@beechcms/api 0.6.1 → 0.6.3

package/dist/index.js

@@ -188,7 +188,8 @@ async function applyPrivacy(data, seed) {
       );
     }
     if (privacy === "hash" && value != null) {
-      result[alias] = await sha256hex(String(value));
+      const serialized = typeof value === "string" ? value : JSON.stringify(value);
+      result[alias] = await sha256hex(serialized);
     } else {
       result[alias] = value;
     }
@@ -860,6 +861,7 @@ async function updateHandler(context) {
 // src/shared/storage/upload.ts
 async function deleteR2Objects(c, objectKeys) {
   const { bucket, mediaRepository, systemStatsRepository } = c.var;
+  const untrackFailures = [];
   await Promise.all(
     objectKeys.map(async (key) => {
       const media = await mediaRepository.getByKey(key).catch(() => null);
@@ -875,9 +877,15 @@ async function deleteR2Objects(c, objectKeys) {
         }
       } catch (err) {
         console.warn(`Failed to untrack media object: ${key}`, err);
+        untrackFailures.push(key);
       }
     })
   );
+  if (untrackFailures.length > 0) {
+    throw new Error(
+      `${untrackFailures.length} media row(s) now out of sync (R2 object deleted but DB untrack/decrement failed): ${untrackFailures.join(", ")}`
+    );
+  }
 }
 
 // src/shared/utils/media-utils.ts
@@ -885,11 +893,14 @@ var MEDIA_URL_PATTERN = /\/api\/media\/([^?#]+)/;
 function extractMediaKey(mediaUrl, cdnUrl) {
   const urlStr = String(mediaUrl);
   if (cdnUrl) {
-    const normalizedCdn = cdnUrl.replace(/\/$/, "");
-    if (urlStr.startsWith(normalizedCdn)) {
-      const keyPart = urlStr.slice(normalizedCdn.length).replace(/^\//, "");
-      const keyWithoutQuery = keyPart.split(/[?#]/)[0];
-      return keyWithoutQuery ? decodeURIComponent(keyWithoutQuery) : null;
+    try {
+      const cdnOrigin = new URL(cdnUrl).origin;
+      const mediaUrlParsed = new URL(urlStr);
+      if (mediaUrlParsed.origin === cdnOrigin) {
+        const keyPart = mediaUrlParsed.pathname.replace(/^\//, "");
+        return keyPart ? decodeURIComponent(keyPart) : null;
+      }
+    } catch {
     }
   }
   const match = MEDIA_URL_PATTERN.exec(urlStr);
@@ -1859,7 +1870,7 @@ function resolveEmailLocale(raw) {
 import { sha256hex as sha256hex3 } from "@beechcms/core";
 var PASSWORD_RESET_TOKEN_EXPIRY_SECONDS = 30 * 60;
 async function requestPasswordReset(context) {
-  const { env, req } = context;
+  const { env, req, executionCtx } = context;
   const useSmtp = env.EMAIL_PROVIDER === "smtp";
   if (!useSmtp && !env.RESEND_API_KEY) {
     return context.json({ error: "Service not available" }, 503);
@@ -1902,21 +1913,28 @@ async function requestPasswordReset(context) {
   const baseUrl = (env.APP_URL ?? new URL(req.url).origin).replace(/\/$/, "");
   const resetUrl = `${baseUrl}/admin/reset-password?token=${resetToken}`;
   const smtpBaseUrl = env.SMTP_HOST ? `http://${env.SMTP_HOST}:${env.SMTP_PORT ?? "8025"}` : void 0;
-  try {
-    await sendPasswordResetEmail({
-      to: normalizedEmail,
-      resetUrl,
-      locale: emailLocale,
-      apiKey: env.RESEND_API_KEY ?? "",
-      from: env.EMAIL_FROM,
-      isDev: env.ENV !== "production",
-      provider: env.EMAIL_PROVIDER,
-      smtpBaseUrl
-    });
-  } catch (error) {
-    if (env.ENV !== "production") {
-      console.error("[password-reset] Failed to send email:", error);
+  const sendNotification = async () => {
+    try {
+      await sendPasswordResetEmail({
+        to: normalizedEmail,
+        resetUrl,
+        locale: emailLocale,
+        apiKey: env.RESEND_API_KEY ?? "",
+        from: env.EMAIL_FROM,
+        isDev: env.ENV !== "production",
+        provider: env.EMAIL_PROVIDER,
+        smtpBaseUrl
+      });
+    } catch (error) {
+      if (env.ENV !== "production") {
+        console.error("[password-reset] Failed to send email:", error);
+      }
     }
+  };
+  try {
+    executionCtx.waitUntil(sendNotification());
+  } catch {
+    void sendNotification();
   }
   return context.json({ success: true });
 }
@@ -2153,6 +2171,26 @@ setupApp.post("/auth/setup", async (context) => {
       });
     }
   }
+  const passwordHash = await context.get("hashProvider").hash(password);
+  const normalizedEmail = email.trim().toLowerCase();
+  const normalizedName = typeof name === "string" ? name.trim() : null;
+  const normalizedSurname = typeof surname === "string" ? surname.trim() : null;
+  const created = await context.get("userRepository").createInitialAdmin({
+    id: context.get("idGenerator").uuid(),
+    email: normalizedEmail,
+    passwordHash,
+    role: "admin",
+    name: normalizedName,
+    surname: normalizedSurname
+  });
+  if (!created) {
+    return publicProblem(context, {
+      type: "setup-already-done",
+      title: "Setup already completed",
+      status: 403,
+      detail: "An administrator account already exists. Initial setup can only be performed once."
+    });
+  }
   if (track === "developer" && loadDemoData === true) {
     await context.get("demoDataRepository").loadDemoData();
     const layout = {
@@ -2238,18 +2276,6 @@ setupApp.post("/auth/setup", async (context) => {
     };
     await context.get("dashboardLayoutRepository").upsert("default", layout, "system");
   }
-  const passwordHash = await context.get("hashProvider").hash(password);
-  const normalizedEmail = email.trim().toLowerCase();
-  const normalizedName = typeof name === "string" ? name.trim() : null;
-  const normalizedSurname = typeof surname === "string" ? surname.trim() : null;
-  await context.get("userRepository").create({
-    id: context.get("idGenerator").uuid(),
-    email: normalizedEmail,
-    passwordHash,
-    role: "admin",
-    name: normalizedName,
-    surname: normalizedSurname
-  });
   if (track === "normal" && company && typeof company === "object") {
     const c = company;
     const companyName = c.name.trim();
@@ -3131,7 +3157,8 @@ async function deleteSeedMediaObjects(context, slug, seed, schemaMutator) {
       }
     }
     if (r2Keys.length > 0) {
-      await deleteR2Objects(context, r2Keys).catch(() => {
+      await deleteR2Objects(context, r2Keys).catch((error) => {
+        console.warn(`Seed drop for '${slug}' left media rows out of sync:`, error);
       });
     }
   } catch {
@@ -3620,10 +3647,13 @@ function interpolate(template, context, defaultValue = "", onMissing) {
     if (val == null || val === "") {
       return defaultValue;
     }
-    return String(val);
+    return escapeHtml(String(val));
   };
   return template.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, replacer);
 }
+function escapeHtml(input) {
+  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 function resolvePath(obj, path) {
   if (path in obj && obj[path] !== void 0) {
     return obj[path];
@@ -5046,7 +5076,8 @@ webhooksApp.post("/qstash", async (context) => {
   try {
     const isValid = await receiver.verify({
       signature,
-      body
+      body,
+      url: context.req.url
     });
     if (!isValid) {
       return context.text("Invalid signature", 401);
@@ -5304,7 +5335,7 @@ function publicRateLimitMiddleware() {
       const remaining = path.slice("/api/v1/public/".length);
       const firstSegment = remaining.split("/")[0];
       if (firstSegment && firstSegment !== "health" && firstSegment !== "schema" && firstSegment !== "schema.html") {
-        seed = firstSegment;
+        seed = c.get("seedRegistry").get(firstSegment) ? firstSegment : "invalid-seed";
       }
     }
     const key = `${getClientIp(c.req)}:${seed}:${limiterName}`;
@@ -5392,7 +5423,11 @@ function applyPublicPolicies(data, seed) {
     const { public: isPublic, visibility } = resolvePolicies7(branch);
     if (!isPublic) continue;
     if (visibility === "hidden") continue;
-    result[branch.alias] = visibility === "masked" && typeof value === "string" && value.length > 0 ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : value;
+    if (visibility === "masked") {
+      result[branch.alias] = typeof value === "string" && value.length > 0 ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : null;
+    } else {
+      result[branch.alias] = value;
+    }
   }
   return result;
 }
@@ -5447,6 +5482,7 @@ async function readSingleEntry(input) {
 }
 
 // src/public/query-builder.ts
+import { resolvePolicies as resolvePolicies8 } from "@beechcms/core";
 var PUBLIC_FILTER_OPERATORS = /* @__PURE__ */ new Set([
   "eq",
   "neq",
@@ -5526,6 +5562,12 @@ function toEngineFilters2(seed, parsedFilter) {
   if (!parsedFilter || parsedFilter.where.length === 0) return [];
   return parsedFilter.where.map((cond) => {
     const branch = seed.branches.find((b) => b.alias === cond.field);
+    if (branch) {
+      const { public: isPublic, filter: filterable } = resolvePolicies8(branch);
+      if (!isPublic || !filterable) {
+        throw new TypeError(`Invalid filter: field '${cond.field}' is not filterable`);
+      }
+    }
     const type = branch ? mapBranchToFilterType(branch.type) : SYSTEM_COLUMNS2.has(cond.field) ? "system" : "text";
     return {
       column: cond.field,
@@ -5633,7 +5675,7 @@ async function publicReadHandler(context) {
 }
 
 // src/public/public-add.ts
-import { isValidContentStatus as isValidContentStatus3, SlugConflictError as SlugConflictError2 } from "@beechcms/core";
+import { isValidContentStatus as isValidContentStatus3, resolvePolicies as resolvePolicies9, SlugConflictError as SlugConflictError2 } from "@beechcms/core";
 
 // src/public/slug-utils.ts
 import { slugify as slugify3, generateEntrySlug } from "@beechcms/core";
@@ -5718,6 +5760,13 @@ async function publicAddHandler(context) {
   if (!isValidContentStatus3(statusValue)) {
     return publicProblem(context, { type: "invalid-status", title: "Bad Request", status: 400, detail: "Invalid status. Allowed values are: draft, review, published" });
   }
+  const sensitiveAliases = Object.keys(rawData).filter((alias) => {
+    const branch = seed.branches.find((b) => b.alias === alias);
+    return branch != null && resolvePolicies9(branch).public === false;
+  });
+  if (sensitiveAliases.length > 0) {
+    return publicProblem(context, { type: "sensitive-field-edit", title: "Unprocessable Entity", status: 422, detail: `Cannot write internal fields: ${sensitiveAliases.join(", ")}` });
+  }
   const sanitized = sanitizePublicPayload(seed, rawData, { operation: "create", allowNull: false, requireAtLeastOneValidField: true, enforceRequiredFields: true });
   if (!sanitized.ok) {
     if (sanitized.status === 422) {
@@ -5725,8 +5774,17 @@ async function publicAddHandler(context) {
     }
     return publicProblem(context, { type: sanitized.code, title: "Bad Request", status: 400, detail: sanitized.message, errors: sanitized.details });
   }
+  let privacyData;
+  try {
+    privacyData = await applyPrivacy(sanitized.data, seed);
+  } catch (error) {
+    if (error instanceof PrivacyPolicyError) {
+      return publicProblem(context, { type: "policy-not-implemented", title: "Not Implemented", status: 501, detail: error.message });
+    }
+    throw error;
+  }
   const idempotencyKey = parseIdempotencyKey(context.req.header("Idempotency-Key"));
-  const finalSlug = pickSlug(body, sanitized.data) || context.get("idGenerator").uuid().slice(0, 8);
+  const finalSlug = pickSlug(body, privacyData) || context.get("idGenerator").uuid().slice(0, 8);
   const repository = context.get("repository");
   const idempotencyRepository = context.get("idempotencyRepository");
   try {
@@ -5750,7 +5808,7 @@ async function publicAddHandler(context) {
     }
     const id = context.get("idGenerator").uuid();
     try {
-      await repository.create(seed, id, finalSlug, statusValue, sanitized.data);
+      await repository.create(seed, id, finalSlug, statusValue, privacyData);
     } catch (error) {
       if (error instanceof SlugConflictError2) {
         return publicProblem(context, { type: "slug-conflict", title: "Conflict", status: 409, detail: `An entry with slug '${finalSlug}' already exists for content type '${seedSlug}'.` });
@@ -5763,7 +5821,7 @@ async function publicAddHandler(context) {
     }
     context.get("notificationService").notify({
       title: `${seed.label}: New entry`,
-      message: `A new entry ("${sanitized.data.title || sanitized.data.name || finalSlug}") has been added via the public API.`,
+      message: `A new entry ("${privacyData.title || privacyData.name || finalSlug}") has been added via the public API.`,
       type: "success"
     });
     return context.json(responseBody, 201);
@@ -5774,7 +5832,7 @@ async function publicAddHandler(context) {
 }
 
 // src/public/public-edit.ts
-import { isValidContentStatus as isValidContentStatus4, resolvePolicies as resolvePolicies8, EntryNotFoundError as EntryNotFoundError7 } from "@beechcms/core";
+import { isValidContentStatus as isValidContentStatus4, resolvePolicies as resolvePolicies10, EntryNotFoundError as EntryNotFoundError7 } from "@beechcms/core";
 var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function errorMessage(context, error) {
   if (context.env.ENV !== "production" && error instanceof Error) return error.message;
@@ -5824,7 +5882,7 @@ function resolveData(context, seed, body) {
   const sensitiveAliases = Object.keys(rawData).filter((alias) => {
     const branch = seed.branches.find((b) => b.alias === alias);
     if (!branch) return false;
-    const policies = resolvePolicies8(branch);
+    const policies = resolvePolicies10(branch);
     return policies.privacy !== "plain" || policies.public === false;
   });
   if (sensitiveAliases.length > 0) {
@@ -6782,21 +6840,12 @@ var D1ContentRepository = class extends BaseD1Repository {
       const draftTableName = this.getTableName(seed.slug, true);
       const mRelBranches = multiRelBranches(seed);
       const mRelAliases = new Set(mRelBranches.map((b) => b.alias));
-      let existingTouched = [];
-      try {
-        const existing = await this.database.prepare(`SELECT _touched_fields FROM ${draftTableName} WHERE entry_id = ?`).bind(entryId).first();
-        if (existing && existing._touched_fields) {
-          existingTouched = JSON.parse(existing._touched_fields);
-        }
-      } catch {
-      }
-      const currentTouched = new Set(existingTouched);
+      const thisCallTouched = [];
       for (const branch of seed.branches) {
         if (Object.hasOwn(data, branch.alias)) {
-          currentTouched.add(branch.alias);
+          thisCallTouched.push(branch.alias);
         }
       }
-      const updatedTouchedFields = Array.from(currentTouched);
       const columnNames = ["entry_id"];
       const placeholders = ["?"];
       const queryBindings = [entryId];
@@ -6813,8 +6862,14 @@ var D1ContentRepository = class extends BaseD1Repository {
       }
       columnNames.push("_touched_fields");
       placeholders.push("?");
-      queryBindings.push(JSON.stringify(updatedTouchedFields));
-      updateClauses.push(`_touched_fields = EXCLUDED._touched_fields`);
+      queryBindings.push(JSON.stringify(thisCallTouched));
+      updateClauses.push(`_touched_fields = (
+        SELECT json_group_array(value) FROM (
+          SELECT value FROM json_each(COALESCE(_touched_fields, '[]'))
+          UNION
+          SELECT value FROM json_each(excluded._touched_fields)
+        )
+      )`);
       updateClauses.push("updated_at = (unixepoch())");
       const sql = `
         INSERT INTO ${draftTableName} (${columnNames.join(", ")})
@@ -7304,6 +7359,18 @@ var D1UserRepository = class {
   async create(user) {
     await this.db.prepare("INSERT INTO users (id, email, password_hash, role, name, surname) VALUES (?, ?, ?, ?, ?, ?)").bind(user.id, user.email, user.passwordHash, user.role, user.name, user.surname).run();
   }
+  async createInitialAdmin(user) {
+    try {
+      await this.db.batch([
+        this.db.prepare("INSERT INTO setup_completed (id) VALUES (1)"),
+        this.db.prepare("INSERT INTO users (id, email, password_hash, role, name, surname) VALUES (?, ?, ?, ?, ?, ?)").bind(user.id, user.email, user.passwordHash, user.role, user.name, user.surname)
+      ]);
+      return true;
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("UNIQUE constraint failed")) return false;
+      throw err;
+    }
+  }
   async updateProfile(userId, fields) {
     const columnAssignments = [];
     const boundValues = [];

package/dist/shared/db/repositories/d1-user.repository.d.ts

@@ -6,6 +6,7 @@ export declare class D1UserRepository implements IUserRepository {
     findById(userId: string): Promise<UserRecord | null>;
     findByEmail(email: string): Promise<UserRecord | null>;
     create(user: NewUserInput): Promise<void>;
+    createInitialAdmin(user: NewUserInput): Promise<boolean>;
     updateProfile(userId: string, fields: {
         name?: string;
         surname?: string;

package/dist/shared/email/templates/automation-mail.d.ts

@@ -1,5 +1,4 @@
 import type { AutomationMailParams } from '../email.types';
-/** Identity builder: automation payloads are already user-authored. */
 export declare function buildAutomationEmail(params: AutomationMailParams): {
     to: string;
     subject: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/factory.d.ts",
@@ -20,7 +20,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
     "@aws-sdk/s3-request-presigner": "^3.995.0",
-    "@beechcms/core": "^0.6.1",
+    "@beechcms/core": "^0.6.3",
     "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
     "hono": "^4.12.21",