create-nextblock 0.14.4 → 0.14.6

package/templates/nextblock-template/app/cms/settings/cortex-ai/mcp-actions.ts

@@ -0,0 +1,205 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+
+import {
+  CORTEX_AI_MCP_SETTINGS_KEY,
+  CORTEX_AI_MCP_TOKENS_TABLE,
+  mintCortexAiMcpToken,
+  normalizeCortexAiMcpSettings,
+  type CortexAiMcpScope,
+  type CortexAiMcpSettings,
+} from '@nextblock-cms/cortex';
+
+import { requireAdminSupabaseClient } from './require-admin';
+
+/**
+ * Server actions for the "MCP server access" card.
+ *
+ * Unlike the rest of `actions.ts`, these return values instead of redirecting with a
+ * `?success=` message. A minted token is displayed exactly once and must never travel
+ * in a URL — it would land in browser history, the referrer header, and the server
+ * access log. Returning it to a client component that renders it in-place and forgets
+ * it keeps the secret out of every one of those.
+ */
+
+const CORTEX_AI_SETTINGS_PATH = '/cms/settings/cortex-ai';
+
+const MAX_TOKEN_NAME_LENGTH = 80;
+const MAX_TOKENS = 20;
+
+export type McpAccessTokenSummary = {
+  createdAt: string;
+  expiresAt: string | null;
+  id: string;
+  lastUsedAt: string | null;
+  name: string;
+  scopes: CortexAiMcpScope[];
+  tokenPrefix: string;
+};
+
+export type McpSettingsStatus = {
+  settings: CortexAiMcpSettings;
+  tokens: McpAccessTokenSummary[];
+};
+
+function toScopeList(raw: unknown): CortexAiMcpScope[] {
+  const list = Array.isArray(raw) ? raw : [];
+  const scopes = list.filter(
+    (entry): entry is CortexAiMcpScope => entry === 'read' || entry === 'write'
+  );
+
+  return scopes.length > 0 ? Array.from(new Set(scopes)) : ['read'];
+}
+
+/**
+ * Load MCP settings and the non-secret token list.
+ *
+ * Revoked tokens are filtered out rather than deleted at revoke time so the row keeps
+ * acting as a tombstone: the hash stays in the unique index, which makes an
+ * accidental re-mint of the same value impossible.
+ */
+export async function getMcpSettingsStatus(): Promise<McpSettingsStatus> {
+  const { supabase } = await requireAdminSupabaseClient();
+
+  const [{ data: settingsRow }, { data: tokenRows }] = await Promise.all([
+    supabase.from('site_settings').select('value').eq('key', CORTEX_AI_MCP_SETTINGS_KEY).maybeSingle(),
+    supabase
+      .from(CORTEX_AI_MCP_TOKENS_TABLE)
+      .select('id, name, scopes, token_prefix, created_at, expires_at, last_used_at, revoked_at')
+      .is('revoked_at', null)
+      .order('created_at', { ascending: false })
+      .limit(MAX_TOKENS),
+  ]);
+
+  return {
+    settings: normalizeCortexAiMcpSettings(settingsRow?.value),
+    tokens: (tokenRows ?? []).map((row: Record<string, any>) => ({
+      createdAt: row.created_at,
+      expiresAt: row.expires_at,
+      id: row.id,
+      lastUsedAt: row.last_used_at,
+      name: row.name,
+      scopes: toScopeList(row.scopes),
+      tokenPrefix: row.token_prefix,
+    })),
+  };
+}
+
+export async function saveMcpSettingsAction(input: {
+  allowLocalhostWithoutToken: boolean;
+  enabled: boolean;
+}): Promise<{ error?: string; success: boolean }> {
+  try {
+    const { supabase } = await requireAdminSupabaseClient();
+    const value = normalizeCortexAiMcpSettings(input);
+
+    const { error } = await supabase
+      .from('site_settings')
+      .upsert({ key: CORTEX_AI_MCP_SETTINGS_KEY, value });
+
+    if (error) {
+      throw new Error(error.message);
+    }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : 'Failed to save MCP server settings.',
+      success: false,
+    };
+  }
+
+  revalidatePath(CORTEX_AI_SETTINGS_PATH);
+  return { success: true };
+}
+
+export async function createMcpAccessTokenAction(input: {
+  expiresInDays?: number | null;
+  name: string;
+  scopes: CortexAiMcpScope[];
+}): Promise<{ error?: string; success: boolean; token?: string; tokenPrefix?: string }> {
+  try {
+    const { supabase, userId } = await requireAdminSupabaseClient();
+
+    const name = String(input.name || '').trim().slice(0, MAX_TOKEN_NAME_LENGTH);
+
+    if (!name) {
+      throw new Error('Give the token a name so you can tell your clients apart later.');
+    }
+
+    const scopes = toScopeList(input.scopes);
+
+    const { count } = await supabase
+      .from(CORTEX_AI_MCP_TOKENS_TABLE)
+      .select('id', { count: 'exact', head: true })
+      .is('revoked_at', null);
+
+    if ((count ?? 0) >= MAX_TOKENS) {
+      throw new Error(
+        `You already have ${MAX_TOKENS} active MCP tokens. Revoke one before creating another.`
+      );
+    }
+
+    const expiresInDays =
+      typeof input.expiresInDays === 'number' && Number.isFinite(input.expiresInDays)
+        ? Math.min(3650, Math.max(1, Math.round(input.expiresInDays)))
+        : null;
+
+    const expiresAt = expiresInDays
+      ? new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1000).toISOString()
+      : null;
+
+    const minted = mintCortexAiMcpToken();
+
+    const { error } = await supabase.from(CORTEX_AI_MCP_TOKENS_TABLE).insert({
+      created_by: userId,
+      expires_at: expiresAt,
+      name,
+      scopes,
+      token_hash: minted.tokenHash,
+      token_prefix: minted.tokenPrefix,
+    });
+
+    if (error) {
+      throw new Error(error.message);
+    }
+
+    revalidatePath(CORTEX_AI_SETTINGS_PATH);
+
+    return { success: true, token: minted.token, tokenPrefix: minted.tokenPrefix };
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : 'Failed to create the MCP access token.',
+      success: false,
+    };
+  }
+}
+
+export async function revokeMcpAccessTokenAction(input: {
+  id: string;
+}): Promise<{ error?: string; success: boolean }> {
+  try {
+    const { supabase } = await requireAdminSupabaseClient();
+    const id = String(input.id || '').trim();
+
+    if (!id) {
+      throw new Error('Missing token id.');
+    }
+
+    const { error } = await supabase
+      .from(CORTEX_AI_MCP_TOKENS_TABLE)
+      .update({ revoked_at: new Date().toISOString() })
+      .eq('id', id);
+
+    if (error) {
+      throw new Error(error.message);
+    }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : 'Failed to revoke the MCP access token.',
+      success: false,
+    };
+  }
+
+  revalidatePath(CORTEX_AI_SETTINGS_PATH);
+  return { success: true };
+}

package/templates/nextblock-template/app/cms/settings/cortex-ai/page.tsx

@@ -1,5 +1,9 @@
+import { headers } from 'next/headers';
+
 import { listCortexAiCompatibleOpenRouterModels } from '@nextblock-cms/cortex';
 import { getCortexAiSettingsStatus } from './actions';
+import { getMcpSettingsStatus } from './mcp-actions';
+import { McpServerSettingsCard } from './McpServerSettingsCard';
 import { SandboxCortexAiSettingsClient } from './SandboxCortexAiSettingsClient';
 import { StoredCortexAiSettingsClient } from './StoredCortexAiSettingsClient';
 import { redirect } from 'next/navigation';
@@ -22,6 +26,51 @@ function formatDate(value: string | null) {
   }).format(new Date(value));
 }
 
+/**
+ * The origin an external MCP client should dial.
+ *
+ * Prefers NEXT_PUBLIC_URL (the deployed canonical origin) and falls back to the
+ * request's own host, so the snippet is correct on a preview deployment or a custom
+ * domain that was never written into the env.
+ */
+async function resolveSiteOrigin(): Promise<string> {
+  const configured = process.env.NEXT_PUBLIC_URL?.trim();
+
+  if (configured) {
+    return configured.replace(/\/+$/, '');
+  }
+
+  const headerList = await headers();
+  const host = headerList.get('host');
+
+  if (!host) {
+    return 'https://your-site.com';
+  }
+
+  const protocol = headerList.get('x-forwarded-proto') || (host.startsWith('localhost') ? 'http' : 'https');
+
+  return `${protocol}://${host}`;
+}
+
+/**
+ * The loopback origin to show in the "Localhost" client snippets.
+ *
+ * Ports differ per setup — `nx serve nextblock` uses Nx's default 4200, not Next's
+ * plain 3000 — and a snippet pointing at the wrong port fails with a bare connection
+ * error that gives the reader nothing to go on. When this page is itself being viewed
+ * over loopback, that request's own host is the authoritative answer.
+ */
+async function resolveLocalOrigin(): Promise<string> {
+  const headerList = await headers();
+  const host = headerList.get('host')?.trim();
+
+  if (host && /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(host)) {
+    return `http://${host}`;
+  }
+
+  return 'http://localhost:4200';
+}
+
 export default async function CortexAiSettingsPage({
   searchParams,
 }: CortexAiSettingsPageProps) {
@@ -70,6 +119,12 @@ export default async function CortexAiSettingsPage({
     );
   }
 
+  const [mcpStatus, siteOrigin, localOrigin] = await Promise.all([
+    getMcpSettingsStatus(),
+    resolveSiteOrigin(),
+    resolveLocalOrigin(),
+  ]);
+
   return (
     <StoredCortexAiSettingsClient
       compatibleModels={compatibleModels as any}
@@ -95,6 +150,14 @@ export default async function CortexAiSettingsPage({
       agentSettings={status.agentSettings}
       successMessage={params.success}
       errorMessage={params.error}
-    />
+    >
+      <McpServerSettingsCard
+        allowLocalhostWithoutToken={mcpStatus.settings.allowLocalhostWithoutToken}
+        enabled={mcpStatus.settings.enabled}
+        localMcpUrl={`${localOrigin}/api/mcp`}
+        mcpUrl={`${siteOrigin}/api/mcp`}
+        tokens={mcpStatus.tokens}
+      />
+    </StoredCortexAiSettingsClient>
   );
 }

package/templates/nextblock-template/app/cms/settings/cortex-ai/require-admin.ts

@@ -0,0 +1,34 @@
+import { createClient } from '@nextblock-cms/db/server';
+
+/**
+ * Admin gate shared by the Cortex AI settings server actions.
+ *
+ * Lives outside `actions.ts` because that file is `'use server'`, where every export
+ * must itself be a valid server action — a helper returning a Supabase client cannot
+ * be exported from there. Keeping one copy matters more than the file count: this is
+ * the check standing between a WRITER and the OpenRouter key, the stock-photo keys,
+ * and the MCP access tokens.
+ */
+export async function requireAdminSupabaseClient() {
+  const supabase = createClient();
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    throw new Error('You must be logged in to manage Cortex AI settings.');
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  if (profileError || !profile || profile.role !== 'ADMIN') {
+    throw new Error('You do not have permission to manage Cortex AI settings.');
+  }
+
+  return { supabase, userId: user.id };
+}

package/templates/nextblock-template/app/lib/sitemap-utils.ts

@@ -1,4 +1,5 @@
 import { getSsgSupabaseClient } from '@nextblock-cms/db/server';
+import { buildPublishedAtOrFilter } from '@nextblock-cms/utils';
 import { getHomepageTranslationGroupId } from './homepage';
 
 /**
@@ -164,7 +165,8 @@ export async function fetchAllPublishedPages(): Promise<SitemapEntry[]> {
       supabase
         .from('pages')
         .select('slug, updated_at, language_id, translation_group_id')
-        .eq('status', 'published'),
+        .eq('status', 'published')
+        .or(buildPublishedAtOrFilter()),
       fetchLanguageMap(supabase),
       getHomepageTranslationGroupId(supabase),
     ]);
@@ -200,13 +202,12 @@ export async function fetchAllPublishedPages(): Promise<SitemapEntry[]> {
 export async function fetchAllPublishedPosts(): Promise<SitemapEntry[]> {
   const supabase = getSsgSupabaseClient();
   try {
-    const nowIso = new Date().toISOString();
     const [{ data: posts, error }, languageMap] = await Promise.all([
       supabase
         .from('posts')
         .select('slug, updated_at, language_id, translation_group_id')
         .eq('status', 'published')
-        .or(`published_at.is.null,published_at.lte.${nowIso}`),
+        .or(buildPublishedAtOrFilter()),
       fetchLanguageMap(supabase),
     ]);
 
@@ -238,7 +239,8 @@ export async function fetchAllActiveProducts(): Promise<SitemapEntry[]> {
       supabase
         .from('products')
         .select('slug, updated_at, created_at, language_id, translation_group_id')
-        .eq('status', 'active'),
+        .eq('status', 'active')
+        .or(buildPublishedAtOrFilter()),
       fetchLanguageMap(supabase),
     ]);
 

package/templates/nextblock-template/app/lib/ucp/server.ts

@@ -1,6 +1,7 @@
 import 'server-only';
 
 import { getServiceRoleSupabaseClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+import { buildPublishedAtOrFilter } from '@nextblock-cms/utils';
 import {
   getDefaultCurrency,
   inferCurrencyCodeFromLocale,
@@ -1099,6 +1100,7 @@ export async function searchCatalogProducts(body: unknown, request: Request) {
     .from('products')
     .select(PRODUCT_SELECT, { count: 'exact' })
     .eq('status', 'active')
+    .or(buildPublishedAtOrFilter())
     .order('created_at', { ascending: false })
     .range(pagination.offset, pagination.offset + pagination.limit - 1);
 
@@ -1192,7 +1194,7 @@ async function selectRowsByField(
 
   let query = client.from(table).select(select).in(field, values);
   if (table === 'products') {
-    query = query.eq('status', 'active');
+    query = query.eq('status', 'active').or(buildPublishedAtOrFilter());
   }
 
   const { data } = await query;
@@ -1251,6 +1253,7 @@ async function resolveProductRowsByIdentifiers(ids: string[]): Promise<{
     .from('products')
     .select(PRODUCT_SELECT)
     .eq('status', 'active')
+    .or(buildPublishedAtOrFilter())
     .in('id', productIds);
 
   if (error) {

package/templates/nextblock-template/app/page.tsx

@@ -3,6 +3,7 @@ import { cookies, draftMode, headers } from 'next/headers';
 import { notFound } from 'next/navigation';
 import type { Metadata } from 'next';
 import { createClient, getSsgSupabaseClient } from '@nextblock-cms/db/server';
+import { buildPublishedAtOrFilter } from '@nextblock-cms/utils';
 import PageClientContent from './[slug]/PageClientContent';
 import { getPageDataBySlug } from './[slug]/page.utils';
 import BlockRenderer from '../components/BlockRenderer';
@@ -56,7 +57,7 @@ async function resolveHomepageData(preferredLocale: string) {
       .limit(1);
 
     if (!draft.isEnabled) {
-      siblingQuery = siblingQuery.eq('status', 'published');
+      siblingQuery = siblingQuery.eq('status', 'published').or(buildPublishedAtOrFilter());
     }
 
     const { data: sibling } = await siblingQuery.maybeSingle();
@@ -131,7 +132,8 @@ export async function generateMetadata(): Promise<Metadata> {
       .from('pages')
       .select('language_id, slug')
       .eq('translation_group_id', pageData.translation_group_id)
-      .eq('status', 'published'),
+      .eq('status', 'published')
+      .or(buildPublishedAtOrFilter()),
   ]);
 
   const { data: languages } = languagesResult;
@@ -188,7 +190,8 @@ export default async function RootPage() {
       .from('pages')
       .select('slug, languages!inner(code)')
       .eq('translation_group_id', pageData.translation_group_id)
-      .eq('status', 'published');
+      .eq('status', 'published')
+      .or(buildPublishedAtOrFilter());
 
     if (translations) {
       translations.forEach((translation: PageTranslation) => {

package/templates/nextblock-template/app/product/[slug]/page.tsx

@@ -8,6 +8,7 @@ import {
   resolveTranslatedText,
 } from '@nextblock-cms/ecommerce';
 import { getSsgSupabaseClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+import { LIVE_STATUS, buildPublishedAtOrFilter, isPubliclyVisible } from '@nextblock-cms/utils';
 import { notFound } from 'next/navigation';
 import { Metadata } from 'next';
 import { draftMode, cookies, headers } from 'next/headers';
@@ -124,7 +125,16 @@ export async function generateMetadata({ params }: ProductPageProps): Promise<Me
   const { data: product } = await getProductBySlug(supabase, slug, preferredLocale);
   const productRecord = product as any;
 
-  if (!productRecord || productRecord.status !== 'active') return { title: 'Product Not Found' };
+  if (
+    !productRecord ||
+    !isPubliclyVisible({
+      status: productRecord.status,
+      publishedAt: productRecord.published_at,
+      liveStatus: LIVE_STATUS.product,
+    })
+  ) {
+    return { title: 'Product Not Found' };
+  }
   
   // Resolve image URL for OG Image
   let imageUrl = undefined;
@@ -147,6 +157,8 @@ export async function generateMetadata({ params }: ProductPageProps): Promise<Me
       .select('language_id, slug')
       .eq('translation_group_id', productRecord.translation_group_id)
       .eq('status', 'active')
+      // Never advertise a scheduled translation via hreflang.
+      .or(buildPublishedAtOrFilter())
   ]);
 
   const { data: languages } = languagesResult;
@@ -225,11 +237,23 @@ export default async function ProductPage({ params }: ProductPageProps) {
   const { data: product } = await getProductBySlug(supabase, slug, preferredLocale);
   let productRecord = product as any;
 
-  if (!productRecord || productRecord.status !== 'active') {
+  const draft = await draftMode();
+
+  // Draft mode is how the CMS previews a product before it is public, so it must
+  // reach draft and scheduled rows — everyone else only sees active products whose
+  // go-live moment has passed.
+  if (
+    !productRecord ||
+    (!draft.isEnabled &&
+      !isPubliclyVisible({
+        status: productRecord.status,
+        publishedAt: productRecord.published_at,
+        liveStatus: LIVE_STATUS.product,
+      }))
+  ) {
     notFound();
   }
 
-  const draft = await draftMode();
   const visualEditingEnabled =
     draft.isEnabled || process.env.NEXTBLOCK_VISUAL_EDITING_ENABLED === 'true';
 

package/templates/nextblock-template/components/visual-editing/NextblockVisualEditing.tsx

@@ -1018,7 +1018,10 @@ function VisualEditingToolbar() {
       return;
     }
 
-    setMessage("Draft published.");
+    // A warning means the content is live but the revision didn't record — still a
+    // publish, so the editor closes, but don't report it as a clean one.
+    const warning = result && "success" in result ? result.warning : undefined;
+    setMessage(warning ?? "Draft published.");
     hasSavedSinceOpenRef.current = false;
     closeVisualEditor();
     router.refresh();

package/templates/nextblock-template/docs/04-DATABASE-AND-AUTH.md

@@ -100,6 +100,7 @@ Defined primarily in `00000000000002_setup_content_tables.sql`:
 - `navigation_items`
 - `page_revisions`
 - `post_revisions`
+- `product_revisions` (added in `00000000000016`, alongside `products.version`)
 
 ### Commerce tables
 
@@ -179,8 +180,12 @@ tree. The current sequence is:
 
 Every file is fully idempotent. Existing databases already have versions
 `000`–`003` recorded, so both appliers skip the baseline — it only runs on a
-fresh/empty database. **The next new migration is `00000000000004`**, appended
-forward-only.
+fresh/empty database.
+
+`00000000000004` was the first migration appended after that re-baseline, not the
+one still to be written — the folder has grown well past it. **To find the next
+number, list `libs/db/src/supabase/migrations` and take the one after the highest
+file on disk.** Never copy a hardcoded "next is N" out of a doc.
 
 ### Production migration policy
 
@@ -193,7 +198,13 @@ production or shared database change.
   `libs/db/src/supabase/migrations` for each new schema/data change.
 - Keep migrations non-destructive by default. Avoid dropping or rewriting data
   that may include orders, users, payments, or customer records.
-- Run `npm run db:migrate:check` before `npm run db:migrate`.
+- Run `npm run db:migrate:check` before `npm run db:migrate`. **Read its pending
+  list** — do not just look for a success line. If you added a migration and the
+  check reports `Pending: 0`, that file will never run (see below).
+- **Supabase matches migration history by version only, never by content.** A file
+  whose 14-digit version is already recorded remotely is skipped in silence — no
+  error, no output. That is why the check prints the pending list and warns when a
+  version is recorded remotely with no local file behind it.
 - If an existing database lists old baseline files such as
   `00000000000000_baseline_schema.sql` as pending, do not replay them. Use
   `npm run db:migrate:repair-history:check`, then
@@ -202,6 +213,30 @@ production or shared database change.
   rerun `npm run db:migrate:check`.
 - Use `npm run db:migrate:fresh` only for a brand-new empty database.
 
+#### Why `db:migrate:check` is read-only by construction
+
+On 2026-08-10 the check applied migration `00000000000017` to the production
+project while printing `DRY RUN: migrations will *not* be pushed` and `Dry run
+complete. No database changes were applied.` The `--check` path then ran
+`supabase link --yes` followed by `supabase db push --dry-run` (Supabase CLI
+v2.107); which of the two executed the SQL was never established, and the decisive
+probe would have written a row to the production migration history.
+
+`tools/scripts/push-db-migrations.js` no longer runs either on the check path. It
+now runs only `supabase migration list` — a pure read — and derives the pending set
+by diffing local files against remote history. Consequences worth keeping:
+
+- The check links nothing. An unlinked repo is told to run `supabase link` itself
+  rather than having project state written underneath a command called "check".
+- The check needs no `SUPABASE_ACCESS_TOKEN`, because only linking did.
+- The apply path derives its baseline-replay guard from the same read instead of
+  regex-scraping `db push --dry-run` output, and returns early when nothing is
+  pending, so `db push` is never invoked without work to do.
+- `parseMigrationList` is unit-tested in `tools/scripts/push-db-migrations.test.ts`.
+
+If a future CLI upgrade tempts you back toward `db push --dry-run` for previewing:
+don't. A command named `check` must not be able to write.
+
 ### Category map
 
 | Migration file | Domain | What it covers |