@nextsparkjs/core 0.1.0-beta.7 → 0.1.0-beta.70

package/dist/templates/app/api/v1/users/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { queryWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import { 
-  createApiResponse, 
+import {
+  createApiResponse,
   createApiError,
   parsePaginationParams,
   createPaginationMeta,
@@ -17,6 +17,7 @@ import {
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { hasAdminPermission } from '@nextsparkjs/core/lib/api/auth/permissions';
 import { z } from 'zod';
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 const createUserSchema = z.object({
   email: z.string().email('Invalid email format'),
@@ -38,7 +39,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/users - List users with dual auth
-export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -108,10 +109,10 @@ export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-});
+}), 'read');
 
 // POST /api/v1/users - Create user with dual auth
-export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -193,5 +194,5 @@ export const POST = withApiLogging(async (req: NextRequest): Promise<NextRespons
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-});
+}), 'write');
 

package/dist/templates/app/dashboard/(main)/[entity]/[id]/page.tsx

@@ -1,9 +1,14 @@
 import { notFound, redirect } from 'next/navigation'
-import { getEntity, getEntityRegistry, getChildEntities } from '@nextsparkjs/core/lib/entities/queries'
+import { getEntity, getEntityRegistry, getChildEntities, setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
 import { EntityDetailWrapper } from '@nextsparkjs/core/components/entities/wrappers/EntityDetailWrapper'
 import type { Metadata } from 'next'
 import { TemplateService } from '@nextsparkjs/core/lib/services/template.service'
 import type { EntityConfig, ChildEntityDefinition } from '@nextsparkjs/core/lib/entities/types'
+// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+
+// Initialize registry at module load time (before any component renders)
+setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
 // Type guard to check if entity is a full EntityConfig
 function isEntityConfig(entity: EntityConfig | ChildEntityDefinition): entity is EntityConfig {

package/dist/templates/app/dashboard/(main)/[entity]/layout.tsx

@@ -1,113 +1,27 @@
 /**
- * Entity Permission Layout
+ * Entity Layout (Dynamic Routes Fallback)
  *
- * Server Component that validates entity permissions BEFORE rendering any page.
- * This layout is NOT overridable by themes to ensure security.
+ * This layout handles dynamic entity routes that don't have specific template pages.
  *
- * IMPORTANT: Do NOT use getTemplateOrDefault here - security must not be bypassable.
+ * IMPORTANT: Permission checking is now handled by the parent layout at:
+ * app/dashboard/(main)/layout.tsx
  *
- * Flow:
- * 1. User navigates to /dashboard/companies/create
- * 2. Browser sends activeTeamId cookie automatically
- * 3. This layout reads cookie and checks permission via checkPermission()
- * 4. If denied, redirects to /dashboard/permission-denied
- * 5. If allowed, renders the page (children)
- */
-import { headers, cookies } from 'next/headers'
-import { redirect } from 'next/navigation'
-import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
-import { isValidPermission } from '@nextsparkjs/core/lib/permissions/init'
-import type { Permission } from '@nextsparkjs/core/lib/permissions/types'
-
-type EntityAction = 'list' | 'read' | 'create' | 'update' | 'delete'
-
-/**
- * Detect the required action from the pathname
+ * This ensures permissions are checked for ALL routes, including:
+ * - Template routes (e.g., /dashboard/ai-agents/create with specific page.tsx)
+ * - Dynamic routes (e.g., /dashboard/[entity]/create fallback)
  *
- * @param pathname - Full pathname (e.g., /dashboard/companies/create)
- * @param entitySlug - Entity slug (e.g., companies)
- * @returns The action being attempted
+ * Previously, permission checking was here but it never executed for template routes
+ * because Next.js route specificity gives priority to explicit paths over dynamic ones.
  */
-function detectActionFromPathname(pathname: string, entitySlug: string): EntityAction {
-  const entityPath = `/dashboard/${entitySlug}`
-  const relativePath = pathname.replace(entityPath, '')
-
-  // List: /dashboard/companies or /dashboard/companies/
-  if (relativePath === '' || relativePath === '/') return 'list'
-
-  // Create: /dashboard/companies/create
-  if (relativePath === '/create') return 'create'
-
-  // Update: /dashboard/companies/[id]/edit
-  if (relativePath.match(/^\/[^/]+\/edit$/)) return 'update'
-
-  // Read: /dashboard/companies/[id] (single detail view)
-  if (relativePath.match(/^\/[^/]+$/)) return 'read'
-
-  // Default fallback for any other path
-  return 'read'
-}
 
 interface EntityLayoutProps {
   children: React.ReactNode
   params: Promise<{ entity: string }>
 }
 
-export default async function EntityPermissionLayout({
-  children,
-  params
+export default async function EntityLayout({
+  children
 }: EntityLayoutProps) {
-  const { entity } = await params
-  const headersList = await headers()
-  const cookieStore = await cookies()
-
-  // Get pathname from middleware header
-  const pathname = headersList.get('x-pathname') || ''
-
-  // Get userId from middleware header (set for all authenticated routes)
-  const userId = headersList.get('x-user-id')
-
-  // Get teamId from cookie (set by TeamContext and /api/v1/teams/switch)
-  const teamId = cookieStore.get('activeTeamId')?.value
-
-  // Skip validation if missing required data
-  // - No userId: middleware will redirect to login (shouldn't happen for dashboard routes)
-  // - No teamId: user hasn't selected a team yet, let page handle it
-  if (!userId || !teamId) {
-    console.log('[EntityPermissionLayout] Skipping validation - missing data:', {
-      entity,
-      userId: !!userId,
-      teamId: !!teamId
-    })
-    return <>{children}</>
-  }
-
-  // Skip permission validation for routes that don't have entity permissions
-  // These are custom template pages (like agent-single, agent-multi) that aren't real entities
-  if (!isValidPermission(`${entity}.list` as Permission)) {
-    console.log('[EntityPermissionLayout] Skipping validation - no entity permission config for:', entity)
-    return <>{children}</>
-  }
-
-  // Detect required action from pathname
-  const action = detectActionFromPathname(pathname, entity)
-  const permission = `${entity}.${action}` as Permission
-
-  console.log('[EntityPermissionLayout] Checking permission:', {
-    entity,
-    action,
-    permission,
-    userId,
-    teamId
-  })
-
-  // Check permission using existing core function
-  const hasPermission = await checkPermission(userId, teamId, permission)
-
-  if (!hasPermission) {
-    console.log('[EntityPermissionLayout] Permission denied, redirecting')
-    redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`)
-  }
-
+  // Permission checking handled by parent (main)/layout.tsx
   return <>{children}</>
 }

package/dist/templates/app/dashboard/(main)/[entity]/page.tsx

@@ -1,9 +1,15 @@
 import { notFound } from 'next/navigation'
-import { getEntity, getEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
+import { getEntity, getEntityRegistry, setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
 import { EntityListWrapper } from '@nextsparkjs/core/components/entities/wrappers/EntityListWrapper'
 import type { Metadata } from 'next'
 import { getTemplateOrDefault } from '@nextsparkjs/core/lib/template-resolver'
 import type { EntityConfig, ChildEntityDefinition } from '@nextsparkjs/core/lib/entities/types'
+// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+
+// Initialize registry at module load time (before any component renders)
+// This ensures the registry is available even if this page loads before the layout
+setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
 // Type guard to check if entity is a full EntityConfig
 function isEntityConfig(entity: EntityConfig | ChildEntityDefinition): entity is EntityConfig {

package/dist/templates/app/dashboard/(main)/layout.tsx

@@ -1,33 +1,100 @@
+/**
+ * Main Dashboard Layout with Permission Checking
+ *
+ * This layout handles:
+ * 1. Entity registry initialization
+ * 2. Server-side permission validation for entity routes
+ * 3. Rendering the DashboardShell with entity navigation
+ *
+ * IMPORTANT: Permission checking MUST be in this layout (not in [entity]/layout.tsx)
+ * because (templates) routes with specific paths take precedence over dynamic [entity] routes.
+ */
+import { headers, cookies } from 'next/headers'
+import { redirect } from 'next/navigation'
 import { DashboardShell } from '@nextsparkjs/core/components/dashboard/layouts/DashboardShell'
-import { getRegisteredEntities } from '@nextsparkjs/core/lib/entities/queries'
 import { serializeEntityConfig, type SerializableEntityConfig } from '@nextsparkjs/core/lib/entities/serialization'
+import { setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
 import { getTemplateOrDefault } from '@nextsparkjs/core/lib/template-resolver'
-import { TemplateService } from '@nextsparkjs/core/lib/services/template.service'
 import type { EntityConfig, ChildEntityDefinition } from '@nextsparkjs/core/lib/entities/types'
+import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
+import { isValidPermission } from '@nextsparkjs/core/lib/permissions/init'
+import type { Permission } from '@nextsparkjs/core/lib/permissions/types'
+// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
 
-// Debug: Check template override status at module load
-const LAYOUT_PATH = 'app/dashboard/(main)/layout.tsx'
-console.log('[MainLayout] Checking template override for:', LAYOUT_PATH)
-console.log('[MainLayout] hasTemplateOverride:', TemplateService.hasOverride(LAYOUT_PATH))
-console.log('[MainLayout] templateEntry:', TemplateService.getEntry(LAYOUT_PATH)?.template?.themeName)
+// Register entities globally so other parts of the app can access them via getRegisteredEntities()
+setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
+
+type EntityAction = 'list' | 'read' | 'create' | 'update' | 'delete'
+
+/**
+ * Parse entity and action from pathname
+ * Handles paths like: /dashboard/ai-agents, /dashboard/ai-agents/create, /dashboard/ai-agents/[id]/edit
+ */
+function parseEntityFromPathname(pathname: string): { entity: string; action: EntityAction } | null {
+  // Match /dashboard/[entity] patterns
+  const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/)
+  if (!match) return null
+
+  const entity = match[1]
+  const rest = match[2] || ''
+
+  // Detect action from the rest of the path
+  if (rest === '' || rest === '/') return { entity, action: 'list' }
+  if (rest === 'create') return { entity, action: 'create' }
+  if (rest.match(/^[^/]+\/edit$/)) return { entity, action: 'update' }
+  if (rest.match(/^[^/]+$/)) return { entity, action: 'read' }
+
+  // Default to read for any other path
+  return { entity, action: 'read' }
+}
 
 // Type guard to check if entity is a full EntityConfig
 function isEntityConfig(entity: EntityConfig | ChildEntityDefinition): entity is EntityConfig {
   return 'slug' in entity
 }
 
-// Default main dashboard layout component
-// Note: AuthGuard removed - authentication guaranteed by parent CoreDashboardLayout
-function DefaultMainDashboardLayout({
+// Default main dashboard layout component with permission checking
+async function DefaultMainDashboardLayout({
   children
 }: {
   children: React.ReactNode
 }) {
-  const allEntities = getRegisteredEntities()
+  // Get entities directly from the imported registry
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const allEntities = Object.values(ENTITY_REGISTRY).map(entry => (entry as any).config)
   // Filter to only include full EntityConfig (not child entities)
   const entities = allEntities.filter(isEntityConfig)
   const serializedEntities: SerializableEntityConfig[] = entities.map(serializeEntityConfig)
 
+  // === PERMISSION CHECK ===
+  const headersList = await headers()
+  const cookieStore = await cookies()
+
+  // Get pathname from middleware header
+  const pathname = headersList.get('x-pathname') || ''
+  const userId = headersList.get('x-user-id')
+  const teamId = cookieStore.get('activeTeamId')?.value
+
+  // Only check permissions if we have the required data
+  if (userId && teamId && pathname) {
+    const parsed = parseEntityFromPathname(pathname)
+
+    if (parsed) {
+      const { entity, action } = parsed
+      const permission = `${entity}.${action}` as Permission
+
+      // Only check if this is a valid entity permission
+      if (isValidPermission(`${entity}.list` as Permission)) {
+        const hasPermission = await checkPermission(userId, teamId, permission)
+
+        if (!hasPermission) {
+          redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`)
+        }
+      }
+    }
+  }
+
   return (
     <DashboardShell entities={serializedEntities}>
       {children}

package/dist/templates/app/dashboard/(main)/loading.tsx

@@ -0,0 +1,5 @@
+import { SkeletonDashboardHome } from '@nextsparkjs/core/components/ui/skeleton-dashboard'
+
+export default function DashboardLoading() {
+  return <SkeletonDashboardHome />
+}

package/dist/templates/app/dashboard/(main)/patterns/[id]/edit/page.tsx

@@ -0,0 +1,114 @@
+/**
+ * Patterns Edit Page
+ *
+ * Wrapper that delegates to the BuilderEditorView for pattern editing.
+ */
+
+'use client'
+
+import { notFound, useRouter } from 'next/navigation'
+import { useParams } from 'next/navigation'
+import { useEffect, useState } from 'react'
+import { clientEntityRegistry, ensureClientInitialized, type ClientEntityConfig } from '@nextsparkjs/registries/entity-registry.client'
+import { EntityFormWrapper } from '@nextsparkjs/core/components/entities/wrappers/EntityFormWrapper'
+import { BuilderEditorView } from '@nextsparkjs/core/components/dashboard/block-editor/builder-editor-view'
+import { Alert, AlertDescription } from '@nextsparkjs/core/components/ui/alert'
+import { getEntityData } from '@nextsparkjs/core/lib/api/entities'
+
+export default function PatternEditPage() {
+  const params = useParams()
+  const router = useRouter()
+  const [entityConfig, setEntityConfig] = useState<ClientEntityConfig | null>(null)
+  const [initialData, setInitialData] = useState<Record<string, unknown> | null>(null)
+  const [loading, setLoading] = useState(true)
+
+  const entitySlug = 'patterns'
+  const entityId = params.id as string
+
+  useEffect(() => {
+    async function loadEntityData() {
+      if (!entityId) {
+        setLoading(false)
+        return
+      }
+
+      try {
+        await ensureClientInitialized()
+        const config = clientEntityRegistry.getBySlug(entitySlug)
+
+        if (!config) {
+          setEntityConfig(null)
+          setLoading(false)
+          return
+        }
+
+        setEntityConfig(config)
+
+        // For builder-enabled entities, BuilderEditorView handles its own data fetching
+        // For regular entities, fetch data here
+        if (!config.builder?.enabled) {
+          const data = await getEntityData(entitySlug, entityId, true)
+          setInitialData(data as Record<string, unknown>)
+        }
+      } catch (error) {
+        console.error('Error loading pattern:', error)
+        setEntityConfig(null)
+        setInitialData(null)
+      } finally {
+        setLoading(false)
+      }
+    }
+
+    loadEntityData()
+  }, [entityId])
+
+  if (loading) {
+    return (
+      <div className="flex items-center justify-center min-h-[400px]">
+        <div className="animate-spin rounded-full h-8 w-8 border-b-2 border-primary" />
+      </div>
+    )
+  }
+
+  if (!entityConfig || !entityConfig.features?.enabled) {
+    return (
+      <Alert>
+        <AlertDescription>
+          Patterns entity is not configured or not enabled.
+        </AlertDescription>
+      </Alert>
+    )
+  }
+
+  // Use BuilderEditorView for builder-enabled entities
+  if (entityConfig.builder?.enabled) {
+    return (
+      <BuilderEditorView
+        entitySlug={entitySlug}
+        entityConfig={entityConfig}
+        id={entityId}
+        mode="edit"
+      />
+    )
+  }
+
+  // For non-builder entities, we need the initial data
+  if (!initialData) {
+    notFound()
+  }
+
+  // Use EntityFormWrapper for regular entities
+  return (
+    <EntityFormWrapper
+      entityType={entitySlug}
+      id={entityId}
+      mode="edit"
+      onSuccess={() => {
+        router.push(`/dashboard/${entitySlug}/${entityId}`)
+      }}
+      onError={(error) => {
+        console.error('Error updating pattern:', error)
+      }}
+    />
+  )
+}

package/dist/templates/app/dashboard/(main)/patterns/[id]/page.tsx

@@ -0,0 +1,20 @@
+/**
+ * Patterns Detail Page
+ *
+ * For builder-enabled entities like patterns, this redirects to edit mode.
+ */
+
+import { redirect } from 'next/navigation'
+
+interface PageProps {
+  params: Promise<{
+    id: string
+  }>
+}
+
+export default async function PatternDetailPage({ params }: PageProps) {
+  const resolvedParams = await params
+
+  // Patterns are builder-enabled, so redirect to edit view
+  redirect(`/dashboard/patterns/${resolvedParams.id}/edit`)
+}

package/dist/templates/app/dashboard/(main)/patterns/[id]/reports/page.tsx

@@ -0,0 +1,171 @@
+/**
+ * Pattern Usage Reports Page
+ *
+ * Shows detailed usage reports for a specific pattern.
+ * Displays stats cards and a table of entities using the pattern.
+ */
+
+'use client'
+
+import { useParams, useRouter } from 'next/navigation'
+import { useEffect, useState } from 'react'
+import Link from 'next/link'
+import { ArrowLeft, Edit, LayoutGrid } from 'lucide-react'
+import { clientEntityRegistry, ensureClientInitialized } from '@nextsparkjs/registries/entity-registry.client'
+import { PatternUsageReport } from '@nextsparkjs/core/components/patterns/PatternUsageReport'
+import { Button } from '@nextsparkjs/core/components/ui/button'
+import { Alert, AlertDescription, AlertTitle } from '@nextsparkjs/core/components/ui/alert'
+import { Skeleton } from '@nextsparkjs/core/components/ui/skeleton'
+import { getEntityData } from '@nextsparkjs/core/lib/api/entities'
+
+interface PatternData {
+  id: string
+  name?: string
+  title?: string
+}
+
+export default function PatternReportsPage() {
+  const params = useParams()
+  const router = useRouter()
+  const patternId = params.id as string
+
+  const [pattern, setPattern] = useState<PatternData | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    async function loadPattern() {
+      if (!patternId) {
+        setError('Pattern ID is required')
+        setLoading(false)
+        return
+      }
+
+      try {
+        // Ensure entity registry is initialized
+        await ensureClientInitialized()
+        const config = clientEntityRegistry.getBySlug('patterns')
+
+        if (!config || !config.features?.enabled) {
+          setError('Patterns entity is not configured or not enabled')
+          setLoading(false)
+          return
+        }
+
+        // Load pattern data
+        const data = await getEntityData('patterns', patternId, false) as PatternData
+        setPattern(data)
+      } catch (err) {
+        console.error('Error loading pattern:', err)
+        setError(err instanceof Error ? err.message : 'Failed to load pattern')
+      } finally {
+        setLoading(false)
+      }
+    }
+
+    loadPattern()
+  }, [patternId])
+
+  if (loading) {
+    return (
+      <div className="p-6 space-y-6" data-cy="pattern-reports-loading">
+        <div className="flex items-center gap-4">
+          <Skeleton className="h-8 w-8" />
+          <Skeleton className="h-8 w-64" />
+        </div>
+        <Skeleton className="h-4 w-96" />
+        <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-4">
+          {[...Array(4)].map((_, i) => (
+            <Skeleton key={i} className="h-24" />
+          ))}
+        </div>
+        <Skeleton className="h-64" />
+      </div>
+    )
+  }
+
+  if (error) {
+    return (
+      <div className="p-6" data-cy="pattern-reports-error">
+        <Alert variant="destructive">
+          <AlertTitle>Error</AlertTitle>
+          <AlertDescription>{error}</AlertDescription>
+        </Alert>
+        <Button
+          variant="outline"
+          className="mt-4"
+          onClick={() => router.push('/dashboard/patterns')}
+        >
+          <ArrowLeft className="mr-2 h-4 w-4" />
+          Back to Patterns
+        </Button>
+      </div>
+    )
+  }
+
+  if (!pattern) {
+    return (
+      <div className="p-6" data-cy="pattern-reports-not-found">
+        <Alert>
+          <AlertTitle>Pattern Not Found</AlertTitle>
+          <AlertDescription>
+            The pattern you are looking for does not exist or has been deleted.
+          </AlertDescription>
+        </Alert>
+        <Button
+          variant="outline"
+          className="mt-4"
+          onClick={() => router.push('/dashboard/patterns')}
+        >
+          <ArrowLeft className="mr-2 h-4 w-4" />
+          Back to Patterns
+        </Button>
+      </div>
+    )
+  }
+
+  const patternName = pattern.name || pattern.title || pattern.id
+
+  return (
+    <div className="p-6 space-y-6" data-cy="pattern-reports-page">
+      {/* Header */}
+      <div className="flex flex-col gap-4 md:flex-row md:items-center md:justify-between">
+        <div className="flex items-center gap-4">
+          <Button
+            variant="ghost"
+            size="icon"
+            asChild
+            data-cy="pattern-reports-back"
+          >
+            <Link href="/dashboard/patterns">
+              <ArrowLeft className="h-4 w-4" />
+            </Link>
+          </Button>
+          <div>
+            <div className="flex items-center gap-2">
+              <LayoutGrid className="h-5 w-5 text-muted-foreground" />
+              <h1 className="text-2xl font-bold tracking-tight" data-cy="pattern-reports-title">
+                {patternName}
+              </h1>
+            </div>
+            <p className="text-sm text-muted-foreground mt-1">
+              Usage reports and analytics
+            </p>
+          </div>
+        </div>
+
+        <div className="flex items-center gap-2">
+          <Button variant="outline" asChild data-cy="pattern-reports-edit">
+            <Link href={`/dashboard/patterns/${patternId}/edit`}>
+              <Edit className="mr-2 h-4 w-4" />
+              Edit Pattern
+            </Link>
+          </Button>
+        </div>
+      </div>
+
+      {/* Usage Report */}
+      <PatternUsageReport patternId={patternId} pageSize={20} />
+    </div>
+  )
+}