create-nextblock 0.13.6 → 0.13.8

package/templates/nextblock-template/app/cms/settings/cortex-ai/actions.ts

@@ -50,6 +50,16 @@ type CortexAiSettingsStatus = {
   unsplashAppName: string | null;
 };
 
+/**
+ * How every action in this file reports back: the page reads `?success=` / `?error=` and
+ * renders it. These are plain `<form action={fn}>` submissions, so a return value would be
+ * discarded and a thrown error would take out the page (with its message replaced by a
+ * generic string in production).
+ *
+ * Must be called OUTSIDE the try blocks below. `redirect()` signals itself by throwing
+ * NEXT_REDIRECT, so calling this inside a `try` would have the `catch` swallow the
+ * navigation and re-redirect with the framework's digest as the user-facing message.
+ */
 function redirectWithStatus(status: 'success' | 'error', message: string): never {
   redirect(`${CORTEX_AI_SETTINGS_PATH}?${status}=${encodeURIComponent(message)}`);
 }
@@ -173,7 +183,7 @@ export async function getCortexAiSettingsStatus(): Promise<CortexAiSettingsStatu
 
 export async function saveOpenRouterApiKeyAction(formData: FormData) {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot save keys to the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot save keys to the database.');
   }
 
   try {
@@ -206,7 +216,7 @@ export async function saveOpenRouterApiKeyAction(formData: FormData) {
 
 export async function clearOpenRouterApiKeyAction() {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot clear keys from the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot clear keys from the database.');
   }
 
   try {
@@ -235,7 +245,7 @@ export async function clearOpenRouterApiKeyAction() {
 
 export async function saveStockPhotoKeysAction(formData: FormData) {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot save keys to the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot save keys to the database.');
   }
 
   try {
@@ -287,7 +297,7 @@ export async function saveStockPhotoKeysAction(formData: FormData) {
 
 export async function clearStockPhotoKeysAction() {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot clear keys from the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot clear keys from the database.');
   }
 
   try {
@@ -313,7 +323,7 @@ export async function clearStockPhotoKeysAction() {
 
 export async function saveCortexAiAgentSettingsAction(formData: FormData) {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot save settings to the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot save settings to the database.');
   }
 
   try {
@@ -357,7 +367,7 @@ export async function saveCortexAiAgentSettingsAction(formData: FormData) {
 
 export async function resetCortexAiAgentSettingsAction() {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot change settings in the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot change settings in the database.');
   }
 
   try {
@@ -383,7 +393,7 @@ export async function resetCortexAiAgentSettingsAction() {
 
 export async function saveCortexAiModelSelectionAction(formData: FormData) {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot save model selection to the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot save model selection to the database.');
   }
 
   try {
@@ -440,7 +450,7 @@ export async function saveCortexAiModelSelectionAction(formData: FormData) {
 
 export async function clearCortexAiModelSelectionAction() {
   if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
-    throw new Error('Sandbox environment cannot clear model selection from the database.');
+    redirectWithStatus('error', 'Sandbox environment cannot clear model selection from the database.');
   }
 
   try {

package/templates/nextblock-template/app/cms/settings/email/actions.ts

@@ -6,13 +6,23 @@ import { revalidatePath } from 'next/cache';
 import { saveEmailSettings } from '../../../../lib/config/email-settings';
 import { sendEmail } from '../../../actions/email';
 
-async function assertAdmin() {
+/**
+ * Returned rather than thrown: Next replaces uncaught Server Action error messages with a
+ * generic string in production, and the relay's own rejection ("535 authentication failed")
+ * is the single most useful thing an admin can see while getting SMTP working.
+ */
+export type EmailActionResult =
+  | { ok: true; message: string }
+  | { ok: false; error: string };
+
+/** Null when the caller is an ADMIN, otherwise the failure to return. */
+async function adminCheck(): Promise<EmailActionResult | null> {
   const supabase = createClient();
   const {
     data: { user },
   } = await supabase.auth.getUser();
   if (!user) {
-    throw new Error('You must be logged in to update settings.');
+    return { ok: false, error: 'You must be logged in to update settings.' };
   }
   const { data: profile, error } = await supabase
     .from('profiles')
@@ -20,45 +30,65 @@ async function assertAdmin() {
     .eq('id', user.id)
     .single();
   if (error || !profile || profile.role !== 'ADMIN') {
-    throw new Error('You do not have permission to perform this action.');
+    return { ok: false, error: 'You do not have permission to perform this action.' };
   }
+  return null;
 }
 
-export async function updateEmailSettings(formData: FormData) {
-  await assertAdmin();
+export async function updateEmailSettings(formData: FormData): Promise<EmailActionResult> {
+  const denied = await adminCheck();
+  if (denied) return denied;
 
-  await saveEmailSettings({
-    host: String(formData.get('host') ?? ''),
-    port: String(formData.get('port') ?? ''),
-    fromEmail: String(formData.get('fromEmail') ?? ''),
-    fromName: String(formData.get('fromName') ?? ''),
-    secure: formData.get('secure') === 'on' || formData.get('secure') === 'true',
-    user: String(formData.get('user') ?? ''),
-    pass: String(formData.get('pass') ?? ''),
-  });
+  try {
+    await saveEmailSettings({
+      host: String(formData.get('host') ?? ''),
+      port: String(formData.get('port') ?? ''),
+      fromEmail: String(formData.get('fromEmail') ?? ''),
+      fromName: String(formData.get('fromName') ?? ''),
+      secure: formData.get('secure') === 'on' || formData.get('secure') === 'true',
+      user: String(formData.get('user') ?? ''),
+      pass: String(formData.get('pass') ?? ''),
+    });
+  } catch (error) {
+    console.error('Failed to save email settings:', error);
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : 'Failed to save email settings.',
+    };
+  }
 
   revalidatePath('/cms/settings/email');
-  return { success: true as const, message: 'Email settings saved.' };
+  return { ok: true, message: 'Email settings saved.' };
 }
 
-export async function sendTestEmail(formData: FormData) {
-  await assertAdmin();
+export async function sendTestEmail(formData: FormData): Promise<EmailActionResult> {
+  const denied = await adminCheck();
+  if (denied) return denied;
 
   const to = String(formData.get('to') ?? '').trim();
   if (!to) {
-    throw new Error('Enter a recipient email address.');
+    return { ok: false, error: 'Enter a recipient email address.' };
   }
 
-  await sendEmail({
-    to,
-    subject: 'Test email',
-    text: 'This is a test email from your CMS. SMTP is configured correctly.',
-    html:
-      '<div style="font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto;padding:24px;">' +
-      '{{brand_header}}' +
-      '<p>This is a test email from your CMS. SMTP is configured correctly. 🎉</p>' +
-      '</div>',
-  });
+  try {
+    await sendEmail({
+      to,
+      subject: 'Test email',
+      text: 'This is a test email from your CMS. SMTP is configured correctly.',
+      html:
+        '<div style="font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto;padding:24px;">' +
+        '{{brand_header}}' +
+        '<p>This is a test email from your CMS. SMTP is configured correctly. 🎉</p>' +
+        '</div>',
+    });
+  } catch (error) {
+    console.error('Test email failed:', error);
+    // Surface the relay's verbatim complaint — that is the whole point of a test send.
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : 'Failed to send test email.',
+    };
+  }
 
-  return { success: true as const, message: `Test email sent to ${to}.` };
+  return { ok: true, message: `Test email sent to ${to}.` };
 }

package/templates/nextblock-template/app/cms/settings/email/components/EmailForm.tsx

@@ -52,6 +52,10 @@ export default function EmailForm({ initialSettings }: EmailFormProps) {
     startTransition(async () => {
       try {
         const result = await updateEmailSettings(formData);
+        if (!result.ok) {
+          setMessage({ error: result.error });
+          return;
+        }
         setMessage({ success: result.message });
         setUser('');
         setPass('');
@@ -68,7 +72,7 @@ export default function EmailForm({ initialSettings }: EmailFormProps) {
     startTestTransition(async () => {
       try {
         const result = await sendTestEmail(formData);
-        setMessage({ success: result.message });
+        setMessage(result.ok ? { success: result.message } : { error: result.error });
       } catch (error) {
         setMessage({ error: error instanceof Error ? error.message : 'Failed to send test email.' });
       }

package/templates/nextblock-template/app/cms/settings/global-css/actions.ts

@@ -3,6 +3,7 @@
 
 import { createClient } from '@nextblock-cms/db/server';
 import { revalidatePath } from 'next/cache';
+import type { SettingsActionResult } from '../../../../lib/cms/action-result';
 
 export async function getGlobalCss(): Promise<string> {
   const supabase = createClient();
@@ -33,12 +34,12 @@ export async function getGlobalCss(): Promise<string> {
   return String(data.value);
 }
 
-export async function updateGlobalCss(css: string) {
+export async function updateGlobalCss(css: string): Promise<SettingsActionResult> {
   const supabase = createClient();
 
   const { data: { user } } = await supabase.auth.getUser();
   if (!user) {
-    throw new Error('You must be logged in to update settings.');
+    return { ok: false, error: 'You must be logged in to update settings.' };
   }
 
   const { data: profile, error: profileError } = await supabase
@@ -48,7 +49,7 @@ export async function updateGlobalCss(css: string) {
     .single();
 
   if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
-    throw new Error('You do not have permission to perform this action.');
+    return { ok: false, error: 'You do not have permission to perform this action.' };
   }
 
   const { error } = await supabase
@@ -57,9 +58,9 @@ export async function updateGlobalCss(css: string) {
 
   if (error) {
     console.error('Error updating global CSS:', error);
-    throw new Error('Failed to update CSS.');
+    return { ok: false, error: 'Failed to update CSS.' };
   }
 
   revalidatePath('/', 'layout');
-  return { success: true, message: 'Global CSS updated successfully.' };
+  return { ok: true, message: 'Global CSS updated successfully.' };
 }

package/templates/nextblock-template/app/cms/settings/global-css/components/GlobalCssForm.tsx

@@ -15,7 +15,8 @@ export default function GlobalCssForm({ initialCss }: { initialCss: string }) {
     setIsSubmitting(true);
     try {
       const res = await updateGlobalCss(css);
-      toast.success(res.message);
+      if (res.ok) toast.success(res.message);
+      else toast.error(res.error);
     } catch (err: any) {
       toast.error(err.message || 'An error occurred.');
     } finally {

package/templates/nextblock-template/app/cms/settings/google-analytics/actions.ts

@@ -7,6 +7,7 @@ import {
   mergePrivacySettings,
 } from '../../../../lib/privacy/settings';
 import type { PrivacySettings } from '../../../../lib/privacy/types';
+import type { SettingsActionResult } from '../../../../lib/cms/action-result';
 
 export interface GoogleAnalyticsSettings {
   gtm_id: string;
@@ -23,13 +24,14 @@ export async function getGoogleAnalyticsSettings(): Promise<GoogleAnalyticsSetti
   };
 }
 
-async function assertAdmin(): Promise<void> {
+/** Null when the caller is an ADMIN, otherwise the failure to return. */
+async function adminCheck(): Promise<SettingsActionResult | null> {
   const supabase = createClient();
   const {
     data: { user },
   } = await supabase.auth.getUser();
   if (!user) {
-    throw new Error('You must be logged in to update settings.');
+    return { ok: false, error: 'You must be logged in to update settings.' };
   }
   const { data: profile } = await supabase
     .from('profiles')
@@ -37,12 +39,16 @@ async function assertAdmin(): Promise<void> {
     .eq('id', user.id)
     .single();
   if (!profile || profile.role !== 'ADMIN') {
-    throw new Error('You do not have permission to perform this action.');
+    return { ok: false, error: 'You do not have permission to perform this action.' };
   }
+  return null;
 }
 
-export async function updateGoogleAnalyticsSettings(formData: FormData) {
-  await assertAdmin();
+export async function updateGoogleAnalyticsSettings(
+  formData: FormData,
+): Promise<SettingsActionResult> {
+  const denied = await adminCheck();
+  if (denied) return denied;
 
   // Only the analytics fields are touched; mergePrivacySettings preserves the
   // banner/corporate fields owned by the Privacy & Consent page.
@@ -52,9 +58,14 @@ export async function updateGoogleAnalyticsSettings(formData: FormData) {
     custom_scripts: formData.get('custom_scripts')?.toString() ?? '',
   };
 
-  await mergePrivacySettings(patch);
+  try {
+    await mergePrivacySettings(patch);
+  } catch (error) {
+    console.error('Failed to save Google Analytics settings:', error);
+    return { ok: false, error: 'Failed to save Google Analytics settings.' };
+  }
   // The analytics guard (GTM/GA4 + custom scripts) lives in the root layout.
   revalidatePath('/', 'layout');
 
-  return { success: true, message: 'Google Analytics settings saved.' };
+  return { ok: true, message: 'Google Analytics settings saved.' };
 }

package/templates/nextblock-template/app/cms/settings/google-analytics/components/GoogleAnalyticsForm.tsx

@@ -44,7 +44,7 @@ export default function GoogleAnalyticsForm({ initialSettings }: GoogleAnalytics
     startTransition(async () => {
       try {
         const result = await updateGoogleAnalyticsSettings(formData);
-        setMessage({ success: result.message });
+        setMessage(result.ok ? { success: result.message } : { error: result.error });
       } catch (error) {
         setMessage({
           error: error instanceof Error ? error.message : 'An unknown error occurred.',

package/templates/nextblock-template/app/cms/settings/languages/page.tsx

@@ -18,7 +18,7 @@ import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
-  DropdownMenuTrigger,
+  DropdownMenuButtonTrigger,
   DropdownMenuSeparator,
 } from "@nextblock-cms/ui";
 import type { Database } from "@nextblock-cms/db";
@@ -126,12 +126,10 @@ export default async function CmsLanguagesListPage() {
                   </TableCell>
                   <TableCell className="text-right">
                     <DropdownMenu>
-                      <DropdownMenuTrigger asChild>
-                        <Button id={`lang-trigger-${lang.id}`} variant="ghost" size="icon">
-                          <MoreHorizontal className="h-4 w-4" />
-                          <span className="sr-only">Language actions</span>
-                        </Button>
-                      </DropdownMenuTrigger>
+                      <DropdownMenuButtonTrigger id={`lang-trigger-${lang.id}`}>
+                        <MoreHorizontal className="h-4 w-4" />
+                        <span className="sr-only">Language actions</span>
+                      </DropdownMenuButtonTrigger>
                       <DropdownMenuContent align="end">
                         <DropdownMenuItem asChild>
                           <Link href={`/cms/settings/languages/${lang.id}/edit`} className="flex items-center cursor-pointer">

package/templates/nextblock-template/app/cms/settings/logos/page.tsx

@@ -14,7 +14,7 @@ import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
-  DropdownMenuTrigger,
+  DropdownMenuButtonTrigger,
   DropdownMenuSeparator,
 } from '@nextblock-cms/ui'
 import { getActiveLogoId, getLogos, getSiteSeoSettings } from './actions'
@@ -131,11 +131,9 @@ export default async function CmsLogosListPage() {
                     </TableCell>
                     <TableCell className="text-right">
                       <DropdownMenu>
-                        <DropdownMenuTrigger asChild>
-                          <Button id={`logo-trigger-${logo.id}`} variant="ghost" size="icon">
-                            <MoreHorizontal className="h-4 w-4" />
-                          </Button>
-                        </DropdownMenuTrigger>
+                        <DropdownMenuButtonTrigger id={`logo-trigger-${logo.id}`}>
+                          <MoreHorizontal className="h-4 w-4" />
+                        </DropdownMenuButtonTrigger>
                         <DropdownMenuContent align="end">
                           {logo.id !== activeLogoId ? (
                             <>

package/templates/nextblock-template/app/cms/settings/privacy/actions.ts

@@ -7,18 +7,20 @@ import {
   mergePrivacySettings,
 } from '../../../../lib/privacy/settings';
 import type { PrivacySettings } from '../../../../lib/privacy/types';
+import type { SettingsActionResult } from '../../../../lib/cms/action-result';
 
 export async function getPrivacySettings(): Promise<PrivacySettings> {
   return readPrivacySettings();
 }
 
-async function assertAdmin(): Promise<void> {
+/** Null when the caller is an ADMIN, otherwise the failure to return. */
+async function adminCheck(): Promise<SettingsActionResult | null> {
   const supabase = createClient();
   const {
     data: { user },
   } = await supabase.auth.getUser();
   if (!user) {
-    throw new Error('You must be logged in to update settings.');
+    return { ok: false, error: 'You must be logged in to update settings.' };
   }
   const { data: profile } = await supabase
     .from('profiles')
@@ -26,12 +28,14 @@ async function assertAdmin(): Promise<void> {
     .eq('id', user.id)
     .single();
   if (!profile || profile.role !== 'ADMIN') {
-    throw new Error('You do not have permission to perform this action.');
+    return { ok: false, error: 'You do not have permission to perform this action.' };
   }
+  return null;
 }
 
-export async function updatePrivacySettings(formData: FormData) {
-  await assertAdmin();
+export async function updatePrivacySettings(formData: FormData): Promise<SettingsActionResult> {
+  const denied = await adminCheck();
+  if (denied) return denied;
 
   // Analytics fields (GTM/GA4/custom scripts) are owned by the Google Analytics
   // settings page; merge only the consent + corporate fields so they aren't clobbered.
@@ -44,9 +48,14 @@ export async function updatePrivacySettings(formData: FormData) {
     },
   };
 
-  await mergePrivacySettings(patch);
+  try {
+    await mergePrivacySettings(patch);
+  } catch (error) {
+    console.error('Failed to save privacy settings:', error);
+    return { ok: false, error: 'Failed to save privacy settings.' };
+  }
   // Footer (corporate identity) and the analytics guard live in the root layout.
   revalidatePath('/', 'layout');
 
-  return { success: true, message: 'Privacy settings saved.' };
+  return { ok: true, message: 'Privacy settings saved.' };
 }

package/templates/nextblock-template/app/cms/settings/privacy/components/PrivacyForm.tsx

@@ -46,7 +46,7 @@ export default function PrivacyForm({ initialSettings }: PrivacyFormProps) {
     startTransition(async () => {
       try {
         const result = await updatePrivacySettings(formData);
-        setMessage({ success: result.message });
+        setMessage(result.ok ? { success: result.message } : { error: result.error });
       } catch (error) {
         setMessage({
           error: error instanceof Error ? error.message : 'An unknown error occurred.',

package/templates/nextblock-template/app/cms/settings/registration/actions.ts

@@ -7,19 +7,21 @@ import {
   getSystemConfiguration,
   updateSystemConfiguration,
 } from '../../../../lib/setup/system-config';
+import type { SettingsActionResult } from '../../../../lib/cms/action-result';
 
 export async function getRegistrationSettings(): Promise<{ autoAcceptSignups: boolean }> {
   const config = await getSystemConfiguration();
   return { autoAcceptSignups: config.auto_accept_signups };
 }
 
-async function assertAdmin() {
+/** Null when the caller is an ADMIN, otherwise the failure to return. */
+async function adminCheck(): Promise<SettingsActionResult | null> {
   const supabase = createClient();
   const {
     data: { user },
   } = await supabase.auth.getUser();
   if (!user) {
-    throw new Error('You must be logged in to update settings.');
+    return { ok: false, error: 'You must be logged in to update settings.' };
   }
   const { data: profile, error } = await supabase
     .from('profiles')
@@ -27,18 +29,27 @@ async function assertAdmin() {
     .eq('id', user.id)
     .single();
   if (error || !profile || profile.role !== 'ADMIN') {
-    throw new Error('You do not have permission to perform this action.');
+    return { ok: false, error: 'You do not have permission to perform this action.' };
   }
+  return null;
 }
 
-export async function updateRegistrationSettings(formData: FormData) {
-  await assertAdmin();
+export async function updateRegistrationSettings(
+  formData: FormData,
+): Promise<SettingsActionResult> {
+  const denied = await adminCheck();
+  if (denied) return denied;
 
   const autoAcceptSignups =
     formData.get('autoAcceptSignups') === 'on' || formData.get('autoAcceptSignups') === 'true';
 
-  await updateSystemConfiguration({ auto_accept_signups: autoAcceptSignups });
+  try {
+    await updateSystemConfiguration({ auto_accept_signups: autoAcceptSignups });
+  } catch (error) {
+    console.error('Failed to save registration settings:', error);
+    return { ok: false, error: 'Failed to save registration settings.' };
+  }
 
   revalidatePath('/cms/settings/registration');
-  return { success: true as const, message: 'Registration settings saved.' };
+  return { ok: true, message: 'Registration settings saved.' };
 }

package/templates/nextblock-template/app/cms/settings/registration/components/RegistrationForm.tsx

@@ -27,7 +27,7 @@ export default function RegistrationForm({ initialSettings }: RegistrationFormPr
     startTransition(async () => {
       try {
         const result = await updateRegistrationSettings(formData);
-        setMessage({ success: result.message });
+        setMessage(result.ok ? { success: result.message } : { error: result.error });
       } catch (error) {
         setMessage({ error: error instanceof Error ? error.message : 'Failed to save settings.' });
       }