@smi-digital/create-smi-app 2.9.1 → 2.10.0

package/dist/index.js

@@ -505,10 +505,10 @@ async function createApps(projectRoot, targets) {
         );
       }
       await runStep(
-        "Adding Postgres driver (pg) for production",
+        "Adding Postgres + email-provider dependencies for production",
         async () => runCommandQuiet(
           "npm",
-          ["install", "pg"],
+          ["install", "pg", "@strapi/provider-email-nodemailer"],
           join4(projectRoot, target.directory)
         )
       );
@@ -702,21 +702,23 @@ async function activateVaultFilter(projectRoot) {
   } catch {
     return;
   }
-  const setFilter = async (key, value) => runCommandQuiet(
-    "git",
-    ["config", `filter.ansible-vault.${key}`, value],
-    projectRoot
-  );
+  const setConfig = async (key, value) => runCommandQuiet("git", ["config", key, value], projectRoot);
   try {
-    await setFilter(
-      "clean",
-      "ansible-vault encrypt --vault-password-file .vault-password --output=- -"
-    );
-    await setFilter(
-      "smudge",
+    await setConfig("filter.ansible-vault.clean", "sh .gitvault/clean.sh %f");
+    await setConfig(
+      "filter.ansible-vault.smudge",
       "ansible-vault decrypt --vault-password-file .vault-password --output=- -"
     );
-    await setFilter("required", "true");
+    await setConfig("filter.ansible-vault.required", "true");
+    await setConfig(
+      "merge.ansible-vault.name",
+      "Ansible-Vault aware 3-way merge"
+    );
+    await setConfig(
+      "merge.ansible-vault.driver",
+      "sh .gitvault/merge.sh %O %A %B %P"
+    );
+    await setConfig("diff.ansible-vault.textconv", "sh .gitvault/textconv.sh");
   } catch {
     console.warn(
       "Could not configure the Ansible-Vault git filter automatically. Run `npm run setup:vault` before committing."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.9.1",
+  "version": "2.10.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/base/package.json.template

@@ -9,7 +9,7 @@
     "prettier": "npx prettier --write .",
     "lint": "npx eslint .",
     "prepare": "husky",
-    "setup:vault": "git config filter.ansible-vault.clean \"ansible-vault encrypt --vault-password-file .vault-password --output=- -\" && git config filter.ansible-vault.smudge \"ansible-vault decrypt --vault-password-file .vault-password --output=- -\" && git config filter.ansible-vault.required true && echo '✅ Ansible-Vault Git Filters configured successfully!'",
+    "setup:vault": "git config filter.ansible-vault.clean 'sh .gitvault/clean.sh %f' && git config filter.ansible-vault.smudge 'ansible-vault decrypt --vault-password-file .vault-password --output=- -' && git config filter.ansible-vault.required true && git config merge.ansible-vault.name 'Ansible-Vault aware 3-way merge' && git config merge.ansible-vault.driver 'sh .gitvault/merge.sh %O %A %B %P' && git config diff.ansible-vault.textconv 'sh .gitvault/textconv.sh' && echo '✅ Ansible-Vault Git filters configured successfully!'",
     "knip": "knip",
     "depcruise": "depcruise . --exclude \"node_modules|dist|.husky|test\"",
     "depcheck": "npm run knip && npm run depcruise",

package/templates/integrations/strapi-astro/.gitattributes.template

@@ -1,2 +1,6 @@
 # Use Ansible-Vault Git filters for production environment files
 production.*.env filter=ansible-vault diff=ansible-vault merge=ansible-vault
+
+# The vault filter/merge/diff helpers are invoked as shell scripts; force LF so a
+# CRLF checkout on Windows can't break them.
+.gitvault/*.sh text eol=lf

package/templates/integrations/strapi-astro/.gitvault/clean.sh.template

@@ -0,0 +1,41 @@
+#!/bin/sh
+# Idempotent Ansible-Vault "clean" filter (encrypt on the way INTO git).
+#
+# Why this exists: `ansible-vault encrypt` uses a random salt, so encrypting the
+# same plaintext twice produces DIFFERENT ciphertext. With a naive clean filter
+# git re-encrypts on every status/diff/checkout and therefore ALWAYS sees the
+# file as "modified" — phantom diffs, salt-only churn baked into history, and
+# rebases/stashes that conflict on the ciphertext.
+#
+# This wrapper makes the filter deterministic: if the plaintext is unchanged
+# from what is already committed, it re-emits the EXISTING ciphertext verbatim
+# (no re-salt), so git sees no change. Only a real plaintext edit re-encrypts.
+#
+# Invoked by git as:  sh .gitvault/clean.sh %f   (%f = repo-relative path)
+#   stdin  = working-tree plaintext
+#   stdout = ciphertext to store in the index/commit
+set -eu
+
+path="${1:-}"
+pwfile=".vault-password"
+
+new="$(mktemp)"
+old_cipher="$(mktemp)"
+old_plain="$(mktemp)"
+trap 'rm -f "$new" "$old_cipher" "$old_plain"' EXIT
+
+cat > "$new"
+
+# The ciphertext already recorded for this path in the index (if any). Missing on
+# a first add, or unreadable if it was committed as plaintext once — both cases
+# fall through to a fresh encrypt.
+if [ -n "$path" ] \
+  && git cat-file -p ":$path" > "$old_cipher" 2>/dev/null \
+  && ansible-vault decrypt --vault-password-file "$pwfile" --output=- "$old_cipher" > "$old_plain" 2>/dev/null \
+  && cmp -s "$new" "$old_plain"; then
+  # Plaintext identical to what's stored → reuse the stored ciphertext (no re-salt).
+  cat "$old_cipher"
+else
+  # New file or a genuine plaintext change → encrypt fresh.
+  ansible-vault encrypt --vault-password-file "$pwfile" --output=- "$new"
+fi

package/templates/integrations/strapi-astro/.gitvault/merge.sh.template

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Ansible-Vault aware merge driver — merges at the PLAINTEXT level.
+#
+# Git's default merge would 3-way-merge the opaque ciphertext and conflict on
+# nearly everything (different salts even when the plaintext agrees). This driver
+# decrypts the three inputs, runs a normal 3-way text merge, then RE-ENCRYPTS the
+# result. Git stores %A's bytes verbatim and then runs the smudge filter on them,
+# so %A must contain CIPHERTEXT (verified behaviour).
+#
+# Invoked by git as:  sh .gitvault/merge.sh %O %A %B %P
+#   %O = common-ancestor (base) ciphertext file
+#   %A = our version ciphertext file  (ALSO the output file git reads back)
+#   %B = their version ciphertext file
+#   %P = the real pathname (used only for conflict-marker labels)
+# Exit 0 = clean merge; non-zero = conflict (git marks the path unmerged, then
+# smudges %A so the working tree shows readable plaintext conflict markers).
+set -eu
+
+base="$1"; ours="$2"; theirs="$3"; path="${4:-file}"
+pwfile=".vault-password"
+
+# Decrypt $1 to stdout; if it isn't vault-encrypted (e.g. an empty base), pass
+# it through unchanged so the merge still has something to work with.
+dec() {
+  ansible-vault decrypt --vault-password-file "$pwfile" --output=- "$1" 2>/dev/null || cat "$1"
+}
+
+o="$(mktemp)"; a="$(mktemp)"; b="$(mktemp)"
+trap 'rm -f "$o" "$a" "$b"' EXIT
+dec "$base"   > "$o"
+dec "$ours"   > "$a"
+dec "$theirs" > "$b"
+
+# 3-way merge on plaintext, written in place into "$a". Returns the conflict
+# count (0 = clean); capture it instead of letting `set -e` abort.
+status=0
+git merge-file -L "ours ($path)" -L "base ($path)" -L "theirs ($path)" "$a" "$o" "$b" || status=$?
+
+# Re-encrypt the (possibly conflict-marked) result back into %A as ciphertext.
+ansible-vault encrypt --vault-password-file "$pwfile" --output=- "$a" > "$ours"
+
+exit "$status"

package/templates/integrations/strapi-astro/.gitvault/textconv.sh.template

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Ansible-Vault diff textconv: render a vault file as plaintext for `git diff`.
+#
+# git applies this to BOTH sides of a diff — the committed blob (ciphertext) and
+# the working-tree copy (already decrypted by the smudge filter). So decrypt when
+# possible and fall back to cat when the input isn't vault-encrypted, otherwise
+# the working-tree side errors with "Input is not vault encrypted data".
+#
+# Invoked by git as:  sh .gitvault/textconv.sh <path>
+ansible-vault decrypt --vault-password-file .vault-password --output=- "$1" 2>/dev/null || cat "$1"

package/templates/integrations/strapi-astro/backend/config/plugins.ts.template

@@ -0,0 +1,20 @@
+export default ({ env }) => ({
+    email: {
+        config: {
+            provider: 'nodemailer',
+            providerOptions: {
+                host: env('SMTP_HOST', 'smtp.example.com'),
+                port: env.int('SMTP_PORT', 587),
+                auth: {
+                    user: env('SMTP_USER'),
+                    pass: env('SMTP_PASSWORD'),
+                },
+                secure: false, // true for 465, false for other ports
+            },
+            settings: {
+                defaultFrom: env('SMTP_DEFAULT_FROM'),
+                defaultReplyTo: env('SMTP_DEFAULT_REPLY_TO'),
+            },
+        },
+    },
+});

package/templates/integrations/strapi-astro/backend/config/server.ts.template

@@ -0,0 +1,15 @@
+import type { Core } from '@strapi/strapi';
+
+const config = ({ env }: Core.Config.Shared.ConfigParams): Core.Config.Server => ({
+  host: env('HOST', '0.0.0.0'),
+  port: env.int('PORT', 1337),
+  // Public URL of the CMS backend itself. Used to build absolute links such as
+  // the admin password-reset email; without it Strapi falls back to host:port
+  // (e.g. http://0.0.0.0:1337). Set via PUBLIC_URL in production.backend.env.
+  url: env('PUBLIC_URL', undefined),
+  app: {
+    keys: env.array('APP_KEYS'),
+  },
+});
+
+export default config;

package/templates/integrations/strapi-astro/backend/src/extensions/users-permissions/strapi-server.ts.template

@@ -0,0 +1,223 @@
+import type { Core } from '@strapi/strapi';
+
+export type EmailLocale = 'de' | 'en';
+
+export interface ResetPasswordTemplateVars {
+    USER: { username: string; email: string };
+    URL: string;
+    TOKEN: string;
+}
+
+export interface EmailConfirmationTemplateVars {
+    USER: { username: string; email: string };
+    URL: string;
+    CODE: string;
+}
+
+// ─── Reset Password ────────────────────────────────────────────────────────────
+
+const resetPasswordSubject: Record<EmailLocale, string> = {
+    de: 'Passwort zurücksetzen – __PROJECT_DOMAIN__',
+    en: 'Reset your password – __PROJECT_DOMAIN__',
+};
+
+const resetPasswordHtml: Record<EmailLocale, (v: ResetPasswordTemplateVars) => string> = {
+    de: (v) => `
+        <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+            <h2>Hallo ${v.USER.username},</h2>
+            <p>wir haben eine Anfrage zum Zurücksetzen deines Passworts erhalten.</p>
+            <p>Klicke auf den folgenden Link, um dein Passwort zurückzusetzen:</p>
+            <p>
+                <a href="${v.URL}?code=${v.TOKEN}"
+                   style="display:inline-block;padding:12px 24px;background:#1C135D;color:#fff;text-decoration:none;border-radius:4px">
+                    Passwort zurücksetzen
+                </a>
+            </p>
+            <p style="color:#888;font-size:13px">
+                Falls du diese Anfrage nicht gestellt hast, kannst du diese E-Mail ignorieren.
+            </p>
+        </div>`,
+
+    en: (v) => `
+        <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+            <h2>Hi ${v.USER.username},</h2>
+            <p>We received a request to reset your password.</p>
+            <p>Click the link below to choose a new password:</p>
+            <p>
+                <a href="${v.URL}?code=${v.TOKEN}"
+                   style="display:inline-block;padding:12px 24px;background:#1C135D;color:#fff;text-decoration:none;border-radius:4px">
+                    Reset password
+                </a>
+            </p>
+            <p style="color:#888;font-size:13px">
+                If you did not request this, you can safely ignore this email.
+            </p>
+        </div>`,
+};
+
+const resetPasswordText: Record<EmailLocale, (v: ResetPasswordTemplateVars) => string> = {
+    de: (v) =>
+        `Hallo ${v.USER.username},\n\nKlicke auf diesen Link, um dein Passwort zurückzusetzen:\n${v.URL}?code=${v.TOKEN}\n\nFalls du diese Anfrage nicht gestellt hast, ignoriere diese E-Mail.`,
+    en: (v) =>
+        `Hi ${v.USER.username},\n\nClick this link to reset your password:\n${v.URL}?code=${v.TOKEN}\n\nIf you did not request this, ignore this email.`,
+};
+
+// ─── Email Confirmation ────────────────────────────────────────────────────────
+
+const emailConfirmationSubject: Record<EmailLocale, string> = {
+    de: 'E-Mail-Adresse bestätigen – __PROJECT_DOMAIN__',
+    en: 'Confirm your email address – __PROJECT_DOMAIN__',
+};
+
+const emailConfirmationHtml: Record<EmailLocale, (v: EmailConfirmationTemplateVars) => string> = {
+    de: (v) => `
+        <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+            <h2>Hallo ${v.USER.username},</h2>
+            <p>Bitte bestätige deine E-Mail-Adresse, indem du auf den folgenden Link klickst:</p>
+            <p>
+                <a href="${v.URL}?confirmation=${v.CODE}"
+                   style="display:inline-block;padding:12px 24px;background:#1C135D;color:#fff;text-decoration:none;border-radius:4px">
+                    E-Mail bestätigen
+                </a>
+            </p>
+            <p style="color:#888;font-size:13px">
+                Falls du kein Konto erstellt hast, kannst du diese E-Mail ignorieren.
+            </p>
+        </div>`,
+
+    en: (v) => `
+        <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+            <h2>Hi ${v.USER.username},</h2>
+            <p>Please confirm your email address by clicking the link below:</p>
+            <p>
+                <a href="${v.URL}?confirmation=${v.CODE}"
+                   style="display:inline-block;padding:12px 24px;background:#1C135D;color:#fff;text-decoration:none;border-radius:4px">
+                    Confirm email
+                </a>
+            </p>
+            <p style="color:#888;font-size:13px">
+                If you did not create an account, you can safely ignore this email.
+            </p>
+        </div>`,
+};
+
+const emailConfirmationText: Record<EmailLocale, (v: EmailConfirmationTemplateVars) => string> = {
+    de: (v) =>
+        `Hallo ${v.USER.username},\n\nBitte bestätige deine E-Mail-Adresse:\n${v.URL}?confirmation=${v.CODE}\n\nFalls du kein Konto erstellt hast, ignoriere diese E-Mail.`,
+    en: (v) =>
+        `Hi ${v.USER.username},\n\nPlease confirm your email address:\n${v.URL}?confirmation=${v.CODE}\n\nIf you did not create an account, ignore this email.`,
+};
+
+// ─── Helpers ───────────────────────────────────────────────────────────────────
+
+function resolveLocale(raw: unknown): EmailLocale {
+    if (raw === 'en') return 'en';
+    return 'de';
+}
+
+// ─── Extension ────────────────────────────────────────────────────────────────
+
+export default (plugin: any): any => {
+    const originalBootstrap = plugin.bootstrap;
+
+    plugin.bootstrap = async ({ strapi }: { strapi: Core.Strapi }): Promise<void> => {
+        // Run the original bootstrap first
+        if (originalBootstrap) {
+            await originalBootstrap({ strapi });
+        }
+
+        const authController = strapi
+            .plugin('users-permissions')
+            .controller('auth') as Record<string, Function>;
+
+        // ── Override: forgotPassword ──────────────────────────────────────────
+        authController.forgotPassword = async (ctx: any): Promise<void> => {
+            const locale = resolveLocale(ctx.request.body?.locale ?? ctx.query?.locale);
+            const email: string = (ctx.request.body?.email as string)?.toLowerCase();
+
+            if (!email) {
+                return ctx.badRequest('email is required');
+            }
+
+            const user = await strapi.db
+                .query('plugin::users-permissions.user')
+                .findOne({ where: { email } });
+
+            if (!user || user.blocked) {
+                ctx.send({ ok: true });
+                return;
+            }
+
+            const crypto = await import('crypto');
+            const resetPasswordToken = crypto.randomBytes(64).toString('hex');
+
+            const baseUrl = (process.env.PROD_URL ?? '').replace(/\/+$/, '');
+            const resetUrl = `${baseUrl}/reset-password`;
+            const vars: ResetPasswordTemplateVars = {
+                USER: { username: user.username, email: user.email },
+                URL: resetUrl,
+                TOKEN: resetPasswordToken,
+            };
+
+            await strapi.db
+                .query('plugin::users-permissions.user')
+                .update({ where: { id: user.id }, data: { resetPasswordToken } });
+
+            await strapi.plugin('email').provider.send({
+                to: user.email,
+                from: process.env.SMTP_DEFAULT_FROM,
+                subject: resetPasswordSubject[locale],
+                html: resetPasswordHtml[locale](vars),
+                text: resetPasswordText[locale](vars),
+            });
+
+            ctx.send({ ok: true });
+        };
+
+        // ── Override: sendEmailConfirmation ───────────────────────────────────
+        authController.sendEmailConfirmation = async (ctx: any): Promise<void> => {
+            const locale = resolveLocale(ctx.request.body?.locale ?? ctx.query?.locale);
+            const email: string = (ctx.request.body?.email as string)?.toLowerCase();
+
+            if (!email) {
+                return ctx.badRequest('email is required');
+            }
+
+            const user = await strapi.db
+                .query('plugin::users-permissions.user')
+                .findOne({ where: { email } });
+
+            if (!user) {
+                return ctx.badRequest('No user found with this email');
+            }
+
+            if (user.confirmed) {
+                return ctx.badRequest('This email is already confirmed');
+            }
+
+            const serverUrl: string = ((strapi.config.get('server.url') as string) ?? '').replace(
+                /\/+$/,
+                '',
+            );
+            const confirmUrl = `${serverUrl}/api/auth/email-confirmation`;
+
+            const vars: EmailConfirmationTemplateVars = {
+                USER: { username: user.username, email: user.email },
+                URL: confirmUrl,
+                CODE: user.confirmationToken ?? '',
+            };
+
+            await strapi.plugin('email').provider.send({
+                to: user.email,
+                from: process.env.SMTP_DEFAULT_FROM,
+                subject: emailConfirmationSubject[locale],
+                html: emailConfirmationHtml[locale](vars),
+                text: emailConfirmationText[locale](vars),
+            });
+
+            ctx.send({ email, sent: true });
+        };
+    };
+
+    return plugin;
+};

package/templates/integrations/strapi-astro/integration.config.json

@@ -49,6 +49,18 @@
     }
   ],
   "cdFiles": [
+    {
+      "template": "backend/config/plugins.ts.template",
+      "target": "backend/config/plugins.ts"
+    },
+    {
+      "template": "backend/config/server.ts.template",
+      "target": "backend/config/server.ts"
+    },
+    {
+      "template": "backend/src/extensions/users-permissions/strapi-server.ts.template",
+      "target": "backend/src/extensions/users-permissions/strapi-server.ts"
+    },
     {
       "template": "docker-compose.yml.template",
       "target": "docker-compose.yml"
@@ -81,6 +93,18 @@
       "template": ".gitattributes.template",
       "target": ".gitattributes"
     },
+    {
+      "template": ".gitvault/clean.sh.template",
+      "target": ".gitvault/clean.sh"
+    },
+    {
+      "template": ".gitvault/merge.sh.template",
+      "target": ".gitvault/merge.sh"
+    },
+    {
+      "template": ".gitvault/textconv.sh.template",
+      "target": ".gitvault/textconv.sh"
+    },
     {
       "template": "production.frontend.env.template",
       "target": "production.frontend.env"

package/templates/integrations/strapi-astro/production.backend.env.template

@@ -28,6 +28,25 @@ DATABASE_USERNAME=__DB_NAME__
 DATABASE_PASSWORD=__DB_PASSWORD__
 DATABASE_SSL=false
 
+# Public URLs.
+# PROD_URL  → the public site (frontend). Used to build the end-user password
+#             reset link (<PROD_URL>/reset-password).
+# PUBLIC_URL → the CMS backend itself. Used for absolute backend links such as
+#             the admin password-reset email and the email-confirmation link.
+PROD_URL=https://__PROJECT_DOMAIN__
+PUBLIC_URL=https://__BACKEND_DOMAIN__
+
+# SMTP / contact form (FILL IN before relying on email — password reset,
+# email confirmation, contact flow).
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_DEFAULT_FROM=
+SMTP_DEFAULT_REPLY_TO=
+CONTACTFLOW_SENDER=
+CONTACTFLOW_RECEIVER=
+
 # Production Settings
 HOST=0.0.0.0
 PORT=1337