create-nextblock 0.11.2 → 0.12.0

package/templates/nextblock-template/app/actions/visualEditingActions.ts

@@ -175,6 +175,7 @@ async function publishPageDraft(draft: ContentDraftRow, authorId: string) {
   addStringMeta(pageUpdate, draft, "status");
   addNullableStringMeta(pageUpdate, draft, "meta_title");
   addNullableStringMeta(pageUpdate, draft, "meta_description");
+  addNullableStringMeta(pageUpdate, draft, "custom_canonical");
   addNullableStringMeta(pageUpdate, draft, "feature_image_id");
 
   const { error: pageError } = await supabase
@@ -219,6 +220,7 @@ async function publishPostDraft(draft: ContentDraftRow, authorId: string) {
   addStringMeta(postUpdate, draft, "status");
   addNullableStringMeta(postUpdate, draft, "meta_title");
   addNullableStringMeta(postUpdate, draft, "meta_description");
+  addNullableStringMeta(postUpdate, draft, "custom_canonical");
   addNullableStringMeta(postUpdate, draft, "label");
   addNullableStringMeta(postUpdate, draft, "excerpt");
   addNullableStringMeta(postUpdate, draft, "subtitle");

package/templates/nextblock-template/app/actions.ts

@@ -9,6 +9,7 @@ import { createEmailChallenge, evaluateTwoFactor } from "../lib/auth/twoFactor";
 import { REMEMBER_INTENT_COOKIE, setSecureCookie } from "../lib/auth/cookies";
 import { sendTwoFactorCodeEmail } from "./actions/twoFactorEmail";
 import { getSystemConfiguration } from "../lib/setup/system-config";
+import { verifyBotProtection } from "../lib/botProtection/verify";
 
 export const signUpAction = async (formData: FormData) => {
   const email = formData.get("email")?.toString();
@@ -30,6 +31,19 @@ export const signUpAction = async (formData: FormData) => {
     );
   }
 
+  // Bot protection: the same honeypot + Turnstile/reCAPTCHA check the public
+  // contact forms use, run BEFORE any account is created. On a honeypot hit we
+  // mimic a normal "check your email" success so the bot learns nothing; a failed
+  // captcha surfaces the reason. (The site-wide provider from CMS → Settings →
+  // Bot Protection applies; when it's "none", only the honeypot gates signup.)
+  const botCheck = await verifyBotProtection(formData);
+  if (!botCheck.ok) {
+    if (botCheck.reason === "honeypot") {
+      return encodedRedirect("success", "/sign-up", "auth.signup_check_email_profile");
+    }
+    return encodedRedirect("error", "/sign-up", botCheck.message);
+  }
+
   // Auto-accept mode (system_configuration.auto_accept_signups): create an already-
   // confirmed account via the service role so the user is active immediately, with no
   // outbound verification email — regardless of SMTP / project email-confirmation

package/templates/nextblock-template/app/api/brand/email-logo/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server';
+
+import { resolveEmailBranding } from '../../../../lib/email/branding';
+
+// Public, unauthenticated logo endpoint for the Supabase auth emails (magic link, password
+// reset, confirm email, invite, ...). Those templates are rendered and sent by Supabase's
+// own SMTP from static HTML, so they cannot read the CMS logo per-send. Instead their
+// `<img>` points here (`{{ .SiteURL }}/api/brand/email-logo`); when the recipient opens the
+// email their client fetches this route, which 302-redirects to the operator's CURRENT
+// uploaded logo. That keeps the statically-pushed auth templates in sync with the live CMS
+// logo with no re-deploy — "change at will".
+//
+// Email image proxies (e.g. Gmail) hit this unauthenticated and follow the redirect, so it
+// must never require auth and must always return an image (never a 4xx/5xx that would show
+// a broken-image icon). When no logo is configured it returns a 1x1 transparent PNG — a
+// static <img> can't fall back to a text banner the way the app-rendered emails do.
+export const dynamic = 'force-dynamic';
+
+// 1x1 transparent PNG.
+const TRANSPARENT_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
+  'base64',
+);
+
+function transparentPixel(): NextResponse {
+  return new NextResponse(TRANSPARENT_PNG, {
+    status: 200,
+    headers: {
+      'Content-Type': 'image/png',
+      // Short cache so a newly-set logo starts showing quickly on freshly-sent emails.
+      'Cache-Control': 'public, max-age=60',
+    },
+  });
+}
+
+export async function GET() {
+  try {
+    const { logoUrl } = await resolveEmailBranding();
+    if (logoUrl) {
+      const response = NextResponse.redirect(logoUrl, 302);
+      response.headers.set('Cache-Control', 'public, max-age=300');
+      return response;
+    }
+  } catch {
+    // Fall through to the transparent pixel — never surface an error to an email client.
+  }
+  return transparentPixel();
+}

package/templates/nextblock-template/app/api/cron/reset-sandbox/route.ts

@@ -14,7 +14,7 @@ import {
 } from '@nextblock-cms/ecommerce/server';
 import postgres from 'postgres';
 
-import { CORTEX_AI_PACKAGE_ID } from '@nextblock/cortex';
+import { CORTEX_AI_PACKAGE_ID } from '@nextblock/cortex';
 import { SANDBOX_RESET_SQL } from './sandboxResetSql';
 
 export const dynamic = 'force-dynamic';
@@ -2712,6 +2712,48 @@ async function seedFakeStoreData(sql: SqlClient, supabaseAdmin: any) {
   }
 }
 
+// The home-page "Live Demo" promo (migration 00000000000006) sends visitors to this
+// very sandbox. That CTA is valuable on production (nextblock.dev) but pointless *inside*
+// the demo it points at, so we strip it after the reset replays migrations. The blocks are
+// tagged with a `nb-sandbox-promo` sentinel comment; after removing them we renumber the
+// affected home pages so their block ordering stays contiguous.
+async function removeSandboxPromoSections(sql: SqlClient) {
+  const deleted = await sql`
+    DELETE FROM public.blocks
+    WHERE block_type = 'section'
+      AND content::text LIKE '%nb-sandbox-promo%'
+    RETURNING id
+  `;
+
+  if (deleted.length === 0) {
+    return;
+  }
+
+  await sql`
+    WITH home_pages AS (
+      SELECT p.id
+      FROM public.pages p
+      JOIN public.languages l ON l.id = p.language_id
+      WHERE (l.code = 'en' AND p.slug = 'home')
+         OR (l.code = 'fr' AND p.slug = 'accueil')
+    ),
+    ranked AS (
+      SELECT b.id,
+             (ROW_NUMBER() OVER (PARTITION BY b.page_id ORDER BY b."order", b.id) - 1) AS new_order
+      FROM public.blocks b
+      WHERE b.page_id IN (SELECT id FROM home_pages)
+    )
+    UPDATE public.blocks b
+    SET "order" = r.new_order
+    FROM ranked r
+    WHERE b.id = r.id AND b."order" <> r.new_order
+  `;
+
+  console.log(
+    `[Sandbox Reset] Removed ${deleted.length} sandbox-promo section(s) from the home pages.`
+  );
+}
+
 export async function GET(request: NextRequest) {
   // 1. Guard: fail closed anywhere that is not explicitly the sandbox.
   const isSandboxResetEnabled = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
@@ -2818,6 +2860,10 @@ export async function GET(request: NextRequest) {
         throw dbError;
       }
 
+      // The replayed migrations re-add the "Live Demo" home-page promo that points at this
+      // sandbox — strip it here so the demo does not advertise itself to itself.
+      await removeSandboxPromoSections(db);
+
       const normalizedMediaCount = await normalizeMediaStorageKeys(db);
       if (normalizedMediaCount > 0) {
         console.log(