create-nevela 0.7.1 → 0.9.1

package/index.mjs

@@ -75,13 +75,16 @@ const HELP = `  Create a new Nevela app: a Laravel API and a Next.js dashboard.
     nevela dev                 Run the API and the dashboard
     nevela status              Check versions, migrations, users and the dashboard
     nevela resource <Name> --fields="…" [--seed]
-    nevela seed | user | generate | migrate | trash | artisan <command>
+    nevela adopt <table>       Make a resource of a table you already have
+    nevela blog                Give the site a blog, if it was created without one
+    nevela seed | user | generate | migrate | trash | disposable | artisan <command>
 
   ${bold('Options')}
     --pm <pnpm|npm|yarn|bun>   Package manager for the dashboard. Default: the one you ran this with.
     --no-install               Don't install the dashboard's dependencies.
     --no-user                  Don't create the starter admin account, or the sample users.
     --no-sample-users          Create the admin only, without the ten sample users.
+    --no-blog                  Leave out the blog: the Post resource, three sample posts and /blog.
     --fast                     Leave out PHPUnit, Pint and Laravel's other development packages.
                                About a third quicker. Add them later: cd apps/api && composer install
     --no-git                   Don't run git init.
@@ -193,7 +196,7 @@ async function step(label, work) {
 }
 
 function parseArgs(argv) {
-  const options = { name: undefined, pm: undefined, install: true, user: true, samples: true, git: true, yes: false, bundledPackage: false, devTools: true };
+  const options = { name: undefined, pm: undefined, install: true, user: true, samples: true, blog: true, git: true, yes: false, bundledPackage: false, devTools: true };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '-h' || arg === '--help') {
@@ -207,6 +210,7 @@ function parseArgs(argv) {
     else if (arg === '--no-install') options.install = false;
     else if (arg === '--no-user') options.user = false;
     else if (arg === '--no-sample-users') options.samples = false;
+    else if (arg === '--no-blog') options.blog = false;
     else if (arg === '--no-git') options.git = false;
     else if (arg === '--no-dev-tools' || arg === '--fast') options.devTools = false;
     else if (arg === '--bundled-package') options.bundledPackage = true;
@@ -285,7 +289,7 @@ function write(file, contents) {
   fs.writeFileSync(file, contents);
 }
 
-function writeRootFiles(root, { name, title, pm, admin, samples }) {
+function writeRootFiles(root, { name, title, pm, admin, samples, blog }) {
   write(path.join(root, 'package.json'), `${JSON.stringify({
     name,
     version: '0.1.0',
@@ -337,7 +341,11 @@ php nevela upgrade     # bring this app to the latest Nevela
 php nevela             # everything it can do
 \`\`\`
 
-## Add a resource
+${blog ? `## The blog
+
+The site has a blog at http://localhost:3000/blog. Posts are written under **Posts** in the dashboard, and a post is on the site once it is published. Its pages are in \`apps/web/app/blog\` and its settings in \`apps/web/lib/blog.ts\`: both are yours to change.
+
+` : ''}## Add a resource
 
 \`\`\`sh
 php nevela resource Product --fields="name:string, sku:string!, price:money, notes:text?"
@@ -681,7 +689,7 @@ async function main() {
   // `nevela upgrade` compares against these to tell the files you changed from the ones
   // you didn't, so an update never overwrites your work.
   write(path.join(web, '.nevela.json'), `${JSON.stringify(templateRecord(VERSION), null, 4)}\n`);
-  writeRootFiles(root, { name, title, pm, admin: options.user ? ADMIN : null, samples: options.user && options.samples });
+  writeRootFiles(root, { name, title, pm, admin: options.user ? ADMIN : null, samples: options.user && options.samples, blog: options.blog });
   const packages = options.install ? start(pm, ['install'], { cwd: web }) : null;
 
   const tokens = await step('Creating the Laravel app', async (progress) => {
@@ -738,15 +746,20 @@ async function main() {
 
   let admin = false;
   let samples = false;
+  let blog = false;
+  let blogMissing = false;
   await step('Setting up the database', () => {
     // One artisan process for the app key, Sanctum's migration, the generated files, the
     // migrations, the starter account and the sample users: each separate call would
     // start Laravel again.
     const account = options.user && tokens ? [`--name=${ADMIN.name}`, `--email=${ADMIN.email}`, `--password=${ADMIN.password}`, ...(options.samples ? [] : ['--no-sample-users'])] : [];
-    const setup = run('php', ['artisan', 'nevela:setup', ...account], { cwd: api, allowFailure: true });
+    const setup = run('php', ['artisan', 'nevela:setup', ...account, ...(options.blog ? [] : ['--no-blog'])], { cwd: api, allowFailure: true });
     if (setup.ok) {
       admin = account.length > 0;
       samples = admin && options.samples;
+      blog = options.blog && fs.existsSync(path.join(web, 'app', 'blog', 'page.tsx'));
+      // Asked for, and not there: the setup carried on without it, and the person is told.
+      blogMissing = options.blog && !blog;
       return;
     }
     // 2: the app is set up and only the starter account could not be created.
@@ -797,7 +810,12 @@ async function main() {
       console.log(`  ${dim(`Ten sample users are there too, with the same password: 2 editors and 8 users. See them under Users, and what each may do under Roles.`)}`);
     }
   }
-  console.log(`\n  Add your first resource: ${dim(`${nevela} resource Product --fields="name:string, price:money"`)}`);
+  if (blog) {
+    console.log(`\n  The site has a blog at ${indigo('http://localhost:3000/blog')}, with three posts to start. Write more under Posts in the dashboard.`);
+  } else if (blogMissing) {
+    console.log(`\n  The blog couldn't be set up, so this app has none yet. Everything else is in place. Add it later: ${dim(`${nevela} blog`)}`);
+  }
+  console.log(`\n  Add ${blog ? 'a' : 'your first'} resource: ${dim(`${nevela} resource Product --fields="name:string, price:money"`)}`);
   console.log(`  Check the app: ${dim(`${nevela} status`)}   Upgrade it later: ${dim(`${nevela} upgrade`)}   Everything: ${dim(nevela)}`);
   if (nevela !== 'php nevela' && nevela !== 'nevela') {
     console.log(`\n  ${dim(`In this shell "php" isn't a command (your PHP is php.bat), so use ${nevela}. In PowerShell, php nevela works too.`)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nevela",
-  "version": "0.7.1",
+  "version": "0.9.1",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {

package/project.mjs

@@ -11,7 +11,7 @@ import { isNewer, satisfiesCaret } from './packagist.mjs';
 import { spawnCommand } from './shell.mjs';
 
 /** What `nevela <name>` runs: these go to `php artisan nevela:<name>`. */
-const NEVELA = ['upgrade', 'dev', 'status', 'version', 'resource', 'generate', 'seed', 'user', 'trash'];
+const NEVELA = ['upgrade', 'dev', 'status', 'version', 'resource', 'adopt', 'blog', 'generate', 'seed', 'user', 'trash', 'digest', 'disposable'];
 /** These go to the artisan command of the same name. */
 const ARTISAN = ['migrate', 'tinker', 'test', 'serve'];
 

package/template/laravel/config/nevela.php

@@ -131,6 +131,60 @@ return [
         'days' => 30,
     ],
 
+    /*
+    | Forms anyone can send: a resource's "public" create, with "protect" or "confirm".
+    |
+    | turnstile   Cloudflare's robot check. The secret key is this app's alone; the site key
+    |             goes in the web app (NEXT_PUBLIC_TURNSTILE_SITE_KEY). With no secret the
+    |             check is skipped in development, and in production a form that asks for
+    |             it answers 503: it is never quietly left open. A check counts only if it
+    |             was solved on one of `hostnames` (a name stands for its subdomains), and
+    |             never on localhost in production.
+    | form_lifetime  How long a form can sit open before it must be loaded again, in seconds.
+    | mail        The most one address is emailed because someone typed it into a form
+    |             (PublicMail::toVisitor), across every form. Past it the email is dropped
+    |             and the record is still saved. This is what stops a form being used to
+    |             mail strangers.
+    | notify      Who is told a form was sent (PublicMail::toOwner), and how often: past
+    |             max_per_hour the rest wait for one email at the top of the hour.
+    | confirm     How long an address has to follow its link ("confirm"), after which the
+    |             record is removed, and the page of the web app the link opens.
+    */
+    'public' => [
+        'turnstile' => [
+            'secret' => env('TURNSTILE_SECRET_KEY'),
+            /* The sites a check may be solved on, with commas and no spaces between: example.com,shop.example.com. The web app's own (NEVELA_WEB_URL), unless set. */
+            'hostnames' => env('TURNSTILE_HOSTNAMES'),
+            'verify_url' => 'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+        ],
+        'form_lifetime' => 2 * 60 * 60,
+        'mail' => [
+            'visitor_per_hour' => 1,
+            'visitor_per_day' => 3,
+        ],
+        'notify' => [
+            'to' => env('NEVELA_NOTIFY_TO'),
+            'max_per_hour' => 10,
+        ],
+        'confirm' => [
+            'hours' => 48,
+            'path' => '/confirm',
+        ],
+    ],
+
+    /*
+    | Rich text fields (body:richtext). Whatever is sent is parsed and written out again
+    | with only these tags and attributes: nothing the editor, a script or a visitor sends
+    | is trusted. A tag that isn't listed goes and its words stay. The list matches the
+    | dashboard editor's toolbar; add to it only what you would let a stranger put on a page.
+    | A link may use these schemes, or none (/about).
+    */
+    'rich_text' => [
+        'tags' => ['p', 'br', 'strong', 'em', 's', 'a', 'h2', 'h3', 'ul', 'ol', 'li', 'blockquote'],
+        'attributes' => ['a' => ['href']],
+        'schemes' => ['http', 'https', 'mailto'],
+    ],
+
     /*
     | The most rows POST /{slug}/_bulk creates in one request (the dashboard's "Add several"
     | grid). They are saved in one transaction, so this is also how long one can run.
@@ -142,14 +196,23 @@ return [
     |
     | Files go on a disk from config/filesystems.php and are handed out by Nevela's own
     | route, GET {prefix}/_nevela/files/{key}, so nothing needs linking or publishing. Keys
-    | are unguessable, but anyone who has one can fetch the file: don't use these fields
-    | for documents that must stay private. If a CDN or your web server serves the disk,
-    | put its address in NEVELA_UPLOADS_URL and the API's links point there.
+    | are unguessable, but anyone who has one can fetch the file. If a CDN or your web
+    | server serves the disk, put its address in NEVELA_UPLOADS_URL and the API's links
+    | point there.
+    |
+    | A document that must stay private goes in a private file field ("private": true in
+    | the descriptor, or cv:file(pdf|private)). It is kept on private_disk, which must not
+    | be one the web server serves, and is handed out by
+    | GET {prefix}/_nevela/private/{slug}/{id}/{field} to someone signed in who may view
+    | that record. Its key opens nothing.
     */
     'uploads' => [
         'disk' => env('NEVELA_UPLOADS_DISK', 'public'),
         'url' => env('NEVELA_UPLOADS_URL'),
 
+        /* Where private files are kept. Never served: not "public", and not a bucket anyone can read. */
+        'private_disk' => env('NEVELA_PRIVATE_DISK', 'local'),
+
         /* Where untouched originals are kept, so an image can be optimised again later. Never served. */
         'originals_disk' => env('NEVELA_ORIGINALS_DISK', 'local'),
 

package/template/laravel/database/migrations/2026_10_12_000000_create_nevela_form_tables.php

@@ -0,0 +1,60 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+// Public forms: what was refused, and the mail a form causes.
+//
+// A form anyone can send is sent by bots too. What is turned away is counted, so that
+// protection which works can be told from a form nobody uses. And because every send can
+// cause mail, to the address that was typed and to the owner, each of those is counted
+// too: that is what keeps the form from being a way to mail strangers, and the owner's
+// inbox from being buried.
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('nevela_form_blocks')) {
+            Schema::create('nevela_form_blocks', function (Blueprint $table) {
+                $table->uuid('id')->primary();
+                $table->string('resource');
+                // honeypot, forged, too_fast, expired, robot, disposable, undeliverable, throttled, unconfigured, unreachable
+                $table->string('reason', 32);
+                $table->date('day');
+                $table->unsignedInteger('count')->default(0);
+                $table->unique(['resource', 'reason', 'day']);
+            });
+        }
+
+        if (! Schema::hasTable('nevela_public_mail')) {
+            Schema::create('nevela_public_mail', function (Blueprint $table) {
+                $table->uuid('id')->primary();
+                // "visitor": to an address a form was given. "owner": a notice that a form was sent.
+                $table->string('kind', 16);
+                // A visitor's address is kept as a fingerprint: enough to count by, not to read back.
+                $table->string('recipient', 64);
+                $table->timestamp('sent_at')->index();
+                $table->index(['kind', 'recipient', 'sent_at']);
+            });
+        }
+
+        if (! Schema::hasTable('nevela_owner_digest')) {
+            // Notices to the owner past the hour's limit, held for one email that names them all.
+            Schema::create('nevela_owner_digest', function (Blueprint $table) {
+                $table->uuid('id')->primary();
+                $table->string('subject');
+                $table->string('line', 500)->nullable();
+                $table->string('url', 2048)->nullable();
+                $table->timestamp('held_at')->index();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('nevela_owner_digest');
+        Schema::dropIfExists('nevela_public_mail');
+        Schema::dropIfExists('nevela_form_blocks');
+    }
+};