@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/features/content/handlers/bulk.handler.ts

@@ -0,0 +1,185 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { Context } from 'hono'
+import { resolvePolicies, type BulkFieldUpdate } from '@beechcms/core'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+
+const MAX_BULK_SIZE = 500
+
+const MULTI_REL_MODES = ['replace', 'add', 'remove'] as const
+type MultiRelMode = (typeof MULTI_REL_MODES)[number]
+
+interface MultiRelWrapper {
+  mode: MultiRelMode
+  value: string[]
+}
+
+function isMultiRelWrapper(v: unknown): v is MultiRelWrapper {
+  if (typeof v !== 'object' || v === null) return false
+  const obj = v as Record<string, unknown>
+  return (
+    MULTI_REL_MODES.includes(obj.mode as MultiRelMode) &&
+    Array.isArray(obj.value) &&
+    (obj.value as unknown[]).every((x) => typeof x === 'string')
+  )
+}
+
+export async function bulkHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, {
+      type: 'content-invalid-slug-or-id',
+      title: 'Bad Request',
+      status: 400,
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID,
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, {
+      type: 'content-seed-not-found',
+      title: 'Not Found',
+      status: 404,
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND,
+    })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await context.req.json<Record<string, unknown>>()
+  } catch {
+    return publicProblem(context, {
+      type: 'content-invalid-json',
+      title: 'Bad Request',
+      status: 400,
+      detail: CONTENT_ERRORS.INVALID_JSON_BODY,
+    })
+  }
+
+  // ── Validate ids ─────────────────────────────────────────────────────────────
+  const ids = body.ids
+  if (!Array.isArray(ids) || ids.length === 0 || ids.some((id) => typeof id !== 'string')) {
+    return publicProblem(context, {
+      type: 'bulk-invalid-ids',
+      title: 'Bad Request',
+      status: 400,
+      detail: 'ids must be a non-empty array of strings',
+    })
+  }
+
+  if (ids.length > MAX_BULK_SIZE) {
+    return publicProblem(context, {
+      type: 'bulk-size-exceeded',
+      title: 'Bad Request',
+      status: 400,
+      detail: `Cannot edit more than ${MAX_BULK_SIZE} entries at once`,
+    })
+  }
+
+  // ── Validate fields ───────────────────────────────────────────────────────────
+  const rawFields = body.fields
+  if (
+    typeof rawFields !== 'object' ||
+    rawFields === null ||
+    Array.isArray(rawFields) ||
+    Object.keys(rawFields as object).length === 0
+  ) {
+    return publicProblem(context, {
+      type: 'bulk-invalid-fields',
+      title: 'Bad Request',
+      status: 400,
+      detail: 'fields must be an object with at least one key',
+    })
+  }
+
+  const fieldsRaw = rawFields as Record<string, unknown>
+
+  // Validate each alias exists on the seed and is not hidden/encrypt
+  const resolvedFields: Record<string, BulkFieldUpdate> = {}
+
+  for (const [alias, rawValue] of Object.entries(fieldsRaw)) {
+    const branch = seed.branches.find((b) => b.alias === alias)
+    if (!branch) {
+      return publicProblem(context, {
+        type: 'bulk-unknown-field',
+        title: 'Bad Request',
+        status: 400,
+        detail: `Field '${alias}' does not exist on seed '${slug}'`,
+      })
+    }
+
+    const policies = resolvePolicies(branch)
+    if (policies.visibility === 'hidden' || policies.privacy === 'encrypt') {
+      return publicProblem(context, {
+        type: 'field-not-bulk-editable',
+        title: 'Bad Request',
+        status: 400,
+        detail: `Field '${alias}' cannot be bulk-edited (hidden or encrypted)`,
+      })
+    }
+
+    // Multi-relation branches accept a { mode, value } wrapper or a plain array (treated as replace)
+    const branchAny = branch as { type: string; multiple?: boolean }
+    if (branchAny.type === 'relation' && branchAny.multiple === true) {
+      if (isMultiRelWrapper(rawValue)) {
+        const kindMap: Record<MultiRelMode, BulkFieldUpdate['kind']> = {
+          replace: 'array_replace',
+          add: 'array_add',
+          remove: 'array_remove',
+        }
+        resolvedFields[alias] = { kind: kindMap[rawValue.mode], value: rawValue.value }
+      } else if (Array.isArray(rawValue) && (rawValue as unknown[]).every((x) => typeof x === 'string')) {
+        resolvedFields[alias] = { kind: 'array_replace', value: rawValue as string[] }
+      } else {
+        return publicProblem(context, {
+          type: 'bulk-invalid-field-value',
+          title: 'Bad Request',
+          status: 400,
+          detail: `Field '${alias}' is a multi-relation and requires { mode, value } or a string array`,
+        })
+      }
+    } else {
+      resolvedFields[alias] = { kind: 'set', value: rawValue }
+    }
+  }
+
+  // ── Execute ───────────────────────────────────────────────────────────────────
+  const repository = context.get('repository')
+  const { updated, failed } = await repository.bulkUpdate(slug, ids as string[], resolvedFields)
+
+  // ── Activity log (single entry for the whole operation) ───────────────────────
+  const jwtPayload = context.get('jwtPayload')
+  context.get('activityLogger').log({
+    action: 'bulk_update',
+    entityType: 'content',
+    entityId: slug,
+    entitySlug: slug,
+    details: { count: updated, fields: Object.keys(resolvedFields) },
+    actor: {
+      id: jwtPayload.sub,
+      email: jwtPayload.email ?? 'unknown',
+      name: [jwtPayload.name, jwtPayload.surname].filter(Boolean).join(' ') || null,
+    },
+  })
+
+  // ── Build structured failure objects ─────────────────────────────────────────
+  const failedProblems = failed.map(({ id, reason }) => ({
+    id,
+    problem: {
+      status: 422,
+      type: reason.startsWith('relation-target-not-found')
+        ? 'relation-target-not-found'
+        : reason === 'not-found'
+          ? 'content-not-found'
+          : 'bulk-update-error',
+      detail: reason,
+    },
+  }))
+
+  return context.json({ updated, failed: failedProblems })
+}

package/src/features/content/handlers/create.ts

@@ -1,165 +1,129 @@
-import { Context } from 'hono'
-import { 
-  slugify, 
-  isValidContentStatus, 
-  validateAndSanitizeSeedPayload,
-  SlugConflictError
-} from '@beechcms/core'
-import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
-import { publicProblem } from '../../../public/problem-details'
-import { CONTENT_ERRORS } from '../constants'
-import { cleanStr } from '../../../shared/query-utils'
-import { AppEnv } from '../../../types'
-
-function normalizeBody(raw: unknown): Record<string, unknown> {
-  return typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : {}
-}
-
-function contentValidationProblem(
-  context: Context,
-  details: Array<{ field: string; expected: string; received: string; message: string }>
-) {
-  return publicProblem(context, { 
-    type: 'content-validation-failed', 
-    title: 'Bad Request', 
-    status: 400, 
-    detail: 'Validation failed', 
-    errors: details 
-  })
-}
-
-export async function createHandler(context: Context<AppEnv>) {
-  const slug = context.req.param('slug')
-  if (!slug) {
-    return publicProblem(context, { 
-      type: 'content-invalid-slug', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: CONTENT_ERRORS.INVALID_SLUG 
-    })
-  }
-
-  const seed = context.get('getSeed')(slug)
-  if (!seed) {
-    return publicProblem(context, { 
-      type: 'content-seed-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
-    })
-  }
-
-  let body: Record<string, unknown>
-  try {
-    body = normalizeBody(await context.req.json<unknown>())
-  } catch {
-    return publicProblem(context, { 
-      type: 'content-invalid-json', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: CONTENT_ERRORS.INVALID_JSON_BODY 
-    })
-  }
-
-  const entrySlug = body.slug ? slugify(String(body.slug)) : null
-  const status = cleanStr(body.status) ?? 'draft'
-  if (!isValidContentStatus(status)) {
-    return publicProblem(context, { 
-      type: 'content-invalid-status', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Invalid status. Allowed values are: draft, review, published' 
-    })
-  }
-
-  const bodyForData = { ...body }
-  delete bodyForData.slug
-  delete bodyForData.status
-
-  const validation = validateAndSanitizeSeedPayload(seed, bodyForData, {
-    operation: 'create', 
-    allowNull: false, 
-    requireAtLeastOneValidField: true, 
-    enforceRequiredFields: true,
-  })
-
-  if (validation.dangerousFields.length > 0) {
-    return publicProblem(context, { 
-      type: 'content-dangerous-content', 
-      title: 'Unprocessable Entity', 
-      status: 422, 
-      detail: `Content rejected: dangerous markup detected in field '${validation.dangerousFields[0]}'` 
-    })
-  }
-  
-  if (validation.details.length > 0) return contentValidationProblem(context, validation.details)
-
-  let privacyData: Record<string, unknown>
-  try {
-    privacyData = await applyPrivacy(validation.data, seed)
-  } catch (error) {
-    if (error instanceof PrivacyPolicyError) {
-      return publicProblem(context, { 
-        type: 'content-policy-not-implemented', 
-        title: 'Not Implemented', 
-        status: 501, 
-        detail: error.message 
-      })
-    }
-    throw error
-  }
-
-  const id = context.get('idGenerator').uuid()
-  let finalSlug = entrySlug
-  if (!finalSlug) {
-    const fallbackSource = privacyData[seed.displayNameAlias ?? 'title'] || privacyData.title || privacyData.name || id
-    finalSlug = slugify(String(fallbackSource))
-  }
-
-  try {
-    const repository = context.get('repository')
-    await repository.create(seed, id, finalSlug, status, privacyData)
-
-    const jwtPayload = context.get('jwtPayload')
-    const title = privacyData.title || privacyData.name || finalSlug
-
-    context.get('activityLogger').log({
-      action: 'create',
-      entityType: 'content',
-      entityId: id,
-      entitySlug: slug,
-      details: { title },
-      actor: {
-        id: jwtPayload.sub,
-        email: jwtPayload.email ?? 'unknown',
-        name: jwtPayload.name ?? null,
-      },
-    })
-
-    context.get('scheduler').waitUntil(
-      context.get('automationRunner').run({
-        seedSlug: slug,
-        event: 'create',
-        entry: { id, slug: finalSlug, status, ...privacyData },
-      }),
-    )
-
-    return context.json({ id }, 201)
-  } catch (error) {
-    if (error instanceof SlugConflictError) {
-      return publicProblem(context, { 
-        type: 'content-slug-conflict', 
-        title: 'Conflict', 
-        status: 409, 
-        detail: CONTENT_ERRORS.SLUG_CONFLICT 
-      })
-    }
-    console.error('Content create error:', error)
-    return publicProblem(context, { 
-      type: 'content-database-error', 
-      title: 'Internal Server Error', 
-      status: 500, 
-      detail: CONTENT_ERRORS.DATABASE_ERROR 
-    })
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { Context } from 'hono'
+import { 
+  slugify, 
+  isValidContentStatus, 
+  validateAndSanitizeSeedPayload
+} from '@beechcms/core'
+import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import {
+  normalizeBody,
+  contentValidationProblem,
+  logContentActivity,
+  dispatchContentAutomation,
+  handleContentDatabaseError
+} from './helpers'
+import { CONTENT_ERRORS } from '../constants'
+import { cleanStr } from '../../../shared/query-utils'
+import { AppEnv } from '../../../types'
+
+
+
+export async function createHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = normalizeBody(await context.req.json<unknown>())
+  } catch {
+    return publicProblem(context, { 
+      type: 'content-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_JSON_BODY 
+    })
+  }
+
+  const entrySlug = body.slug ? slugify(String(body.slug)) : null
+  const status = cleanStr(body.status) ?? 'draft'
+  if (!isValidContentStatus(status)) {
+    return publicProblem(context, { 
+      type: 'content-invalid-status', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: 'Invalid status. Allowed values are: draft, review, published' 
+    })
+  }
+
+  const bodyForData = { ...body }
+  delete bodyForData.slug
+  delete bodyForData.status
+
+  const validation = validateAndSanitizeSeedPayload(seed, bodyForData, {
+    operation: 'create',
+    allowNull: false,
+    requireAtLeastOneValidField: true,
+    enforceRequiredFields: true,
+    idGenerator: context.get('idGenerator'),
+  })
+
+  if (validation.dangerousFields.length > 0) {
+    return publicProblem(context, { 
+      type: 'content-dangerous-content', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Content rejected: dangerous markup detected in field '${validation.dangerousFields[0]}'` 
+    })
+  }
+  
+  if (validation.details.length > 0) return contentValidationProblem(context, validation.details)
+
+  let privacyData: Record<string, unknown>
+  try {
+    privacyData = await applyPrivacy(validation.data, seed)
+  } catch (error) {
+    if (error instanceof PrivacyPolicyError) {
+      return publicProblem(context, { 
+        type: 'content-policy-not-implemented', 
+        title: 'Not Implemented', 
+        status: 501, 
+        detail: error.message 
+      })
+    }
+    throw error
+  }
+
+  const id = context.get('idGenerator').uuid()
+  let finalSlug = entrySlug
+  if (!finalSlug) {
+    const fallbackSource = privacyData[seed.displayNameAlias ?? 'title'] || privacyData.title || privacyData.name || id
+    finalSlug = slugify(String(fallbackSource))
+  }
+
+  try {
+    const repository = context.get('repository')
+    await repository.create(seed, id, finalSlug, status, privacyData)
+
+    const jwtPayload = context.get('jwtPayload')
+    const title = privacyData.title || privacyData.name || finalSlug
+
+    logContentActivity(context, 'create', id, slug, String(title))
+    dispatchContentAutomation(context, slug, 'create', { id, slug: finalSlug, status, ...privacyData })
+
+    return context.json({ id }, 201)
+  } catch (error) {
+    return handleContentDatabaseError(context, error)
+  }
+}

package/src/features/content/handlers/delete.ts

@@ -1,87 +1,62 @@
-import { Context } from 'hono'
-import { EntryNotFoundError } from '@beechcms/core'
-import { deleteR2Objects } from '../../../upload'
-import { extractMediaKeysFromData } from '../../../media-utils'
-import { publicProblem } from '../../../public/problem-details'
-import { CONTENT_ERRORS } from '../constants'
-import { AppEnv } from '../../../types'
-
-export async function deleteHandler(context: Context<AppEnv>) {
-  const schemaSlug = context.req.param('slug')
-  const entryId = context.req.param('id')
-  if (!schemaSlug || !entryId) {
-    return publicProblem(context, { 
-      type: 'content-invalid-slug-or-id', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
-    })
-  }
-
-  const seed = context.get('getSeed')(schemaSlug)
-  if (!seed) {
-    return publicProblem(context, { 
-      type: 'content-seed-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
-    })
-  }
-
-  try {
-    const repository = context.get('repository')
-    // Repository.delete returns the row data for cleanup
-    const { row } = await repository.delete(seed, entryId)
-
-    const jwtPayload = context.get('jwtPayload')
-    const title = row.title || row.name || entryId
-
-    context.get('activityLogger').log({
-      action: 'delete',
-      entityType: 'content',
-      entityId: entryId,
-      entitySlug: schemaSlug,
-      details: { title },
-      actor: {
-        id: jwtPayload.sub,
-        email: jwtPayload.email ?? 'unknown',
-        name: jwtPayload.name ?? null,
-      },
-    })
-
-    context.get('scheduler').waitUntil(
-      context.get('automationRunner').run({
-        seedSlug: schemaSlug,
-        event: 'delete',
-        entry: { ...row, id: entryId },
-      }),
-    )
-
-    const r2ObjectKeys = extractMediaKeysFromData(seed, row)
-    if (r2ObjectKeys.length > 0) {
-      await deleteR2Objects(context, r2ObjectKeys).catch((error) => {
-        if (context.env.ENV !== 'production') {
-          console.warn('R2 cleanup on delete failed (orphaned files):', error)
-        }
-      })
-    }
-
-    return context.json({ success: true })
-  } catch (error) {
-    if (error instanceof EntryNotFoundError) {
-      return publicProblem(context, { 
-        type: 'content-not-found', 
-        title: 'Not Found', 
-        status: 404, 
-        detail: CONTENT_ERRORS.NOT_FOUND 
-      })
-    }
-    console.error('Content delete error:', error)
-    return publicProblem(context, { 
-      type: 'content-database-error', 
-      title: 'Internal Server Error', 
-      status: 500, 
-      detail: CONTENT_ERRORS.DATABASE_ERROR 
-    })
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { Context } from 'hono'
+import { deleteR2Objects } from '../../../upload'
+import { extractMediaKeysFromData } from '../../../media-utils'
+import { publicProblem } from '../../../public/problem-details'
+import {
+  logContentActivity,
+  dispatchContentAutomation,
+  handleContentDatabaseError
+} from './helpers'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+
+export async function deleteHandler(context: Context<AppEnv>) {
+  const schemaSlug = context.req.param('slug')
+  const entryId = context.req.param('id')
+  if (!schemaSlug || !entryId) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(schemaSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    // Repository.delete returns the row data for cleanup
+    const { row } = await repository.delete(seed, entryId)
+
+    const title = row.title || row.name || entryId
+
+    logContentActivity(context, 'delete', entryId, schemaSlug, String(title))
+    dispatchContentAutomation(context, schemaSlug, 'delete', { ...row, id: entryId })
+
+    const r2ObjectKeys = extractMediaKeysFromData(seed, row)
+    if (r2ObjectKeys.length > 0) {
+      await deleteR2Objects(context, r2ObjectKeys).catch((error) => {
+        if (context.env.ENV !== 'production') {
+          console.warn('R2 cleanup on delete failed (orphaned files):', error)
+        }
+      })
+    }
+
+    return context.json({ success: true })
+  } catch (error) {
+    return handleContentDatabaseError(context, error)
+  }
+}