/src/features/automations/__tests__/automation-runner.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { AutomationRunner } from '../automation-runner'
 import type { AutomationRunnerDeps } from '../automation-runner'

package/src/features/automations/__tests__/automation-runner.utils.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { interpolate } from '../automation-runner.utils'
 import { resolveAutomationContext } from '../context-resolver'

package/src/features/automations/__tests__/automations.handler.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { Hono } from 'hono'
 import type { IAutomationRepository, Automation } from '@beechcms/core'
@@ -10,7 +14,7 @@ const baseAutomation: Automation = {
   enabled: true,
   triggers: [{ event: 'create' }],
   trigger_conditions: null,
-  actions: [{ type: 'webhook', url: 'https://example.com' }],
+  actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
   created_at: 1000,
   updated_at: 1000,
 }
@@ -99,7 +103,7 @@ describe('POST /', () => {
             { kind: 'predicate', left: { kind: 'ref', key: 'this.status' }, op: 'eq', right: { kind: 'literal', value: 'draft' } },
           ],
         },
-        actions: [{ type: 'webhook', url: 'https://example.com' }],
+        actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
       }),
     })
     expect(res.status).toBe(201)
@@ -116,7 +120,7 @@ describe('POST /', () => {
         seed_slug: 'posts',
         name: 'test-create-automation',
         triggers: [{ event: 'create' }],
-        actions: [{ type: 'webhook', url: 'https://example.com' }],
+        actions: [{ type: 'webhook', url: 'https://example.com', body_template: '{}' }],
       }),
     })
     expect(res.status).toBe(201)

package/src/features/automations/__tests__/automations.repository.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi } from 'vitest'
 import { D1AutomationRepository } from '../../../shared/automations.repository.d1'
 

package/src/features/automations/__tests__/automations.schema.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import {
   createAutomationSchema,
@@ -5,7 +9,7 @@ import {
   toggleAutomationSchema,
 } from '../automations.schema'
 
-const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook' }
+const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook', body_template: '{}' }
 
 const minimalValid = {
   seed_slug: 'posts',
@@ -67,11 +71,97 @@ describe('createAutomationSchema', () => {
   it('rejects webhook with non-url', () => {
     const result = createAutomationSchema.safeParse({
       ...minimalValid,
-      actions: [{ type: 'webhook', url: 'not-a-url' }],
+      actions: [{ type: 'webhook', url: 'not-a-url', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with HTTP url (not HTTPS)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'http://example.com', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookHttpsRequired')).toBe(true)
+  })
+
+  it('rejects webhook with localhost url', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://localhost/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookPrivateHostBlocked')).toBe(true)
+  })
+
+  it('rejects webhook with 127.0.0.1', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://127.0.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with AWS metadata IP (169.254.169.254)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://169.254.169.254/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 10.x.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://10.0.0.5/x', body_template: '{}' }],
     })
     expect(result.success).toBe(false)
   })
 
+  it('rejects webhook with 192.168.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://192.168.1.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 172.16.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.16.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts webhook with 172.32.x.x (outside private range)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.32.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects webhook without body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.bodyRequired')).toBe(true)
+  })
+
+  it('accepts webhook with valid HTTPS public url and body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
   it('rejects send_mail with invalid email', () => {
     const result = createAutomationSchema.safeParse({
       ...minimalValid,

package/src/features/automations/__tests__/context-resolver.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import type { Automation } from '@beechcms/core'
 import { resolveAutomationContext, deriveEntryContext } from '../context-resolver'

package/src/features/automations/__tests__/cron-runner.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import type { Automation, IAutomationRepository, ContentRepository, Seed, IIdGenerator } from '@beechcms/core'
 import { runCronAutomations } from '../cron-runner'
@@ -18,13 +22,13 @@ const SEED: Seed = {
   label: 'Post',
   displayNameAlias: 'title',
   branches: [
-    { alias: 'title', type: 'text', label: 'Title' },
-    { alias: 'count', type: 'number', label: 'Count' },
-    { alias: 'published', type: 'boolean', label: 'Published' },
-    { alias: 'publish_date', type: 'date', label: 'Publish Date' },
-    { alias: 'tags_list', type: 'tags', label: 'Tags' },
-    { alias: 'meta_json', type: 'json', label: 'Meta JSON' },
-    { alias: 'body_rich', type: 'richtext', label: 'Body' },
+    { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+    { id: 'br_02', alias: 'count', type: 'number', label: 'Count' },
+    { id: 'br_03', alias: 'published', type: 'boolean', label: 'Published' },
+    { id: 'br_04', alias: 'publish_date', type: 'date', label: 'Publish Date' },
+    { id: 'br_05', alias: 'tags_list', type: 'tags', label: 'Tags' },
+    { id: 'br_06', alias: 'meta_json', type: 'json', label: 'Meta JSON' },
+    { id: 'br_07', alias: 'body_rich', type: 'richtext', label: 'Body' },
   ],
 }
 

package/src/features/automations/__tests__/cron-runner.utils.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { cronMatches } from '../cron-runner.utils'
 

package/src/features/automations/__tests__/set-variable.executor.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect, vi } from 'vitest'
 import { executeSetVariable } from '../action-executors/set-variable.executor'
 import { resolveAutomationContext } from '../context-resolver'
@@ -304,3 +308,76 @@ describe('collection mode', () => {
     expect(result._items).toEqual(items)
   })
 })
+
+// ── Sprint 07: backward-compatibility with legacy load_type field ──────────────
+
+describe('legacy load_type backward compatibility', () => {
+  it('L1 — load_type: fruit + single id-eq filter → upgraded to fixed_id path', async () => {
+    const item = { id: 'c_1', name: 'Mario', email: 'mario@x.com', total: 99 }
+    const findMany = vi.fn().mockResolvedValue({ items: [item] })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'cliente',
+        seed_slug: 'clienti',
+        load_type: 'fruit',
+        filters: [{ field: 'id', op: 'eq', value: 'c_1' }],
+      } as any,
+      ctx,
+    )
+
+    // Should use fixed_id path: pagination.limit = 1, filter on id column
+    const [, opts] = findMany.mock.calls[0]
+    expect(opts.filters[0].column).toBe('id')
+    expect(opts.filters[0].conditions[0].value).toBe('c_1')
+    expect(opts.pagination.limit).toBe(1)
+    expect(ctx.variables.cliente).toEqual(item)
+  })
+
+  it('L2 — load_type: fruit + non-id filter → collection path (degraded)', async () => {
+    const items = [{ id: '1', name: 'Mario', email: 'mario@x.com', total: 10, created_at: 1 }]
+    const findMany = vi.fn().mockResolvedValue({ items })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'clienti',
+        seed_slug: 'clienti',
+        load_type: 'fruit',
+        filters: [{ field: 'name', op: 'eq', value: 'Mario' }],
+      } as any,
+      ctx,
+    )
+
+    // Non-id filter: falls through to collection path
+    const result = ctx.variables.clienti as any
+    expect(result.count).toBe(1)
+  })
+
+  it('L3 — load_type: branch → collection path', async () => {
+    const items = [
+      { id: '1', name: 'A', email: 'a@x.com', total: 10, created_at: 1 },
+      { id: '2', name: 'B', email: 'b@x.com', total: 20, created_at: 2 },
+    ]
+    const findMany = vi.fn().mockResolvedValue({ items })
+    const ctx = await makeCtx({ repository: { findMany } as unknown as ContentRepository })
+
+    await executeSetVariable(
+      {
+        type: 'set_variable',
+        name: 'ordini',
+        seed_slug: 'clienti',
+        load_type: 'branch',
+      } as any,
+      ctx,
+    )
+
+    const result = ctx.variables.ordini as any
+    expect(result.count).toBe(2)
+    expect(result.sum).toBeDefined()
+    expect(result.pluck).toBeDefined()
+  })
+})

package/src/features/automations/__tests__/template-grammar.test.ts

@@ -1,3 +1,7 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
 import { describe, it, expect } from 'vitest'
 import { parseTemplateKey } from '../template-grammar'
 import type { ParsedKey, VarStep, InlineCondition } from '../template-grammar'