create-nextblock 0.13.10 → 0.13.11

package/templates/nextblock-template/app/api/cms/check-updates/route.ts

@@ -1,44 +1,44 @@
-import { NextResponse } from 'next/server';
-import { createClient } from '@nextblock-cms/db/server';
-import { refreshUpstreamStatus } from '../../../../lib/updates/check-upstream';
-
-// Node runtime: the update checker reads the filesystem (.git / workflow detection) and
-// uses the service-role client. force-dynamic so it never gets statically cached.
-export const runtime = 'nodejs';
-export const dynamic = 'force-dynamic';
-
-/** Authenticated ADMIN gate, mirroring lib/full-backup/server.ts. */
-async function requireAdmin(): Promise<string | null> {
-  const supabase = createClient();
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
-  if (!user) return 'Not authenticated.';
-
-  const { data: profile, error } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', user.id)
-    .single();
-  if (error || profile?.role !== 'ADMIN') return 'Administrator role required.';
-  return null;
-}
-
-/**
- * Admin-triggered upstream update check (Track B). Polls the GitHub Releases API,
- * compares versions, and — on a standalone install — records a runtime_update_available
- * alert. Returns the comparison either way so an admin "Check for updates" control can
- * show the result inline.
- */
-export async function POST() {
-  const denied = await requireAdmin();
-  if (denied) {
-    return NextResponse.json({ ok: false, error: denied }, { status: 401 });
-  }
-
-  const { update, conflicts, snapshot } = await refreshUpstreamStatus();
-  // The check itself succeeded as an operation even if a network call failed; surface any
-  // soft error in the body rather than 500ing the admin action.
-  const ok = update.ok && conflicts.ok;
-  return NextResponse.json({ ok, update, conflicts, snapshot }, { status: ok ? 200 : 502 });
-}
+import { NextResponse } from 'next/server';
+import { createClient } from '@nextblock-cms/db/server';
+import { refreshUpstreamStatus } from '../../../../lib/updates/check-upstream';
+
+// Node runtime: the update checker reads the filesystem (.git / workflow detection) and
+// uses the service-role client. force-dynamic so it never gets statically cached.
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/** Authenticated ADMIN gate, mirroring lib/full-backup/server.ts. */
+async function requireAdmin(): Promise<string | null> {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return 'Not authenticated.';
+
+  const { data: profile, error } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (error || profile?.role !== 'ADMIN') return 'Administrator role required.';
+  return null;
+}
+
+/**
+ * Admin-triggered upstream update check (Track B). Polls the GitHub Releases API,
+ * compares versions, and — on a standalone install — records a runtime_update_available
+ * alert. Returns the comparison either way so an admin "Check for updates" control can
+ * show the result inline.
+ */
+export async function POST() {
+  const denied = await requireAdmin();
+  if (denied) {
+    return NextResponse.json({ ok: false, error: denied }, { status: 401 });
+  }
+
+  const { update, conflicts, snapshot } = await refreshUpstreamStatus();
+  // The check itself succeeded as an operation even if a network call failed; surface any
+  // soft error in the body rather than 500ing the admin action.
+  const ok = update.ok && conflicts.ok;
+  return NextResponse.json({ ok, update, conflicts, snapshot }, { status: ok ? 200 : 502 });
+}

package/templates/nextblock-template/app/api/cms/ecommerce/product-picker/route.ts

@@ -1,151 +1,151 @@
-import { NextResponse } from 'next/server';
-import {
-  createClient,
-  getServiceRoleSupabaseClient,
-  verifyPackageOnline,
-} from '@nextblock-cms/db/server';
-
-export const dynamic = 'force-dynamic';
-
-/** How many products a single search returns before the UI asks for a narrower query. */
-const PRODUCT_PAGE_SIZE = 50;
-/** Guard against an unbounded `ids` list when hydrating labels for an existing selection. */
-const MAX_HYDRATED_IDS = 100;
-
-export interface ProductPickerCategory {
-  id: string;
-  name: string;
-  slug: string;
-}
-
-export interface ProductPickerProduct {
-  id: string;
-  title: string;
-  slug: string | null;
-  sku: string | null;
-  status: string | null;
-  languageCode: string | null;
-  translationGroupId: string | null;
-}
-
-/**
- * PostgREST parses `,`, `.`, `(` and `)` inside an `or(...)` filter, so anything
- * the author types has to be stripped before it is interpolated into one.
- */
-function sanitizeSearchTerm(term: string): string {
-  return term.replace(/[,().*%\\]/g, ' ').trim().slice(0, 80);
-}
-
-/**
- * Options for the Product Grid block pickers: every category plus a page of
- * products (optionally filtered by `search`). `ids` hydrates labels for an
- * existing selection whose products fall outside the current page.
- */
-export async function GET(request: Request) {
-  try {
-    const supabase = createClient();
-    const {
-      data: { user },
-      error: authError,
-    } = await supabase.auth.getUser();
-
-    if (authError || !user) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-    }
-
-    const { data: profile } = await supabase
-      .from('profiles')
-      .select('role')
-      .eq('id', user.id)
-      .single();
-
-    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
-      return NextResponse.json(
-        { error: 'Forbidden: Insufficient permissions' },
-        { status: 403 }
-      );
-    }
-
-    // Fail closed: without the ecommerce package there is no product catalog to
-    // browse, and the blocks that use this route are hidden from the picker.
-    if (!(await verifyPackageOnline('ecommerce'))) {
-      return NextResponse.json(
-        { error: 'The ecommerce package is not active.' },
-        { status: 403 }
-      );
-    }
-
-    const url = new URL(request.url);
-    const search = sanitizeSearchTerm(url.searchParams.get('search') ?? '');
-    const ids = (url.searchParams.get('ids') ?? '')
-      .split(',')
-      .map((id) => id.trim())
-      .filter(Boolean)
-      .slice(0, MAX_HYDRATED_IDS);
-
-    // Reading the catalog is admin work behind the role check above.
-    const admin = getServiceRoleSupabaseClient();
-
-    const productColumns =
-      'id, title, slug, sku, status, translation_group_id, languages(code)';
-
-    let productsQuery = admin
-      .from('products')
-      .select(productColumns)
-      .order('created_at', { ascending: false })
-      // Fetch one extra row so the UI can tell the author the list was truncated.
-      .limit(PRODUCT_PAGE_SIZE + 1);
-
-    if (search) {
-      productsQuery = productsQuery.or(`title.ilike.%${search}%,sku.ilike.%${search}%`);
-    }
-
-    const [categoriesResult, productsResult, selectedResult] = await Promise.all([
-      admin.from('categories').select('id, name, slug').order('name', { ascending: true }),
-      productsQuery,
-      ids.length > 0
-        ? admin.from('products').select(productColumns).in('id', ids)
-        : Promise.resolve({ data: [], error: null }),
-    ]);
-
-    if (categoriesResult.error) throw categoriesResult.error;
-    if (productsResult.error) throw productsResult.error;
-    if (selectedResult.error) throw selectedResult.error;
-
-    const toPickerProduct = (row: any): ProductPickerProduct => ({
-      id: row.id,
-      title: row.title,
-      slug: row.slug ?? null,
-      sku: row.sku ?? null,
-      status: row.status ?? null,
-      languageCode: row.languages?.code ?? null,
-      translationGroupId: row.translation_group_id ?? null,
-    });
-
-    const productRows = (productsResult.data ?? []) as any[];
-    const hasMore = productRows.length > PRODUCT_PAGE_SIZE;
-    const products = productRows.slice(0, PRODUCT_PAGE_SIZE).map(toPickerProduct);
-
-    // Merge the hydrated selection in so already-chosen products always render
-    // with a real label, even when a search hides them.
-    const byId = new Map(products.map((product) => [product.id, product]));
-    for (const row of (selectedResult.data ?? []) as any[]) {
-      if (!byId.has(row.id)) byId.set(row.id, toPickerProduct(row));
-    }
-
-    return NextResponse.json(
-      {
-        categories: (categoriesResult.data ?? []) as ProductPickerCategory[],
-        products: Array.from(byId.values()),
-        hasMore,
-      },
-      { status: 200 }
-    );
-  } catch (error) {
-    console.error('[Product Picker API] Unexpected error:', error);
-    return NextResponse.json(
-      { error: 'Failed to load product picker options.' },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from 'next/server';
+import {
+  createClient,
+  getServiceRoleSupabaseClient,
+  verifyPackageOnline,
+} from '@nextblock-cms/db/server';
+
+export const dynamic = 'force-dynamic';
+
+/** How many products a single search returns before the UI asks for a narrower query. */
+const PRODUCT_PAGE_SIZE = 50;
+/** Guard against an unbounded `ids` list when hydrating labels for an existing selection. */
+const MAX_HYDRATED_IDS = 100;
+
+export interface ProductPickerCategory {
+  id: string;
+  name: string;
+  slug: string;
+}
+
+export interface ProductPickerProduct {
+  id: string;
+  title: string;
+  slug: string | null;
+  sku: string | null;
+  status: string | null;
+  languageCode: string | null;
+  translationGroupId: string | null;
+}
+
+/**
+ * PostgREST parses `,`, `.`, `(` and `)` inside an `or(...)` filter, so anything
+ * the author types has to be stripped before it is interpolated into one.
+ */
+function sanitizeSearchTerm(term: string): string {
+  return term.replace(/[,().*%\\]/g, ' ').trim().slice(0, 80);
+}
+
+/**
+ * Options for the Product Grid block pickers: every category plus a page of
+ * products (optionally filtered by `search`). `ids` hydrates labels for an
+ * existing selection whose products fall outside the current page.
+ */
+export async function GET(request: Request) {
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    // Fail closed: without the ecommerce package there is no product catalog to
+    // browse, and the blocks that use this route are hidden from the picker.
+    if (!(await verifyPackageOnline('ecommerce'))) {
+      return NextResponse.json(
+        { error: 'The ecommerce package is not active.' },
+        { status: 403 }
+      );
+    }
+
+    const url = new URL(request.url);
+    const search = sanitizeSearchTerm(url.searchParams.get('search') ?? '');
+    const ids = (url.searchParams.get('ids') ?? '')
+      .split(',')
+      .map((id) => id.trim())
+      .filter(Boolean)
+      .slice(0, MAX_HYDRATED_IDS);
+
+    // Reading the catalog is admin work behind the role check above.
+    const admin = getServiceRoleSupabaseClient();
+
+    const productColumns =
+      'id, title, slug, sku, status, translation_group_id, languages(code)';
+
+    let productsQuery = admin
+      .from('products')
+      .select(productColumns)
+      .order('created_at', { ascending: false })
+      // Fetch one extra row so the UI can tell the author the list was truncated.
+      .limit(PRODUCT_PAGE_SIZE + 1);
+
+    if (search) {
+      productsQuery = productsQuery.or(`title.ilike.%${search}%,sku.ilike.%${search}%`);
+    }
+
+    const [categoriesResult, productsResult, selectedResult] = await Promise.all([
+      admin.from('categories').select('id, name, slug').order('name', { ascending: true }),
+      productsQuery,
+      ids.length > 0
+        ? admin.from('products').select(productColumns).in('id', ids)
+        : Promise.resolve({ data: [], error: null }),
+    ]);
+
+    if (categoriesResult.error) throw categoriesResult.error;
+    if (productsResult.error) throw productsResult.error;
+    if (selectedResult.error) throw selectedResult.error;
+
+    const toPickerProduct = (row: any): ProductPickerProduct => ({
+      id: row.id,
+      title: row.title,
+      slug: row.slug ?? null,
+      sku: row.sku ?? null,
+      status: row.status ?? null,
+      languageCode: row.languages?.code ?? null,
+      translationGroupId: row.translation_group_id ?? null,
+    });
+
+    const productRows = (productsResult.data ?? []) as any[];
+    const hasMore = productRows.length > PRODUCT_PAGE_SIZE;
+    const products = productRows.slice(0, PRODUCT_PAGE_SIZE).map(toPickerProduct);
+
+    // Merge the hydrated selection in so already-chosen products always render
+    // with a real label, even when a search hides them.
+    const byId = new Map(products.map((product) => [product.id, product]));
+    for (const row of (selectedResult.data ?? []) as any[]) {
+      if (!byId.has(row.id)) byId.set(row.id, toPickerProduct(row));
+    }
+
+    return NextResponse.json(
+      {
+        categories: (categoriesResult.data ?? []) as ProductPickerCategory[],
+        products: Array.from(byId.values()),
+        hasMore,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[Product Picker API] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Failed to load product picker options.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/cms/full-backup/export/route.ts

@@ -1,33 +1,33 @@
-import { NextResponse } from "next/server";
-
-import { exportFullBackupArchive } from "../../../../../lib/full-backup/server";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-export async function POST() {
-  try {
-    const archive = await exportFullBackupArchive();
-    const body = archive.content.buffer.slice(
-      archive.content.byteOffset,
-      archive.content.byteOffset + archive.content.byteLength
-    ) as ArrayBuffer;
-
-    return new NextResponse(body, {
-      headers: {
-        "Content-Type": archive.mimeType,
-        "Content-Disposition": `attachment; filename="${archive.fileName}"`,
-        "Content-Length": String(archive.content.byteLength),
-        "Cache-Control": "no-store",
-      },
-    });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "Failed to export full ZIP backup.",
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "next/server";
+
+import { exportFullBackupArchive } from "../../../../../lib/full-backup/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function POST() {
+  try {
+    const archive = await exportFullBackupArchive();
+    const body = archive.content.buffer.slice(
+      archive.content.byteOffset,
+      archive.content.byteOffset + archive.content.byteLength
+    ) as ArrayBuffer;
+
+    return new NextResponse(body, {
+      headers: {
+        "Content-Type": archive.mimeType,
+        "Content-Disposition": `attachment; filename="${archive.fileName}"`,
+        "Content-Length": String(archive.content.byteLength),
+        "Cache-Control": "no-store",
+      },
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : "Failed to export full ZIP backup.",
+      },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/cms/full-backup/restore/route.ts

@@ -1,63 +1,63 @@
-import { NextResponse } from "next/server";
-
-import {
-  requireFullBackupAdmin,
-  restoreFullBackupArchive,
-  reviewFullBackupArchiveForAdmin,
-} from "../../../../../lib/full-backup/server";
-import type { FullBackupMediaUrlMode } from "../../../../../lib/full-backup/manifest";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-function normalizeMediaUrlMode(value: FormDataEntryValue | null): FullBackupMediaUrlMode {
-  return value === "keep_exact_urls" ? "keep_exact_urls" : "rewrite_to_destination";
-}
-
-async function readZipFile(formData: FormData) {
-  const file = formData.get("file");
-  if (!(file instanceof File)) {
-    throw new Error("Choose a full backup ZIP file first.");
-  }
-
-  return new Uint8Array(await file.arrayBuffer());
-}
-
-export async function POST(request: Request) {
-  try {
-    await requireFullBackupAdmin();
-    const formData = await request.formData();
-    const action = String(formData.get("action") || "review");
-    const archive = await readZipFile(formData);
-
-    if (action === "review") {
-      return NextResponse.json(await reviewFullBackupArchiveForAdmin(archive));
-    }
-
-    if (action !== "restore") {
-      return NextResponse.json(
-        { success: false, error: "Unknown full backup restore action.", warnings: [] },
-        { status: 400 }
-      );
-    }
-
-    const result = await restoreFullBackupArchive({
-      archive,
-      confirmation: String(formData.get("confirmation") || ""),
-      mediaUrlMode: normalizeMediaUrlMode(formData.get("mediaUrlMode")),
-      destinationBaseUrl: String(formData.get("destinationBaseUrl") || ""),
-      deleteExtraneousR2Objects: formData.get("deleteExtraneousR2Objects") === "true",
-    });
-
-    return NextResponse.json(result, { status: result.success ? 200 : 400 });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "Failed to restore full ZIP backup.",
-        warnings: [],
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "next/server";
+
+import {
+  requireFullBackupAdmin,
+  restoreFullBackupArchive,
+  reviewFullBackupArchiveForAdmin,
+} from "../../../../../lib/full-backup/server";
+import type { FullBackupMediaUrlMode } from "../../../../../lib/full-backup/manifest";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function normalizeMediaUrlMode(value: FormDataEntryValue | null): FullBackupMediaUrlMode {
+  return value === "keep_exact_urls" ? "keep_exact_urls" : "rewrite_to_destination";
+}
+
+async function readZipFile(formData: FormData) {
+  const file = formData.get("file");
+  if (!(file instanceof File)) {
+    throw new Error("Choose a full backup ZIP file first.");
+  }
+
+  return new Uint8Array(await file.arrayBuffer());
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireFullBackupAdmin();
+    const formData = await request.formData();
+    const action = String(formData.get("action") || "review");
+    const archive = await readZipFile(formData);
+
+    if (action === "review") {
+      return NextResponse.json(await reviewFullBackupArchiveForAdmin(archive));
+    }
+
+    if (action !== "restore") {
+      return NextResponse.json(
+        { success: false, error: "Unknown full backup restore action.", warnings: [] },
+        { status: 400 }
+      );
+    }
+
+    const result = await restoreFullBackupArchive({
+      archive,
+      confirmation: String(formData.get("confirmation") || ""),
+      mediaUrlMode: normalizeMediaUrlMode(formData.get("mediaUrlMode")),
+      destinationBaseUrl: String(formData.get("destinationBaseUrl") || ""),
+      deleteExtraneousR2Objects: formData.get("deleteExtraneousR2Objects") === "true",
+    });
+
+    return NextResponse.json(result, { status: result.success ? 200 : 400 });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : "Failed to restore full ZIP backup.",
+        warnings: [],
+      },
+      { status: 500 }
+    );
+  }
+}