create-nextblock 0.10.2 → 0.10.3

package/templates/nextblock-template/lib/config/email-settings.ts

@@ -0,0 +1,217 @@
+import 'server-only';
+// DB-backed SMTP configuration. Non-secret fields (host, port, from, secure) live in the
+// public `email_public` row; the SMTP username and password live encrypted in the
+// ADMIN-only `email_secret` row. Resolution is DB-first with an env fallback
+// (SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS / SMTP_FROM_EMAIL / SMTP_FROM_NAME) so
+// existing deployments keep working until the values are moved into the CMS.
+import {
+  createClient,
+  getServiceRoleSupabaseClient,
+  encryptWithEnvKey,
+  getSecretEnvelopeStatus,
+  isSandboxEnvironment,
+  resolveConfigValue,
+  tryDecryptWithEnvKey,
+} from '@nextblock-cms/db/server';
+
+const EMAIL_PUBLIC_KEY = 'email_public';
+const EMAIL_SECRET_KEY = 'email_secret';
+
+export type EmailPublicSettings = {
+  host: string;
+  port: string;
+  fromEmail: string;
+  fromName: string;
+  secure: boolean;
+};
+
+export const DEFAULT_EMAIL_PUBLIC_SETTINGS: EmailPublicSettings = {
+  host: '',
+  port: '',
+  fromEmail: '',
+  fromName: '',
+  secure: true,
+};
+
+/** What the CMS form needs: public fields + whether each secret is already stored. */
+export type EmailSettingsView = EmailPublicSettings & {
+  hasUser: boolean;
+  hasPass: boolean;
+  userLast4: string | null;
+  envFallbackActive: boolean;
+};
+
+/** Fully-resolved transport config consumed by nodemailer. */
+export type ResolvedEmailConfig = {
+  host: string;
+  port: number;
+  secure: boolean;
+  auth: { user: string; pass: string };
+  from: string;
+};
+
+function asString(value: unknown, fallback = ''): string {
+  return typeof value === 'string' ? value : fallback;
+}
+
+function asBool(value: unknown, fallback: boolean): boolean {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') return value === 'true' || value === 'on';
+  return fallback;
+}
+
+function normalizePublic(value: unknown): EmailPublicSettings {
+  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
+  return {
+    host: asString(raw['host']),
+    port: asString(raw['port']),
+    fromEmail: asString(raw['fromEmail']),
+    fromName: asString(raw['fromName']),
+    secure: asBool(raw['secure'], true),
+  };
+}
+
+export async function getEmailPublicSettings(): Promise<EmailPublicSettings> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', EMAIL_PUBLIC_KEY)
+    .maybeSingle();
+  return normalizePublic(data?.value);
+}
+
+/**
+ * Read the public settings plus stored-secret status for the CMS form. Uses the
+ * request-scoped client; RLS restricts the secret row to ADMIN, which is who reaches
+ * this page.
+ */
+export async function getEmailSettingsView(): Promise<EmailSettingsView> {
+  const supabase = createClient();
+  const [{ data: publicData }, { data: secretData }] = await Promise.all([
+    supabase.from('site_settings').select('value').eq('key', EMAIL_PUBLIC_KEY).maybeSingle(),
+    supabase.from('site_settings').select('value').eq('key', EMAIL_SECRET_KEY).maybeSingle(),
+  ]);
+
+  const pub = normalizePublic(publicData?.value);
+  const secret = (secretData?.value ?? {}) as Record<string, unknown>;
+  const userStatus = getSecretEnvelopeStatus(secret['user']);
+  const passStatus = getSecretEnvelopeStatus(secret['pass']);
+
+  return {
+    ...pub,
+    hasUser: userStatus.hasStoredValue,
+    hasPass: passStatus.hasStoredValue,
+    userLast4: userStatus.last4,
+    // Show a hint in the UI when SMTP still comes from env vars rather than the CMS.
+    envFallbackActive: !pub.host && Boolean(process.env['SMTP_HOST']),
+  };
+}
+
+export type SaveEmailSettingsInput = {
+  host: string;
+  port: string;
+  fromEmail: string;
+  fromName: string;
+  secure: boolean;
+  /** Only persisted when non-empty — a blank field keeps the existing stored secret. */
+  user?: string;
+  pass?: string;
+};
+
+/**
+ * Persist email settings. Public fields always overwrite; secret fields are encrypted
+ * and only written when a new value is supplied. Refuses to store real secrets in the
+ * sandbox (its DB resets daily). Caller must enforce ADMIN; RLS double-enforces.
+ */
+export async function saveEmailSettings(input: SaveEmailSettingsInput): Promise<void> {
+  const supabase = createClient();
+
+  const publicValue: EmailPublicSettings = {
+    host: input.host.trim(),
+    port: input.port.trim(),
+    fromEmail: input.fromEmail.trim(),
+    fromName: input.fromName.trim(),
+    secure: input.secure,
+  };
+
+  const { error: publicError } = await supabase
+    .from('site_settings')
+    .upsert({ key: EMAIL_PUBLIC_KEY, value: publicValue });
+  if (publicError) {
+    console.error('Error saving email_public settings:', publicError.message);
+    throw new Error('Failed to save email settings.');
+  }
+
+  const newUser = input.user?.trim();
+  const newPass = input.pass?.trim();
+  if (newUser || newPass) {
+    if (isSandboxEnvironment()) {
+      throw new Error('The sandbox cannot store live SMTP credentials.');
+    }
+
+    // Read-merge so updating only one of user/pass keeps the other.
+    const { data: existing } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', EMAIL_SECRET_KEY)
+      .maybeSingle();
+    const current = (existing?.value ?? {}) as Record<string, unknown>;
+
+    const nextValue: Record<string, unknown> = { ...current };
+    if (newUser) nextValue['user'] = encryptWithEnvKey(newUser);
+    if (newPass) nextValue['pass'] = encryptWithEnvKey(newPass);
+
+    const { error: secretError } = await supabase
+      .from('site_settings')
+      .upsert({ key: EMAIL_SECRET_KEY, value: nextValue });
+    if (secretError) {
+      console.error('Error saving email_secret settings:', secretError.message);
+      throw new Error('Failed to save email credentials.');
+    }
+  }
+}
+
+/**
+ * Resolve the full SMTP transport config, DB-first with an env fallback. Uses the
+ * service-role client so it works from any context (the secret row is ADMIN-only under
+ * RLS). Returns null when host/user/pass/from cannot be resolved from either source.
+ */
+export async function resolveEmailServerConfig(): Promise<ResolvedEmailConfig | null> {
+  let pub: EmailPublicSettings = DEFAULT_EMAIL_PUBLIC_SETTINGS;
+  let secret: Record<string, unknown> = {};
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const [{ data: publicData }, { data: secretData }] = await Promise.all([
+      supabase.from('site_settings').select('value').eq('key', EMAIL_PUBLIC_KEY).maybeSingle(),
+      supabase.from('site_settings').select('value').eq('key', EMAIL_SECRET_KEY).maybeSingle(),
+    ]);
+    pub = normalizePublic(publicData?.value);
+    secret = (secretData?.value ?? {}) as Record<string, unknown>;
+  } catch {
+    // No service-role key (unconfigured instance) — fall through to env-only resolution.
+  }
+
+  const host = resolveConfigValue(pub.host, 'SMTP_HOST');
+  const port = resolveConfigValue(pub.port, 'SMTP_PORT');
+  const fromEmail = resolveConfigValue(pub.fromEmail, 'SMTP_FROM_EMAIL');
+  const fromName = resolveConfigValue(pub.fromName, 'SMTP_FROM_NAME');
+  const user = resolveConfigValue(tryDecryptWithEnvKey(secret['user']), 'SMTP_USER');
+  const pass = resolveConfigValue(tryDecryptWithEnvKey(secret['pass']), 'SMTP_PASS');
+
+  if (!host || !port || !user || !pass || !fromEmail) {
+    console.warn('Email is not configured (CMS or SMTP_* env). Outbound email will not be sent.');
+    return null;
+  }
+
+  const portNumber = Number(port);
+  return {
+    host,
+    port: portNumber,
+    // Honor the CMS toggle; fall back to the SMTPS convention (465 ⇒ implicit TLS).
+    secure: pub.host ? pub.secure : portNumber === 465,
+    auth: { user, pass },
+    from: fromName ? `"${fromName}" <${fromEmail}>` : fromEmail,
+  };
+}

package/templates/nextblock-template/lib/onboarding/actions.ts

@@ -0,0 +1,31 @@
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import { revalidatePath } from 'next/cache';
+
+/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
+export async function setOnboardingDismissed(dismissed: boolean) {
+  const supabase = createClient();
+
+  const { data: existing } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', 'onboarding_state')
+    .maybeSingle();
+
+  const current =
+    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
+      ? (existing.value as Record<string, unknown>)
+      : {};
+
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
+
+  if (error) {
+    console.error('Error updating onboarding state:', error.message);
+    throw new Error('Failed to update onboarding state.');
+  }
+
+  revalidatePath('/cms/dashboard');
+}

package/templates/nextblock-template/lib/onboarding/status.ts

@@ -0,0 +1,136 @@
+import 'server-only';
+// Derives the dashboard onboarding checklist live from configuration state. Every check
+// reads public/service-role data only, so it works for both ADMIN and WRITER dashboards.
+import { createClient } from '@nextblock-cms/db/server';
+import { getStoreConfigStatus } from '@nextblock-cms/ecommerce/server';
+import { getEmailPublicSettings } from '../config/email-settings';
+import { getPrivacySettings } from '../privacy/settings';
+
+export type OnboardingStep = {
+  key: string;
+  title: string;
+  description: string;
+  href: string;
+  done: boolean;
+  optional: boolean;
+};
+
+export type OnboardingStatus = {
+  steps: OnboardingStep[];
+  completed: number;
+  total: number;
+  dismissed: boolean;
+};
+
+function hasCopyright(value: unknown): boolean {
+  if (!value || typeof value !== 'object') return false;
+  return Object.values(value as Record<string, unknown>).some(
+    (v) => typeof v === 'string' && v.trim().length > 0
+  );
+}
+
+export async function getOnboardingStatus(opts: {
+  isEcommerceActive: boolean;
+}): Promise<OnboardingStatus> {
+  const supabase = createClient();
+
+  const [{ data: settingRows }, { data: logoRow }, emailPublic, privacy] = await Promise.all([
+    supabase
+      .from('site_settings')
+      .select('key, value')
+      .in('key', ['footer_copyright', 'bot_protection_public', 'onboarding_state']),
+    supabase.from('logos').select('id').limit(1).maybeSingle(),
+    getEmailPublicSettings(),
+    getPrivacySettings(),
+  ]);
+
+  const rows = new Map((settingRows ?? []).map((r) => [r.key, r.value]));
+  const botPublic = (rows.get('bot_protection_public') ?? {}) as Record<string, unknown>;
+  const onboardingState = (rows.get('onboarding_state') ?? {}) as Record<string, unknown>;
+
+  const brandingDone = Boolean(logoRow);
+  const copyrightDone = hasCopyright(rows.get('footer_copyright'));
+  const emailDone = Boolean(emailPublic.host) || Boolean(process.env['SMTP_HOST']);
+  const analyticsDone = Boolean(privacy.gtm_id);
+  const botProvider = typeof botPublic['provider'] === 'string' ? (botPublic['provider'] as string) : 'none';
+  const botDone = botProvider !== 'none' && botProvider !== '';
+
+  const steps: OnboardingStep[] = [
+    {
+      key: 'admin',
+      title: 'Create your admin account',
+      description: 'Your administrator account is set up.',
+      href: '/cms/users',
+      done: true,
+      optional: false,
+    },
+    {
+      key: 'branding',
+      title: 'Add your branding',
+      description: 'Upload your logo and set your site identity.',
+      href: '/cms/settings/logos',
+      done: brandingDone,
+      optional: false,
+    },
+    {
+      key: 'copyright',
+      title: 'Set your copyright / footer',
+      description: 'Configure the footer copyright shown across your site.',
+      href: '/cms/settings/copyright',
+      done: copyrightDone,
+      optional: false,
+    },
+    {
+      key: 'email',
+      title: 'Configure email (SMTP)',
+      description: 'Enable verification emails, password resets, and notifications.',
+      href: '/cms/settings/email',
+      done: emailDone,
+      optional: false,
+    },
+    {
+      key: 'analytics',
+      title: 'Connect analytics',
+      description: 'Add a Google Tag Manager ID for consent-gated analytics.',
+      href: '/cms/settings/google-analytics',
+      done: analyticsDone,
+      optional: true,
+    },
+    {
+      key: 'bot',
+      title: 'Enable bot protection',
+      description: 'Protect your sign-up and sign-in forms with a CAPTCHA.',
+      href: '/cms/settings/bot-protection',
+      done: botDone,
+      optional: true,
+    },
+  ];
+
+  if (opts.isEcommerceActive) {
+    let paymentsDone = false;
+    try {
+      const storeStatus = await getStoreConfigStatus();
+      paymentsDone = storeStatus.stripe.hasKeys || storeStatus.freemius.hasKeys;
+    } catch {
+      paymentsDone = false;
+    }
+    // Insert Payments before the optional steps.
+    steps.splice(4, 0, {
+      key: 'payments',
+      title: 'Set up payment providers',
+      description: 'Add your Stripe and/or Freemius API keys to accept payments.',
+      href: '/cms/payments',
+      done: paymentsDone,
+      optional: false,
+    });
+  }
+
+  const completed = steps.filter((s) => s.done).length;
+
+  return {
+    steps,
+    completed,
+    total: steps.length,
+    dismissed: onboardingState['dismissed'] === true,
+  };
+}

package/templates/nextblock-template/lib/privacy/contact-emails.ts

@@ -0,0 +1,64 @@
+// Server-only resolution of the public-facing contact addresses that used to be
+// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
+// must NEVER route mail to the original authors. Real addresses live only in
+// sandbox env vars (never committed); committed seeds use neutral @example.com
+// placeholders.
+//
+// Resolution precedence (highest first):
+//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
+//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
+//   3. A neutral @example.com placeholder.
+//
+// Sandbox DB resets re-seed dummy values on every run, so a static seed value
+// could never stay correct for the hosted demo — hence env-var-backed resolution
+// at render time instead of baking the address into the migration.
+import 'server-only';
+import { cache } from 'react';
+import { getPrivacySettings } from './settings';
+
+/** Neutral placeholder shown when nothing is configured (real installs). */
+const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
+
+/** Merge tag seeded into the Privacy Policy / Terms page copy. */
+export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
+
+function isSandbox(): boolean {
+  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
+}
+
+/**
+ * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
+ * value from privacy settings (reused as the legal contact per product choice).
+ */
+export function resolvePrivacyEmail(supportEmail: string): string {
+  const configured = supportEmail.trim();
+  if (configured) return configured;
+
+  if (isSandbox()) {
+    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
+    if (fromEnv) return fromEnv;
+  }
+
+  return DUMMY_PRIVACY_EMAIL;
+}
+
+/**
+ * Per-request cached read of the resolved privacy email. Wrapped in React
+ * `cache()` so the many text blocks on a legal page share a single settings
+ * lookup within one render.
+ */
+export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
+  const settings = await getPrivacySettings();
+  return resolvePrivacyEmail(settings.corporate.support_email);
+});
+
+/**
+ * Substitute supported merge tags in a block's HTML. Callers should guard with a
+ * cheap `html.includes('{{')` check first so normal blocks pay nothing.
+ * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
+ */
+export async function substitutePrivacyMergeTags(html: string): Promise<string> {
+  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
+  const email = await getPrivacyMergeEmail();
+  return html.split(PRIVACY_EMAIL_TAG).join(email);
+}

package/templates/nextblock-template/lib/privacy/settings.ts

@@ -90,6 +90,18 @@ export async function savePrivacySettings(input: PrivacySettings): Promise<void>
   }
 }
 
+// Privacy/consent and Google Analytics share the single `privacy_settings` row but
+// are edited from two different CMS pages (Settings -> Privacy vs Settings -> Google
+// Analytics). Each page must persist only its own fields without clobbering the other
+// page's, so writes read-merge against the current row. (We may split this into a
+// dedicated `analytics_settings` key later.)
+export async function mergePrivacySettings(
+  patch: Partial<PrivacySettings>
+): Promise<void> {
+  const current = await getPrivacySettings();
+  await savePrivacySettings({ ...current, ...patch });
+}
+
 export async function saveSecuritySettings(input: SecuritySettings): Promise<void> {
   const supabase = createClient();
   const value = normalizeSecurity(input);

package/templates/nextblock-template/lib/privacy/types.ts

@@ -61,7 +61,9 @@ export const DEFAULT_TRUSTED_DEVICE_DAYS = 30;
 
 export const DEFAULT_SECURITY_SETTINGS: SecuritySettings = {
   trusted_device_days: DEFAULT_TRUSTED_DEVICE_DAYS,
-  enforce_staff_2fa: false,
+  // On by default: staff are encouraged to enable 2FA (a CMS reminder banner is shown to
+  // ADMIN/WRITER accounts without a second factor). Never enforced in the sandbox.
+  enforce_staff_2fa: true,
 };
 
 export type MfaType = 'totp' | 'email';

package/templates/nextblock-template/lib/setup/actions.ts

@@ -227,11 +227,8 @@ export async function recheckStatus(): Promise<ProvisioningStatus & { writable:
 
 export interface CompleteSetupInput {
   admin: { email: string; password: string; fullName: string };
-  autoAcceptSignups: boolean;
-  /** Local-only extra env (storage / SMTP) collected by the wizard. */
+  /** Local-only extra env (media storage) collected by the wizard. */
   envValues?: Record<string, string>;
-  /** Bot protection — stored in the DB so it works on read-only channels too. */
-  turnstile?: { provider: 'none' | 'turnstile'; siteKey: string; secretKey: string };
   /** "Start from a clean database" — wipe before installing (local dev only, server-gated). */
   resetFirst?: boolean;
 }
@@ -286,11 +283,8 @@ export async function completeSetup(input: CompleteSetupInput): Promise<ActionRe
   if (password.length < 8) {
     return { ok: false, error: 'Use an administrator password of at least 8 characters.' };
   }
-  if (input.turnstile?.provider === 'turnstile' && !input.turnstile.secretKey?.trim()) {
-    return { ok: false, error: 'Enter a Turnstile secret key, or disable bot protection.' };
-  }
 
-  // 1) Persist any local env extras (storage / SMTP) for Profile B.
+  // 1) Persist any local env extras (media storage) for Profile B.
   if (
     input.envValues &&
     Object.keys(input.envValues).length > 0 &&
@@ -377,20 +371,11 @@ export async function completeSetup(input: CompleteSetupInput): Promise<ActionRe
   }
 
   // 4) Persist DB-backed settings (service role bypasses RLS — no admin exists yet).
+  //    Sign-up policy, bot protection, email, and payments are no longer collected by the
+  //    wizard; they are configured later from the CMS. New sign-ups default to requiring
+  //    email verification (auto_accept_signups = false) as a safe default.
   try {
-    if (input.turnstile && input.turnstile.provider !== 'none') {
-      await admin.from('site_settings').upsert({
-        key: 'bot_protection_public',
-        value: { provider: input.turnstile.provider, siteKey: input.turnstile.siteKey },
-      });
-      await admin.from('site_settings').upsert({
-        key: 'bot_protection_secret',
-        value: { secretKey: input.turnstile.secretKey },
-      });
-    }
-    await setSystemConfigurationServiceRole({
-      auto_accept_signups: Boolean(input.autoAcceptSignups),
-    });
+    await setSystemConfigurationServiceRole({ auto_accept_signups: false });
   } catch (caught) {
     return {
       ok: false,

package/templates/nextblock-template/lib/setup/migrations-bundle.ts

@@ -168,5 +168,15 @@ export const MIGRATIONS_BUNDLE: BundledMigration[] = [
     "version": "00000000000030",
     "name": "00000000000030_setup_system_configuration.sql",
     "sql": "-- 00000000000030_setup_system_configuration.sql\n-- First-Boot Setup Wizard: global system configuration.\n--\n-- Adds a dedicated, RLS-locked `system_configuration` table that holds settings the\n-- browser /setup wizard manages and that don't belong in the public key-value\n-- `site_settings` store. It is a singleton (exactly one row, id = 1).\n--\n-- Shape:\n--   auto_accept_signups boolean  -- when true, new public sign-ups skip outbound email\n--                                   verification (the signup route uses a service-role\n--                                   admin.createUser({ email_confirm: true }) path).\n--   settings            jsonb    -- forward-compatible catch-all for future feature\n--                                   toggles ({} by default). Do NOT store true secrets\n--                                   here (Turnstile/AI secrets keep living in their\n--                                   existing site_settings sensitive keys).\n--\n-- Access is locked to the ADMIN role for normal clients (NextBlock has no separate\n-- \"super-admin\" tier — ADMIN is the top level). The service_role retains full access\n-- so the wizard can seed/read it before any admin exists.\n\nCREATE TABLE IF NOT EXISTS public.system_configuration (\n  id integer PRIMARY KEY DEFAULT 1,\n  auto_accept_signups boolean NOT NULL DEFAULT false,\n  settings jsonb NOT NULL DEFAULT '{}'::jsonb,\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT system_configuration_singleton CHECK (id = 1)\n);\n\nCOMMENT ON TABLE public.system_configuration IS\n  'Singleton (id = 1) of global setup-wizard configuration. ADMIN-only via RLS; never store secrets in settings.';\n\n-- Seed the single row so reads always find it.\nINSERT INTO public.system_configuration (id, auto_accept_signups, settings)\nVALUES (1, false, '{}'::jsonb)\nON CONFLICT (id) DO NOTHING;\n\nALTER TABLE public.system_configuration ENABLE ROW LEVEL SECURITY;\n\nGRANT SELECT, INSERT, UPDATE, DELETE ON public.system_configuration TO authenticated;\nGRANT ALL ON public.system_configuration TO service_role;\n\n-- ADMIN-only for every operation by authenticated clients.\nDROP POLICY IF EXISTS system_configuration_admin_select ON public.system_configuration;\nCREATE POLICY system_configuration_admin_select\n  ON public.system_configuration\n  FOR SELECT\n  TO authenticated\n  USING ((SELECT public.get_current_user_role()) = 'ADMIN');\n\nDROP POLICY IF EXISTS system_configuration_admin_insert ON public.system_configuration;\nCREATE POLICY system_configuration_admin_insert\n  ON public.system_configuration\n  FOR INSERT\n  TO authenticated\n  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');\n\nDROP POLICY IF EXISTS system_configuration_admin_update ON public.system_configuration;\nCREATE POLICY system_configuration_admin_update\n  ON public.system_configuration\n  FOR UPDATE\n  TO authenticated\n  USING ((SELECT public.get_current_user_role()) = 'ADMIN')\n  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');\n\nDROP POLICY IF EXISTS system_configuration_admin_delete ON public.system_configuration;\nCREATE POLICY system_configuration_admin_delete\n  ON public.system_configuration\n  FOR DELETE\n  TO authenticated\n  USING ((SELECT public.get_current_user_role()) = 'ADMIN');\n\n-- Service role bypasses the ADMIN checks (used by the wizard before an admin exists,\n-- and by the signup route to read auto_accept_signups as an anonymous visitor).\nDROP POLICY IF EXISTS system_configuration_service_role_all ON public.system_configuration;\nCREATE POLICY system_configuration_service_role_all\n  ON public.system_configuration\n  FOR ALL\n  TO service_role\n  USING (true)\n  WITH CHECK (true);\n"
+  },
+  {
+    "version": "00000000000031",
+    "name": "00000000000031_seed_footer_navigation.sql",
+    "sql": "-- 00000000000031_seed_footer_navigation.sql\n-- Seed editable FOOTER navigation items (EN + FR).\n--\n-- The public footer used to hard-code its \"Privacy Policy\" and \"Terms of Service\"\n-- links in apps/nextblock/components/AppShell.tsx. This migration turns them into\n-- real navigation_items rows under the FOOTER menu so they are editable from the\n-- CMS (/cms/navigation) like any other menu, and so the French footer points at\n-- the localized page slugs.\n--\n-- Targets the legal pages seeded by 00000000000027_setup_privacy_and_mfa.sql:\n--   EN  /privacy-policy            FR  /politique-de-confidentialite\n--   EN  /terms-of-service          FR  /conditions-utilisation\n--\n-- Idempotent: re-running replaces the FOOTER rows it owns (matched by URL) and\n-- reuses their translation_group_id so EN/FR stay linked across re-runs.\nDO $seed_footer$\nDECLARE\n  v_en bigint;\n  v_fr bigint;\n  v_privacy_group uuid;\n  v_terms_group uuid;\n  v_en_privacy_page bigint;\n  v_fr_privacy_page bigint;\n  v_en_terms_page bigint;\n  v_fr_terms_page bigint;\nBEGIN\n  SELECT id INTO v_en FROM public.languages WHERE code = 'en' LIMIT 1;\n  SELECT id INTO v_fr FROM public.languages WHERE code = 'fr' LIMIT 1;\n\n  IF v_en IS NULL THEN\n    RAISE NOTICE 'Default language \"en\" not found; skipping footer navigation seed.';\n    RETURN;\n  END IF;\n\n  -- Reuse existing translation groups if these footer items were seeded before,\n  -- so EN <-> FR stay paired and re-runs do not orphan translations.\n  SELECT translation_group_id INTO v_privacy_group\n    FROM public.navigation_items\n    WHERE menu_key = 'FOOTER' AND url = '/privacy-policy' LIMIT 1;\n  IF v_privacy_group IS NULL THEN v_privacy_group := gen_random_uuid(); END IF;\n\n  SELECT translation_group_id INTO v_terms_group\n    FROM public.navigation_items\n    WHERE menu_key = 'FOOTER' AND url = '/terms-of-service' LIMIT 1;\n  IF v_terms_group IS NULL THEN v_terms_group := gen_random_uuid(); END IF;\n\n  -- Best-effort link each item to its underlying page (ON DELETE SET NULL keeps\n  -- the link working even if a page is later removed; url remains the source of truth).\n  SELECT id INTO v_en_privacy_page\n    FROM public.pages WHERE slug = 'privacy-policy' AND language_id = v_en LIMIT 1;\n  SELECT id INTO v_en_terms_page\n    FROM public.pages WHERE slug = 'terms-of-service' AND language_id = v_en LIMIT 1;\n\n  -- Remove any prior copies of the footer links we own, then re-insert cleanly.\n  DELETE FROM public.navigation_items\n    WHERE menu_key = 'FOOTER'\n      AND url IN (\n        '/privacy-policy', '/terms-of-service',\n        '/politique-de-confidentialite', '/conditions-utilisation'\n      );\n\n  -- ----- English footer -----\n  INSERT INTO public.navigation_items\n    (language_id, menu_key, label, url, \"order\", page_id, translation_group_id)\n  VALUES\n    (v_en, 'FOOTER', 'Privacy Policy',    '/privacy-policy',    0, v_en_privacy_page, v_privacy_group),\n    (v_en, 'FOOTER', 'Terms of Service',  '/terms-of-service',  1, v_en_terms_page,   v_terms_group);\n\n  -- ----- French footer (only if the French language exists) -----\n  IF v_fr IS NOT NULL THEN\n    SELECT id INTO v_fr_privacy_page\n      FROM public.pages WHERE slug = 'politique-de-confidentialite' AND language_id = v_fr LIMIT 1;\n    SELECT id INTO v_fr_terms_page\n      FROM public.pages WHERE slug = 'conditions-utilisation' AND language_id = v_fr LIMIT 1;\n\n    INSERT INTO public.navigation_items\n      (language_id, menu_key, label, url, \"order\", page_id, translation_group_id)\n    VALUES\n      (v_fr, 'FOOTER', 'Politique de confidentialité', '/politique-de-confidentialite', 0, v_fr_privacy_page, v_privacy_group),\n      (v_fr, 'FOOTER', 'Conditions d''utilisation',    '/conditions-utilisation',       1, v_fr_terms_page,   v_terms_group);\n  END IF;\n\n  RAISE NOTICE 'Seeded FOOTER navigation items (Privacy Policy, Terms of Service).';\nEND;\n$seed_footer$;\n"
+  },
+  {
+    "version": "00000000000032",
+    "name": "00000000000032_neutralize_seeded_contact_emails.sql",
+    "sql": "-- 00000000000032_neutralize_seeded_contact_emails.sql\n-- Remove the original authors' contact addresses from seeded content so a\n-- downloaded / self-hosted copy of NextBlock never routes mail to us.\n--\n-- Earlier migrations baked real addresses into block content:\n--   * 00000000000027 seeded `privacy@nextblock.dev` across the Privacy Policy and\n--     Terms pages (EN + FR), as visible text and `mailto:` links.\n--   * 00000000000010 seeded a `mailto:info@nextblock.dev` CTA on the French home\n--     page (the English page correctly links to /contact), and `foo@bar.com` as\n--     the contact form recipient.\n--\n-- Migrations are append-only, so this is a forward-only data fix rather than an\n-- edit of those files. Each statement is idempotent (a no-op once applied).\n--\n-- The `{{privacy_email}}` token is resolved at render time by the app\n-- (apps/nextblock/lib/privacy/contact-emails.ts): admin \"Support email\" setting\n-- -> SANDBOX_PRIVACY_EMAIL env (sandbox only) -> privacy@example.com fallback.\n\n-- 1. Privacy / Terms legal pages: swap the hard-coded address for a merge tag.\nUPDATE public.blocks\nSET content = replace(content::text, 'privacy@nextblock.dev', '{{privacy_email}}')::jsonb\nWHERE content::text LIKE '%privacy@nextblock.dev%';\n\n-- 2. French home \"Nous contacter\" CTA: point at the contact form like the English\n--    page instead of a mailto to our inbox.\nUPDATE public.blocks\nSET content = replace(content::text, 'mailto:info@nextblock.dev', '/contact')::jsonb\nWHERE content::text LIKE '%mailto:info@nextblock.dev%';\n\n-- 3. Contact form default recipient: use a neutral placeholder. In sandbox the\n--    app overrides this with SANDBOX_CONTACT_EMAIL at submit time.\nUPDATE public.blocks\nSET content = replace(content::text, 'foo@bar.com', 'contact@example.com')::jsonb\nWHERE content::text LIKE '%foo@bar.com%';\n"
   }
 ];

package/templates/nextblock-template/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
+import "./.next/dev/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/templates/nextblock-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "scripts": {
     "dev": "next dev",