create-nextblock 0.10.2 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/actions/email.ts

@@ -1,6 +1,6 @@
 "use server";
 
-import { getEmailServerConfig } from '@nextblock-cms/utils/server';
+import { resolveEmailServerConfig } from '../../lib/config/email-settings';
 import nodemailer from 'nodemailer';
 
 interface EmailParams {
@@ -11,10 +11,11 @@ interface EmailParams {
 }
 
 export async function sendEmail({ to, subject, text, html }: EmailParams) {
-  const emailConfig = await getEmailServerConfig();
+  // DB-first (CMS Settings → Configuration → Email), falling back to SMTP_* env vars.
+  const emailConfig = await resolveEmailServerConfig();
 
   if (!emailConfig) {
-    throw new Error("Email server is not configured. Please check environment variables.");
+    throw new Error("Email server is not configured. Configure SMTP in CMS Settings → Configuration → Email.");
   }
 
   const transporter = nodemailer.createTransport(emailConfig);

package/templates/nextblock-template/app/actions/formActions.ts

@@ -4,36 +4,45 @@
 import { sendEmail } from './email';
 import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
 
-interface FormSubmissionResult {
-  success: boolean;
-  message: string;
-}
-
-type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
-
-type FormSubmissionConfig = {
-  recipient: string;
-  botProtectionProvider?: BotProtectionProvider;
-};
-
-function normalizeSubmissionConfig(config: string | FormSubmissionConfig) {
-  if (typeof config === 'string') {
-    return {
-      recipient: config,
-      botProtectionProvider: undefined,
-    };
-  }
-
-  return config;
-}
-
-export async function handleFormSubmission(
-  config: string | FormSubmissionConfig,
-  prevState: unknown,
-  formData: FormData
-): Promise<FormSubmissionResult> {
-  const { recipient, botProtectionProvider } = normalizeSubmissionConfig(config);
-
+interface FormSubmissionResult {
+  success: boolean;
+  message: string;
+}
+
+type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
+
+type FormSubmissionConfig = {
+  recipient: string;
+  botProtectionProvider?: BotProtectionProvider;
+};
+
+function normalizeSubmissionConfig(config: string | FormSubmissionConfig) {
+  if (typeof config === 'string') {
+    return {
+      recipient: config,
+      botProtectionProvider: undefined,
+    };
+  }
+
+  return config;
+}
+
+export async function handleFormSubmission(
+  config: string | FormSubmissionConfig,
+  prevState: unknown,
+  formData: FormData
+): Promise<FormSubmissionResult> {
+  const { recipient: configuredRecipient, botProtectionProvider } = normalizeSubmissionConfig(config);
+
+  // In sandbox mode the DB is periodically wiped and re-seeded with a dummy
+  // recipient, so route every submission to the operator's sandbox inbox instead.
+  // Real installs ignore this and use the recipient configured on the form block.
+  const sandboxRecipient =
+    process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+      ? process.env.SANDBOX_CONTACT_EMAIL?.trim() || ''
+      : '';
+  const recipient = sandboxRecipient || configuredRecipient;
+
   // Phase 1: Honeypot Validation
   const honeypot = formData.get('verification_secondary_email');
   if (honeypot && typeof honeypot === 'string' && honeypot.length > 0) {
@@ -59,17 +68,17 @@ export async function handleFormSubmission(
       .eq('key', 'bot_protection_secret')
       .maybeSingle();
 
-    const publicVal = (publicSetting?.value || {}) as Record<string, any>;
-    const secretVal = (secretSetting?.value || {}) as Record<string, any>;
-
-    const blockProvider =
-      botProtectionProvider === 'turnstile' || botProtectionProvider === 'recaptcha'
-        ? botProtectionProvider
-        : undefined;
-    const provider = blockProvider || publicVal.provider || 'none';
-    const secretKey = secretVal.secretKey || 
-      (provider === 'turnstile' ? process.env.TURNSTILE_SECRET_KEY : process.env.RECAPTCHA_SECRET_KEY) || 
-      '';
+    const publicVal = (publicSetting?.value || {}) as Record<string, any>;
+    const secretVal = (secretSetting?.value || {}) as Record<string, any>;
+
+    const blockProvider =
+      botProtectionProvider === 'turnstile' || botProtectionProvider === 'recaptcha'
+        ? botProtectionProvider
+        : undefined;
+    const provider = blockProvider || publicVal.provider || 'none';
+    const secretKey = secretVal.secretKey || 
+      (provider === 'turnstile' ? process.env.TURNSTILE_SECRET_KEY : process.env.RECAPTCHA_SECRET_KEY) || 
+      '';
 
     if (provider === 'turnstile') {
       const token = formData.get('cf-turnstile-response') as string;
@@ -181,4 +190,4 @@ export async function handleFormSubmission(
     console.error("Email sending failed:", error);
     return { success: false, message: "Sorry, there was an error sending your message. Please try again later." };
   }
-}
+}

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -7899,6 +7899,251 @@ CREATE POLICY system_configuration_service_role_all
   WITH CHECK (true);
 
 
+-- >>> FROM: 00000000000031_seed_footer_navigation.sql <<<
+-- 00000000000031_seed_footer_navigation.sql
+-- Seed editable FOOTER navigation items (EN + FR).
+--
+-- The public footer used to hard-code its "Privacy Policy" and "Terms of Service"
+-- links in apps/nextblock/components/AppShell.tsx. This migration turns them into
+-- real navigation_items rows under the FOOTER menu so they are editable from the
+-- CMS (/cms/navigation) like any other menu, and so the French footer points at
+-- the localized page slugs.
+--
+-- Targets the legal pages seeded by 00000000000027_setup_privacy_and_mfa.sql:
+--   EN  /privacy-policy            FR  /politique-de-confidentialite
+--   EN  /terms-of-service          FR  /conditions-utilisation
+--
+-- Idempotent: re-running replaces the FOOTER rows it owns (matched by URL) and
+-- reuses their translation_group_id so EN/FR stay linked across re-runs.
+DO $seed_footer$
+DECLARE
+  v_en bigint;
+  v_fr bigint;
+  v_privacy_group uuid;
+  v_terms_group uuid;
+  v_en_privacy_page bigint;
+  v_fr_privacy_page bigint;
+  v_en_terms_page bigint;
+  v_fr_terms_page bigint;
+BEGIN
+  SELECT id INTO v_en FROM public.languages WHERE code = 'en' LIMIT 1;
+  SELECT id INTO v_fr FROM public.languages WHERE code = 'fr' LIMIT 1;
+
+  IF v_en IS NULL THEN
+    RAISE NOTICE 'Default language "en" not found; skipping footer navigation seed.';
+    RETURN;
+  END IF;
+
+  -- Reuse existing translation groups if these footer items were seeded before,
+  -- so EN <-> FR stay paired and re-runs do not orphan translations.
+  SELECT translation_group_id INTO v_privacy_group
+    FROM public.navigation_items
+    WHERE menu_key = 'FOOTER' AND url = '/privacy-policy' LIMIT 1;
+  IF v_privacy_group IS NULL THEN v_privacy_group := gen_random_uuid(); END IF;
+
+  SELECT translation_group_id INTO v_terms_group
+    FROM public.navigation_items
+    WHERE menu_key = 'FOOTER' AND url = '/terms-of-service' LIMIT 1;
+  IF v_terms_group IS NULL THEN v_terms_group := gen_random_uuid(); END IF;
+
+  -- Best-effort link each item to its underlying page (ON DELETE SET NULL keeps
+  -- the link working even if a page is later removed; url remains the source of truth).
+  SELECT id INTO v_en_privacy_page
+    FROM public.pages WHERE slug = 'privacy-policy' AND language_id = v_en LIMIT 1;
+  SELECT id INTO v_en_terms_page
+    FROM public.pages WHERE slug = 'terms-of-service' AND language_id = v_en LIMIT 1;
+
+  -- Remove any prior copies of the footer links we own, then re-insert cleanly.
+  DELETE FROM public.navigation_items
+    WHERE menu_key = 'FOOTER'
+      AND url IN (
+        '/privacy-policy', '/terms-of-service',
+        '/politique-de-confidentialite', '/conditions-utilisation'
+      );
+
+  -- ----- English footer -----
+  INSERT INTO public.navigation_items
+    (language_id, menu_key, label, url, "order", page_id, translation_group_id)
+  VALUES
+    (v_en, 'FOOTER', 'Privacy Policy',    '/privacy-policy',    0, v_en_privacy_page, v_privacy_group),
+    (v_en, 'FOOTER', 'Terms of Service',  '/terms-of-service',  1, v_en_terms_page,   v_terms_group);
+
+  -- ----- French footer (only if the French language exists) -----
+  IF v_fr IS NOT NULL THEN
+    SELECT id INTO v_fr_privacy_page
+      FROM public.pages WHERE slug = 'politique-de-confidentialite' AND language_id = v_fr LIMIT 1;
+    SELECT id INTO v_fr_terms_page
+      FROM public.pages WHERE slug = 'conditions-utilisation' AND language_id = v_fr LIMIT 1;
+
+    INSERT INTO public.navigation_items
+      (language_id, menu_key, label, url, "order", page_id, translation_group_id)
+    VALUES
+      (v_fr, 'FOOTER', 'Politique de confidentialité', '/politique-de-confidentialite', 0, v_fr_privacy_page, v_privacy_group),
+      (v_fr, 'FOOTER', 'Conditions d''utilisation',    '/conditions-utilisation',       1, v_fr_terms_page,   v_terms_group);
+  END IF;
+
+  RAISE NOTICE 'Seeded FOOTER navigation items (Privacy Policy, Terms of Service).';
+END;
+$seed_footer$;
+
+
+-- >>> FROM: 00000000000032_neutralize_seeded_contact_emails.sql <<<
+-- 00000000000032_neutralize_seeded_contact_emails.sql
+-- Remove the original authors' contact addresses from seeded content so a
+-- downloaded / self-hosted copy of NextBlock never routes mail to us.
+--
+-- Earlier migrations baked real addresses into block content:
+--   * 00000000000027 seeded \`privacy@nextblock.dev\` across the Privacy Policy and
+--     Terms pages (EN + FR), as visible text and \`mailto:\` links.
+--   * 00000000000010 seeded a \`mailto:info@nextblock.dev\` CTA on the French home
+--     page (the English page correctly links to /contact), and \`foo@bar.com\` as
+--     the contact form recipient.
+--
+-- Migrations are append-only, so this is a forward-only data fix rather than an
+-- edit of those files. Each statement is idempotent (a no-op once applied).
+--
+-- The \`{{privacy_email}}\` token is resolved at render time by the app
+-- (apps/nextblock/lib/privacy/contact-emails.ts): admin "Support email" setting
+-- -> SANDBOX_PRIVACY_EMAIL env (sandbox only) -> privacy@example.com fallback.
+
+-- 1. Privacy / Terms legal pages: swap the hard-coded address for a merge tag.
+UPDATE public.blocks
+SET content = replace(content::text, 'privacy@nextblock.dev', '{{privacy_email}}')::jsonb
+WHERE content::text LIKE '%privacy@nextblock.dev%';
+
+-- 2. French home "Nous contacter" CTA: point at the contact form like the English
+--    page instead of a mailto to our inbox.
+UPDATE public.blocks
+SET content = replace(content::text, 'mailto:info@nextblock.dev', '/contact')::jsonb
+WHERE content::text LIKE '%mailto:info@nextblock.dev%';
+
+-- 3. Contact form default recipient: use a neutral placeholder. In sandbox the
+--    app overrides this with SANDBOX_CONTACT_EMAIL at submit time.
+UPDATE public.blocks
+SET content = replace(content::text, 'foo@bar.com', 'contact@example.com')::jsonb
+WHERE content::text LIKE '%foo@bar.com%';
+
+
+-- >>> FROM: 00000000000033_setup_config_settings.sql <<<
+-- 00000000000033_setup_config_settings.sql
+-- DB-backed CMS configuration: move SMTP and payment-provider credentials out of
+-- environment variables and into \`site_settings\`. Secret rows (email_secret,
+-- payment_secret) hold AES-256-GCM envelopes and are restricted to ADMIN / service_role,
+-- extending the sensitive-key masking established in migration 018. Public rows hold
+-- non-secret config (SMTP host/from, publishable keys, provider flags) and the dashboard
+-- onboarding state.
+--
+-- This re-issues ALL FOUR site_settings policies because the masked-key list is embedded
+-- in each policy body and Postgres has no incremental "add a key" operation.
+
+COMMENT ON TABLE public.site_settings IS 'Key-value store for global site settings. Sensitive keys (Cortex AI BYOK, Bot Protection Secret, Email secret, Payment secret) hold encrypted envelopes and are restricted to ADMIN via row-level policies.';
+
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+
+CREATE POLICY site_settings_read_policy
+  ON public.site_settings
+  FOR SELECT
+  TO public
+  USING (
+    key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+    OR (
+      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT auth.role()) = 'authenticated'
+      AND (SELECT public.get_current_user_role()) = 'ADMIN'
+    )
+  );
+
+CREATE POLICY site_settings_insert_policy
+  ON public.site_settings
+  FOR INSERT
+  TO authenticated
+  WITH CHECK (
+    (
+      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')
+    )
+    OR (
+      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) = 'ADMIN'
+    )
+  );
+
+CREATE POLICY site_settings_update_policy
+  ON public.site_settings
+  FOR UPDATE
+  TO authenticated
+  USING (
+    (
+      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')
+    )
+    OR (
+      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) = 'ADMIN'
+    )
+  )
+  WITH CHECK (
+    (
+      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')
+    )
+    OR (
+      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) = 'ADMIN'
+    )
+  );
+
+CREATE POLICY site_settings_delete_policy
+  ON public.site_settings
+  FOR DELETE
+  TO authenticated
+  USING (
+    (
+      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')
+    )
+    OR (
+      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')
+      AND (SELECT public.get_current_user_role()) = 'ADMIN'
+    )
+  );
+
+-- Seed the new configuration rows (idempotent). Secret rows are created on first save
+-- from the CMS, so they are intentionally not seeded here.
+INSERT INTO public.site_settings (key, value)
+VALUES ('email_public', '{"host": "", "port": "", "fromEmail": "", "fromName": "", "secure": true}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO public.site_settings (key, value)
+VALUES ('payment_public', '{"stripe": {"publishableKey": ""}, "freemius": {"developerId": "", "publicKey": "", "productId": "", "sandboxEnabled": false}}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO public.site_settings (key, value)
+VALUES ('onboarding_state', '{"dismissed": false, "skipped": []}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+
+-- >>> FROM: 00000000000034_enable_staff_2fa_reminder_default.sql <<<
+-- 00000000000034_enable_staff_2fa_reminder_default.sql
+-- Turn the "Encourage staff to enable 2FA" policy ON by default. The reminder banner is
+-- now implemented (shown to ADMIN/WRITER accounts without a second factor); migration 027
+-- seeded this flag to false, so flip the existing security_settings row to true. Admins can
+-- still turn it off afterward. The sandbox never enforces it (handled at runtime), so the
+-- stored value here is harmless after a sandbox reset.
+
+UPDATE public.site_settings
+SET value = jsonb_set(coalesce(value, '{}'::jsonb), '{enforce_staff_2fa}', 'true'::jsonb)
+WHERE key = 'security_settings';
+
+-- Cover the unlikely case where the row is missing (it is seeded in migration 027).
+INSERT INTO public.site_settings (key, value)
+VALUES ('security_settings', '{"trusted_device_days": 30, "enforce_staff_2fa": true}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+
   -- Step D: Anchor preserved profiles
   INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
   SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'

package/templates/nextblock-template/app/api/webhooks/freemius/route.ts

@@ -1,11 +1,15 @@
 import { NextResponse } from 'next/server';
 import {
+  hydrateFreemiusEnvFromDb,
   syncFreemiusOrderFromWebhookEvent,
   verifyFreemiusWebhookSignature,
 } from '@nextblock-cms/ecommerce/server';
 
 export async function POST(req: Request) {
   try {
+    // Make CMS-stored Freemius credentials available to the (sync) signature + sync helpers.
+    await hydrateFreemiusEnvFromDb();
+
     const rawBody = await req.text();
     const signature =
       req.headers.get('x-signature') ?? req.headers.get('x-freemius-signature');

package/templates/nextblock-template/app/checkout/success/actions.ts

@@ -5,7 +5,7 @@ import {
   applyOrderInventoryDeduction,
   assignInvoiceMetadata,
   getInvoicePresentationData,
-  stripe,
+  getStripeClient,
   syncStripeOrderFromSession,
 } from '@nextblock-cms/ecommerce/server';
 import { resolveSupabaseServiceKey, resolveSupabaseUrl } from '../../../lib/setup/env-status';
@@ -37,6 +37,7 @@ export async function fulfillOrderAction(sessionId: string) {
 
   try {
     if (sessionId.startsWith('cs_')) {
+      const stripe = await getStripeClient();
       const session = await stripe.checkout.sessions.retrieve(sessionId);
 
       if (session.payment_status !== 'paid') {

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -9,8 +9,9 @@ import {
   LayoutDashboard, FileText, PenTool, Users, Settings, ChevronRight, LogOut, Menu, ListTree, Image as ImageIconLucide, X, Languages as LanguagesIconLucide, MessageSquare,
   Copyright as CopyrightIcon, ShoppingBag, ListOrdered, CreditCard, Package, Coins,
   ExternalLink, Paintbrush, Brain, TicketPercent, ShieldAlert, Folder, DatabaseBackup, Boxes, Tag,
-  ShieldCheck, Cookie,
+  ShieldCheck, Cookie, LineChart, Mail, UserPlus, SlidersHorizontal,
 } from "lucide-react"
+import TwoFactorReminderBanner from "./components/TwoFactorReminderBanner"
 import { Button } from "@nextblock-cms/ui"
 import { Avatar, AvatarFallback, AvatarImage } from "@nextblock-cms/ui"
 import { cn } from "@nextblock-cms/utils"
@@ -115,11 +116,14 @@ export default function CmsClientLayout({
   children,
   isCortexAiActive = false,
   isEcommerceActive = false,
+  showTwoFactorReminder = false,
 }: {
   children: ReactNode,
   isCortexAiActive?: boolean,
   isEcommerceActive?: boolean,
+  showTwoFactorReminder?: boolean,
 }) {
+  const isSandbox = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
   const { user, profile, role, isLoading, isAdmin, isWriter } = useAuth();
   const { logo, siteTitle } = useAppBranding();
   const router = useRouter();
@@ -228,6 +232,9 @@ export default function CmsClientLayout({
   else if (pathname.startsWith("/cms/settings/taxes")) pageTitle = "Tax Settings";
   else if (pathname.startsWith("/cms/settings/cortex-ai")) pageTitle = "Cortex AI";
   else if (pathname.startsWith("/cms/settings/bot-protection")) pageTitle = "Bot Protection";
+  else if (pathname.startsWith("/cms/settings/email")) pageTitle = "Email";
+  else if (pathname.startsWith("/cms/settings/registration")) pageTitle = "Sign-ups & Registration";
+  else if (pathname.startsWith("/cms/settings/google-analytics")) pageTitle = "Google Analytics";
   else if (pathname.startsWith("/cms/settings/privacy")) pageTitle = "Privacy & Consent";
   else if (pathname.startsWith("/cms/settings/security")) pageTitle = "Security & 2FA";
   else if (pathname.startsWith("/cms/payments")) pageTitle = "Payment Settings";
@@ -309,9 +316,11 @@ export default function CmsClientLayout({
               <NavItem href="/cms/navigation" icon={ListTree} isActive={pathname.startsWith("/cms/navigation")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                     Navigation
               </NavItem>
-              <NavItem href="/cms/settings/security" icon={ShieldCheck} isActive={pathname.startsWith("/cms/settings/security")} writerOnly isAdmin={isAdmin} isWriter={isWriter} onClick={closeSidebarOnMobile}>
-                Security
-              </NavItem>
+              {!isSandbox && (
+                <NavItem href="/cms/settings/security" icon={ShieldCheck} isActive={pathname.startsWith("/cms/settings/security")} writerOnly isAdmin={isAdmin} isWriter={isWriter} onClick={closeSidebarOnMobile}>
+                  Security
+                </NavItem>
+              )}
 
               {isEcommerceActive && (
                 <>
@@ -347,18 +356,31 @@ export default function CmsClientLayout({
                   <NavItem href="/cms/promotions" icon={Tag} isActive={pathname.startsWith("/cms/promotions")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                     Bulk Price & Sales
                   </NavItem>
-                  <NavItem href="/cms/shipping" icon={Package} isActive={pathname.startsWith("/cms/shipping")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                    Shipping
-                  </NavItem>
-                  <NavItem href="/cms/payments" icon={CreditCard} isActive={pathname.startsWith("/cms/payments")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                    Payments
-                  </NavItem>
-                  <NavItem href="/cms/settings/taxes" icon={Settings} isActive={pathname.startsWith("/cms/settings/taxes")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                    Taxes
-                  </NavItem>
-                  <NavItem href="/cms/settings/currencies" icon={Coins} isActive={pathname.startsWith("/cms/settings/currencies")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                    Currencies
-                  </NavItem>
+                  <CollapsibleNavItem
+                    icon={SlidersHorizontal}
+                    title="Configuration"
+                    isActive={
+                      pathname.startsWith("/cms/payments") ||
+                      pathname.startsWith("/cms/shipping") ||
+                      pathname.startsWith("/cms/settings/taxes") ||
+                      pathname.startsWith("/cms/settings/currencies")
+                    }
+                    adminOnly
+                    isAdmin={isAdmin}
+                  >
+                    <NavItem href="/cms/payments" icon={CreditCard} isActive={pathname.startsWith("/cms/payments")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Payments
+                    </NavItem>
+                    <NavItem href="/cms/shipping" icon={Package} isActive={pathname.startsWith("/cms/shipping")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Shipping
+                    </NavItem>
+                    <NavItem href="/cms/settings/taxes" icon={Settings} isActive={pathname.startsWith("/cms/settings/taxes")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Taxes
+                    </NavItem>
+                    <NavItem href="/cms/settings/currencies" icon={Coins} isActive={pathname.startsWith("/cms/settings/currencies")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Currencies
+                    </NavItem>
+                  </CollapsibleNavItem>
                 </>
               )}
 
@@ -378,7 +400,7 @@ export default function CmsClientLayout({
                   <CollapsibleNavItem
                     icon={Settings}
                     title="Settings"
-                    isActive={pathname.startsWith("/cms/settings") && !pathname.startsWith("/cms/settings/taxes") && !pathname.startsWith("/cms/settings/currencies")}
+                    isActive={pathname.startsWith("/cms/settings") && !pathname.startsWith("/cms/settings/taxes") && !pathname.startsWith("/cms/settings/currencies") && !pathname.startsWith("/cms/settings/email") && !pathname.startsWith("/cms/settings/registration") && !pathname.startsWith("/cms/settings/bot-protection")}
                     adminOnly
                     isAdmin={isAdmin}
                   >
@@ -394,12 +416,12 @@ export default function CmsClientLayout({
                     <NavItem href="/cms/settings/global-css" icon={Paintbrush} isActive={pathname.startsWith("/cms/settings/global-css")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Global CSS
                     </NavItem>
-                    <NavItem href="/cms/settings/bot-protection" icon={ShieldAlert} isActive={pathname.startsWith("/cms/settings/bot-protection")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                      Bot Protection
-                    </NavItem>
                     <NavItem href="/cms/settings/privacy" icon={Cookie} isActive={pathname.startsWith("/cms/settings/privacy")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Privacy &amp; Consent
                     </NavItem>
+                    <NavItem href="/cms/settings/google-analytics" icon={LineChart} isActive={pathname.startsWith("/cms/settings/google-analytics")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Google Analytics
+                    </NavItem>
                     <NavItem href="/cms/settings/extra-translations" icon={MessageSquare} isActive={pathname.startsWith("/cms/settings/extra-translations")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Extra Translations
                     </NavItem>
@@ -407,6 +429,27 @@ export default function CmsClientLayout({
                       Backup / Restore
                     </NavItem>
                  </CollapsibleNavItem>
+                  <CollapsibleNavItem
+                    icon={SlidersHorizontal}
+                    title="Configuration"
+                    isActive={
+                      pathname.startsWith("/cms/settings/email") ||
+                      pathname.startsWith("/cms/settings/registration") ||
+                      pathname.startsWith("/cms/settings/bot-protection")
+                    }
+                    adminOnly
+                    isAdmin={isAdmin}
+                  >
+                    <NavItem href="/cms/settings/email" icon={Mail} isActive={pathname.startsWith("/cms/settings/email")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Email
+                    </NavItem>
+                    <NavItem href="/cms/settings/bot-protection" icon={ShieldAlert} isActive={pathname.startsWith("/cms/settings/bot-protection")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Bot Protection
+                    </NavItem>
+                    <NavItem href="/cms/settings/registration" icon={UserPlus} isActive={pathname.startsWith("/cms/settings/registration")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Sign-ups
+                    </NavItem>
+                 </CollapsibleNavItem>
                 </>
               )}
             </ul>
@@ -454,6 +497,7 @@ export default function CmsClientLayout({
             </Button>
         </header>
         <main className="flex-1 min-h-0 w-full overflow-y-auto overscroll-contain px-6 pt-6 pb-20 scroll-pb-24 md:pb-24">
+            {showTwoFactorReminder && <TwoFactorReminderBanner />}
             {children}
         </main>
       </div>

package/templates/nextblock-template/app/cms/components/TwoFactorReminderBanner.tsx

@@ -0,0 +1,45 @@
+'use client';
+
+import Link from 'next/link';
+import { useState } from 'react';
+import { Button } from '@nextblock-cms/ui';
+import { ShieldAlert, X } from 'lucide-react';
+
+/**
+ * In-app reminder for staff (ADMIN/WRITER) who have not enrolled a second factor,
+ * shown when the "Encourage staff to enable 2FA" policy is on. Dismissible for the
+ * session (state lives in the persistent CMS layout, so it survives client-side
+ * navigation but reappears on the next full load until 2FA is set up).
+ */
+export default function TwoFactorReminderBanner() {
+  const [dismissed, setDismissed] = useState(false);
+  if (dismissed) return null;
+
+  return (
+    <div className="mb-6 flex items-start gap-3 rounded-lg border border-amber-300 bg-amber-50 px-4 py-3 text-amber-900 dark:border-amber-700/60 dark:bg-amber-900/20 dark:text-amber-200">
+      <ShieldAlert className="mt-0.5 h-5 w-5 shrink-0" />
+      <div className="min-w-0 flex-1">
+        <p className="text-sm font-medium">
+          Your account doesn&rsquo;t have two-factor authentication enabled.
+        </p>
+        <p className="text-xs opacity-90">
+          Protect your CMS account by adding a second factor (authenticator app or email code).
+        </p>
+      </div>
+      <div className="flex shrink-0 items-center gap-2">
+        <Button asChild size="sm" variant="outline" className="border-amber-400">
+          <Link href="/cms/settings/security">Set up 2FA</Link>
+        </Button>
+        <Button
+          variant="ghost"
+          size="icon"
+          onClick={() => setDismissed(true)}
+          aria-label="Dismiss for now"
+          className="h-8 w-8"
+        >
+          <X className="h-4 w-4" />
+        </Button>
+      </div>
+    </div>
+  );
+}