@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/templates/app/layout.ppr.tsx

@@ -55,27 +55,22 @@ export const metadata: Metadata = getMetadataOrDefault(
   defaultMetadata
 )
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode
 }>) {
+  const billingHints = await getBillingResourceHints()
+
   return (
     <html lang={DEFAULT_LOCALE} suppressHydrationWarning>
       <head>
-        {(() => {
-          const hints = getBillingResourceHints()
-          return (
-            <>
-              {hints.preconnect.map((domain) => (
-                <link key={`pre-${domain}`} rel="preconnect" href={domain} />
-              ))}
-              {[...hints.preconnect, ...hints.dnsPrefetch].map((domain) => (
-                <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
-              ))}
-            </>
-          )
-        })()}
+        {billingHints.preconnect.map((domain) => (
+          <link key={`pre-${domain}`} rel="preconnect" href={domain} />
+        ))}
+        {[...billingHints.preconnect, ...billingHints.dnsPrefetch].map((domain) => (
+          <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
+        ))}
       </head>
       <body
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
@@ -84,7 +79,12 @@ export default function RootLayout({
           <NextThemeProvider
             attribute="class"
             defaultTheme={DEFAULT_THEME_MODE}
-            enableSystem={DEFAULT_THEME_MODE === 'system'}
+            // Always true here: this layout never passes forcedTheme, so
+            // ThemeToggle is unconditionally visible and offers "System" as one
+            // of its 3 choices — gating on DEFAULT_THEME_MODE === 'system' had
+            // the same bug as the non-PPR layout (see #175): a build-time
+            // default of 'light'/'dark' silently broke the "System" option.
+            enableSystem
             disableTransitionOnChange
           >
             <CustomThemeProvider>

package/templates/app/layout.tsx

@@ -15,11 +15,15 @@ import { getBillingResourceHints } from "@nextsparkjs/core/lib/billing/gateways/
 import { ThemeProvider as NextThemeProvider } from "@nextsparkjs/core/providers/theme-provider"
 import { ThemeProvider as CustomThemeProvider } from "@nextsparkjs/core/lib/theme/ThemeProvider"
 import { Toaster } from "@nextsparkjs/core/components/ui/sonner"
+import { QueryProvider } from "@nextsparkjs/core/providers/query-provider"
+import { TeamProvider } from "@nextsparkjs/core/contexts/TeamContext"
+import { SubscriptionProvider } from "@nextsparkjs/core/contexts/SubscriptionContext"
 import { getUserLocale } from '@nextsparkjs/core/lib/locale'
 import { TranslationContextManager } from "@nextsparkjs/core/providers/TranslationContextManager"
+import { SessionCookieRefresher } from "@nextsparkjs/core/components/auth/SessionCookieRefresher"
 import { PluginService } from '@nextsparkjs/core/lib/services'
 import { getMetadataOrDefault } from '@nextsparkjs/core/lib/template-resolver'
-import { getDefaultThemeMode } from '@nextsparkjs/core/lib/theme/get-default-theme-mode'
+import { getThemeSettings } from '@nextsparkjs/core/lib/theme/get-default-theme-mode'
 
 const geistSans = Geist({
   variable: "--font-geist-sans",
@@ -55,24 +59,18 @@ export default async function RootLayout({
 
   const locale = await getUserLocale()
   const messages = await getMessages({ locale })
-  const defaultTheme = await getDefaultThemeMode()
+  const { defaultMode, allowUserToggle, forcedThemeRoutes } = await getThemeSettings()
+  const billingHints = await getBillingResourceHints()
 
   return (
     <html lang={locale} suppressHydrationWarning>
       <head>
-        {(() => {
-          const hints = getBillingResourceHints()
-          return (
-            <>
-              {hints.preconnect.map((domain) => (
-                <link key={`pre-${domain}`} rel="preconnect" href={domain} />
-              ))}
-              {[...hints.preconnect, ...hints.dnsPrefetch].map((domain) => (
-                <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
-              ))}
-            </>
-          )
-        })()}
+        {billingHints.preconnect.map((domain) => (
+          <link key={`pre-${domain}`} rel="preconnect" href={domain} />
+        ))}
+        {[...billingHints.preconnect, ...billingHints.dnsPrefetch].map((domain) => (
+          <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
+        ))}
       </head>
       <body
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
@@ -80,14 +78,42 @@ export default async function RootLayout({
         <NextIntlClientProvider locale={locale} messages={messages}>
           <NextThemeProvider
             attribute="class"
-            defaultTheme={defaultTheme}
-            enableSystem
+            defaultTheme={defaultMode}
+            // When allowUserToggle is false, force the theme and ignore localStorage/system
+            forcedTheme={!allowUserToggle ? defaultMode : undefined}
+            // Detect OS preference whenever the user can toggle at all. ThemeToggle
+            // always offers "System" as one of its 3 choices when toggling is
+            // allowed, so the provider must be able to resolve it whenever that's
+            // true — gating on `defaultMode === 'system'` looks equivalent at
+            // first render, but defaultMode is the user's last SAVED preference
+            // for a logged-in user (see getThemeSettings), not a static "is
+            // system-matching enabled" flag. That made "System" silently write a
+            // literal, unmatched `class="system"` for anyone whose saved
+            // preference (or the theme's own config default) wasn't already
+            // 'system' — see #175.
+            enableSystem={allowUserToggle}
+            // Force a theme on the routes declared in theme.config.ts (forcedThemeRoutes)
+            forcedThemeRoutes={forcedThemeRoutes}
             disableTransitionOnChange
           >
             <CustomThemeProvider>
-              <TranslationContextManager />
-              <main>{children}</main>
-              <Suspense><Toaster position="bottom-left" /></Suspense>
+              {/* Team providers live here (not only in DashboardProviders) so the activeTeamId
+                  cookie is synced from any route, matching layout.ppr.tsx — see #115.
+                  DashboardProviders skips re-mounting them when already present. */}
+              <QueryProvider>
+                <TeamProvider>
+                  <SubscriptionProvider>
+                    <TranslationContextManager />
+                    {/* Real session-cookie renewal for installed PWAs: the render-time
+                        session reads above (getUserLocale/getThemeSettings) cannot
+                        write cookies, so the rolling refresh is triggered from the
+                        client through the auth Route Handler instead. */}
+                    <SessionCookieRefresher />
+                    <main>{children}</main>
+                    <Suspense><Toaster position="bottom-left" /></Suspense>
+                  </SubscriptionProvider>
+                </TeamProvider>
+              </QueryProvider>
             </CustomThemeProvider>
           </NextThemeProvider>
         </NextIntlClientProvider>

package/templates/contents/themes/starter/config/app.config.ts

@@ -115,6 +115,25 @@ export const APP_CONFIG_OVERRIDES = {
         enabled: false,
       },
     },
+    /**
+     * Login methods, in priority order. Core default = passwordless preset:
+     * a one-time code by email + Google, no password field (needs an email
+     * provider — RESEND_API_KEY — and GOOGLE_CLIENT_ID/SECRET for Google).
+     *
+     * Uncomment to switch to the classic email + password preset, or list both
+     * (the first email method is the form shown first):
+     */
+    // methods: ['email-password', 'google'],
+    // methods: ['email-otp', 'email-password', 'google'],
+
+    /**
+     * Session duration / renewal in seconds (defaults: 7 days, renewed daily).
+     * Long-lived sessions for an installed PWA, for example:
+     */
+    // session: {
+    //   expiresIn: 60 * 60 * 24 * 90, // 90 days
+    //   updateAge: 60 * 60 * 24 * 7,  // renew weekly
+    // },
     /**
      * Whether Better Auth automatically sends the verification email on signup.
      *

package/templates/contents/themes/starter/config/theme.config.ts

@@ -22,6 +22,12 @@ export const starterThemeConfig: ThemeConfig = {
   // ==========================================
   plugins: [],
 
+  // ==========================================
+  // THEME MODE (Optional)
+  // ==========================================
+  // defaultMode: 'system',                    // 'light' | 'dark' | 'system'
+  // forcedThemeRoutes: { '/login': 'light' }, // force a theme on route prefixes (longest wins)
+
   // ==========================================
   // STYLES CONFIGURATION
   // ==========================================

package/templates/contents/themes/starter/styles/globals.css

@@ -200,8 +200,12 @@
 /* =============================================
    BASE STYLES
    ============================================= */
-* {
-  border-color: var(--border);
+/* Must live in @layer base: un-layered rules beat every Tailwind v4 utility
+   (border-primary, border-destructive, ...) regardless of specificity. */
+@layer base {
+  * {
+    border-color: var(--border);
+  }
 }
 
 body {

package/templates/proxy.ts

@@ -64,9 +64,48 @@ function isPublicPath(pathname: string): boolean {
   )
 }
 
+/**
+ * Identity headers this proxy injects for downstream server code.
+ *
+ * SECURITY (#87): these headers are trusted by RSC layouts and permission
+ * checks, so an inbound value must NEVER reach the app. They are stripped from
+ * every request before any path branching and re-added only from the verified
+ * session. Gating the strip on protected prefixes is not enough: Next.js
+ * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
+ * action can be POSTed to a public path with a forged `x-user-id`.
+ */
+const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname'] as const
+
+/**
+ * Build the request headers forwarded to the app: inbound copy minus every
+ * trusted identity header, plus the real pathname.
+ */
+function sanitizeRequestHeaders(request: NextRequest): Headers {
+  const headers = new Headers(request.headers)
+  for (const name of TRUSTED_IDENTITY_HEADERS) {
+    headers.delete(name)
+  }
+  headers.set('x-pathname', request.nextUrl.pathname)
+  return headers
+}
+
+/**
+ * Continue to the app with the (sanitized) request headers.
+ * Every pass-through in this proxy MUST go through here so the strip applies
+ * to public paths, /api/v1 and unmatched routes alike.
+ */
+function passThrough(requestHeaders: Headers): NextResponse {
+  return NextResponse.next({
+    request: { headers: requestHeaders },
+  })
+}
+
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl
 
+  // 0. Strip forgeable identity headers before ANY branching (see #87)
+  const requestHeaders = sanitizeRequestHeaders(request)
+
   // 1. Check for theme middleware override
   const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
   if (activeTheme && hasThemeMiddleware(activeTheme)) {
@@ -114,17 +153,17 @@ export async function proxy(request: NextRequest) {
         return NextResponse.redirect(loginUrl)
       }
     }
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 4. Allow public paths
   if (isPublicPath(pathname)) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 5. API v1 routes handle their own dual authentication
   if (pathname.startsWith('/api/v1')) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 6. Protected routes - require authentication and inject user headers
@@ -162,20 +201,17 @@ export async function proxy(request: NextRequest) {
         }
       }
 
-      // Inject user headers for downstream use
+      // Inject user headers for downstream use, ONLY from the verified session
+      // (requestHeaders already had any inbound values stripped).
       // IMPORTANT: EntityPermissionLayout depends on these headers
-      const requestHeaders = new Headers(request.headers)
       if (session.user?.id) {
         requestHeaders.set('x-user-id', session.user.id)
       }
       if (session.user?.email) {
         requestHeaders.set('x-user-email', session.user.email)
       }
-      requestHeaders.set('x-pathname', pathname)
 
-      return NextResponse.next({
-        request: { headers: requestHeaders },
-      })
+      return passThrough(requestHeaders)
     } catch (error) {
       console.error('Proxy error:', error)
       const loginUrl = new URL('/login', request.url)
@@ -184,7 +220,7 @@ export async function proxy(request: NextRequest) {
     }
   }
 
-  return NextResponse.next()
+  return passThrough(requestHeaders)
 }
 
 export const config = {

package/templates/tsconfig.json

@@ -56,6 +56,10 @@
   ],
   "exclude": [
     "node_modules",
+    // PPR template variants (layout.ppr.tsx) are copied over layout.tsx when a project
+    // enables cacheComponents; in place they import registry exports that only exist
+    // in PPR mode, so they are never type-checked as-is.
+    "**/*.ppr.tsx",
     "**/*.test.ts",
     "**/*.test.tsx",
     "**/*.spec.ts",

package/tests/jest/__mocks__/@nextsparkjs/registries/permissions-registry.ts

@@ -36,3 +36,26 @@ export const TEAM_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
   member: ['team.view', 'team.members.view'],
   viewer: ['team.view'],
 }
+
+// Entity permissions used by service tests (mirrors the default theme's customers entity)
+const ENTITY_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
+  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete'],
+  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update'],
+  editor: ['customers.read', 'customers.list'],
+  member: ['customers.read', 'customers.list'],
+  viewer: [],
+}
+
+export const ROLE_PERMISSIONS_ARRAY: Record<string, string[]> = Object.fromEntries(
+  AVAILABLE_ROLES.map((role) => [
+    role,
+    [...(TEAM_PERMISSIONS_BY_ROLE[role] ?? []), ...(ENTITY_PERMISSIONS_BY_ROLE[role] ?? [])],
+  ])
+)
+
+export const PERMISSIONS_BY_ROLE: Record<string, Set<string>> = Object.fromEntries(
+  Object.entries(ROLE_PERMISSIONS_ARRAY).map(([role, perms]) => [role, new Set(perms)])
+)
+
+export const ALL_PERMISSIONS: string[] = Array.from(new Set(Object.values(ROLE_PERMISSIONS_ARRAY).flat()))
+export const ALL_PERMISSIONS_SET: Set<string> = new Set(ALL_PERMISSIONS)

package/tests/jest/__mocks__/next-server.js

@@ -9,6 +9,14 @@ class MockNextRequest {
     this.method = options.method || 'GET'
     this.headers = new Map(Object.entries(options.headers || {}))
     this._body = options.body
+    // Minimal nextUrl (pathname/origin/searchParams/clone) for proxy/middleware tests
+    try {
+      const parsed = new URL(url, 'http://localhost')
+      parsed.clone = () => new URL(parsed.toString())
+      this.nextUrl = parsed
+    } catch {
+      this.nextUrl = undefined
+    }
   }
 
   async json() {
@@ -48,6 +56,22 @@ class MockNextResponse {
       headers: { 'Content-Type': 'application/json', ...options.headers }
     })
   }
+
+  // Pass-through response. Keeps the forwarded request headers (if any) so
+  // middleware/proxy tests can assert what reaches the app.
+  static next(init = {}) {
+    const response = new MockNextResponse(null, { status: 200, headers: init.headers })
+    response.type = 'next'
+    response.requestHeaders = init.request && init.request.headers ? init.request.headers : null
+    return response
+  }
+
+  static redirect(url, status = 307) {
+    const response = new MockNextResponse(null, { status, headers: { Location: String(url) } })
+    response.type = 'redirect'
+    response.redirectUrl = String(url)
+    return response
+  }
 }
 
 module.exports = {

package/dist/lib/config/index.d.js

@@ -1,7 +0,0 @@
-export * from "./config-utils.js";
-export * from "./config-loader.js";
-export * from "./config-sync.js";
-import { defineConfig } from "./nextspark-types.js";
-export {
-  defineConfig
-};

package/dist/lib/email/index.d.js

@@ -1,3 +0,0 @@
-export * from "./types.js";
-export * from "./factory.js";
-export * from "./templates.js";

package/dist/lib/scheduled-actions/index.d.js

@@ -1,19 +0,0 @@
-import { registerScheduledAction, getActionHandler, getAllRegisteredActions, isActionRegistered, clearActionRegistry } from "./registry.js";
-import { scheduleAction, scheduleRecurringAction, cancelScheduledAction } from "./scheduler.js";
-import { processPendingActions } from "./processor.js";
-import { cleanupOldActions } from "./cleanup.js";
-import { initializeScheduledActions, initializeRecurringActions } from "./initializer.js";
-export {
-  cancelScheduledAction,
-  cleanupOldActions,
-  clearActionRegistry,
-  getActionHandler,
-  getAllRegisteredActions,
-  initializeRecurringActions,
-  initializeScheduledActions,
-  isActionRegistered,
-  processPendingActions,
-  registerScheduledAction,
-  scheduleAction,
-  scheduleRecurringAction
-};

package/dist/lib/scheduled-actions/initializer.d.js

@@ -1 +0,0 @@
-import "server-only";

package/dist/lib/services/index.d.js

@@ -1,40 +0,0 @@
-import { UserService } from "./user.service.js";
-import { MetaService } from "./meta.service.js";
-import { PlanService } from "./plan.service.js";
-import { SubscriptionService } from "./subscription.service.js";
-import { UsageService } from "./usage.service.js";
-import { InvoiceService } from "./invoice.service.js";
-import { TeamService } from "./team.service.js";
-import { TeamMemberService } from "./team-member.service.js";
-import { PermissionService } from "./permission.service.js";
-import { MembershipService, TeamMembership } from "./membership.service.js";
-import { ThemeService } from "./theme.service.js";
-import { EntityTypeService } from "./entity-type.service.js";
-import { NamespaceService } from "./namespace.service.js";
-import { MiddlewareService } from "./middleware.service.js";
-import { ScopeService } from "./scope.service.js";
-import { RouteHandlerService } from "./route-handler.service.js";
-import { PluginService, usePlugin } from "./plugin.service.js";
-import { ApiRoutesService } from "./api-routes.service.js";
-export {
-  ApiRoutesService,
-  EntityTypeService,
-  InvoiceService,
-  MembershipService,
-  MetaService,
-  MiddlewareService,
-  NamespaceService,
-  PermissionService,
-  PlanService,
-  PluginService,
-  RouteHandlerService,
-  ScopeService,
-  SubscriptionService,
-  TeamMemberService,
-  TeamMembership,
-  TeamService,
-  ThemeService,
-  UsageService,
-  UserService,
-  usePlugin
-};