@next-friday/create-app 9.1.0 → 9.2.0

package/templates/payload/src/app/(frontend)/page.test.ts

@@ -8,7 +8,7 @@ describe("Page", () => {
   it("renders the template heading and the admin link", () => {
     const html = renderToStaticMarkup(createElement(Page));
 
-    expect(html).toContain("Next Friday Payload template");
+    expect(html).toContain("Payload application");
     expect(html).toContain('href="/admin"');
   });
 });

package/templates/payload/src/app/(frontend)/page.tsx

@@ -3,7 +3,7 @@ import Link from "next/link";
 export default function Page() {
   return (
     <main>
-      <h1>Next Friday Payload template</h1>
+      <h1>Payload application</h1>
 
       <p>
         Edit <code>src/app/(frontend)/page.tsx</code> to get started, or open the{" "}

package/templates/payload/src/app/health/route.test.ts

@@ -1,4 +1,5 @@
-import {describe, expect, it, vi} from "vitest";
+import {beforeEach, describe, expect, it, vi} from "vitest";
+import {getPayload} from "payload";
 
 import {GET} from "./route";
 
@@ -6,8 +7,20 @@ vi.mock("next/server", () => ({
   connection: vi.fn(async () => {}),
 }));
 
+vi.mock("@payload-config", () => ({
+  default: {},
+}));
+
+vi.mock("payload", () => ({
+  getPayload: vi.fn(),
+}));
+
 describe("GET /health", () => {
-  it("reports ok without caching", async () => {
+  beforeEach(() => {
+    vi.mocked(getPayload).mockReset();
+  });
+
+  it("reports ok without caching once Payload is ready", async () => {
     const response = await GET();
 
     expect(response.status).toBe(200);
@@ -17,4 +30,9 @@ describe("GET /health", () => {
       status: "ok",
     });
   });
+
+  it("fails when Payload cannot initialise", async () => {
+    vi.mocked(getPayload).mockRejectedValue(new Error("database unreachable"));
+    await expect(GET()).rejects.toThrow("database unreachable");
+  });
 });

package/templates/payload/src/app/health/route.ts

@@ -1,13 +1,20 @@
+import config from "@payload-config";
 import {connection} from "next/server";
+import {getPayload} from "payload";
 
 /**
- * Report that the server is up, for platform health checks. Rendered per request and never cached, so a
- * stopped server cannot pass from a cached response.
+ * Report that the server is up and Payload is ready, for platform health checks. Initialising Payload connects to
+ * the database and applies pending migrations, so an unreachable or unmigrated database fails the check. Rendered
+ * per request and never cached, so a stopped server cannot pass from a cached response.
  * @returns A JSON response with `status: "ok"`.
  */
 async function get(): Promise<Response> {
   await connection();
 
+  await getPayload({
+    config,
+  });
+
   return Response.json(
     {
       status: "ok",

package/templates/payload/src/collections/media.test.ts

@@ -1,8 +1,12 @@
-import {describe, expect, it} from "vitest";
+import {afterEach, describe, expect, it, vi} from "vitest";
 import type {PayloadRequest} from "payload";
 
 import {Media} from "./media";
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 describe("Media", () => {
   it("lets anyone read uploaded files", () => {
     const read = Media.access?.read;
@@ -24,4 +28,35 @@ describe("Media", () => {
       }),
     );
   });
+
+  it.each([
+    ["image/png", true],
+    ["image/svg+xml", false],
+  ])("validates the uploaded file type %s as accepted: %j", async (mimeType, accepted) => {
+    vi.stubEnv("APP_URL", "http://localhost:3000");
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("../payload.config");
+    const resolved = await config;
+    const media = resolved.collections.find(collection => collection.slug === "media");
+
+    const field = media?.fields.find(
+      candidate => "name" in candidate && candidate.name === "mimeType",
+    );
+
+    expect(field).toBeDefined();
+
+    const {validate} = field as {
+      validate?: (value: string, options: object) => unknown;
+    };
+
+    const result = validate?.(mimeType, {
+      siblingData: {
+        filename: "upload",
+      },
+    });
+
+    expect(result === true).toBe(accepted);
+  });
 });

package/templates/payload/src/collections/media.ts

@@ -10,7 +10,7 @@ export const Media: CollectionConfig = {
     },
   ],
   upload: {
-    mimeTypes: ["image/*"],
+    mimeTypes: ["image/avif", "image/gif", "image/jpeg", "image/png", "image/webp"],
   },
   access: {
     read: () => true,

package/templates/payload/src/payload.config.test.ts

@@ -5,8 +5,11 @@ interface PackageManifest {
   dependencies?: Record<string, string>;
 }
 
+const publicURL = "https://app.example.test";
+
 afterEach(() => {
   vi.unstubAllEnvs();
+  vi.resetModules();
 });
 
 describe("payload config", () => {
@@ -21,6 +24,18 @@ describe("payload config", () => {
     expect(resolved.graphQL.disable).toBe(true);
   });
 
+  it("accepts cross-origin requests only from the public URL", async () => {
+    vi.stubEnv("APP_URL", publicURL);
+    vi.stubEnv("PAYLOAD_SECRET", "test-secret");
+    vi.stubEnv("DATABASE_URL", "postgres://postgres:postgres@127.0.0.1:5432/payload");
+
+    const {default: config} = await import("./payload.config");
+    const resolved = await config;
+
+    expect(resolved.serverURL).toBe(publicURL);
+    expect(resolved.cors).toEqual([publicURL]);
+  });
+
   it("does not add an extra peer dependency", () => {
     const manifest = JSON.parse(
       readFileSync(new URL("../package.json", import.meta.url), "utf8"),

package/templates/payload/test/home.e2e.test.ts

@@ -1,13 +1,9 @@
 import {expect, test} from "@playwright/test";
 
-test("home page shows the template heading", async ({page}) => {
-  await page.goto("/");
+test("serves the home page", async ({page}) => {
+  const response = await page.goto("/");
 
-  await expect(
-    page.getByRole("heading", {
-      level: 1,
-    }),
-  ).toHaveText("Next Friday Payload template");
+  expect(response?.status()).toBe(200);
 });
 
 test("admin panel asks for a user to sign in or create the first user", async ({page}) => {

package/templates/payload/tsconfig.json

@@ -18,7 +18,6 @@
       }
     ],
     "paths": {
-      "@/*": ["./src/*"],
       "@payload-config": ["./src/payload.config.ts"]
     },
     "allowJs": true

package/templates/turborepo/.agents/agents/verifier.md

@@ -1 +1 @@
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.agents/review.md

@@ -0,0 +1,21 @@
+# Review instructions
+
+## Passes
+
+Run three passes and tag each finding with its pass:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection risks, authentication gaps, PII in logs
+- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+
+## What Important means here
+
+Reserve Important for findings that would break behavior, leak data or breach a policy. Style and naming are nits.
+
+## Cap the nits
+
+Report at most five nits per review; summarize the rest as a count.
+
+## Do not report
+
+Generated files and anything CI already enforces: `pnpm-lock.yaml`, `apps/backoffice/src/app/(payload)/**`, `apps/backoffice/src/migrations/**`, and `apps/backoffice/src/payload-types.ts`.

package/templates/turborepo/.claude/agents/verifier.md

@@ -4,4 +4,4 @@ description: Runs the app and checks the change works before the session reports
 tools: Bash, Read
 ---
 
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.cursor/agents/verifier.md

@@ -4,4 +4,4 @@ description: Runs the app and checks the change works before the session reports
 readonly: true
 ---
 
-Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.
+Start the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.dockerignore

@@ -1,12 +1,17 @@
-node_modules
+*
+!package.json
+!pnpm-lock.yaml
+!pnpm-workspace.yaml
+!apps/
+!packages/
 **/node_modules
 **/.next
 **/.turbo
 **/coverage
+**/test-results
+**/playwright-report
+apps/backoffice/media
 **/.env
 **/.env.*
-!**/.env.example
-.git
-.github
 **/*.test.ts
 **/*.test.tsx

package/templates/turborepo/.github/ISSUE_TEMPLATE/bug.yml

@@ -21,7 +21,22 @@ body:
     id: version
     attributes:
       label: Commit
-      placeholder: 769e0ef
+      placeholder: Output of `git rev-parse --short HEAD`
+    validations:
+      required: true
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Affected area
+      description: Select the area where the problem appears.
+      options:
+        - App pages and routes
+        - Backoffice collections and admin panel
+        - Components and styling
+        - Configuration and environment
+        - Tooling / CI
+        - Documentation
+        - Repository governance
     validations:
       required: true
   - type: textarea

package/templates/turborepo/.github/dependabot.yml

@@ -7,7 +7,6 @@ updates:
       interval: weekly
       day: monday
       time: "09:00"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     open-pull-requests-limit: 10
@@ -15,10 +14,6 @@ updates:
       prefix: chore
       prefix-development: chore
       include: scope
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - version-update:semver-major
     groups:
       minor-patch:
         applies-to: version-updates
@@ -29,13 +24,11 @@ updates:
           - patch
 
   - package-ecosystem: github-actions
-    directories:
-      - /
+    directory: /
     schedule:
       interval: weekly
       day: monday
       time: "09:30"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:
@@ -54,7 +47,6 @@ updates:
       interval: weekly
       day: monday
       time: "10:00"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:
@@ -71,7 +63,6 @@ updates:
       interval: weekly
       day: monday
       time: "10:30"
-      timezone: Asia/Bangkok
     cooldown:
       default-days: 7
     commit-message:

package/templates/turborepo/.github/scripts/affected-apps.sh

@@ -5,27 +5,9 @@ base="${1-}"
 head="${2:-HEAD}"
 
 if [[ -z "$base" ]]; then
-  printf '%s\n' app backoffice
-  exit 0
-fi
-
-query="$(pnpm exec turbo query affected --packages --base "$base" --head "$head")"
-paths="$(printf '%s' "$query" | jq -r '.data.affectedPackages.items[].path // empty')"
-
-app=false
-backoffice=false
-
-while IFS= read -r path; do
-  case "$path" in
-    apps/app) app=true ;;
-    apps/backoffice) backoffice=true ;;
-  esac
-done <<< "$paths"
-
-if [[ "$app" == true ]]; then
-  printf '%s\n' app
-fi
-
-if [[ "$backoffice" == true ]]; then
-  printf '%s\n' backoffice
+  query="$(pnpm exec turbo query 'query { packages { items { path } } }')"
+  printf '%s' "$query" | jq --compact-output '[.data.packages.items[].path | select(startswith("apps/")) | ltrimstr("apps/")]'
+else
+  query="$(pnpm exec turbo query affected --packages --base "$base" --head "$head")"
+  printf '%s' "$query" | jq --compact-output '[.data.affectedPackages.items[].path | select(startswith("apps/")) | ltrimstr("apps/")]'
 fi