@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/features/webhooks/index.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { Hono } from 'hono'
+import { Receiver } from '@upstash/qstash'
+import type { AppEnv } from '../../types'
+import type { CreateNotificationInput } from '@beechcms/core'
+
+export const webhooksApp = new Hono<AppEnv>()
+
+webhooksApp.post('/qstash', async (context) => {
+  const currentSigningKey = context.env.QSTASH_CURRENT_SIGNING_KEY
+  const nextSigningKey = context.env.QSTASH_NEXT_SIGNING_KEY
+
+  if (!currentSigningKey || !nextSigningKey) {
+    console.error('QStash webhook called but signing keys are not configured')
+    return context.text('Configuration error', 500)
+  }
+
+  const receiver = new Receiver({
+    currentSigningKey,
+    nextSigningKey,
+  })
+
+  const body = await context.req.text()
+  const signature = context.req.header('Upstash-Signature')
+
+  if (!signature) {
+    return context.text('Missing signature', 401)
+  }
+
+  try {
+    const isValid = await receiver.verify({
+      signature,
+      body,
+    })
+
+    if (!isValid) {
+      return context.text('Invalid signature', 401)
+    }
+  } catch (err) {
+    console.error('QStash signature verification failed', err)
+    return context.text('Invalid signature', 401)
+  }
+
+  try {
+    const input = JSON.parse(body) as CreateNotificationInput
+    
+    const notificationRepository = context.get('notificationRepository')
+    
+    await notificationRepository.create({
+      title: input.title,
+      message: input.message,
+      type: input.type ?? 'info',
+    })
+
+    return context.text('OK', 200)
+  } catch (error) {
+    console.error('Failed to process QStash webhook payload', error)
+    return context.text('Internal server error', 500)
+  }
+})

package/src/index.ts

@@ -1,56 +1,65 @@
-import { createBeechApp } from './factory'
-import { SeedRegistry, SystemIdGenerator } from '@beechcms/core'
-import { runCronAutomations } from './features/automations'
-import { D1AutomationRepository } from './shared/automations.repository.d1'
-import { D1ContentRepository } from './shared/content.repository.d1'
-import type { Env } from './types'
-
-let seeds: any[] = []
-
-try {
-  // @ts-ignore
-  const mod = await import('../seed.ts')
-  const registry = mod.default || mod.SEED_REGISTRY || mod
-  seeds = (typeof registry === 'object' && !Array.isArray(registry))
-    ? Object.values(registry)
-    : registry
-} catch (e) {
-  // Fallback se seed.ts non esiste
-}
-
-const app = createBeechApp({ seeds })
-
-app.get('/', (c) => c.text('Beech API is running (Local Dev Mode)'))
-
-const validSeeds = seeds.filter((s: any) => s && typeof s === 'object' && 'slug' in s)
-
-export default {
-  fetch: app.fetch,
-
-  async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) {
-    const scheduledTime = controller?.scheduledTime ?? Date.now()
-
-    if (!env.DB) {
-      console.warn('[cron] D1 binding missing. Skipping cron automations.')
-      return
-    }
-
-    const automationRepository = new D1AutomationRepository(env.DB)
-    const contentRepository = new D1ContentRepository(env.DB)
-    const registry = new SeedRegistry(validSeeds)
-    const getSeed = (slug: string) => registry.get(slug) ?? null
-
-    ctx.waitUntil(
-      runCronAutomations(
-        {
-          automationRepository,
-          contentRepository,
-          getSeed,
-          env: env as unknown as Record<string, string | undefined>,
-          idGenerator: SystemIdGenerator,
-        },
-        scheduledTime,
-      ),
-    )
-  },
-} satisfies ExportedHandler<Env>
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { createBeechApp } from './factory'
+import { SeedRegistry, SystemIdGenerator } from '@beechcms/core'
+import { runCronAutomations } from './features/automations'
+import { D1AutomationRepository } from './shared/automations.repository.d1'
+import { D1ContentRepository } from './shared/content.repository.d1'
+import { D1SeedRepository } from './shared/seed.repository.d1'
+import type { Env } from './types'
+
+const app = createBeechApp({ seeds: [] })
+
+app.get('/', (c) => c.text('Beech API is running'))
+
+export default {
+  fetch(request: Request, env: Env, ctx: ExecutionContext) {
+    if (env.ENV === 'development') {
+      const checks: Array<{ name: string; url: string }> = [
+        { name: 'MinIO',   url: (env.R2_ENDPOINT ?? 'http://localhost:9000') + '/minio/health/live' },
+        { name: 'Mailpit', url: `http://${env.SMTP_HOST ?? 'localhost'}:${env.SMTP_PORT ?? '8025'}/livez` },
+      ]
+      for (const c of checks) {
+        fetch(c.url).catch(() => {
+          console.warn(
+            `\n⚠️  ${c.name} non raggiungibile su ${c.url}\n` +
+            `   Beech in dev richiede lo stack Docker completo.\n` +
+            `   Avvialo con: npm run dev:full\n`
+          )
+        })
+      }
+    }
+    return app.fetch(request, env, ctx)
+  },
+
+  async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) {
+    const scheduledTime = controller?.scheduledTime ?? Date.now()
+
+    if (!env.DB) {
+      console.warn('[cron] D1 binding missing. Skipping cron automations.')
+      return
+    }
+
+    const automationRepository = new D1AutomationRepository(env.DB)
+    const contentRepository = new D1ContentRepository(env.DB)
+    const seedRepository = new D1SeedRepository(env.DB)
+    const seeds = await seedRepository.listActive()
+    const registry = new SeedRegistry(seeds)
+    const getSeed = (slug: string) => registry.get(slug) ?? null
+
+    ctx.waitUntil(
+      runCronAutomations(
+        {
+          automationRepository,
+          contentRepository,
+          getSeed,
+          env: env as unknown as Record<string, string | undefined>,
+          idGenerator: SystemIdGenerator,
+        },
+        scheduledTime,
+      ),
+    )
+  },
+} satisfies ExportedHandler<Env>

package/src/media-utils.ts

@@ -1,78 +1,82 @@
-/**
- * Media utils: estrazione chiavi R2 dal data di un'entry.
- * Usato alla cancellazione entry per eliminare i file associati da R2.
- *
- * @see docs/media-engine.md
- */
-import type { Seed } from '@beechcms/core'
-
-/** Pattern per estrarre la chiave R2 da URL in formato /api/media/KEY */
-const MEDIA_URL_PATTERN = /\/api\/media\/([^/?#]+)/
-
-/**
- * Estrae la chiave R2 da un URL di media.
- * Es: "https://x.com/api/media/1739123456-avatar.png" → "1739123456-avatar.png"
- *
- * @param mediaUrl - URL completo o path (es. /api/media/123-foto.png)
- * @returns Chiave R2 o null se l'URL non è valido
- */
-export function extractMediaKey(mediaUrl: string): string | null {
-  const match = MEDIA_URL_PATTERN.exec(String(mediaUrl))
-  return match ? decodeURIComponent(match[1]) : null
-}
-
-/**
- * Attraversa ricorsivamente un valore (stringa, array, oggetto) e raccoglie
- * tutte le chiavi R2 trovate in stringhe che matchano /api/media/KEY.
- */
-function collectMediaKeysRecursive(value: unknown, collectedKeys: Set<string>): void {
-  if (typeof value === 'string') {
-    const r2Key = extractMediaKey(value)
-    if (r2Key) {
-      collectedKeys.add(r2Key)
-      return
-    }
-    // Legacy compat: campi json/file possono contenere JSON serializzato.
-    try {
-      const parsed = JSON.parse(value) as unknown
-      if (parsed !== value) {
-        collectMediaKeysRecursive(parsed, collectedKeys)
-      }
-    } catch {
-      // ignore
-    }
-    return
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) collectMediaKeysRecursive(item, collectedKeys)
-    return
-  }
-  if (value != null && typeof value === 'object') {
-    for (const nestedValue of Object.values(value)) {
-      collectMediaKeysRecursive(nestedValue, collectedKeys)
-    }
-  }
-}
-
-/**
- * Estrae tutte le chiavi R2 dal data di un'entry.
- * Cerca nei campi `file` (stringa URL) e `json` (array/oggetto con URL).
- * Il data è in formato DB: chiavi = branch.id (es. art_03, prd_05).
- *
- * @param seed - Schema del tipo di contenuto
- * @param entryData - Payload in formato DB (chiavi = branch ID)
- * @returns Array di chiavi R2 uniche da eliminare
- */
-export function extractMediaKeysFromData(
-  seed: Seed,
-  entryData: Record<string, unknown>
-): string[] {
-  const r2Keys = new Set<string>()
-  for (const branch of seed.branches) {
-    if (branch.type !== 'file' && branch.type !== 'json') continue
-    const fieldValue = entryData[branch.alias]
-    if (fieldValue == null) continue
-    collectMediaKeysRecursive(fieldValue, r2Keys)
-  }
-  return [...r2Keys]
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/**
+ * Media utils: estrazione chiavi R2 dal data di un'entry.
+ * Usato alla cancellazione entry per eliminare i file associati da R2.
+ *
+ * @see docs/media-engine.md
+ */
+import type { Seed } from '@beechcms/core'
+
+/** Pattern per estrarre la chiave R2 da URL in formato /api/media/KEY */
+const MEDIA_URL_PATTERN = /\/api\/media\/([^/?#]+)/
+
+/**
+ * Estrae la chiave R2 da un URL di media.
+ * Es: "https://x.com/api/media/1739123456-avatar.png" → "1739123456-avatar.png"
+ *
+ * @param mediaUrl - URL completo o path (es. /api/media/123-foto.png)
+ * @returns Chiave R2 o null se l'URL non è valido
+ */
+export function extractMediaKey(mediaUrl: string): string | null {
+  const match = MEDIA_URL_PATTERN.exec(String(mediaUrl))
+  return match ? decodeURIComponent(match[1]) : null
+}
+
+/**
+ * Attraversa ricorsivamente un valore (stringa, array, oggetto) e raccoglie
+ * tutte le chiavi R2 trovate in stringhe che matchano /api/media/KEY.
+ */
+function collectMediaKeysRecursive(value: unknown, collectedKeys: Set<string>): void {
+  if (typeof value === 'string') {
+    const r2Key = extractMediaKey(value)
+    if (r2Key) {
+      collectedKeys.add(r2Key)
+      return
+    }
+    // Legacy compat: campi json/file possono contenere JSON serializzato.
+    try {
+      const parsed = JSON.parse(value) as unknown
+      if (parsed !== value) {
+        collectMediaKeysRecursive(parsed, collectedKeys)
+      }
+    } catch {
+      // ignore
+    }
+    return
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectMediaKeysRecursive(item, collectedKeys)
+    return
+  }
+  if (value != null && typeof value === 'object') {
+    for (const nestedValue of Object.values(value)) {
+      collectMediaKeysRecursive(nestedValue, collectedKeys)
+    }
+  }
+}
+
+/**
+ * Estrae tutte le chiavi R2 dal data di un'entry.
+ * Cerca nei campi `file` (stringa URL) e `json` (array/oggetto con URL).
+ * Il data è in formato DB: chiavi = branch.id (es. art_03, prd_05).
+ *
+ * @param seed - Schema del tipo di contenuto
+ * @param entryData - Payload in formato DB (chiavi = branch ID)
+ * @returns Array di chiavi R2 uniche da eliminare
+ */
+export function extractMediaKeysFromData(
+  seed: Seed,
+  entryData: Record<string, unknown>
+): string[] {
+  const r2Keys = new Set<string>()
+  for (const branch of seed.branches) {
+    if (branch.type !== 'file' && branch.type !== 'json') continue
+    const fieldValue = entryData[branch.alias]
+    if (fieldValue == null) continue
+    collectMediaKeysRecursive(fieldValue, r2Keys)
+  }
+  return [...r2Keys]
+}

package/src/middleware/auth-providers.middleware.test.ts

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect, vi } from 'vitest'
+import { Hono } from 'hono'
+import { authProvidersMiddleware } from './auth-providers.middleware'
+
+describe('authProvidersMiddleware', () => {
+  it('throws an error if ENV is production and JWT_SECRET is the development default', async () => {
+    const app = new Hono()
+    app.use('*', authProvidersMiddleware())
+    app.get('/test', (c) => c.text('ok'))
+
+    const env = {
+      ENV: 'production',
+      JWT_SECRET: 'sviluppo-secret-cambiami-almeno-32-byte-per-sicurezza-hono',
+    }
+
+    // Since throwing in Hono middleware returns an unhandled exception or 500 error,
+    // let's run app.request and inspect if the error is thrown. Hono's default errorHandler
+    // catches it, or we can add a custom error handler to catch it.
+    let thrownError: Error | null = null
+    app.onError((err) => {
+      thrownError = err
+      return Hono.prototype.json({ error: err.message }, 500)
+    })
+
+    const res = await app.request('/test', undefined, env)
+    expect(res.status).toBe(500)
+    expect(thrownError).not.toBeNull()
+    expect(thrownError!.message).toContain('JWT_SECRET non configurato')
+  })
+
+  it('injects hashProvider and tokenService when configuration is correct', async () => {
+    const app = new Hono()
+    app.use('*', authProvidersMiddleware())
+    app.get('/test', (c) => {
+      const hash = c.get('hashProvider' as never)
+      const token = c.get('tokenService' as never)
+      return c.json({
+        hasHash: !!hash,
+        hasToken: !!token,
+      })
+    })
+
+    const env = {
+      ENV: 'development',
+      JWT_SECRET: 'custom-secret-key-that-is-secure-enough',
+      JWT_ISSUER: 'issuer',
+      JWT_AUDIENCE: 'audience',
+    }
+
+    const res = await app.request('/test', undefined, env)
+    expect(res.status).toBe(200)
+    const body = await res.json() as any
+    expect(body.hasHash).toBe(true)
+    expect(body.hasToken).toBe(true)
+  })
+
+  it('respects overrides when provided', async () => {
+    const app = new Hono()
+    const mockHash = { hash: vi.fn(), verify: vi.fn() }
+    const mockToken = { sign: vi.fn(), verify: vi.fn() }
+
+    app.use('*', authProvidersMiddleware({
+      hashProvider: mockHash as any,
+      tokenService: mockToken as any,
+    }))
+
+    app.get('/test', (c) => {
+      const hash = c.get('hashProvider' as never)
+      const token = c.get('tokenService' as never)
+      return c.json({
+        hashIsOverridden: hash === mockHash,
+        tokenIsOverridden: token === mockToken,
+      })
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json() as any
+    expect(body.hashIsOverridden).toBe(true)
+    expect(body.tokenIsOverridden).toBe(true)
+  })
+})

package/src/middleware/auth-providers.middleware.ts

@@ -1,32 +1,45 @@
-import { createMiddleware } from 'hono/factory'
-import type { IHashProvider, ITokenService, IClock } from '@beechcms/core'
-import { SystemClock } from '@beechcms/core'
-import type { AppEnv } from '../types'
-import { BcryptHashProvider } from '../auth/bcrypt-hash-provider'
-import { JoseTokenService } from '../auth/jose-token-service'
-
-export interface AuthProviderOverrides {
-  hashProvider?: IHashProvider
-  tokenService?: ITokenService
-  clock?: IClock
-}
-
-export const authProvidersMiddleware = (overrides?: AuthProviderOverrides) => {
-  return createMiddleware<AppEnv>(async (context, next) => {
-    const resolvedClock = overrides?.clock ?? SystemClock
-    const hashProvider = overrides?.hashProvider ?? new BcryptHashProvider()
-    const tokenService = overrides?.tokenService ?? new JoseTokenService(
-      context.env.JWT_SECRET,
-      {
-        issuer: context.env.JWT_ISSUER,
-        audience: context.env.JWT_AUDIENCE,
-      },
-      resolvedClock,
-    )
-
-    context.set('hashProvider', hashProvider)
-    context.set('tokenService', tokenService)
-
-    await next()
-  })
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { createMiddleware } from 'hono/factory'
+import type { IHashProvider, ITokenService, IClock } from '@beechcms/core'
+import { SystemClock } from '@beechcms/core'
+import type { AppEnv } from '../types'
+import { BcryptHashProvider } from '../auth/bcrypt-hash-provider'
+import { JoseTokenService } from '../auth/jose-token-service'
+
+export interface AuthProviderOverrides {
+  hashProvider?: IHashProvider
+  tokenService?: ITokenService
+  clock?: IClock
+}
+
+// Valore di default presente in .dev.vars.example: mai accettabile in produzione.
+const DEV_JWT_SECRET = 'sviluppo-secret-cambiami-almeno-32-byte-per-sicurezza-hono'
+
+export const authProvidersMiddleware = (overrides?: AuthProviderOverrides) => {
+  return createMiddleware<AppEnv>(async (context, next) => {
+    if (context.env.ENV === 'production' && context.env.JWT_SECRET === DEV_JWT_SECRET) {
+      throw new Error(
+        'JWT_SECRET non configurato: in produzione impostare un segreto univoco con `wrangler secret put JWT_SECRET`',
+      )
+    }
+
+    const resolvedClock = overrides?.clock ?? SystemClock
+    const hashProvider = overrides?.hashProvider ?? new BcryptHashProvider()
+    const tokenService = overrides?.tokenService ?? new JoseTokenService(
+      context.env.JWT_SECRET,
+      {
+        issuer: context.env.JWT_ISSUER,
+        audience: context.env.JWT_AUDIENCE,
+      },
+      resolvedClock,
+    )
+
+    context.set('hashProvider', hashProvider)
+    context.set('tokenService', tokenService)
+
+    await next()
+  })
+}

package/src/middleware/observability.middleware.test.ts

@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect, vi } from 'vitest'
+import { Hono } from 'hono'
+import { observabilityMiddleware } from './observability.middleware'
+import type { IClock, IIdGenerator } from '@beechcms/core'
+
+describe('observabilityMiddleware', () => {
+  it('injects default activityLogger and background notification service when no overrides are given', async () => {
+    const app = new Hono()
+    
+    app.use('*', async (c, next) => {
+      c.set('notificationRepository' as never, {} as any)
+      await next()
+    })
+    
+    app.use('*', observabilityMiddleware())
+    
+    app.get('/test', (c) => {
+      const logger = c.get('activityLogger' as never)
+      const notifications = c.get('notificationService' as never)
+      return c.json({
+        hasLogger: !!logger,
+        hasNotifications: !!notifications,
+      })
+    })
+
+    const executionCtx = {
+      waitUntil: vi.fn(),
+      passThroughOnException: vi.fn(),
+    }
+
+    // Mock env with DB
+    const res = await app.request('/test', undefined, { DB: {} }, executionCtx)
+    const body = await res.json() as any
+    expect(body.hasLogger).toBe(true)
+    expect(body.hasNotifications).toBe(true)
+  })
+
+  it('respects overrides when provided', async () => {
+    const app = new Hono()
+    
+    const mockLogger = { log: vi.fn() }
+    const mockNotifications = { send: vi.fn() }
+    const mockClock: IClock = { now: () => 12345 }
+    const mockIdGen: IIdGenerator = { nextId: () => 'custom-id' }
+
+    app.use('*', observabilityMiddleware({
+      activityLogger: mockLogger as any,
+      notificationService: mockNotifications as any,
+      clock: mockClock,
+      idGenerator: mockIdGen,
+    }))
+
+    app.get('/test', (c) => {
+      const logger = c.get('activityLogger' as never)
+      const notifications = c.get('notificationService' as never)
+      return c.json({
+        loggerIsOverridden: logger === mockLogger,
+        notificationsAreOverridden: notifications === mockNotifications,
+      })
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json() as any
+    expect(body.loggerIsOverridden).toBe(true)
+    expect(body.notificationsAreOverridden).toBe(true)
+  })
+
+  it('uses QStashNotificationService when QSTASH_TOKEN and APP_URL are in Env', async () => {
+    const app = new Hono()
+    app.use('*', observabilityMiddleware())
+    
+    app.get('/test', (c) => {
+      const notifications = c.get('notificationService' as never) as any
+      return c.json({
+        type: notifications?.constructor?.name,
+      })
+    })
+
+    const env = {
+      QSTASH_TOKEN: 'token',
+      APP_URL: 'https://my-app.com',
+      DB: {},
+    }
+    
+    const res = await app.request('/test', undefined, env)
+    const body = await res.json() as any
+    expect(body.type).toBe('QStashNotificationService')
+  })
+})