create-nextblock 0.13.7 → 0.13.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.13.7",
+  "version": "0.13.9",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/(auth-pages)/two-factor/actions.ts

@@ -5,6 +5,7 @@ import { redirect } from 'next/navigation';
 import { createClient } from '@nextblock-cms/db/server';
 import {
   createEmailChallenge,
+  getEmailResendCooldownSeconds,
   issueTwoFactorVerifiedCookie,
   verifyEmailChallenge,
 } from '../../../lib/auth/twoFactor';
@@ -15,6 +16,7 @@ import {
   getCookieValue,
 } from '../../../lib/auth/cookies';
 import { sendTwoFactorCodeEmail } from '../../actions/twoFactorEmail';
+import { isEmailConfigured } from '../../../lib/config/email-settings';
 
 function safeRedirect(path?: string): string {
   return path && path.startsWith('/') && !path.startsWith('//') ? path : '/cms/dashboard';
@@ -85,7 +87,25 @@ export async function resendEmailCode() {
   } = await supabase.auth.getUser();
   if (!user?.email) return { error: 'No email address is associated with your account.' };
 
+  // No transport means the code can never arrive; say so rather than claiming it was sent.
+  if (!(await isEmailConfigured())) {
+    return {
+      error:
+        'This site has no email server configured, so a code cannot be sent. Contact your administrator.',
+    };
+  }
+
+  const wait = await getEmailResendCooldownSeconds(user.id);
+  if (wait > 0) {
+    return { error: `A code was just sent. Please wait ${wait}s before requesting another.` };
+  }
+
   const code = await createEmailChallenge(user.id);
-  await sendTwoFactorCodeEmail(user.email, code);
+  try {
+    await sendTwoFactorCodeEmail(user.email, code);
+  } catch (sendError) {
+    console.error('Failed to send 2FA email code:', sendError);
+    return { error: 'The mail server rejected the message. Please try again in a moment.' };
+  }
   return { success: true, message: `A new code is on its way to ${user.email}.` };
 }

package/templates/nextblock-template/app/(auth-pages)/two-factor/components/TwoFactorForm.tsx

@@ -1,10 +1,13 @@
 'use client';
 
-import { useState, useTransition } from 'react';
+import { useEffect, useState, useTransition } from 'react';
 import { unstable_rethrow } from 'next/navigation';
 import { Alert, AlertDescription, Button, Input, Label, Spinner } from '@nextblock-cms/ui';
 import { resendEmailCode, verifyEmailCode, verifyTotpChallenge } from '../actions';
 
+/** Matches the security panel: relays queue, so parking the button beats spamming it. */
+const RESEND_COOLDOWN_SECONDS = 30;
+
 interface TwoFactorFormProps {
   type: 'totp' | 'email';
   email: string;
@@ -24,6 +27,13 @@ export default function TwoFactorForm({
   const [info, setInfo] = useState<string | null>(
     type === 'email' && pendingEmailCode ? `Enter the code we sent to ${email}.` : null,
   );
+  const [cooldown, setCooldown] = useState(0);
+
+  useEffect(() => {
+    if (cooldown <= 0) return;
+    const timer = setTimeout(() => setCooldown((seconds) => seconds - 1), 1000);
+    return () => clearTimeout(timer);
+  }, [cooldown]);
 
   const submit = (codeToSubmit: string = code) => {
     if (codeToSubmit.length !== 6) return;
@@ -48,13 +58,17 @@ export default function TwoFactorForm({
   };
 
   const resend = () => {
+    if (cooldown > 0) return;
     setError(null);
     setInfo(null);
     startTransition(async () => {
       try {
         const result = await resendEmailCode();
         if (result?.error) setError(result.error);
-        else if (result?.message) setInfo(result.message);
+        else if (result?.message) {
+          setInfo(result.message);
+          setCooldown(RESEND_COOLDOWN_SECONDS);
+        }
       } catch (err) {
         setError(err instanceof Error ? err.message : 'Could not send a code.');
       }
@@ -116,14 +130,24 @@ export default function TwoFactorForm({
       </form>
 
       {type === 'email' && (
-        <button
-          type="button"
-          onClick={resend}
-          disabled={isPending}
-          className="mt-4 w-full text-center text-xs text-muted-foreground underline underline-offset-2 hover:text-foreground disabled:opacity-50"
-        >
-          {pendingEmailCode ? 'Resend code' : 'Send me a code'}
-        </button>
+        <>
+          <button
+            type="button"
+            onClick={resend}
+            disabled={isPending || cooldown > 0}
+            className="mt-4 w-full text-center text-xs text-muted-foreground underline underline-offset-2 hover:text-foreground disabled:no-underline disabled:opacity-50"
+          >
+            {cooldown > 0
+              ? `Resend available in ${cooldown}s`
+              : pendingEmailCode
+                ? 'Resend code'
+                : 'Send me a code'}
+          </button>
+          <p className="mt-2 text-center text-xs text-muted-foreground">
+            Codes can take a minute to arrive. If you request another, the earlier one still
+            works — enter whichever reaches you first.
+          </p>
+        </>
       )}
     </div>
   );

package/templates/nextblock-template/app/actions/email.ts

@@ -1,8 +1,12 @@
-"use server";
+import 'server-only';
+// The single outbound-mail choke point. Deliberately NOT a "use server" module: every
+// caller is server-side (2FA codes, form/interaction notifications, feedback, the SMTP
+// test), and marking it as an action would register `sendEmail` as a client-callable
+// endpoint — an open relay taking an arbitrary recipient, subject and HTML body.
 
-import { resolveEmailServerConfig } from '../../lib/config/email-settings';
+import nodemailer, { type Transporter } from 'nodemailer';
+import { resolveEmailServerConfig, type ResolvedEmailConfig } from '../../lib/config/email-settings';
 import { applyEmailBranding, resolveEmailBranding } from '../../lib/email/branding';
-import nodemailer from 'nodemailer';
 
 interface EmailParams {
   to: string;
@@ -11,9 +15,77 @@ interface EmailParams {
   html: string;
 }
 
+// Without explicit bounds nodemailer inherits the OS socket timeouts, so an unreachable
+// or silently-dropping relay hangs the request (and the user's spinner) for minutes.
+const CONNECTION_TIMEOUT_MS = 10_000;
+const GREETING_TIMEOUT_MS = 10_000;
+const SOCKET_TIMEOUT_MS = 20_000;
+
+// Opening a fresh SMTP connection per message costs a TCP handshake + TLS negotiation +
+// AUTH round trip before the first byte of the message is sent — typically the bulk of the
+// wait when a user clicks "send me a code". A pooled transport keeps the authenticated
+// connection warm so subsequent sends start at DATA. Set SMTP_POOL=false to opt out.
+const POOL_ENABLED = process.env['SMTP_POOL'] !== 'false';
+
+let cachedTransport: { key: string; transporter: Transporter } | null = null;
+
+/** Identity of a transport: anything that changes it must force a rebuild. */
+function transportKey(config: ResolvedEmailConfig): string {
+  return [config.host, config.port, config.secure, config.auth.user].join('|');
+}
+
+function getTransporter(config: ResolvedEmailConfig): Transporter {
+  const key = transportKey(config);
+  if (cachedTransport && cachedTransport.key === key) {
+    return cachedTransport.transporter;
+  }
+
+  // Settings changed — tear the old pool down rather than leaking its sockets.
+  if (cachedTransport) {
+    try {
+      cachedTransport.transporter.close();
+    } catch {
+      /* already closed */
+    }
+    cachedTransport = null;
+  }
+
+  const base = {
+    host: config.host,
+    port: config.port,
+    secure: config.secure,
+    auth: config.auth,
+    connectionTimeout: CONNECTION_TIMEOUT_MS,
+    greetingTimeout: GREETING_TIMEOUT_MS,
+    socketTimeout: SOCKET_TIMEOUT_MS,
+  };
+
+  // Branched rather than `pool: POOL_ENABLED` — nodemailer types `pool` as the literal
+  // `true` to select the pooled transport overload, so a boolean matches neither.
+  const transporter: Transporter = POOL_ENABLED
+    ? nodemailer.createTransport({ ...base, pool: true, maxConnections: 3, maxMessages: 100 })
+    : nodemailer.createTransport(base);
+
+  // A pool that errors out (relay restart, credentials rotated, idle socket reaped) must
+  // not be handed to the next caller — drop it so the following send reconnects cleanly.
+  transporter.on('error', () => {
+    if (cachedTransport?.transporter === transporter) {
+      cachedTransport = null;
+    }
+  });
+
+  cachedTransport = { key, transporter };
+  return transporter;
+}
+
 export async function sendEmail({ to, subject, text, html }: EmailParams) {
   // DB-first (CMS Settings → Configuration → Email), falling back to SMTP_* env vars.
-  const emailConfig = await resolveEmailServerConfig();
+  // Resolved in parallel with branding — neither depends on the other, and both are
+  // pure reads standing between the click and the first SMTP packet.
+  const [emailConfig, branding] = await Promise.all([
+    resolveEmailServerConfig(),
+    resolveEmailBranding(),
+  ]);
 
   if (!emailConfig) {
     throw new Error("Email server is not configured. Configure SMTP in CMS Settings → Configuration → Email.");
@@ -22,10 +94,9 @@ export async function sendEmail({ to, subject, text, html }: EmailParams) {
   // Single interception point: white-label every outgoing email with the tenant's own
   // logo + site name (or a text banner when no logo is set). Every app-dispatched email
   // funnels through here, so branding is applied once, centrally.
-  const branding = await resolveEmailBranding();
   const brandedHtml = applyEmailBranding(html, branding);
 
-  const transporter = nodemailer.createTransport(emailConfig);
+  const transporter = getTransporter(emailConfig);
 
   const options = {
     from: emailConfig.from,
@@ -36,4 +107,4 @@ export async function sendEmail({ to, subject, text, html }: EmailParams) {
   };
 
   return transporter.sendMail(options);
-}
+}

package/templates/nextblock-template/app/actions/feedback.ts

@@ -1,37 +1,79 @@
 "use server";
 
+import { createClient } from "@nextblock-cms/db/server";
 import { sendEmail } from "./email";
 
-
 interface FeedbackData {
   subject: string;
   message: string;
-  userEmail: string;
+  /** Accepted for call-site compatibility but ignored — identity comes from the session. */
+  userEmail?: string;
   userName?: string;
   url?: string;
 }
 
+const MAX_SUBJECT_LENGTH = 200;
+const MAX_MESSAGE_LENGTH = 5000;
+const MAX_URL_LENGTH = 500;
+
+/** Everything below is attacker-controlled text landing in an HTML email body. */
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
 export async function submitFeedback(data: FeedbackData) {
   try {
-    // If we have an email config, we use it. If not, we might fail or log.
-    // sendEmail throws if not configured.
-    
-    const { subject, message, userEmail, userName, url } = data;
-    
+    // This is a client-callable action, so the CMS-only modal in front of it is not a
+    // gate: without this check any unauthenticated caller could relay arbitrary mail
+    // through the tenant's SMTP credentials.
+    const supabase = createClient();
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+    if (!user) {
+      return { success: false, error: "You must be signed in to send feedback." };
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role, full_name')
+      .eq('id', user.id)
+      .maybeSingle();
+    if (profile?.role !== 'ADMIN' && profile?.role !== 'WRITER') {
+      return { success: false, error: "You do not have permission to send feedback." };
+    }
+
+    const subject = (data.subject ?? '').slice(0, MAX_SUBJECT_LENGTH);
+    const message = (data.message ?? '').slice(0, MAX_MESSAGE_LENGTH);
+    const url = (data.url ?? '').slice(0, MAX_URL_LENGTH);
+    if (!message.trim()) {
+      return { success: false, error: "Feedback message is empty." };
+    }
+
+    // Identity is read from the session rather than the request body — the client cannot
+    // choose whose name a report is filed under.
+    const senderEmail = user.email ?? 'unknown';
+    const senderName = profile?.full_name || senderEmail;
+
     const htmlContent = `
       {{brand_header}}
       <h2>New Feedback Received</h2>
-      <p><strong>From:</strong> ${userName || 'Unknown'} (${userEmail})</p>
-      <p><strong>Subject:</strong> ${subject}</p>
-      <p><strong>URL:</strong> ${url || 'N/A'}</p>
+      <p><strong>From:</strong> ${escapeHtml(senderName)} (${escapeHtml(senderEmail)})</p>
+      <p><strong>Subject:</strong> ${escapeHtml(subject)}</p>
+      <p><strong>URL:</strong> ${escapeHtml(url) || 'N/A'}</p>
       <br/>
       <h3>Message:</h3>
-      <p style="white-space: pre-wrap;">${message}</p>
+      <p style="white-space: pre-wrap;">${escapeHtml(message)}</p>
     `;
 
     const textContent = `
       New Feedback Received
-      From: ${userName || 'Unknown'} (${userEmail})
+      From: ${senderName} (${senderEmail})
       Subject: ${subject}
       URL: ${url || 'N/A'}
 
@@ -40,8 +82,9 @@ export async function submitFeedback(data: FeedbackData) {
     `;
 
     await sendEmail({
-      to: "feedback@nextblock.ca", // Fixed typo from 'feeedback'
-      subject: `[CMS Feedback] ${subject}`,
+      to: "feedback@nextblock.ca",
+      // Newlines in a header would let a caller inject extra headers (Bcc, …).
+      subject: `[CMS Feedback] ${subject.replace(/[\r\n]+/g, ' ')}`,
       text: textContent,
       html: htmlContent,
     });

package/templates/nextblock-template/app/actions/interactions.test.ts

@@ -2,6 +2,9 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const cacheMocks = vi.hoisted(() => ({
   revalidatePath: vi.fn(),
+  // Reached transitively: interactions -> email -> email/branding -> site-settings, which
+  // wraps its reader in unstable_cache at module scope. Pass the loader straight through.
+  unstable_cache: vi.fn((fn: unknown) => fn),
 }));
 
 const dbServerMocks = vi.hoisted(() => ({

package/templates/nextblock-template/app/actions/productGridActions.ts

@@ -0,0 +1,40 @@
+'use server';
+
+import {
+  loadProductGridPage,
+  type ProductGridQuery,
+} from '../../lib/blocks/product-grid-data';
+import {
+  PRODUCT_GRID_MAX_LIMIT,
+  PRODUCT_GRID_DEFAULT_PAGE_SIZE,
+} from '../../lib/blocks/ecommerce-block-schemas';
+import type { Product } from '@nextblock-cms/ecommerce/types';
+
+export interface ProductGridPageResult {
+  products: Product[];
+  totalCount: number;
+  error?: string;
+}
+
+/**
+ * Pagination for the Product Grid block. Only ever returns published products
+ * (`getProducts` defaults to status `active`), so this is safe to call from the
+ * storefront. The page size is clamped here because the argument arrives from
+ * the client — the unlimited path stays server-render only.
+ */
+export async function fetchProductGridPage(
+  query: ProductGridQuery
+): Promise<ProductGridPageResult> {
+  try {
+    const limit = Math.min(
+      Math.max(1, Math.floor(query.limit) || PRODUCT_GRID_DEFAULT_PAGE_SIZE),
+      PRODUCT_GRID_MAX_LIMIT
+    );
+
+    const { products, totalCount } = await loadProductGridPage({ ...query, limit });
+    return { products, totalCount };
+  } catch (error) {
+    console.error('[Product Grid] Failed to load page:', error);
+    return { products: [], totalCount: 0, error: 'Failed to load products.' };
+  }
+}

package/templates/nextblock-template/app/actions.ts

@@ -3,6 +3,7 @@
 import { encodedRedirect } from "@nextblock-cms/utils/server";
 import { createClient, getServiceRoleSupabaseClient } from "@nextblock-cms/db/server";
 import { headers } from "next/headers";
+import { after } from "next/server";
 import { redirect } from "next/navigation";
 import { resolvePostAuthRedirect } from "../lib/auth-redirects";
 import { createEmailChallenge, evaluateTwoFactor } from "../lib/auth/twoFactor";
@@ -169,13 +170,25 @@ export const signInAction = async (formData: FormData) => {
       await setSecureCookie(REMEMBER_INTENT_COOKIE, "1", 15 * 60);
     }
 
-    // Email factor: send the first code now so the challenge page has one waiting.
+    // Email factor: mint the first code now so the challenge page has one waiting. The
+    // challenge row is created synchronously because the page reads it to decide between
+    // "Resend code" and "Send me a code"; only the SMTP conversation is deferred, so the
+    // redirect isn't held behind a relay handshake that can take seconds. Delivery failure
+    // was already swallowed here — the user resends from the challenge page — so moving it
+    // off the response path costs no error reporting.
     if (evaluation.status === "email_required" && data.user.email) {
+      const recipient = data.user.email;
       try {
         const code = await createEmailChallenge(data.user.id);
-        await sendTwoFactorCodeEmail(data.user.email, code);
-      } catch (sendError) {
-        console.error("Failed to send 2FA email code:", sendError);
+        after(async () => {
+          try {
+            await sendTwoFactorCodeEmail(recipient, code);
+          } catch (sendError) {
+            console.error("Failed to send 2FA email code:", sendError);
+          }
+        });
+      } catch (challengeError) {
+        console.error("Failed to create 2FA email challenge:", challengeError);
       }
     }
 

package/templates/nextblock-template/app/api/cms/ecommerce/product-picker/route.ts

@@ -0,0 +1,151 @@
+import { NextResponse } from 'next/server';
+import {
+  createClient,
+  getServiceRoleSupabaseClient,
+  verifyPackageOnline,
+} from '@nextblock-cms/db/server';
+
+export const dynamic = 'force-dynamic';
+
+/** How many products a single search returns before the UI asks for a narrower query. */
+const PRODUCT_PAGE_SIZE = 50;
+/** Guard against an unbounded `ids` list when hydrating labels for an existing selection. */
+const MAX_HYDRATED_IDS = 100;
+
+export interface ProductPickerCategory {
+  id: string;
+  name: string;
+  slug: string;
+}
+
+export interface ProductPickerProduct {
+  id: string;
+  title: string;
+  slug: string | null;
+  sku: string | null;
+  status: string | null;
+  languageCode: string | null;
+  translationGroupId: string | null;
+}
+
+/**
+ * PostgREST parses `,`, `.`, `(` and `)` inside an `or(...)` filter, so anything
+ * the author types has to be stripped before it is interpolated into one.
+ */
+function sanitizeSearchTerm(term: string): string {
+  return term.replace(/[,().*%\\]/g, ' ').trim().slice(0, 80);
+}
+
+/**
+ * Options for the Product Grid block pickers: every category plus a page of
+ * products (optionally filtered by `search`). `ids` hydrates labels for an
+ * existing selection whose products fall outside the current page.
+ */
+export async function GET(request: Request) {
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    // Fail closed: without the ecommerce package there is no product catalog to
+    // browse, and the blocks that use this route are hidden from the picker.
+    if (!(await verifyPackageOnline('ecommerce'))) {
+      return NextResponse.json(
+        { error: 'The ecommerce package is not active.' },
+        { status: 403 }
+      );
+    }
+
+    const url = new URL(request.url);
+    const search = sanitizeSearchTerm(url.searchParams.get('search') ?? '');
+    const ids = (url.searchParams.get('ids') ?? '')
+      .split(',')
+      .map((id) => id.trim())
+      .filter(Boolean)
+      .slice(0, MAX_HYDRATED_IDS);
+
+    // Reading the catalog is admin work behind the role check above.
+    const admin = getServiceRoleSupabaseClient();
+
+    const productColumns =
+      'id, title, slug, sku, status, translation_group_id, languages(code)';
+
+    let productsQuery = admin
+      .from('products')
+      .select(productColumns)
+      .order('created_at', { ascending: false })
+      // Fetch one extra row so the UI can tell the author the list was truncated.
+      .limit(PRODUCT_PAGE_SIZE + 1);
+
+    if (search) {
+      productsQuery = productsQuery.or(`title.ilike.%${search}%,sku.ilike.%${search}%`);
+    }
+
+    const [categoriesResult, productsResult, selectedResult] = await Promise.all([
+      admin.from('categories').select('id, name, slug').order('name', { ascending: true }),
+      productsQuery,
+      ids.length > 0
+        ? admin.from('products').select(productColumns).in('id', ids)
+        : Promise.resolve({ data: [], error: null }),
+    ]);
+
+    if (categoriesResult.error) throw categoriesResult.error;
+    if (productsResult.error) throw productsResult.error;
+    if (selectedResult.error) throw selectedResult.error;
+
+    const toPickerProduct = (row: any): ProductPickerProduct => ({
+      id: row.id,
+      title: row.title,
+      slug: row.slug ?? null,
+      sku: row.sku ?? null,
+      status: row.status ?? null,
+      languageCode: row.languages?.code ?? null,
+      translationGroupId: row.translation_group_id ?? null,
+    });
+
+    const productRows = (productsResult.data ?? []) as any[];
+    const hasMore = productRows.length > PRODUCT_PAGE_SIZE;
+    const products = productRows.slice(0, PRODUCT_PAGE_SIZE).map(toPickerProduct);
+
+    // Merge the hydrated selection in so already-chosen products always render
+    // with a real label, even when a search hides them.
+    const byId = new Map(products.map((product) => [product.id, product]));
+    for (const row of (selectedResult.data ?? []) as any[]) {
+      if (!byId.has(row.id)) byId.set(row.id, toPickerProduct(row));
+    }
+
+    return NextResponse.json(
+      {
+        categories: (categoriesResult.data ?? []) as ProductPickerCategory[],
+        products: Array.from(byId.values()),
+        hasMore,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[Product Picker API] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Failed to load product picker options.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -22,6 +22,7 @@ import { FeedbackModal } from "./components/FeedbackModal";
 import { CortexGlobalAgentChat } from "./components/CortexGlobalAgentChat";
 import { CortexAiPageContextProvider } from "./components/CortexAiPageContext";
 import { CortexAiActiveProvider } from "./components/CortexAiActiveContext";
+import { EcommerceActiveProvider } from "./components/EcommerceActiveContext";
 import { useAppBranding } from "../../components/AppShell";
 import { resolveMediaUrl } from "../../lib/media/resolveMediaUrl";
 
@@ -257,6 +258,7 @@ export default function CmsClientLayout({
   return (
     <CortexAiPageContextProvider>
       <CortexAiActiveProvider isActive={isCortexAiActive}>
+      <EcommerceActiveProvider isActive={isEcommerceActive}>
     <div className="relative flex h-full min-h-0 w-full overflow-hidden bg-slate-50 dark:bg-slate-950 md:flex-row">
       <div className="fixed bottom-4 right-4 z-[60] md:hidden">
         <Button
@@ -496,7 +498,7 @@ export default function CmsClientLayout({
               {pageTitle}
             </h1>
             <Button asChild variant="outline" size="sm" className="shrink-0">
-              <Link href="/">
+              <Link href="/" target="_blank">
                 <ExternalLink className="h-4 w-4" />
                 <span className="hidden sm:inline">View Site</span>
               </Link>
@@ -516,6 +518,7 @@ export default function CmsClientLayout({
       )}
       {isAdmin && isCortexAiActive && <CortexGlobalAgentChat />}
     </div>
+      </EcommerceActiveProvider>
       </CortexAiActiveProvider>
     </CortexAiPageContextProvider>
   )