@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/features/rotate-field/rotate-field.handler.ts

@@ -1,128 +1,132 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
-import { publicProblem } from '../../public/problem-details'
-import { rotateFieldRequestSchema } from './rotate-field.schema'
-import type { Env, Variables } from '../../types'
-
-const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
-  const seedSlug = context.req.param('slug')
-  const entryId = context.req.param('id')
-
-  const seed = context.get('getSeed')(seedSlug)
-  if (!seed) {
-    return publicProblem(context, { 
-      type: 'content-seed-not-found', 
-      title: 'Not Found', 
-      status: 404, 
-      detail: `Seed '${seedSlug}' not found` 
-    })
-  }
-
-  let requestBody: unknown
-  try {
-    requestBody = await context.req.json()
-  } catch {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-json', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: 'Invalid JSON body' 
-    })
-  }
-
-  const parsedRequestBody = rotateFieldRequestSchema.safeParse(requestBody)
-  if (!parsedRequestBody.success) {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-body', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: parsedRequestBody.error.issues[0]?.message ?? 'Invalid body' 
-    })
-  }
-
-  const { fieldAlias, currentValue, nextValue } = parsedRequestBody.data
-
-  const targetFieldBranch = seed.branches.find((branch) => branch.alias === fieldAlias)
-  if (!targetFieldBranch) {
-    return publicProblem(context, { 
-      type: 'rotate-field-unknown-field', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: `Field '${fieldAlias}' does not exist in seed '${seedSlug}'` 
-    })
-  }
-
-  const { privacy } = resolvePolicies(targetFieldBranch)
-  if (privacy !== 'hash') {
-    return publicProblem(context, { 
-      type: 'rotate-field-not-hashable', 
-      title: 'Unprocessable Entity', 
-      status: 422, 
-      detail: `Field '${fieldAlias}' does not use hash privacy and cannot be rotated with this endpoint` 
-    })
-  }
-
-  let contentRecord: Record<string, unknown>
-  try {
-    contentRecord = await context.get('repository').findById(seed, entryId)
-  } catch (error) {
-    if (error instanceof EntryNotFoundError) {
-      return publicProblem(context, {
-        type: 'content-not-found',
-        title: 'Not Found',
-        status: 404,
-        detail: `Entry '${entryId}' not found`
-      })
-    }
-    throw error
-  }
-
-  const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
-
-  if (typeof storedFieldValueHash !== 'string' || storedFieldValueHash.length === 0) {
-    return publicProblem(context, { 
-      type: 'rotate-field-not-set', 
-      title: 'Unprocessable Entity', 
-      status: 422, 
-      detail: `Field '${fieldAlias}' has no stored value to rotate` 
-    })
-  }
-
-  const isCurrentValueValid = await verifyHashField(storedFieldValueHash, currentValue)
-  if (!isCurrentValueValid) {
-    return publicProblem(context, { 
-      type: 'rotate-field-current-mismatch', 
-      title: 'Forbidden', 
-      status: 403, 
-      detail: 'Current value does not match stored value' 
-    })
-  }
-
-  const fieldValidationResult = validateAndSanitizeSeedPayload(
-    seed, 
-    { [fieldAlias]: nextValue },
-    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
-  )
-
-  if (fieldValidationResult.details.length > 0) {
-    return publicProblem(context, { 
-      type: 'rotate-field-invalid-next', 
-      title: 'Bad Request', 
-      status: 400, 
-      detail: `Invalid value for field '${fieldAlias}': ${fieldValidationResult.details[0]?.message ?? 'validation failed'}` 
-    })
-  }
-
-  const newFieldValueHash = await sha256hex(nextValue)
-
-  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
-
-  return context.json({ success: true })
-})
-
-
-export { rotateFieldApp }
-
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { resolvePolicies, verifyHashField, sha256hex, validateAndSanitizeSeedPayload, EntryNotFoundError } from '@beechcms/core'
+import { publicProblem } from '../../public/problem-details'
+import { rotateFieldRequestSchema } from './rotate-field.schema'
+import type { Env, Variables } from '../../types'
+
+const rotateFieldApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+rotateFieldApp.post('/:slug/:id/rotate-field', async (context) => {
+  const seedSlug = context.req.param('slug')
+  const entryId = context.req.param('id')
+
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: `Seed '${seedSlug}' not found` 
+    })
+  }
+
+  let requestBody: unknown
+  try {
+    requestBody = await context.req.json()
+  } catch {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: 'Invalid JSON body' 
+    })
+  }
+
+  const parsedRequestBody = rotateFieldRequestSchema.safeParse(requestBody)
+  if (!parsedRequestBody.success) {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-body', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: parsedRequestBody.error.issues[0]?.message ?? 'Invalid body' 
+    })
+  }
+
+  const { fieldAlias, currentValue, nextValue } = parsedRequestBody.data
+
+  const targetFieldBranch = seed.branches.find((branch) => branch.alias === fieldAlias)
+  if (!targetFieldBranch) {
+    return publicProblem(context, { 
+      type: 'rotate-field-unknown-field', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: `Field '${fieldAlias}' does not exist in seed '${seedSlug}'` 
+    })
+  }
+
+  const { privacy } = resolvePolicies(targetFieldBranch)
+  if (privacy !== 'hash') {
+    return publicProblem(context, { 
+      type: 'rotate-field-not-hashable', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Field '${fieldAlias}' does not use hash privacy and cannot be rotated with this endpoint` 
+    })
+  }
+
+  let contentRecord: Record<string, unknown>
+  try {
+    contentRecord = await context.get('repository').findById(seed, entryId)
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, {
+        type: 'content-not-found',
+        title: 'Not Found',
+        status: 404,
+        detail: `Entry '${entryId}' not found`
+      })
+    }
+    throw error
+  }
+
+  const storedFieldValueHash = contentRecord[targetFieldBranch.alias]
+
+  if (typeof storedFieldValueHash !== 'string' || storedFieldValueHash.length === 0) {
+    return publicProblem(context, { 
+      type: 'rotate-field-not-set', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Field '${fieldAlias}' has no stored value to rotate` 
+    })
+  }
+
+  const isCurrentValueValid = await verifyHashField(storedFieldValueHash, currentValue)
+  if (!isCurrentValueValid) {
+    return publicProblem(context, { 
+      type: 'rotate-field-current-mismatch', 
+      title: 'Forbidden', 
+      status: 403, 
+      detail: 'Current value does not match stored value' 
+    })
+  }
+
+  const fieldValidationResult = validateAndSanitizeSeedPayload(
+    seed, 
+    { [fieldAlias]: nextValue },
+    { operation: 'update', allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: false }
+  )
+
+  if (fieldValidationResult.details.length > 0) {
+    return publicProblem(context, { 
+      type: 'rotate-field-invalid-next', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: `Invalid value for field '${fieldAlias}': ${fieldValidationResult.details[0]?.message ?? 'validation failed'}` 
+    })
+  }
+
+  const newFieldValueHash = await sha256hex(nextValue)
+
+  await context.get('repository').update(seed, entryId, { [targetFieldBranch.alias]: newFieldValueHash })
+
+  return context.json({ success: true })
+})
+
+
+export { rotateFieldApp }
+

package/src/features/rotate-field/rotate-field.schema.ts

@@ -1,13 +1,17 @@
-import { z } from 'zod'
-
-/**
- * Schema for rotating a hashed field value.
- * Used to update fields that have 'hash' privacy (e.g., passwords, PINs).
- */
-export const rotateFieldRequestSchema = z.object({
-  fieldAlias: z.string().min(1, "The field alias is required"),
-  currentValue: z.string().min(1, "The current value is required"),
-  nextValue: z.string().min(1, "The new value is required"),
-})
-
-export type RotateFieldRequest = z.infer<typeof rotateFieldRequestSchema>
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { z } from 'zod'
+
+/**
+ * Schema for rotating a hashed field value.
+ * Used to update fields that have 'hash' privacy (e.g., passwords, PINs).
+ */
+export const rotateFieldRequestSchema = z.object({
+  fieldAlias: z.string().min(1, "The field alias is required"),
+  currentValue: z.string().min(1, "The current value is required"),
+  nextValue: z.string().min(1, "The new value is required"),
+})
+
+export type RotateFieldRequest = z.infer<typeof rotateFieldRequestSchema>

package/src/features/schema/schema.handler.ts

@@ -1,16 +1,131 @@
-/// <reference types="@cloudflare/workers-types" />
-import { Hono } from 'hono'
-import type { Env, Variables } from '../../types'
-
-const schemaApp = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-/**
- * Ritorna l'intero schema del CMS (la lista dei Seed configurati).
- * Usato dalla Dashboard per generare dinamicamente il menu e le form.
- */
-schemaApp.get('/', async (context) => {
-  const registry = context.get('seedRegistry')
-  return context.json(registry.all())
-})
-
-export { schemaApp }
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { canEditLayout, formLayoutSchema, validateLayoutAgainstSeed } from '@beechcms/core'
+import { publicProblem } from '../../public/problem-details'
+import type { Context } from 'hono'
+import type { Env, Variables } from '../../types'
+
+type AppContext = Context<{ Bindings: Env; Variables: Variables }>
+
+/** Returns a 403 response if the caller lacks layout-edit permission, otherwise undefined. */
+function requireLayoutEditPermission(context: AppContext) {
+  const role = context.get('jwtPayload')?.role
+  if (!canEditLayout(role)) {
+    return publicProblem(context, {
+      type: 'forbidden',
+      title: 'Forbidden',
+      status: 403,
+      detail: 'Layout edit requires admin role.',
+    })
+  }
+  return undefined
+}
+
+/** Resolves the seed by slug. Returns a 404 response if not found, otherwise the seed. */
+function requireSeedBySlug(context: AppContext, slug: string) {
+  const seed = context.get('seedRegistry').get(slug)
+  if (!seed) {
+    return {
+      seed: null,
+      error: publicProblem(context, {
+        type: 'seed-not-found',
+        title: 'Seed not found',
+        status: 404,
+        detail: `No seed with slug '${slug}'.`,
+      }),
+    }
+  }
+  return { seed, error: null }
+}
+
+const schemaApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+/**
+ * Returns the full CMS schema (all configured Seeds), each optionally enriched
+ * with a stored custom FormLayout. Used by the Dashboard to drive menus and forms.
+ */
+schemaApp.get('/', async (context) => {
+  const registry = context.get('seedRegistry')
+  const layouts = await context.get('seedLayoutRepository').getAllAsMap()
+
+  const enriched = registry.all().map((seed) => {
+    const stored = layouts.get(seed.slug)
+    if (!stored) return seed
+    const result = validateLayoutAgainstSeed(stored, seed)
+    return { ...seed, layout: result.cleaned }
+  })
+
+  return context.json(enriched)
+})
+
+/**
+ * Upserts a custom FormLayout for a Seed.
+ * Admin-only. Validates shape (Zod) then semantic constraints against the Seed.
+ */
+schemaApp.put('/:slug/layout', async (context) => {
+  const forbidden = requireLayoutEditPermission(context)
+  if (forbidden) return forbidden
+
+  const slug = context.req.param('slug')
+  const { seed, error: seedError } = requireSeedBySlug(context, slug)
+  if (seedError) return seedError
+
+  let body: unknown
+  try {
+    body = await context.req.json()
+  } catch {
+    return publicProblem(context, {
+      type: 'invalid-json',
+      title: 'Invalid JSON',
+      status: 400,
+      detail: 'Body must be valid JSON.',
+    })
+  }
+
+  const parsed = formLayoutSchema.safeParse(body)
+  if (!parsed.success) {
+    return publicProblem(context, {
+      type: 'invalid-layout',
+      title: 'Invalid layout',
+      status: 422,
+      detail: parsed.error.message,
+    })
+  }
+
+  const semantic = validateLayoutAgainstSeed(parsed.data, seed!)
+  if (!semantic.ok) {
+    return publicProblem(context, {
+      type: 'invalid-layout',
+      title: 'Invalid layout',
+      status: 422,
+      detail: semantic.errors.join('; '),
+    })
+  }
+
+  const userId = context.get('jwtPayload')?.sub ?? 'unknown'
+  await context.get('seedLayoutRepository').upsert(slug, semantic.cleaned, userId)
+
+  return context.json({ ok: true, layout: semantic.cleaned })
+})
+
+/**
+ * Removes the stored layout for a Seed, reverting to the generated default.
+ * Admin-only. The "Reset" action in the Layout Builder calls this endpoint.
+ */
+schemaApp.delete('/:slug/layout', async (context) => {
+  const forbidden = requireLayoutEditPermission(context)
+  if (forbidden) return forbidden
+
+  const slug = context.req.param('slug')
+  const { error: seedError } = requireSeedBySlug(context, slug)
+  if (seedError) return seedError
+
+  await context.get('seedLayoutRepository').remove(slug)
+  return context.json({ ok: true })
+})
+
+export { schemaApp }

package/src/features/seeds/index.ts

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+export { seedsApp } from './seeds.handler'