@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/templates/projects/starter/templates/dashboard/analytics/layout.tsx

@@ -0,0 +1,14 @@
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { selectMessages } from '@nextsparkjs/core/lib/i18n/client-messages'
+
+// TasksChart and RecentActivity are client components that read the `analytics`
+// namespace, which the dashboard group does not carry to the browser by default.
+export default async function AnalyticsLayout({ children }: { children: React.ReactNode }) {
+  const messages = await getMessages()
+  return (
+    <NextIntlClientProvider messages={selectMessages(messages, 'dashboard', ['analytics'])}>
+      {children}
+    </NextIntlClientProvider>
+  )
+}

package/templates/proxy.ts

@@ -20,8 +20,8 @@
  * themselves and use only x-pathname from here, as a routing hint; the
  * identity headers are still stripped and re-set for project code.
  */
-import { betterFetch } from '@better-fetch/fetch'
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import {
   hasProjectMiddleware,
   executeProjectMiddleware,
@@ -181,14 +181,25 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
 }
 
 /**
- * The session the request's cookies carry, asked of this app's own auth route,
- * which is served under the base path like every other route.
+ * The session the request's cookies carry, read in this process the way core's
+ * server code reads it. Asking the app's own /api/auth/get-session over HTTP
+ * built the URL from the request's origin, which behind a proxy that
+ * terminates TLS (X-Forwarded-Proto: https) is https on a port that speaks
+ * plain HTTP: the fetch failed and every signed-in user was sent to /login.
+ * Nothing here leaves the process, so no forwarded scheme or host can point
+ * the check anywhere. `disableRefresh`: this response cannot carry the renewed
+ * session cookie, so the rolling renewal is left to the auth route
+ * (lib/auth/session-refresh). `disableCookieCache`: the session comes from the
+ * database, not the signed session_data cookie, so a sign-out, a revoked
+ * session or a role change counts at once (lib/auth/authorization-session).
+ * A suspended account's session is no session (lib/auth/suspension).
  */
-function getSession(request: NextRequest) {
-  return betterFetch<Session>('/api/auth/get-session', {
-    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
-    headers: { cookie: request.headers.get('cookie') || '' },
+async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true, disableCookieCache: true },
   })
+  return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null
 }
 
 /**
@@ -490,7 +501,6 @@ export async function proxy(request: NextRequest) {
   const verifiedSession = async (): Promise<Session | null> => {
     if (!sessionPromise) {
       sessionPromise = getSession(request)
-        .then(({ data }) => data)
         .catch(error => {
           sessionError = error
           return null

package/templates/public/uploads/README.md

@@ -1,97 +1,8 @@
-# Media Upload System
+# Media uploads
 
-## Overview
-This application uses **Vercel Blob Storage** for all media uploads. Files are stored in the cloud, not on the local filesystem.
+`POST /api/v1/media/upload` stores files in **Vercel Blob** when `BLOB_READ_WRITE_TOKEN` is set. The media library lists the Blob URLs.
 
-> **Note:** This directory (`public/uploads/`) is legacy from a previous filesystem-based implementation and is no longer used.
+- **Development without a token:** files are written to `public/uploads/temp/` (git-ignored) so the library works offline.
+- **Production without a token:** the upload answers `503` with code `STORAGE_NOT_CONFIGURED`. Nothing is written to disk: a file under `public/` is not served until the next restart and does not survive a redeploy.
 
-## Upload Endpoint
-**POST** `/api/v1/media/upload`
-
-### Authentication
-Requires valid user session (Better Auth)
-
-### Request
-- **Content-Type**: `multipart/form-data`
-- **Field name**: `files` (accepts multiple files)
-
-### Supported File Types
-- Images: JPEG, PNG, GIF, WebP
-- Videos: MP4, MPEG, QuickTime, WebM
-
-### File Size Limit
-- Maximum: 10MB per file
-
-### Response
-```json
-{
-  "message": "Files uploaded successfully",
-  "urls": [
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_abc123.jpg",
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_def456.png"
-  ],
-  "count": 2
-}
-```
-
-## File Naming Convention
-Files are automatically renamed using the pattern:
-```
-{timestamp}_{randomString}.{extension}
-```
-
-Example: `1704067200000_k9x2m4p.jpg`
-
-## Storage Location
-- **Storage Provider**: Vercel Blob (cloud object storage)
-- **Blob Path**: `uploads/temp/{filename}` (organizational prefix, not a filesystem path)
-- **Public URL**: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/{filename}`
-
-### How It Works
-
-**Local Development:**
-- Files are uploaded directly to Vercel Blob using `BLOB_READ_WRITE_TOKEN` from `.env`
-- No files are saved to your local filesystem
-- URLs point to Vercel's CDN
-
-**Production/Staging:**
-- Same behavior - files go directly to Vercel Blob
-- Uses environment-specific Blob token
-- No filesystem writes (Vercel serverless is read-only)
-
-## Usage in AI Content Generation
-The generate-content endpoint (`/api/content-buddy/generate-content`) automatically processes images for AI analysis.
-
-**Supported URL formats:**
-- Vercel Blob URLs: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/image.jpg`
-- External URLs: `https://example.com/image.jpg` (also supported)
-
-## Configuration
-Requires `BLOB_READ_WRITE_TOKEN` environment variable:
-
-```env
-BLOB_READ_WRITE_TOKEN="vercel_blob_rw_..."
-```
-
-## Cleanup
-Files are managed through Vercel Blob's retention policies.
-
-**Manual cleanup** (if needed):
-```typescript
-import { del } from '@vercel/blob'
-
-// Delete specific file
-await del(fileUrl)
-
-// Or list and delete old files
-import { list } from '@vercel/blob'
-const { blobs } = await list({ prefix: 'uploads/temp/' })
-// Filter and delete as needed
-```
-
-## Security Notes
-- All uploads require authentication
-- File type validation prevents malicious uploads
-- File size limits prevent DoS attacks
-- Random filenames prevent enumeration attacks
-- Files stored in secure Vercel Blob infrastructure
+Self-hosting needs a storage provider: set `BLOB_READ_WRITE_TOKEN` (a Vercel Blob token, starts with `vercel_blob_`). See the media library docs.

package/tests/jest/__mocks__/@nextsparkjs/registries/api-presets-registry.ts

@@ -0,0 +1,2 @@
+/** Jest mock: no API presets. */
+export const API_PRESETS_REGISTRY = { endpoints: {} }

package/tests/jest/__mocks__/@nextsparkjs/registries/mcp-registry.ts

@@ -0,0 +1,2 @@
+/** Jest mock: no MCP overrides. */
+export const MCP_OVERRIDES = {}

package/tests/jest/__mocks__/@nextsparkjs/registries/permissions-registry.ts

@@ -37,12 +37,13 @@ export const TEAM_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
   viewer: ['team.view'],
 }
 
-// Entity permissions used by service tests (mirrors the default theme's customers entity)
+// Entity permissions used by service tests (mirrors the default theme's customers entity, and the starter's
+// posts entity, whose `publish` action is owner/admin only)
 const ENTITY_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
-  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete'],
-  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update'],
+  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete', 'posts.create', 'posts.update', 'posts.publish'],
+  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'posts.create', 'posts.update', 'posts.publish'],
   editor: ['customers.read', 'customers.list'],
-  member: ['customers.read', 'customers.list'],
+  member: ['customers.read', 'customers.list', 'posts.create', 'posts.update'],
   viewer: [],
 }
 

package/dist/templates/public/uploads/.gitignore

@@ -1,6 +0,0 @@
-# Ignore all uploaded files
-temp/*
-!temp/.gitkeep
-
-# Keep the directory structure
-!.gitignore

package/dist/templates/public/uploads/temp/.gitkeep

@@ -1 +0,0 @@
-# Keep this directory in git but ignore uploaded files

package/templates/public/uploads/.gitignore

@@ -1,6 +0,0 @@
-# Ignore all uploaded files
-temp/*
-!temp/.gitkeep
-
-# Keep the directory structure
-!.gitignore

package/templates/public/uploads/temp/.gitkeep

@@ -1 +0,0 @@
-# Keep this directory in git but ignore uploaded files