@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/public/sanitize.ts

@@ -1,65 +1,69 @@
-import { validateAndSanitizeSeedPayload } from '@beechcms/core'
-import type { Seed, ValidationDetail } from '@beechcms/core'
-
-type PublicSanitizeSuccess = {
-  ok: true
-  data: Record<string, unknown>
-}
-
-type PublicSanitizeFailure = {
-  ok: false
-  status: 400 | 422
-  code: 'validation_failed' | 'dangerous_content'
-  message: string
-  details?: ValidationDetail[]
-}
-
-export type PublicSanitizeResult = PublicSanitizeSuccess | PublicSanitizeFailure
-
-/**
- * Public API Adapter: uses the core foundation and maps errors into the sprint format.
- */
-export function sanitizePublicPayload(
-  seed: Seed,
-  payload: Record<string, unknown>,
-  options: {
-    allowNull?: boolean
-    operation?: 'create' | 'update'
-    requireAtLeastOneValidField?: boolean
-    enforceRequiredFields?: boolean
-  } = {}
-): PublicSanitizeResult {
-  const operation = options.operation ?? 'create'
-  const result = validateAndSanitizeSeedPayload(seed, payload, {
-    allowNull: options.allowNull ?? false,
-    operation,
-    requireAtLeastOneValidField: options.requireAtLeastOneValidField ?? true,
-    enforceRequiredFields: options.enforceRequiredFields ?? true,
-  })
-
-  if (result.dangerousFields.length > 0) {
-    const field = result.dangerousFields[0]
-    return {
-      ok: false,
-      status: 422,
-      code: 'dangerous_content',
-      message: `Content rejected: dangerous markup detected in field '${field}'`,
-    }
-  }
-
-  if (result.details.length > 0) {
-    return {
-      ok: false,
-      status: 400,
-      code: 'validation_failed',
-      message: 'Validation failed',
-      details: result.details,
-    }
-  }
-
-  return {
-    ok: true,
-    data: result.data,
-  }
-}
-
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { validateAndSanitizeSeedPayload } from '@beechcms/core'
+import type { Seed, ValidationDetail } from '@beechcms/core'
+
+type PublicSanitizeSuccess = {
+  ok: true
+  data: Record<string, unknown>
+}
+
+type PublicSanitizeFailure = {
+  ok: false
+  status: 400 | 422
+  code: 'validation_failed' | 'dangerous_content'
+  message: string
+  details?: ValidationDetail[]
+}
+
+export type PublicSanitizeResult = PublicSanitizeSuccess | PublicSanitizeFailure
+
+/**
+ * Public API Adapter: uses the core foundation and maps errors into the sprint format.
+ */
+export function sanitizePublicPayload(
+  seed: Seed,
+  payload: Record<string, unknown>,
+  options: {
+    allowNull?: boolean
+    operation?: 'create' | 'update'
+    requireAtLeastOneValidField?: boolean
+    enforceRequiredFields?: boolean
+  } = {}
+): PublicSanitizeResult {
+  const operation = options.operation ?? 'create'
+  const result = validateAndSanitizeSeedPayload(seed, payload, {
+    allowNull: options.allowNull ?? false,
+    operation,
+    requireAtLeastOneValidField: options.requireAtLeastOneValidField ?? true,
+    enforceRequiredFields: options.enforceRequiredFields ?? true,
+  })
+
+  if (result.dangerousFields.length > 0) {
+    const field = result.dangerousFields[0]
+    return {
+      ok: false,
+      status: 422,
+      code: 'dangerous_content',
+      message: `Content rejected: dangerous markup detected in field '${field}'`,
+    }
+  }
+
+  if (result.details.length > 0) {
+    return {
+      ok: false,
+      status: 400,
+      code: 'validation_failed',
+      message: 'Validation failed',
+      details: result.details,
+    }
+  }
+
+  return {
+    ok: true,
+    data: result.data,
+  }
+}
+

package/src/public/slug-utils.ts

@@ -1,14 +1,18 @@
-import { slugify, generateEntrySlug } from '@beechcms/core'
-
-/**
- * Converts a string into a URL-safe slug.
- * Logic moved to @beechcms/core for consistency between Dashboard and API.
- */
-export { slugify }
-
-/**
- * Generates a slug from a title/name or a UUID-like fallback.
- * Logic moved to @beechcms/core for consistency between Dashboard and API.
- */
-export { generateEntrySlug }
-
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { slugify, generateEntrySlug } from '@beechcms/core'
+
+/**
+ * Converts a string into a URL-safe slug.
+ * Logic moved to @beechcms/core for consistency between Dashboard and API.
+ */
+export { slugify }
+
+/**
+ * Generates a slug from a title/name or a UUID-like fallback.
+ * Logic moved to @beechcms/core for consistency between Dashboard and API.
+ */
+export { generateEntrySlug }
+

package/src/rate-limit/cloudflare-rate-limiter.test.ts

@@ -1,26 +1,30 @@
-import { describe, it, expect, vi } from 'vitest'
-import { CloudflareRateLimiter } from './cloudflare-rate-limiter'
-
-describe('CloudflareRateLimiter', () => {
-  it('returns isAllowed: true when the Cloudflare binding grants the request', async () => {
-    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
-    const limiter = new CloudflareRateLimiter(mockBinding as any)
-    const result = await limiter.checkLimit('192.168.1.1:login')
-    expect(result.isAllowed).toBe(true)
-  })
-
-  it('returns isAllowed: false when the Cloudflare binding blocks the request', async () => {
-    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: false }) }
-    const limiter = new CloudflareRateLimiter(mockBinding as any)
-    const result = await limiter.checkLimit('192.168.1.1:login')
-    expect(result.isAllowed).toBe(false)
-  })
-
-  it('forwards the exact key to the binding so per-key accounting is correct', async () => {
-    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
-    const limiter = new CloudflareRateLimiter(mockBinding as any)
-    const key = '10.0.0.1:some-seed:publicApiRead'
-    await limiter.checkLimit(key)
-    expect(mockBinding.limit).toHaveBeenCalledWith({ key })
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect, vi } from 'vitest'
+import { CloudflareRateLimiter } from './cloudflare-rate-limiter'
+
+describe('CloudflareRateLimiter', () => {
+  it('returns isAllowed: true when the Cloudflare binding grants the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(true)
+  })
+
+  it('returns isAllowed: false when the Cloudflare binding blocks the request', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: false }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const result = await limiter.checkLimit('192.168.1.1:login')
+    expect(result.isAllowed).toBe(false)
+  })
+
+  it('forwards the exact key to the binding so per-key accounting is correct', async () => {
+    const mockBinding = { limit: vi.fn().mockResolvedValue({ success: true }) }
+    const limiter = new CloudflareRateLimiter(mockBinding as any)
+    const key = '10.0.0.1:some-seed:publicApiRead'
+    await limiter.checkLimit(key)
+    expect(mockBinding.limit).toHaveBeenCalledWith({ key })
+  })
+})

package/src/rate-limit/cloudflare-rate-limiter.ts

@@ -1,11 +1,15 @@
-/// <reference types="@cloudflare/workers-types" />
-import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
-
-export class CloudflareRateLimiter implements IRateLimiter {
-  constructor(private readonly binding: RateLimit) {}
-
-  async checkLimit(key: string): Promise<RateLimitResult> {
-    const { success } = await this.binding.limit({ key })
-    return { isAllowed: success }
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class CloudflareRateLimiter implements IRateLimiter {
+  constructor(private readonly binding: RateLimit) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const { success } = await this.binding.limit({ key })
+    return { isAllowed: success }
+  }
+}

package/src/rate-limit/in-memory-rate-limiter.test.ts

@@ -1,33 +1,37 @@
-import { describe, it, expect } from 'vitest'
-import { InMemoryRateLimiter } from './in-memory-rate-limiter'
-
-describe('InMemoryRateLimiter', () => {
-  it('allows requests up to the configured maximum hit count', async () => {
-    const limiter = new InMemoryRateLimiter(3)
-    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
-  })
-
-  it('blocks the very next request after maxAllowedHits is reached', async () => {
-    const limiter = new InMemoryRateLimiter(2)
-    await limiter.checkLimit('key')
-    await limiter.checkLimit('key')
-    expect((await limiter.checkLimit('key')).isAllowed).toBe(false)
-  })
-
-  it('tracks hit counts independently for each key', async () => {
-    const limiter = new InMemoryRateLimiter(1)
-    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
-    // Both keys exhausted independently
-    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(false)
-    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(false)
-  })
-
-  it('maxAllowedHits = 1 allows exactly one request before blocking', async () => {
-    const limiter = new InMemoryRateLimiter(1)
-    expect((await limiter.checkLimit('k')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('k')).isAllowed).toBe(false)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { InMemoryRateLimiter } from './in-memory-rate-limiter'
+
+describe('InMemoryRateLimiter', () => {
+  it('allows requests up to the configured maximum hit count', async () => {
+    const limiter = new InMemoryRateLimiter(3)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(true)
+  })
+
+  it('blocks the very next request after maxAllowedHits is reached', async () => {
+    const limiter = new InMemoryRateLimiter(2)
+    await limiter.checkLimit('key')
+    await limiter.checkLimit('key')
+    expect((await limiter.checkLimit('key')).isAllowed).toBe(false)
+  })
+
+  it('tracks hit counts independently for each key', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    // Both keys exhausted independently
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(false)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(false)
+  })
+
+  it('maxAllowedHits = 1 allows exactly one request before blocking', async () => {
+    const limiter = new InMemoryRateLimiter(1)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('k')).isAllowed).toBe(false)
+  })
+})

package/src/rate-limit/in-memory-rate-limiter.ts

@@ -1,13 +1,17 @@
-import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
-
-export class InMemoryRateLimiter implements IRateLimiter {
-  private readonly hitCounts = new Map<string, number>()
-
-  constructor(private readonly maxAllowedHits: number) {}
-
-  async checkLimit(key: string): Promise<RateLimitResult> {
-    const currentHits = (this.hitCounts.get(key) ?? 0) + 1
-    this.hitCounts.set(key, currentHits)
-    return { isAllowed: currentHits <= this.maxAllowedHits }
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class InMemoryRateLimiter implements IRateLimiter {
+  private readonly hitCounts = new Map<string, number>()
+
+  constructor(private readonly maxAllowedHits: number) {}
+
+  async checkLimit(key: string): Promise<RateLimitResult> {
+    const currentHits = (this.hitCounts.get(key) ?? 0) + 1
+    this.hitCounts.set(key, currentHits)
+    return { isAllowed: currentHits <= this.maxAllowedHits }
+  }
+}

package/src/rate-limit/no-op-rate-limiter.test.ts

@@ -1,18 +1,22 @@
-import { describe, it, expect } from 'vitest'
-import { NoOpRateLimiter } from './no-op-rate-limiter'
-
-describe('NoOpRateLimiter', () => {
-  it('always returns isAllowed: true regardless of the key', async () => {
-    const limiter = new NoOpRateLimiter()
-    for (let i = 0; i < 100; i++) {
-      expect((await limiter.checkLimit('any-key')).isAllowed).toBe(true)
-    }
-  })
-
-  it('allows all keys without accumulating state', async () => {
-    const limiter = new NoOpRateLimiter()
-    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
-    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { NoOpRateLimiter } from './no-op-rate-limiter'
+
+describe('NoOpRateLimiter', () => {
+  it('always returns isAllowed: true regardless of the key', async () => {
+    const limiter = new NoOpRateLimiter()
+    for (let i = 0; i < 100; i++) {
+      expect((await limiter.checkLimit('any-key')).isAllowed).toBe(true)
+    }
+  })
+
+  it('allows all keys without accumulating state', async () => {
+    const limiter = new NoOpRateLimiter()
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-b')).isAllowed).toBe(true)
+    expect((await limiter.checkLimit('ip-a')).isAllowed).toBe(true)
+  })
+})

package/src/rate-limit/no-op-rate-limiter.ts

@@ -1,7 +1,11 @@
-import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
-
-export class NoOpRateLimiter implements IRateLimiter {
-  async checkLimit(_key: string): Promise<RateLimitResult> {
-    return { isAllowed: true }
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { IRateLimiter, RateLimitResult } from '@beechcms/core'
+
+export class NoOpRateLimiter implements IRateLimiter {
+  async checkLimit(_key: string): Promise<RateLimitResult> {
+    return { isAllowed: true }
+  }
+}