@beechcms/api 0.6.0 → 0.6.2

package/dist/index.js

@@ -36,10 +36,10 @@ function parseLoginBody(body) {
   const password = obj.password;
   if (typeof email !== "string" || typeof password !== "string") return null;
   if (!email.trim() || !password) return null;
-  return { email: email.trim(), password };
+  return { email: email.trim().toLowerCase(), password };
 }
 function validateLoginInput(email, password) {
-  return email.length <= MAX_EMAIL_LENGTH && EMAIL_REGEX.test(email) && password.trim().length >= MIN_PASSWORD_LENGTH && password.length <= MAX_PASSWORD_LENGTH && new TextEncoder().encode(password).length <= MAX_PASSWORD_BYTES;
+  return email.length <= MAX_EMAIL_LENGTH && EMAIL_REGEX.test(email) && password.length >= MIN_PASSWORD_LENGTH && password.length <= MAX_PASSWORD_LENGTH && new TextEncoder().encode(password).length <= MAX_PASSWORD_BYTES;
 }
 async function verifyPassword(plainPassword, hash, hashProvider) {
   return hashProvider.verify(plainPassword, hash);
@@ -188,7 +188,8 @@ async function applyPrivacy(data, seed) {
       );
     }
     if (privacy === "hash" && value != null) {
-      result[alias] = await sha256hex(String(value));
+      const serialized = typeof value === "string" ? value : JSON.stringify(value);
+      result[alias] = await sha256hex(serialized);
     } else {
       result[alias] = value;
     }
@@ -336,9 +337,9 @@ async function buildRelationsMap(context, seed, entries) {
       });
       const map = {};
       for (const item of items) {
-        const id = item.id;
-        const data = item.data;
-        const label = data[labelAlias];
+        const row = item;
+        const id = row.id;
+        const label = row[labelAlias];
         map[id] = label != null && label !== "" ? String(label) : id;
       }
       relations[branch.alias] = map;
@@ -885,11 +886,14 @@ var MEDIA_URL_PATTERN = /\/api\/media\/([^?#]+)/;
 function extractMediaKey(mediaUrl, cdnUrl) {
   const urlStr = String(mediaUrl);
   if (cdnUrl) {
-    const normalizedCdn = cdnUrl.replace(/\/$/, "");
-    if (urlStr.startsWith(normalizedCdn)) {
-      const keyPart = urlStr.slice(normalizedCdn.length).replace(/^\//, "");
-      const keyWithoutQuery = keyPart.split(/[?#]/)[0];
-      return keyWithoutQuery ? decodeURIComponent(keyWithoutQuery) : null;
+    try {
+      const cdnOrigin = new URL(cdnUrl).origin;
+      const mediaUrlParsed = new URL(urlStr);
+      if (mediaUrlParsed.origin === cdnOrigin) {
+        const keyPart = mediaUrlParsed.pathname.replace(/^\//, "");
+        return keyPart ? decodeURIComponent(keyPart) : null;
+      }
+    } catch {
     }
   }
   const match = MEDIA_URL_PATTERN.exec(urlStr);
@@ -1150,7 +1154,7 @@ async function bulkHandler(context) {
 }
 
 // src/features/content/handlers/kanban-position.ts
-import { resolveKanbanConfig as resolveKanbanConfig2 } from "@beechcms/core";
+import { resolveKanbanConfig as resolveKanbanConfig2, EntryNotFoundError as EntryNotFoundError3 } from "@beechcms/core";
 async function kanbanPositionHandler(context) {
   const slug = context.req.param("slug");
   const id = context.req.param("id");
@@ -1175,9 +1179,13 @@ async function kanbanPositionHandler(context) {
   if (!compat.compatible || !compat.candidates.some((c) => c.branchId === axisBranchId)) {
     return publicProblem(context, { type: "content-invalid-kanban-axis", title: "Bad Request", status: 400, detail: "axisBranchId is not a valid kanban candidate for this seed" });
   }
-  const entry = await context.get("repository").findById(seed, id);
-  if (!entry) {
-    return publicProblem(context, { type: "content-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.NOT_FOUND });
+  try {
+    await context.get("repository").findById(seed, id);
+  } catch (error) {
+    if (error instanceof EntryNotFoundError3) {
+      return publicProblem(context, { type: "content-not-found", title: "Not Found", status: 404, detail: CONTENT_ERRORS.NOT_FOUND });
+    }
+    throw error;
   }
   await context.get("kanbanPositionRepository").setPosition(slug, id, axisBranchId, position);
   return context.json({ success: true });
@@ -1231,7 +1239,7 @@ async function kanbanMoveHandler(context) {
       const currentTags = current[axisBranch.alias] ?? [];
       const { oldValue, newValue } = body.axis;
       const withoutOld = oldValue !== null ? currentTags.filter((t) => t !== oldValue) : currentTags;
-      const nextTags = newValue !== null ? [...withoutOld, newValue] : withoutOld;
+      const nextTags = newValue !== null && !withoutOld.includes(newValue) ? [...withoutOld, newValue] : withoutOld;
       patch = { [axisBranch.alias]: nextTags };
     }
     const validation = validateAndSanitizeSeedPayload3(seed, patch, {
@@ -1504,7 +1512,7 @@ widgetApp.get("/distribution/:seed", async (context) => {
 
 // src/features/rotate-field/rotate-field.handler.ts
 import { Hono as Hono3 } from "hono";
-import { resolvePolicies as resolvePolicies4, verifyHashField, sha256hex as sha256hex2, validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload4, EntryNotFoundError as EntryNotFoundError3 } from "@beechcms/core";
+import { resolvePolicies as resolvePolicies4, verifyHashField, sha256hex as sha256hex2, validateAndSanitizeSeedPayload as validateAndSanitizeSeedPayload4, EntryNotFoundError as EntryNotFoundError4 } from "@beechcms/core";
 
 // src/features/rotate-field/rotate-field.schema.ts
 import { z } from "zod";
@@ -1571,7 +1579,7 @@ rotateFieldApp.post("/:slug/:id/rotate-field", async (context) => {
   try {
     contentRecord = await context.get("repository").findById(seed, entryId);
   } catch (error) {
-    if (error instanceof EntryNotFoundError3) {
+    if (error instanceof EntryNotFoundError4) {
       return publicProblem(context, {
         type: "content-not-found",
         title: "Not Found",
@@ -2274,7 +2282,7 @@ import {
 
 // src/features/draft/draft.middleware.ts
 import { createMiddleware } from "hono/factory";
-import { EntryNotFoundError as EntryNotFoundError4 } from "@beechcms/core";
+import { EntryNotFoundError as EntryNotFoundError5 } from "@beechcms/core";
 var draftGuard = createMiddleware(async (context, next) => {
   const slug = context.req.param("slug");
   const id = context.req.param("id");
@@ -2307,7 +2315,7 @@ var draftGuard = createMiddleware(async (context, next) => {
   try {
     await repository.findById(seed, id);
   } catch (error) {
-    if (error instanceof EntryNotFoundError4) {
+    if (error instanceof EntryNotFoundError5) {
       return publicProblem(context, {
         type: "content-not-found",
         title: "Not Found",
@@ -5294,7 +5302,15 @@ function publicRateLimitMiddleware() {
   return async (c, next) => {
     const readMethod = isReadMethod2(c.req.method);
     const limiterName = readMethod ? "publicApiRead" : "publicApiWrite";
-    const seed = c.req.param("seed") ?? "no-seed";
+    const path = c.req.path;
+    let seed = "no-seed";
+    if (path.startsWith("/api/v1/public/")) {
+      const remaining = path.slice("/api/v1/public/".length);
+      const firstSegment = remaining.split("/")[0];
+      if (firstSegment && firstSegment !== "health" && firstSegment !== "schema" && firstSegment !== "schema.html") {
+        seed = firstSegment;
+      }
+    }
     const key = `${getClientIp(c.req)}:${seed}:${limiterName}`;
     const result = await c.get("rateLimiters").getLimiter(limiterName).checkLimit(key);
     if (!result.isAllowed) {
@@ -5364,7 +5380,7 @@ function withCachedResponse(edgeCache, cacheKey, response) {
 }
 
 // src/public/read-single.ts
-import { EntryNotFoundError as EntryNotFoundError5 } from "@beechcms/core";
+import { EntryNotFoundError as EntryNotFoundError6 } from "@beechcms/core";
 
 // src/public/entry-projection.ts
 import { resolvePolicies as resolvePolicies7 } from "@beechcms/core";
@@ -5380,7 +5396,11 @@ function applyPublicPolicies(data, seed) {
     const { public: isPublic, visibility } = resolvePolicies7(branch);
     if (!isPublic) continue;
     if (visibility === "hidden") continue;
-    result[branch.alias] = visibility === "masked" && typeof value === "string" && value.length > 0 ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : value;
+    if (visibility === "masked") {
+      result[branch.alias] = typeof value === "string" && value.length > 0 ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : null;
+    } else {
+      result[branch.alias] = value;
+    }
   }
   return result;
 }
@@ -5427,7 +5447,7 @@ async function readSingleEntry(input) {
       meta: buildPublicSingleMeta(seedSlug)
     };
   } catch (error) {
-    if (error instanceof EntryNotFoundError5) {
+    if (error instanceof EntryNotFoundError6) {
       return { ok: false, detail: `Entry '${label}' not found for content type '${seedSlug}'.` };
     }
     throw error;
@@ -5435,6 +5455,7 @@ async function readSingleEntry(input) {
 }
 
 // src/public/query-builder.ts
+import { resolvePolicies as resolvePolicies8 } from "@beechcms/core";
 var PUBLIC_FILTER_OPERATORS = /* @__PURE__ */ new Set([
   "eq",
   "neq",
@@ -5514,6 +5535,12 @@ function toEngineFilters2(seed, parsedFilter) {
   if (!parsedFilter || parsedFilter.where.length === 0) return [];
   return parsedFilter.where.map((cond) => {
     const branch = seed.branches.find((b) => b.alias === cond.field);
+    if (branch) {
+      const { public: isPublic, filter: filterable } = resolvePolicies8(branch);
+      if (!isPublic || !filterable) {
+        throw new TypeError(`Invalid filter: field '${cond.field}' is not filterable`);
+      }
+    }
     const type = branch ? mapBranchToFilterType(branch.type) : SYSTEM_COLUMNS2.has(cond.field) ? "system" : "text";
     return {
       column: cond.field,
@@ -5554,6 +5581,7 @@ async function readListEntries(input) {
   const sortDir = (cleanStr(query.orderDir) ?? "desc").toLowerCase() === "asc" ? "ASC" : "DESC";
   const { items, total } = await repository.findMany(seed, {
     filters: engineFilters,
+    filterLogic: parsedFilter?.logic,
     search: search || void 0,
     status: publishedOnly ? "published" : null,
     pagination: {
@@ -5620,7 +5648,7 @@ async function publicReadHandler(context) {
 }
 
 // src/public/public-add.ts
-import { isValidContentStatus as isValidContentStatus3, SlugConflictError as SlugConflictError2 } from "@beechcms/core";
+import { isValidContentStatus as isValidContentStatus3, resolvePolicies as resolvePolicies9, SlugConflictError as SlugConflictError2 } from "@beechcms/core";
 
 // src/public/slug-utils.ts
 import { slugify as slugify3, generateEntrySlug } from "@beechcms/core";
@@ -5705,6 +5733,13 @@ async function publicAddHandler(context) {
   if (!isValidContentStatus3(statusValue)) {
     return publicProblem(context, { type: "invalid-status", title: "Bad Request", status: 400, detail: "Invalid status. Allowed values are: draft, review, published" });
   }
+  const sensitiveAliases = Object.keys(rawData).filter((alias) => {
+    const branch = seed.branches.find((b) => b.alias === alias);
+    return branch != null && resolvePolicies9(branch).public === false;
+  });
+  if (sensitiveAliases.length > 0) {
+    return publicProblem(context, { type: "sensitive-field-edit", title: "Unprocessable Entity", status: 422, detail: `Cannot write internal fields: ${sensitiveAliases.join(", ")}` });
+  }
   const sanitized = sanitizePublicPayload(seed, rawData, { operation: "create", allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true });
   if (!sanitized.ok) {
     if (sanitized.status === 422) {
@@ -5712,8 +5747,17 @@ async function publicAddHandler(context) {
     }
     return publicProblem(context, { type: sanitized.code, title: "Bad Request", status: 400, detail: sanitized.message, errors: sanitized.details });
   }
+  let privacyData;
+  try {
+    privacyData = await applyPrivacy(sanitized.data, seed);
+  } catch (error) {
+    if (error instanceof PrivacyPolicyError) {
+      return publicProblem(context, { type: "policy-not-implemented", title: "Not Implemented", status: 501, detail: error.message });
+    }
+    throw error;
+  }
   const idempotencyKey = parseIdempotencyKey(context.req.header("Idempotency-Key"));
-  const finalSlug = pickSlug(body, sanitized.data) || context.get("idGenerator").uuid().slice(0, 8);
+  const finalSlug = pickSlug(body, privacyData) || context.get("idGenerator").uuid().slice(0, 8);
   const repository = context.get("repository");
   const idempotencyRepository = context.get("idempotencyRepository");
   try {
@@ -5737,7 +5781,7 @@ async function publicAddHandler(context) {
     }
     const id = context.get("idGenerator").uuid();
     try {
-      await repository.create(seed, id, finalSlug, statusValue, sanitized.data);
+      await repository.create(seed, id, finalSlug, statusValue, privacyData);
     } catch (error) {
       if (error instanceof SlugConflictError2) {
         return publicProblem(context, { type: "slug-conflict", title: "Conflict", status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` });
@@ -5750,7 +5794,7 @@ async function publicAddHandler(context) {
     }
     context.get("notificationService").notify({
       title: `${seed.label}: New entry`,
-      message: `A new entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") has been added via the public API.`,
+      message: `A new entry ("${privacyData.title || privacyData.name || finalSlug}") has been added via the public API.`,
       type: "success"
     });
     return context.json(responseBody, 201);
@@ -5761,7 +5805,7 @@ async function publicAddHandler(context) {
 }
 
 // src/public/public-edit.ts
-import { isValidContentStatus as isValidContentStatus4, resolvePolicies as resolvePolicies8, EntryNotFoundError as EntryNotFoundError6 } from "@beechcms/core";
+import { isValidContentStatus as isValidContentStatus4, resolvePolicies as resolvePolicies10, EntryNotFoundError as EntryNotFoundError7 } from "@beechcms/core";
 var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function errorMessage(context, error) {
   if (context.env.ENV !== "production" && error instanceof Error) return error.message;
@@ -5811,7 +5855,7 @@ function resolveData(context, seed, body) {
   const sensitiveAliases = Object.keys(rawData).filter((alias) => {
     const branch = seed.branches.find((b) => b.alias === alias);
     if (!branch) return false;
-    const policies = resolvePolicies8(branch);
+    const policies = resolvePolicies10(branch);
     return policies.privacy !== "plain" || policies.public === false;
   });
   if (sensitiveAliases.length > 0) {
@@ -5869,7 +5913,7 @@ async function publicEditHandler(context) {
     });
     return context.json({ success: true, id, slug: slugResult.value.nextSlug }, 200);
   } catch (error) {
-    if (error instanceof EntryNotFoundError6) {
+    if (error instanceof EntryNotFoundError7) {
       return publicProblem(context, { type: "entry-not-found", title: "Not Found", status: 404, detail: `Entry '${id}' not found for content type '${seedSlug}'.` });
     }
     console.error("Public edit error:", error);
@@ -6092,7 +6136,7 @@ import { createMiddleware as createMiddleware2 } from "hono/factory";
 
 // src/shared/db/repositories/content.repository.d1.ts
 import {
-  EntryNotFoundError as EntryNotFoundError7,
+  EntryNotFoundError as EntryNotFoundError8,
   RepositoryError as RepositoryError2,
   SlugConflictError as SlugConflictError4,
   RelationTargetNotFoundError as RelationTargetNotFoundError2,
@@ -6120,7 +6164,7 @@ var BaseD1Repository = class {
    */
   mapError(error, context) {
     const message = error?.message || "Unknown database error";
-    if (message.includes("UNIQUE constraint failed:") && message.includes(".slug")) {
+    if (message.includes("UNIQUE constraint failed") && message.includes("slug")) {
       return new SlugConflictError3(`${context}: ${message}`);
     }
     return new RepositoryError(`${context}: ${message}`, error);
@@ -6274,13 +6318,13 @@ var D1ContentRepository = class extends BaseD1Repository {
       const tableName = this.getTableName(seed.slug);
       const entryRow = await this.database.prepare(`SELECT * FROM ${tableName} WHERE id = ? LIMIT 1`).bind(id).first();
       if (!entryRow) {
-        throw new EntryNotFoundError7(`Entry ${id} not found in ${seed.slug}`);
+        throw new EntryNotFoundError8(`Entry ${id} not found in ${seed.slug}`);
       }
       const data = this.rowToData(seed, entryRow);
       await this.attachMultiRelations(seed, id, data);
       return data;
     } catch (error) {
-      if (error instanceof EntryNotFoundError7) throw error;
+      if (error instanceof EntryNotFoundError8) throw error;
       throw this.mapError(error, `findById(${seed.slug}, ${id})`);
     }
   }
@@ -6294,13 +6338,13 @@ var D1ContentRepository = class extends BaseD1Repository {
       const tableName = this.getTableName(seed.slug);
       const entryRow = await this.database.prepare(`SELECT * FROM ${tableName} WHERE slug = ? LIMIT 1`).bind(slug).first();
       if (!entryRow) {
-        throw new EntryNotFoundError7(`Entry with slug "${slug}" not found in ${seed.slug}`);
+        throw new EntryNotFoundError8(`Entry with slug "${slug}" not found in ${seed.slug}`);
       }
       const data = this.rowToData(seed, entryRow);
       await this.attachMultiRelations(seed, entryRow.id, data);
       return data;
     } catch (error) {
-      if (error instanceof EntryNotFoundError7) throw error;
+      if (error instanceof EntryNotFoundError8) throw error;
       throw this.mapError(error, `findBySlug(${seed.slug}, ${slug})`);
     }
   }
@@ -6616,16 +6660,16 @@ var D1ContentRepository = class extends BaseD1Repository {
       if (batchStmts.length === 1) {
         const updateResult = await batchStmts[0].run();
         if (updateResult.meta.changes === 0) {
-          throw new EntryNotFoundError7(`Entry ${id} not found in ${seed.slug}`);
+          throw new EntryNotFoundError8(`Entry ${id} not found in ${seed.slug}`);
         }
       } else if (batchStmts.length > 1) {
         const results = await this.database.batch(batchStmts);
         if (stmt && (results[0].meta?.changes ?? 0) === 0) {
-          throw new EntryNotFoundError7(`Entry ${id} not found in ${seed.slug}`);
+          throw new EntryNotFoundError8(`Entry ${id} not found in ${seed.slug}`);
         }
       }
     } catch (error) {
-      if (error instanceof EntryNotFoundError7) throw error;
+      if (error instanceof EntryNotFoundError8) throw error;
       throw this.mapError(error, `update(${seed.slug}, ${id})`);
     }
     if (this.hooks?.afterUpdate) {
@@ -6650,12 +6694,12 @@ var D1ContentRepository = class extends BaseD1Repository {
       const tableName = this.getTableName(seed.slug);
       const entryRow = await this.database.prepare(`SELECT * FROM ${tableName} WHERE id = ?`).bind(id).first();
       if (!entryRow) {
-        throw new EntryNotFoundError7(`Entry ${id} not found in ${seed.slug}`);
+        throw new EntryNotFoundError8(`Entry ${id} not found in ${seed.slug}`);
       }
       await this.database.prepare(`DELETE FROM ${tableName} WHERE id = ?`).bind(id).run();
       row = this.rowToData(seed, entryRow);
     } catch (error) {
-      if (error instanceof EntryNotFoundError7) throw error;
+      if (error instanceof EntryNotFoundError8) throw error;
       throw this.mapError(error, `delete(${seed.slug}, ${id})`);
     }
     if (this.hooks?.afterDelete) {
@@ -6769,21 +6813,12 @@ var D1ContentRepository = class extends BaseD1Repository {
       const draftTableName = this.getTableName(seed.slug, true);
       const mRelBranches = multiRelBranches(seed);
       const mRelAliases = new Set(mRelBranches.map((b) => b.alias));
-      let existingTouched = [];
-      try {
-        const existing = await this.database.prepare(`SELECT _touched_fields FROM ${draftTableName} WHERE entry_id = ?`).bind(entryId).first();
-        if (existing && existing._touched_fields) {
-          existingTouched = JSON.parse(existing._touched_fields);
-        }
-      } catch {
-      }
-      const currentTouched = new Set(existingTouched);
+      const thisCallTouched = [];
       for (const branch of seed.branches) {
         if (Object.hasOwn(data, branch.alias)) {
-          currentTouched.add(branch.alias);
+          thisCallTouched.push(branch.alias);
         }
       }
-      const updatedTouchedFields = Array.from(currentTouched);
       const columnNames = ["entry_id"];
       const placeholders = ["?"];
       const queryBindings = [entryId];
@@ -6800,8 +6835,14 @@ var D1ContentRepository = class extends BaseD1Repository {
       }
       columnNames.push("_touched_fields");
       placeholders.push("?");
-      queryBindings.push(JSON.stringify(updatedTouchedFields));
-      updateClauses.push(`_touched_fields = EXCLUDED._touched_fields`);
+      queryBindings.push(JSON.stringify(thisCallTouched));
+      updateClauses.push(`_touched_fields = (
+        SELECT json_group_array(value) FROM (
+          SELECT value FROM json_each(COALESCE(_touched_fields, '[]'))
+          UNION
+          SELECT value FROM json_each(excluded._touched_fields)
+        )
+      )`);
       updateClauses.push("updated_at = (unixepoch())");
       const sql = `
         INSERT INTO ${draftTableName} (${columnNames.join(", ")})
@@ -6909,7 +6950,7 @@ var D1ContentRepository = class extends BaseD1Repository {
       const liveTableName = this.getTableName(seed.slug);
       const draftRow = await this.database.prepare(`SELECT * FROM ${draftTableName} WHERE entry_id = ?`).bind(entryId).first();
       if (!draftRow) {
-        throw new EntryNotFoundError7(`No draft found for ${entryId} in ${seed.slug}`);
+        throw new EntryNotFoundError8(`No draft found for ${entryId} in ${seed.slug}`);
       }
       let touchedFields = [];
       if (draftRow && typeof draftRow["_touched_fields"] === "string") {
@@ -6964,7 +7005,7 @@ var D1ContentRepository = class extends BaseD1Repository {
       }
       await this.database.batch(batchStmts);
     } catch (error) {
-      if (error instanceof EntryNotFoundError7) throw error;
+      if (error instanceof EntryNotFoundError8) throw error;
       if (error instanceof RelationTargetNotFoundError2) throw error;
       throw this.mapError(error, `publishDraft(${seed.slug}, ${entryId})`);
     }
@@ -10172,8 +10213,8 @@ function createBeechApp(config) {
         }
         return null;
       },
-      allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-      allowHeaders: ["Content-Type", "Authorization", "X-API-Key"],
+      allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+      allowHeaders: ["Content-Type", "Authorization", "X-API-Key", "Idempotency-Key"],
       credentials: true
     })(context, next);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/factory.d.ts",
@@ -20,7 +20,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
     "@aws-sdk/s3-request-presigner": "^3.995.0",
-    "@beechcms/core": "^0.6.0",
+    "@beechcms/core": "^0.6.2",
     "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
     "hono": "^4.12.21",