create-nextblock 0.13.10 → 0.13.11

package/templates/nextblock-template/lib/app-secrets.ts

@@ -1,39 +1,39 @@
-import 'server-only';
-import { createHmac } from 'node:crypto';
-
-// Resolve the app's internal shared secrets WITHOUT requiring the operator to paste
-// random strings at deploy time. When an explicit env var is set it always wins;
-// otherwise the secret is derived deterministically from the always-present Supabase
-// service-role key. This is what lets a one-click Vercel deploy work with zero env
-// input while Draft Mode and on-demand revalidation still function out of the box.
-//
-// HMAC-SHA256 is one-way, so a leaked derived secret never exposes the service-role
-// key. The derived value is stable for a given Supabase project; rotating the
-// service-role key rotates these secrets too (set the explicit env var to pin one
-// independently — e.g. to configure a Supabase revalidation webhook with a fixed
-// token). `npm run setup` still writes explicit values locally, so dev is unchanged.
-//
-// CRON_SECRET is intentionally NOT derived here: Vercel Cron injects
-// `Authorization: Bearer ${process.env.CRON_SECRET}` read from the env at invocation,
-// so a derived value could never match it. The cron routes instead treat CRON_SECRET
-// as optional (enforced only when set) — see app/api/cron/*/route.ts.
-
-function deriveFromServiceRole(label: string): string {
-  // Accept the Marketplace integration's SUPABASE_SECRET_KEY alias too, so derivation
-  // still works on a one-click deploy that only injected the new key name.
-  const master = (
-    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY
-  )?.trim();
-  if (!master) return '';
-  return createHmac('sha256', master).update(`nextblock:${label}`).digest('hex');
-}
-
-/** Secret for the programmatic Draft Mode preview entry (`/api/draft?secret=`). */
-export function resolveDraftModeSecret(): string {
-  return process.env.DRAFT_MODE_SECRET?.trim() || deriveFromServiceRole('draft-mode');
-}
-
-/** Shared secret a Supabase webhook sends to `/api/revalidate` (`x-revalidate-secret`). */
-export function resolveRevalidateSecret(): string {
-  return process.env.REVALIDATE_SECRET_TOKEN?.trim() || deriveFromServiceRole('revalidate');
-}
+import 'server-only';
+import { createHmac } from 'node:crypto';
+
+// Resolve the app's internal shared secrets WITHOUT requiring the operator to paste
+// random strings at deploy time. When an explicit env var is set it always wins;
+// otherwise the secret is derived deterministically from the always-present Supabase
+// service-role key. This is what lets a one-click Vercel deploy work with zero env
+// input while Draft Mode and on-demand revalidation still function out of the box.
+//
+// HMAC-SHA256 is one-way, so a leaked derived secret never exposes the service-role
+// key. The derived value is stable for a given Supabase project; rotating the
+// service-role key rotates these secrets too (set the explicit env var to pin one
+// independently — e.g. to configure a Supabase revalidation webhook with a fixed
+// token). `npm run setup` still writes explicit values locally, so dev is unchanged.
+//
+// CRON_SECRET is intentionally NOT derived here: Vercel Cron injects
+// `Authorization: Bearer ${process.env.CRON_SECRET}` read from the env at invocation,
+// so a derived value could never match it. The cron routes instead treat CRON_SECRET
+// as optional (enforced only when set) — see app/api/cron/*/route.ts.
+
+function deriveFromServiceRole(label: string): string {
+  // Accept the Marketplace integration's SUPABASE_SECRET_KEY alias too, so derivation
+  // still works on a one-click deploy that only injected the new key name.
+  const master = (
+    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY
+  )?.trim();
+  if (!master) return '';
+  return createHmac('sha256', master).update(`nextblock:${label}`).digest('hex');
+}
+
+/** Secret for the programmatic Draft Mode preview entry (`/api/draft?secret=`). */
+export function resolveDraftModeSecret(): string {
+  return process.env.DRAFT_MODE_SECRET?.trim() || deriveFromServiceRole('draft-mode');
+}
+
+/** Shared secret a Supabase webhook sends to `/api/revalidate` (`x-revalidate-secret`). */
+export function resolveRevalidateSecret(): string {
+  return process.env.REVALIDATE_SECRET_TOKEN?.trim() || deriveFromServiceRole('revalidate');
+}

package/templates/nextblock-template/lib/auth/cookies.ts

@@ -1,47 +1,47 @@
-// Server-only cookie helpers for the 2FA / trusted-device flow.
-// All three cookies are HttpOnly so they are never readable from JS.
-import { cookies } from 'next/headers';
-
-/** Long-lived "remember this device" token (raw token; its SHA-256 is in the DB). */
-export const TRUSTED_DEVICE_COOKIE = 'nb_trusted_device';
-/** Signed marker proving the email second factor was satisfied this session. */
-export const TWO_FACTOR_COOKIE = 'nb_2fa_verified';
-/** Short-lived flag carrying the "remember me" checkbox from login to post-2FA. */
-export const REMEMBER_INTENT_COOKIE = 'nb_remember_intent';
-
-const isProd = process.env.NODE_ENV === 'production';
-
-export async function setSecureCookie(
-  name: string,
-  value: string,
-  maxAgeSeconds: number,
-): Promise<void> {
-  const store = await cookies();
-  store.set({
-    name,
-    value,
-    httpOnly: true,
-    secure: isProd,
-    sameSite: 'lax',
-    path: '/',
-    maxAge: maxAgeSeconds,
-  });
-}
-
-export async function getCookieValue(name: string): Promise<string | null> {
-  const store = await cookies();
-  return store.get(name)?.value ?? null;
-}
-
-export async function clearCookie(name: string): Promise<void> {
-  const store = await cookies();
-  store.set({
-    name,
-    value: '',
-    httpOnly: true,
-    secure: isProd,
-    sameSite: 'lax',
-    path: '/',
-    maxAge: 0,
-  });
-}
+// Server-only cookie helpers for the 2FA / trusted-device flow.
+// All three cookies are HttpOnly so they are never readable from JS.
+import { cookies } from 'next/headers';
+
+/** Long-lived "remember this device" token (raw token; its SHA-256 is in the DB). */
+export const TRUSTED_DEVICE_COOKIE = 'nb_trusted_device';
+/** Signed marker proving the email second factor was satisfied this session. */
+export const TWO_FACTOR_COOKIE = 'nb_2fa_verified';
+/** Short-lived flag carrying the "remember me" checkbox from login to post-2FA. */
+export const REMEMBER_INTENT_COOKIE = 'nb_remember_intent';
+
+const isProd = process.env.NODE_ENV === 'production';
+
+export async function setSecureCookie(
+  name: string,
+  value: string,
+  maxAgeSeconds: number,
+): Promise<void> {
+  const store = await cookies();
+  store.set({
+    name,
+    value,
+    httpOnly: true,
+    secure: isProd,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: maxAgeSeconds,
+  });
+}
+
+export async function getCookieValue(name: string): Promise<string | null> {
+  const store = await cookies();
+  return store.get(name)?.value ?? null;
+}
+
+export async function clearCookie(name: string): Promise<void> {
+  const store = await cookies();
+  store.set({
+    name,
+    value: '',
+    httpOnly: true,
+    secure: isProd,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0,
+  });
+}

package/templates/nextblock-template/lib/auth/crypto.ts

@@ -1,45 +1,45 @@
-// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
-// signed "second factor satisfied" session marker. Uses Node's crypto module.
-import crypto from 'node:crypto';
-
-/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
-export function sha256Hex(input: string): string {
-  return crypto.createHash('sha256').update(input).digest('hex');
-}
-
-/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
-export function randomToken(bytes = 32): string {
-  return crypto.randomBytes(bytes).toString('base64url');
-}
-
-/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
-export function generateNumericCode(digits = 6): string {
-  const max = 10 ** digits;
-  return crypto.randomInt(0, max).toString().padStart(digits, '0');
-}
-
-function getSecret(): string {
-  // Dedicated secret if provided, otherwise fall back to the service-role key
-  // (server-only, never shipped to the client).
-  const secret =
-    process.env.NB_2FA_SECRET ||
-    process.env.SUPABASE_SERVICE_ROLE_KEY ||
-    process.env.SUPABASE_SECRET_KEY;
-  if (!secret) {
-    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
-  }
-  return secret;
-}
-
-/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
-export function hmacSign(payload: string): string {
-  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
-}
-
-/** Constant-time string comparison that never throws on length mismatch. */
-export function safeEqual(a: string, b: string): boolean {
-  const ab = Buffer.from(a);
-  const bb = Buffer.from(b);
-  if (ab.length !== bb.length) return false;
-  return crypto.timingSafeEqual(ab, bb);
-}
+// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
+// signed "second factor satisfied" session marker. Uses Node's crypto module.
+import crypto from 'node:crypto';
+
+/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
+export function sha256Hex(input: string): string {
+  return crypto.createHash('sha256').update(input).digest('hex');
+}
+
+/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
+export function randomToken(bytes = 32): string {
+  return crypto.randomBytes(bytes).toString('base64url');
+}
+
+/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
+export function generateNumericCode(digits = 6): string {
+  const max = 10 ** digits;
+  return crypto.randomInt(0, max).toString().padStart(digits, '0');
+}
+
+function getSecret(): string {
+  // Dedicated secret if provided, otherwise fall back to the service-role key
+  // (server-only, never shipped to the client).
+  const secret =
+    process.env.NB_2FA_SECRET ||
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.SUPABASE_SECRET_KEY;
+  if (!secret) {
+    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
+  }
+  return secret;
+}
+
+/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
+export function hmacSign(payload: string): string {
+  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
+}
+
+/** Constant-time string comparison that never throws on length mismatch. */
+export function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}

package/templates/nextblock-template/lib/auth/trustedDevices.ts

@@ -1,92 +1,92 @@
-// Server-only trusted-device ("Remember this device") helpers.
-//
-// Trust is server-validated: the cookie holds only a random token, and a bypass
-// is honoured ONLY when a non-expired user_trusted_devices row matches its
-// SHA-256. Deleting the row instantly revokes trust, regardless of the cookie.
-import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-import { getSecuritySettings } from '../privacy/settings';
-import { randomToken, sha256Hex } from './crypto';
-import {
-  TRUSTED_DEVICE_COOKIE,
-  clearCookie,
-  getCookieValue,
-  setSecureCookie,
-} from './cookies';
-
-export interface TrustedDeviceRow {
-  id: string;
-  browser_metadata: string | null;
-  created_at: string;
-  expires_at: string;
-}
-
-/** Mint a trusted-device token, persist its hash, and set the cookie. */
-export async function issueTrustedDevice(
-  userId: string,
-  browserMetadata: string | null,
-): Promise<void> {
-  const { trusted_device_days } = await getSecuritySettings();
-  const maxAgeSeconds = trusted_device_days * 24 * 60 * 60;
-  const token = randomToken(32);
-  const expiresAt = new Date(Date.now() + maxAgeSeconds * 1000).toISOString();
-
-  const svc = getServiceRoleSupabaseClient();
-  const { error } = await svc.from('user_trusted_devices').insert({
-    user_id: userId,
-    device_hash: sha256Hex(token),
-    browser_metadata: browserMetadata ? browserMetadata.slice(0, 500) : null,
-    expires_at: expiresAt,
-  });
-  if (error) {
-    console.error('Failed to persist trusted device:', error.message);
-    return; // Non-fatal: the user simply isn't remembered.
-  }
-  await setSecureCookie(TRUSTED_DEVICE_COOKIE, token, maxAgeSeconds);
-}
-
-/** True when the current request carries a cookie matching a live trusted row. */
-export async function hasValidTrustedDevice(userId: string): Promise<boolean> {
-  const token = await getCookieValue(TRUSTED_DEVICE_COOKIE);
-  if (!token) return false;
-  const svc = getServiceRoleSupabaseClient();
-  const { data } = await svc
-    .from('user_trusted_devices')
-    .select('id')
-    .eq('user_id', userId)
-    .eq('device_hash', sha256Hex(token))
-    .gt('expires_at', new Date().toISOString())
-    .maybeSingle();
-  return Boolean(data);
-}
-
-/** List the signed-in user's trusted devices (RLS scopes to their own rows). */
-export async function listTrustedDevices(userId: string): Promise<TrustedDeviceRow[]> {
-  const supabase = createClient();
-  const { data } = await supabase
-    .from('user_trusted_devices')
-    .select('id, browser_metadata, created_at, expires_at')
-    .eq('user_id', userId)
-    .order('created_at', { ascending: false });
-  return data ?? [];
-}
-
-/** Revoke one trusted device the user owns (RLS prevents touching others'). */
-export async function revokeTrustedDevice(userId: string, id: string): Promise<void> {
-  const supabase = createClient();
-  const { error } = await supabase
-    .from('user_trusted_devices')
-    .delete()
-    .eq('id', id)
-    .eq('user_id', userId);
-  if (error) {
-    console.error('Failed to revoke trusted device:', error.message);
-    throw new Error('Failed to revoke device.');
-  }
-}
-
-/** Drop all of a user's trusted devices and the local cookie (e.g. on MFA disable). */
-export async function revokeAllTrustedDevices(userId: string): Promise<void> {
-  const svc = getServiceRoleSupabaseClient();
-  await svc.from('user_trusted_devices').delete().eq('user_id', userId);
-  await clearCookie(TRUSTED_DEVICE_COOKIE);
-}
+// Server-only trusted-device ("Remember this device") helpers.
+//
+// Trust is server-validated: the cookie holds only a random token, and a bypass
+// is honoured ONLY when a non-expired user_trusted_devices row matches its
+// SHA-256. Deleting the row instantly revokes trust, regardless of the cookie.
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import { getSecuritySettings } from '../privacy/settings';
+import { randomToken, sha256Hex } from './crypto';
+import {
+  TRUSTED_DEVICE_COOKIE,
+  clearCookie,
+  getCookieValue,
+  setSecureCookie,
+} from './cookies';
+
+export interface TrustedDeviceRow {
+  id: string;
+  browser_metadata: string | null;
+  created_at: string;
+  expires_at: string;
+}
+
+/** Mint a trusted-device token, persist its hash, and set the cookie. */
+export async function issueTrustedDevice(
+  userId: string,
+  browserMetadata: string | null,
+): Promise<void> {
+  const { trusted_device_days } = await getSecuritySettings();
+  const maxAgeSeconds = trusted_device_days * 24 * 60 * 60;
+  const token = randomToken(32);
+  const expiresAt = new Date(Date.now() + maxAgeSeconds * 1000).toISOString();
+
+  const svc = getServiceRoleSupabaseClient();
+  const { error } = await svc.from('user_trusted_devices').insert({
+    user_id: userId,
+    device_hash: sha256Hex(token),
+    browser_metadata: browserMetadata ? browserMetadata.slice(0, 500) : null,
+    expires_at: expiresAt,
+  });
+  if (error) {
+    console.error('Failed to persist trusted device:', error.message);
+    return; // Non-fatal: the user simply isn't remembered.
+  }
+  await setSecureCookie(TRUSTED_DEVICE_COOKIE, token, maxAgeSeconds);
+}
+
+/** True when the current request carries a cookie matching a live trusted row. */
+export async function hasValidTrustedDevice(userId: string): Promise<boolean> {
+  const token = await getCookieValue(TRUSTED_DEVICE_COOKIE);
+  if (!token) return false;
+  const svc = getServiceRoleSupabaseClient();
+  const { data } = await svc
+    .from('user_trusted_devices')
+    .select('id')
+    .eq('user_id', userId)
+    .eq('device_hash', sha256Hex(token))
+    .gt('expires_at', new Date().toISOString())
+    .maybeSingle();
+  return Boolean(data);
+}
+
+/** List the signed-in user's trusted devices (RLS scopes to their own rows). */
+export async function listTrustedDevices(userId: string): Promise<TrustedDeviceRow[]> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('user_trusted_devices')
+    .select('id, browser_metadata, created_at, expires_at')
+    .eq('user_id', userId)
+    .order('created_at', { ascending: false });
+  return data ?? [];
+}
+
+/** Revoke one trusted device the user owns (RLS prevents touching others'). */
+export async function revokeTrustedDevice(userId: string, id: string): Promise<void> {
+  const supabase = createClient();
+  const { error } = await supabase
+    .from('user_trusted_devices')
+    .delete()
+    .eq('id', id)
+    .eq('user_id', userId);
+  if (error) {
+    console.error('Failed to revoke trusted device:', error.message);
+    throw new Error('Failed to revoke device.');
+  }
+}
+
+/** Drop all of a user's trusted devices and the local cookie (e.g. on MFA disable). */
+export async function revokeAllTrustedDevices(userId: string): Promise<void> {
+  const svc = getServiceRoleSupabaseClient();
+  await svc.from('user_trusted_devices').delete().eq('user_id', userId);
+  await clearCookie(TRUSTED_DEVICE_COOKIE);
+}

package/templates/nextblock-template/lib/auth-redirects.ts

@@ -1,46 +1,46 @@
-import type { Database } from '@nextblock-cms/db';
-
-type AuthProfile = Pick<Database['public']['Tables']['profiles']['Row'], 'role' | 'full_name'> | null;
-
-const DASHBOARD_PATH = '/cms/dashboard';
-const HOME_PATH = '/';
-const PROFILE_PATH = '/profile';
-const PASSWORD_RESET_PATH = '/profile/password';
-
-function isSafeInternalPath(path?: string | null) {
-  return Boolean(path && path.startsWith('/') && !path.startsWith('//'));
-}
-
-function isDashboardPath(path: string) {
-  return path === DASHBOARD_PATH || path.startsWith(`${DASHBOARD_PATH}/`);
-}
-
-export function isCustomerProfileComplete(profile: AuthProfile) {
-  return Boolean(profile?.full_name?.trim());
-}
-
-export function resolvePostAuthRedirect(
-  profile: AuthProfile,
-  requestedPath?: string | null
-) {
-  const safePath = isSafeInternalPath(requestedPath) ? requestedPath : null;
-  const role = profile?.role ?? null;
-
-  if (safePath === PASSWORD_RESET_PATH) {
-    return PASSWORD_RESET_PATH;
-  }
-
-  if (role === 'ADMIN' || role === 'WRITER') {
-    return safePath ?? DASHBOARD_PATH;
-  }
-
-  if (!isCustomerProfileComplete(profile)) {
-    return PROFILE_PATH;
-  }
-
-  if (safePath && !isDashboardPath(safePath)) {
-    return safePath;
-  }
-
-  return HOME_PATH;
-}
+import type { Database } from '@nextblock-cms/db';
+
+type AuthProfile = Pick<Database['public']['Tables']['profiles']['Row'], 'role' | 'full_name'> | null;
+
+const DASHBOARD_PATH = '/cms/dashboard';
+const HOME_PATH = '/';
+const PROFILE_PATH = '/profile';
+const PASSWORD_RESET_PATH = '/profile/password';
+
+function isSafeInternalPath(path?: string | null) {
+  return Boolean(path && path.startsWith('/') && !path.startsWith('//'));
+}
+
+function isDashboardPath(path: string) {
+  return path === DASHBOARD_PATH || path.startsWith(`${DASHBOARD_PATH}/`);
+}
+
+export function isCustomerProfileComplete(profile: AuthProfile) {
+  return Boolean(profile?.full_name?.trim());
+}
+
+export function resolvePostAuthRedirect(
+  profile: AuthProfile,
+  requestedPath?: string | null
+) {
+  const safePath = isSafeInternalPath(requestedPath) ? requestedPath : null;
+  const role = profile?.role ?? null;
+
+  if (safePath === PASSWORD_RESET_PATH) {
+    return PASSWORD_RESET_PATH;
+  }
+
+  if (role === 'ADMIN' || role === 'WRITER') {
+    return safePath ?? DASHBOARD_PATH;
+  }
+
+  if (!isCustomerProfileComplete(profile)) {
+    return PROFILE_PATH;
+  }
+
+  if (safePath && !isDashboardPath(safePath)) {
+    return safePath;
+  }
+
+  return HOME_PATH;
+}