@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/shared/d1-session.repository.ts

@@ -1,98 +1,102 @@
-/// <reference types="@cloudflare/workers-types" />
-import type { ISessionRepository, NewRefreshToken, RefreshTokenRecord, ActiveSessionSummary, IClock } from '@beechcms/core'
-
-type RefreshTokenRow = {
-  id: string
-  user_id: string
-  token_hash: string
-  expires_at: number
-  created_at: number
-  revoked_at: number | null
-}
-
-type SessionSummaryRow = {
-  id: string
-  created_at: number
-  expires_at: number
-}
-
-function rowToRecord(row: RefreshTokenRow): RefreshTokenRecord {
-  return {
-    id: row.id,
-    userId: row.user_id,
-    tokenHash: row.token_hash,
-    expiresAt: row.expires_at,
-    createdAt: row.created_at,
-    revokedAt: row.revoked_at,
-  }
-}
-
-export class D1SessionRepository implements ISessionRepository {
-  constructor(
-    private readonly db: D1Database,
-    private readonly clock: IClock,
-  ) {}
-
-  async saveRefreshToken(record: NewRefreshToken): Promise<void> {
-    await this.db
-      .prepare('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
-      .bind(record.id, record.userId, record.tokenHash, record.expiresAt, this.clock.nowSeconds())
-      .run()
-  }
-
-  async findActiveByHash(tokenHash: string, nowTimestamp: number): Promise<RefreshTokenRecord | null> {
-    const row = await this.db
-      .prepare(
-        `SELECT id, user_id, token_hash, expires_at, created_at, revoked_at
-         FROM refresh_tokens
-         WHERE token_hash = ? AND expires_at > ? AND revoked_at IS NULL
-         LIMIT 1`
-      )
-      .bind(tokenHash, nowTimestamp)
-      .first<RefreshTokenRow>()
-    return row ? rowToRecord(row) : null
-  }
-
-  async revokeByHash(tokenHash: string, nowTimestamp: number): Promise<boolean> {
-    const result = await this.db
-      .prepare(
-        `UPDATE refresh_tokens
-         SET revoked_at = ?
-         WHERE token_hash = ? AND revoked_at IS NULL AND expires_at >= ?`
-      )
-      .bind(nowTimestamp, tokenHash, nowTimestamp)
-      .run()
-    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-    return changes > 0
-  }
-
-  async revokeAllForUser(userId: string, nowTimestamp: number): Promise<void> {
-    await this.db
-      .prepare('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL')
-      .bind(nowTimestamp, userId)
-      .run()
-  }
-
-  async listActiveForUser(userId: string, nowTimestamp: number, limit: number): Promise<ActiveSessionSummary[]> {
-    const { results } = await this.db
-      .prepare(
-        `SELECT id, created_at, expires_at FROM refresh_tokens
-         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
-         ORDER BY created_at DESC LIMIT ?`
-      )
-      .bind(userId, nowTimestamp, limit)
-      .all<SessionSummaryRow>()
-    return (results ?? []).map(row => ({ id: row.id, createdAt: row.created_at, expiresAt: row.expires_at }))
-  }
-
-  async revokeById(sessionId: string, userId: string, nowTimestamp: number): Promise<boolean> {
-    const result = await this.db
-      .prepare(
-        'UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL'
-      )
-      .bind(nowTimestamp, sessionId, userId)
-      .run()
-    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-    return changes > 0
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+import type { ISessionRepository, NewRefreshToken, RefreshTokenRecord, ActiveSessionSummary, IClock } from '@beechcms/core'
+
+type RefreshTokenRow = {
+  id: string
+  user_id: string
+  token_hash: string
+  expires_at: number
+  created_at: number
+  revoked_at: number | null
+}
+
+type SessionSummaryRow = {
+  id: string
+  created_at: number
+  expires_at: number
+}
+
+function rowToRecord(row: RefreshTokenRow): RefreshTokenRecord {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    tokenHash: row.token_hash,
+    expiresAt: row.expires_at,
+    createdAt: row.created_at,
+    revokedAt: row.revoked_at,
+  }
+}
+
+export class D1SessionRepository implements ISessionRepository {
+  constructor(
+    private readonly db: D1Database,
+    private readonly clock: IClock,
+  ) {}
+
+  async saveRefreshToken(record: NewRefreshToken): Promise<void> {
+    await this.db
+      .prepare('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+      .bind(record.id, record.userId, record.tokenHash, record.expiresAt, this.clock.nowSeconds())
+      .run()
+  }
+
+  async findActiveByHash(tokenHash: string, nowTimestamp: number): Promise<RefreshTokenRecord | null> {
+    const row = await this.db
+      .prepare(
+        `SELECT id, user_id, token_hash, expires_at, created_at, revoked_at
+         FROM refresh_tokens
+         WHERE token_hash = ? AND expires_at > ? AND revoked_at IS NULL
+         LIMIT 1`
+      )
+      .bind(tokenHash, nowTimestamp)
+      .first<RefreshTokenRow>()
+    return row ? rowToRecord(row) : null
+  }
+
+  async revokeByHash(tokenHash: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        `UPDATE refresh_tokens
+         SET revoked_at = ?
+         WHERE token_hash = ? AND revoked_at IS NULL AND expires_at >= ?`
+      )
+      .bind(nowTimestamp, tokenHash, nowTimestamp)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+
+  async revokeAllForUser(userId: string, nowTimestamp: number): Promise<void> {
+    await this.db
+      .prepare('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL')
+      .bind(nowTimestamp, userId)
+      .run()
+  }
+
+  async listActiveForUser(userId: string, nowTimestamp: number, limit: number): Promise<ActiveSessionSummary[]> {
+    const { results } = await this.db
+      .prepare(
+        `SELECT id, created_at, expires_at FROM refresh_tokens
+         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
+         ORDER BY created_at DESC LIMIT ?`
+      )
+      .bind(userId, nowTimestamp, limit)
+      .all<SessionSummaryRow>()
+    return (results ?? []).map(row => ({ id: row.id, createdAt: row.created_at, expiresAt: row.expires_at }))
+  }
+
+  async revokeById(sessionId: string, userId: string, nowTimestamp: number): Promise<boolean> {
+    const result = await this.db
+      .prepare(
+        'UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL'
+      )
+      .bind(nowTimestamp, sessionId, userId)
+      .run()
+    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
+    return changes > 0
+  }
+}

package/src/shared/d1-setup-checklist.repository.ts

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+
+export interface ISetupChecklistRepository {
+  getExistingTableNames(): Promise<Set<string>>
+  countAdmins(): Promise<number>
+  countEntriesInSeed(slug: string): Promise<number>
+}
+
+export class D1SetupChecklistRepository implements ISetupChecklistRepository {
+  constructor(private readonly db: D1Database) {}
+
+  async getExistingTableNames(): Promise<Set<string>> {
+    const result = await this.db
+      .prepare(`SELECT name FROM sqlite_master WHERE type='table'`)
+      .all<{ name: string }>()
+    return new Set((result.results ?? []).map(row => row.name))
+  }
+
+  async countAdmins(): Promise<number> {
+    const result = await this.db
+      .prepare(`SELECT COUNT(*) as count FROM users WHERE role = 'admin'`)
+      .first<{ count: number }>()
+    return result?.count ?? 0
+  }
+
+  async countEntriesInSeed(slug: string): Promise<number> {
+    const result = await this.db
+      .prepare(`SELECT COUNT(*) as count FROM content_${slug}`)
+      .first<{ count: number }>()
+    return result?.count ?? 0
+  }
+}

package/src/shared/d1-user.repository.test.ts

@@ -1,147 +1,151 @@
-import { describe, it, expect, vi } from 'vitest'
-import { D1UserRepository } from './d1-user.repository'
-
-const USER_ROW = {
-  id: 'u1',
-  email: 'test@test.com',
-  name: 'Test User',
-  password_hash: 'hash-abc',
-  role: 'admin',
-  avatar_url: null,
-  notification_prefs: '{}',
-}
-
-function makeMockDb(opts: {
-  firstResult?: unknown
-  runChanges?: number
-  allResults?: unknown[]
-} = {}) {
-  const { firstResult = null, runChanges = 1, allResults = [] } = opts
-  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
-  // prepare() may be called without bind() for countAll (which calls .first() directly)
-  const prepareMock = vi.fn(() => ({ bind: bindMock, first: firstMock, run: runMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
-}
-
-describe('D1UserRepository', () => {
-  describe('countAll', () => {
-    it('returns the count value from the database', async () => {
-      const { db, firstMock } = makeMockDb()
-      firstMock.mockResolvedValue({ count: 5 })
-      expect(await new D1UserRepository(db).countAll()).toBe(5)
-    })
-
-    it('returns 0 when the query returns null', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).countAll()).toBe(0)
-    })
-  })
-
-  describe('findByEmail', () => {
-    it('returns a UserRecord with camelCase keys mapped from the snake_case row', async () => {
-      const { db } = makeMockDb({ firstResult: USER_ROW })
-      const result = await new D1UserRepository(db).findByEmail('test@test.com')
-      expect(result).toEqual({
-        id: 'u1',
-        email: 'test@test.com',
-        name: 'Test User',
-        passwordHash: 'hash-abc',
-        role: 'admin',
-        avatarUrl: null,
-        notificationPreferences: '{}',
-      })
-    })
-
-    it('returns null when no user is found', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).findByEmail('nobody@test.com')).toBeNull()
-    })
-  })
-
-  describe('findById', () => {
-    it('returns a mapped UserRecord when found', async () => {
-      const { db } = makeMockDb({ firstResult: USER_ROW })
-      const result = await new D1UserRepository(db).findById('u1')
-      expect(result?.id).toBe('u1')
-      expect(result?.passwordHash).toBe('hash-abc')
-    })
-
-    it('returns null when the user is not found', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).findById('unknown')).toBeNull()
-    })
-  })
-
-  describe('create', () => {
-    it('calls prepare with an INSERT INTO users statement', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).create({
-        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
-      })
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO users'))
-    })
-
-    it('binds id, email, passwordHash, role, name in the correct order', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1UserRepository(db).create({
-        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test',
-      })
-      expect(bindMock).toHaveBeenCalledWith('u1', 'a@b.com', 'hash', 'admin', 'Test')
-    })
-  })
-
-  describe('updateProfile', () => {
-    it('does nothing when no fields are provided', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', {})
-      expect(prepareMock).not.toHaveBeenCalled()
-    })
-
-    it('generates a SET clause containing only the provided field', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', { name: 'New Name' })
-      const sql: string = prepareMock.mock.calls[0][0]
-      expect(sql).toContain('name = ?')
-      expect(sql).not.toContain('email = ?')
-    })
-
-    it('includes both fields when both name and email are provided', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', { name: 'N', email: 'e@e.com' })
-      const sql: string = prepareMock.mock.calls[0][0]
-      expect(sql).toContain('name = ?')
-      expect(sql).toContain('email = ?')
-    })
-  })
-
-  describe('updatePasswordHash', () => {
-    it('calls UPDATE users SET password_hash', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updatePasswordHash('u1', 'new-hash')
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('password_hash'))
-    })
-  })
-
-  describe('updateAvatarUrl', () => {
-    it('calls UPDATE users SET avatar_url', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateAvatarUrl('u1', 'https://cdn.example.com/avatar.jpg')
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('avatar_url'))
-    })
-  })
-
-  describe('emailBelongsToAnotherUser', () => {
-    it('returns true when another user row is found with that email', async () => {
-      const { db } = makeMockDb({ firstResult: { id: 'other-user' } })
-      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('taken@test.com', 'current')).toBe(true)
-    })
-
-    it('returns false when no other user owns the email', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('free@test.com', 'current')).toBe(false)
-    })
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect, vi } from 'vitest'
+import { D1UserRepository } from './d1-user.repository'
+
+const USER_ROW = {
+  id: 'u1',
+  email: 'test@test.com',
+  name: 'Test User',
+  password_hash: 'hash-abc',
+  role: 'admin',
+  avatar_url: null,
+  notification_prefs: '{}',
+}
+
+function makeMockDb(opts: {
+  firstResult?: unknown
+  runChanges?: number
+  allResults?: unknown[]
+} = {}) {
+  const { firstResult = null, runChanges = 1, allResults = [] } = opts
+  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  const allMock = vi.fn().mockResolvedValue({ results: allResults })
+  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
+  // prepare() may be called without bind() for countAll (which calls .first() directly)
+  const prepareMock = vi.fn(() => ({ bind: bindMock, first: firstMock, run: runMock }))
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
+}
+
+describe('D1UserRepository', () => {
+  describe('countAll', () => {
+    it('returns the count value from the database', async () => {
+      const { db, firstMock } = makeMockDb()
+      firstMock.mockResolvedValue({ count: 5 })
+      expect(await new D1UserRepository(db).countAll()).toBe(5)
+    })
+
+    it('returns 0 when the query returns null', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).countAll()).toBe(0)
+    })
+  })
+
+  describe('findByEmail', () => {
+    it('returns a UserRecord with camelCase keys mapped from the snake_case row', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findByEmail('test@test.com')
+      expect(result).toEqual({
+        id: 'u1',
+        email: 'test@test.com',
+        name: 'Test User',
+        passwordHash: 'hash-abc',
+        role: 'admin',
+        avatarUrl: null,
+        notificationPreferences: '{}',
+      })
+    })
+
+    it('returns null when no user is found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findByEmail('nobody@test.com')).toBeNull()
+    })
+  })
+
+  describe('findById', () => {
+    it('returns a mapped UserRecord when found', async () => {
+      const { db } = makeMockDb({ firstResult: USER_ROW })
+      const result = await new D1UserRepository(db).findById('u1')
+      expect(result?.id).toBe('u1')
+      expect(result?.passwordHash).toBe('hash-abc')
+    })
+
+    it('returns null when the user is not found', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).findById('unknown')).toBeNull()
+    })
+  })
+
+  describe('create', () => {
+    it('calls prepare with an INSERT INTO users statement', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test', surname: null,
+      })
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO users'))
+    })
+
+    it('binds id, email, passwordHash, role, name, surname in the correct order', async () => {
+      const { db, bindMock } = makeMockDb()
+      await new D1UserRepository(db).create({
+        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test', surname: null,
+      })
+      expect(bindMock).toHaveBeenCalledWith('u1', 'a@b.com', 'hash', 'admin', 'Test', null)
+    })
+  })
+
+  describe('updateProfile', () => {
+    it('does nothing when no fields are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', {})
+      expect(prepareMock).not.toHaveBeenCalled()
+    })
+
+    it('generates a SET clause containing only the provided field', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'New Name' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).not.toContain('email = ?')
+    })
+
+    it('includes both fields when both name and email are provided', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateProfile('u1', { name: 'N', email: 'e@e.com' })
+      const sql: string = prepareMock.mock.calls[0][0]
+      expect(sql).toContain('name = ?')
+      expect(sql).toContain('email = ?')
+    })
+  })
+
+  describe('updatePasswordHash', () => {
+    it('calls UPDATE users SET password_hash', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updatePasswordHash('u1', 'new-hash')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('password_hash'))
+    })
+  })
+
+  describe('updateAvatarUrl', () => {
+    it('calls UPDATE users SET avatar_url', async () => {
+      const { db, prepareMock } = makeMockDb()
+      await new D1UserRepository(db).updateAvatarUrl('u1', 'https://cdn.example.com/avatar.jpg')
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('avatar_url'))
+    })
+  })
+
+  describe('emailBelongsToAnotherUser', () => {
+    it('returns true when another user row is found with that email', async () => {
+      const { db } = makeMockDb({ firstResult: { id: 'other-user' } })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('taken@test.com', 'current')).toBe(true)
+    })
+
+    it('returns false when no other user owns the email', async () => {
+      const { db } = makeMockDb({ firstResult: null })
+      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('free@test.com', 'current')).toBe(false)
+    })
+  })
+})