create-nextblock 0.14.6 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.14.6",
+  "version": "0.15.1",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -6607,6 +6607,193 @@ DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
 CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
 
 
+-- >>> FROM: 00000000000018_site_scripts.sql <<<
+-- Site scripts: admin-authored JavaScript injected into every page of the public site.
+--
+-- Rich-text blocks can already carry an inline <script>, but that script belongs to
+-- one block on one page. This table is for behaviour that spans the site: chat
+-- widgets, third-party embeds, and the scroll/animation helpers that page classes
+-- rely on. Each row gets a name, an on/off switch, and a defined injection point.
+--
+-- NOT the same thing as \`site_settings.privacy_settings -> custom_scripts\`, which is
+-- a single consent-gated blob for marketing tags and only fires once a visitor
+-- accepts cookies. Rows here are functional site code and run unconditionally, so
+-- anything requiring consent belongs in that setting instead, not this table.
+--
+-- Scripts are emitted with the request's CSP nonce by the root layout, so they run
+-- under the site's existing Content-Security-Policy rather than forcing it open.
+--
+-- Security posture: this is arbitrary JavaScript on every page, so writes are
+-- ADMIN-only (WRITER is deliberately excluded, unlike most content tables) and the
+-- public may read only rows that are switched on, so a half-written draft is never
+-- served to a visitor.
+
+CREATE TABLE IF NOT EXISTS public.site_scripts (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    name text NOT NULL,
+    description text,
+    -- Raw JavaScript, stored WITHOUT the surrounding <script> tag. The layout adds
+    -- the tag so the nonce and attributes are always applied by us, never by the
+    -- author. Ignored when \`src\` is set.
+    code text DEFAULT ''::text NOT NULL,
+    -- When set, an external script is loaded from this URL and \`code\` is ignored.
+    src text,
+    -- Where the tag is emitted. 'head' runs before first paint (blocking, use
+    -- sparingly); 'body_end' runs once the markup exists and is the right default
+    -- for anything that queries the DOM.
+    placement text DEFAULT 'body_end'::text NOT NULL,
+    -- Applies to external \`src\` scripts; inline code ignores it.
+    load_strategy text DEFAULT 'default'::text NOT NULL,
+    is_active boolean DEFAULT false NOT NULL,
+    sort_order integer DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT site_scripts_pkey PRIMARY KEY (id),
+    CONSTRAINT site_scripts_placement_check
+        CHECK ((placement = ANY (ARRAY['head'::text, 'body_start'::text, 'body_end'::text]))),
+    CONSTRAINT site_scripts_load_strategy_check
+        CHECK ((load_strategy = ANY (ARRAY['default'::text, 'defer'::text, 'async'::text]))),
+    -- An external script must be https so it cannot be downgraded in transit.
+    CONSTRAINT site_scripts_src_scheme_check
+        CHECK ((src IS NULL OR src ~ '^https://')),
+    -- A row has to actually do something: inline code or an external src.
+    CONSTRAINT site_scripts_has_payload_check
+        CHECK ((src IS NOT NULL OR length(btrim(code)) > 0))
+);
+
+COMMENT ON TABLE public.site_scripts IS
+    'Admin-authored JavaScript injected into the public site by the root layout, with the request CSP nonce applied. Only is_active rows are publicly readable; only ADMIN may write. Distinct from privacy_settings.custom_scripts, which is consent-gated marketing tags.';
+
+CREATE INDEX IF NOT EXISTS site_scripts_active_placement_sort_idx
+    ON public.site_scripts USING btree (is_active, placement, sort_order);
+
+DROP TRIGGER IF EXISTS set_site_scripts_updated_at ON public.site_scripts;
+CREATE TRIGGER set_site_scripts_updated_at
+    BEFORE UPDATE ON public.site_scripts
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+ALTER TABLE public.site_scripts ENABLE ROW LEVEL SECURITY;
+
+GRANT ALL ON TABLE public.site_scripts TO anon;
+GRANT ALL ON TABLE public.site_scripts TO authenticated;
+GRANT ALL ON TABLE public.site_scripts TO service_role;
+
+-- Anonymous visitors need the active scripts to render the page. Inactive rows stay
+-- private so a half-written script is never exposed before it is switched on.
+DROP POLICY IF EXISTS "Public read active site scripts" ON public.site_scripts;
+CREATE POLICY "Public read active site scripts" ON public.site_scripts
+    FOR SELECT TO authenticated, anon USING (is_active);
+
+DROP POLICY IF EXISTS "Admins read all site scripts" ON public.site_scripts;
+CREATE POLICY "Admins read all site scripts" ON public.site_scripts
+    FOR SELECT TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins insert site scripts" ON public.site_scripts;
+CREATE POLICY "Admins insert site scripts" ON public.site_scripts
+    FOR INSERT TO authenticated
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins update site scripts" ON public.site_scripts;
+CREATE POLICY "Admins update site scripts" ON public.site_scripts
+    FOR UPDATE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role))
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins delete site scripts" ON public.site_scripts;
+CREATE POLICY "Admins delete site scripts" ON public.site_scripts
+    FOR DELETE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+
+-- >>> FROM: 00000000000019_site_script_revisions.sql <<<
+-- Audit trail and undo for site scripts.
+--
+-- \`site_scripts\` ships arbitrary JavaScript to every visitor, which makes it the
+-- highest-privilege write in the CMS: a bad or malicious snippet can read cookies,
+-- watch checkout forms, or phone home. Content has Revision History for exactly this
+-- reason; code needs it more, not less. Every create/update/delete writes one row
+-- here, and every row is a complete, restorable snapshot — so this table is both the
+-- log ("who shipped what, when, from where") and the undo.
+--
+-- APPEND-ONLY BY CONSTRUCTION. There are no UPDATE or DELETE policies, and the
+-- trigger below rejects both even for the service role, which otherwise bypasses
+-- RLS. An audit trail that the compromised credential can rewrite is not an audit
+-- trail. Reverting therefore writes a NEW 'revert' row rather than removing history.
+--
+-- \`script_id\` and \`actor_user_id\` are deliberately PLAIN uuids with no foreign keys:
+-- an FK with ON DELETE SET NULL would have to UPDATE this table when a script or a
+-- profile is deleted, which the append-only trigger forbids. \`script_name\` is
+-- denormalised so a deleted script is still identifiable in the log.
+
+CREATE TABLE IF NOT EXISTS public.site_script_revisions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    script_id uuid,
+    script_name text NOT NULL,
+    revision_type text NOT NULL,
+    -- Null when the actor could not be resolved (e.g. a localhost dev connection).
+    actor_user_id uuid,
+    -- Which surface made the change, so an unexpected edit can be traced back to
+    -- the dashboard or to an MCP token.
+    source text DEFAULT 'cms'::text NOT NULL,
+    summary text,
+    -- Full restorable state of the script at this revision. For 'delete' it is the
+    -- state immediately BEFORE removal, so restoring it brings the script back.
+    snapshot jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT site_script_revisions_pkey PRIMARY KEY (id),
+    CONSTRAINT site_script_revisions_type_check
+        CHECK ((revision_type = ANY (ARRAY['create'::text, 'update'::text, 'delete'::text, 'revert'::text]))),
+    CONSTRAINT site_script_revisions_source_check
+        CHECK ((source = ANY (ARRAY['cms'::text, 'mcp'::text]))),
+    CONSTRAINT site_script_revisions_snapshot_is_object_check
+        CHECK ((jsonb_typeof(snapshot) = 'object'))
+);
+
+COMMENT ON TABLE public.site_script_revisions IS
+    'Append-only audit log and undo history for site_scripts. Each row is a restorable snapshot. UPDATE and DELETE are blocked by trigger, including for the service role.';
+
+CREATE INDEX IF NOT EXISTS site_script_revisions_script_created_idx
+    ON public.site_script_revisions USING btree (script_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS site_script_revisions_created_idx
+    ON public.site_script_revisions USING btree (created_at DESC);
+
+-- Enforced in the database rather than the application so it holds for every
+-- caller, including the service-role client the MCP server uses.
+CREATE OR REPLACE FUNCTION public.prevent_site_script_revision_rewrite() RETURNS trigger
+    LANGUAGE plpgsql
+    SET search_path = ''
+    AS $$
+BEGIN
+  RAISE EXCEPTION 'site_script_revisions is append-only; % is not permitted', TG_OP
+    USING ERRCODE = 'restrict_violation';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_site_script_revisions_append_only ON public.site_script_revisions;
+CREATE TRIGGER trg_site_script_revisions_append_only
+    BEFORE UPDATE OR DELETE ON public.site_script_revisions
+    FOR EACH ROW EXECUTE FUNCTION public.prevent_site_script_revision_rewrite();
+
+ALTER TABLE public.site_script_revisions ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT, INSERT ON TABLE public.site_script_revisions TO authenticated;
+GRANT ALL ON TABLE public.site_script_revisions TO service_role;
+
+-- Read is ADMIN-only: snapshots contain the full source of scripts that may not be
+-- active yet, and the log itself reveals operational history.
+DROP POLICY IF EXISTS "Admins read site script revisions" ON public.site_script_revisions;
+CREATE POLICY "Admins read site script revisions" ON public.site_script_revisions
+    FOR SELECT TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins insert site script revisions" ON public.site_script_revisions;
+CREATE POLICY "Admins insert site script revisions" ON public.site_script_revisions
+    FOR INSERT TO authenticated
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+
   -- Step D: Record the applied migrations in history (truncated in Step B) so
   -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
   INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
@@ -6627,7 +6814,9 @@ CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO
     ('00000000000014', 'site_themes'),
     ('00000000000015', 'scheduled_publishing'),
     ('00000000000016', 'product_revisions_and_revision_baseline'),
-    ('00000000000017', 'cortex_ai_mcp_server')
+    ('00000000000017', 'cortex_ai_mcp_server'),
+    ('00000000000018', 'site_scripts'),
+    ('00000000000019', 'site_script_revisions')
   ON CONFLICT (version) DO NOTHING;
 
   -- Step E: Anchor preserved profiles

package/templates/nextblock-template/app/api/mcp/route.ts

@@ -55,21 +55,45 @@ const MCP_SKIP_CONFIRMATION = true;
 
 type McpAuth = {
   actorUserId: string | null;
+  /**
+   * True when this token outlived the account that minted it (`created_by` is
+   * `ON DELETE SET NULL`), so `actorUserId` below is a stand-in rather than the
+   * principal that actually holds the credential.
+   *
+   * A stand-in is fine for *attribution* — a revision needs some author — but it
+   * must never be the basis for *authorization*, or deleting an administrator would
+   * silently promote their leftover token to whichever admin happens to sort first.
+   * Offboarding someone is exactly when their credentials should lose power, not
+   * inherit someone else's.
+   */
+  actorFromOrphanedToken: boolean;
   scopes: CortexAiMcpScope[];
   source: 'admin-session' | 'localhost' | 'token';
 };
 
-async function importExternalImageForMcp(input: {
-  url: string;
-  altText?: string;
-}): Promise<{ id: string } | { error: string }> {
-  const result = await importExternalImageToMedia({ altText: input.altText, url: input.url });
+/**
+ * MCP has no cookie session, so the importer is handed the actor this request already
+ * authenticated. Without it every image import fails with "You must be signed in to
+ * import an image" — which silently strips the imagery out of any page or product
+ * built over MCP, since executors treat an import failure as non-fatal.
+ */
+function createMcpImageImporter(actorUserId: string | null) {
+  return async function importExternalImageForMcp(input: {
+    url: string;
+    altText?: string;
+  }): Promise<{ id: string } | { error: string }> {
+    const result = await importExternalImageToMedia({
+      ...(actorUserId ? { actorUserId } : {}),
+      altText: input.altText,
+      url: input.url,
+    });
 
-  if ('error' in result) {
-    return { error: result.error };
-  }
+    if ('error' in result) {
+      return { error: result.error };
+    }
 
-  return { id: result.media.id };
+    return { id: result.media.id };
+  };
 }
 
 /** Mirrors the global-agent route so MCP writes land in Revision History like any other edit. */
@@ -173,7 +197,8 @@ async function authenticateMcpRequest(request: Request): Promise<McpAuth | null>
     void touchCortexAiMcpToken(serviceClient, verification.token.id);
 
     return {
-      actorUserId: verification.token.created_by,
+      actorFromOrphanedToken: !verification.token.created_by,
+      actorUserId: verification.token.created_by ?? (await resolveFallbackAdminUserId()),
       scopes: verification.scopes,
       source: 'token',
     };
@@ -182,16 +207,59 @@ async function authenticateMcpRequest(request: Request): Promise<McpAuth | null>
   const adminUserId = await resolveAdminSessionUserId();
 
   if (adminUserId) {
-    return { actorUserId: adminUserId, scopes: ['read', 'write'], source: 'admin-session' };
+    return {
+      actorFromOrphanedToken: false,
+      actorUserId: adminUserId,
+      scopes: ['read', 'write'],
+      source: 'admin-session',
+    };
   }
 
   if (shouldTrustLocalMcpRequest({ hostHeader: request.headers.get('host'), settings })) {
-    return { actorUserId: null, scopes: ['read', 'write'], source: 'localhost' };
+    // Loopback trust is an explicit opt-in on a development machine, where anyone
+    // who can reach this endpoint can already read the service-role key out of
+    // .env.local. Not treated as orphaned: it grants nothing new.
+    return {
+      actorFromOrphanedToken: false,
+      actorUserId: await resolveFallbackAdminUserId(),
+      scopes: ['read', 'write'],
+      source: 'localhost',
+    };
   }
 
   return null;
 }
 
+/**
+ * Every mutating Cortex executor calls `getActorUserId()` and throws without one, so a
+ * connection with no identity behind it can read but never write. Two connections have
+ * that problem: localhost trust (nobody signed in) and a token whose creator was since
+ * deleted (`created_by` is `ON DELETE SET NULL`).
+ *
+ * Rather than advertise a `write` scope those connections cannot actually use, fall back
+ * to an ADMIN profile so the write is attributed to a real person in Revision History.
+ * This grants no new authority — reaching here already required either loopback in
+ * development or a valid admin-minted token — it only supplies the author field.
+ *
+ * `id` ordering is arbitrary but stable, which is what matters: the same fallback admin
+ * every time, so revision authorship does not jump between people run to run.
+ */
+async function resolveFallbackAdminUserId(): Promise<string | null> {
+  try {
+    const { data } = await getServiceRoleSupabaseClient()
+      .from('profiles')
+      .select('id')
+      .eq('role', 'ADMIN')
+      .order('id', { ascending: true })
+      .limit(1)
+      .maybeSingle();
+
+    return data?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+
 async function resolveAdminSessionUserId(): Promise<string | null> {
   try {
     const supabase = createClient();
@@ -217,8 +285,9 @@ async function resolveAdminSessionUserId(): Promise<string | null> {
 
 function buildToolContext(auth: McpAuth): CortexMcpToolContext {
   return {
+    actorFromOrphanedToken: auth.actorFromOrphanedToken,
     actorUserId: auth.actorUserId,
-    importExternalImage: importExternalImageForMcp,
+    importExternalImage: createMcpImageImporter(auth.actorUserId),
     // No open editor over MCP: tools that need a target take it in their arguments
     // (`cmsTarget`, `slug`, `entityId`) rather than inheriting one from a UI.
     pageContext: null,

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -9,7 +9,7 @@ import {
   LayoutDashboard, FileText, PenTool, Users, Settings, ChevronRight, LogOut, Menu, ListTree, Image as ImageIconLucide, X, Languages as LanguagesIconLucide, MessageSquare,
   Copyright as CopyrightIcon, ShoppingBag, ListOrdered, CreditCard, Package, Coins,
   ExternalLink, Paintbrush, Brain, TicketPercent, ShieldAlert, Folder, DatabaseBackup, Boxes, Tag,
-  ShieldCheck, Cookie, LineChart, Mail, UserPlus, SlidersHorizontal,
+  ShieldCheck, Code2, Cookie, LineChart, Mail, UserPlus, SlidersHorizontal,
 } from "lucide-react"
 import TwoFactorReminderBanner from "./components/TwoFactorReminderBanner"
 import SystemAlertsBanner, { type SystemAlertItem } from "./components/SystemAlertsBanner"
@@ -229,6 +229,7 @@ export default function CmsClientLayout({
   else if (pathname.startsWith("/cms/settings/logos")) pageTitle = "Branding";
   else if (pathname.startsWith("/cms/settings/copyright")) pageTitle = "Copyright Settings";
   else if (pathname.startsWith("/cms/settings/global-css")) pageTitle = "Themes & CSS";
+  else if (pathname.startsWith("/cms/settings/site-scripts")) pageTitle = "Site Scripts";
   else if (pathname.startsWith("/cms/settings/extra-translations")) pageTitle = "Extra Translations";
   else if (pathname.startsWith("/cms/settings/backup-restore")) pageTitle = "Backup And Restore";
   else if (pathname.startsWith("/cms/settings/currencies")) pageTitle = "Currency Settings";
@@ -424,6 +425,9 @@ export default function CmsClientLayout({
                     <NavItem href="/cms/settings/global-css" icon={Paintbrush} isActive={pathname.startsWith("/cms/settings/global-css")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Themes &amp; CSS
                     </NavItem>
+                    <NavItem href="/cms/settings/site-scripts" icon={Code2} isActive={pathname.startsWith("/cms/settings/site-scripts")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      Site Scripts
+                    </NavItem>
                     <NavItem href="/cms/settings/privacy" icon={Cookie} isActive={pathname.startsWith("/cms/settings/privacy")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Privacy &amp; Consent
                     </NavItem>

package/templates/nextblock-template/app/cms/media/import-external-image.ts

@@ -6,7 +6,7 @@ import "server-only";
 import sharp from "sharp";
 import { PutObjectCommand } from "@aws-sdk/client-s3";
 
-import { createClient } from "@nextblock-cms/db/server";
+import { createClient, getServiceRoleSupabaseClient } from "@nextblock-cms/db/server";
 import { recordMediaUpload } from "@nextblock-cms/db";
 import { getS3Client } from "@nextblock-cms/utils/server";
 
@@ -36,6 +36,34 @@ type ImportExternalImageResult =
  * Reject local/loopback/private/link-local hosts and cloud metadata endpoints so an
  * admin-supplied URL cannot be used to probe internal infrastructure (SSRF).
  */
+/**
+ * Unwrap an IPv4-mapped IPv6 address to dotted-quad.
+ *
+ * `http://[::ffff:127.0.0.1]/` reaches loopback, but the URL parser normalises it to
+ * `::ffff:7f00:1`, which matches none of the IPv4 checks below — a working bypass of
+ * the whole blocklist. Mirrors `unwrapMappedIpv4` in
+ * libs/cortex/src/lib/ai-global-agent-tools.ts; the two blocklists are duplicated
+ * because a published lib cannot import from the app, so fix both together.
+ */
+function unwrapMappedIpv4(host: string): string | null {
+  const mapped = host.match(/^::ffff:(.+)$/i);
+
+  if (!mapped) return null;
+
+  const rest = mapped[1] as string;
+
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(rest)) return rest;
+
+  const hextets = rest.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+
+  if (!hextets) return null;
+
+  const high = Number.parseInt(hextets[1] as string, 16);
+  const low = Number.parseInt(hextets[2] as string, 16);
+
+  return [(high >> 8) & 255, high & 255, (low >> 8) & 255, low & 255].join(".");
+}
+
 function isBlockedImportHost(hostname: string): boolean {
   const host = hostname.trim().toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
 
@@ -50,10 +78,23 @@ function isBlockedImportHost(hostname: string): boolean {
     return true;
   }
 
-  if (host === "0.0.0.0" || host === "::1" || host.startsWith("fe80:") || host.startsWith("fc") || host.startsWith("fd")) {
+  if (
+    host === "0.0.0.0" ||
+    host === "::" ||
+    host === "::1" ||
+    host.startsWith("fe80:") ||
+    host.startsWith("fc") ||
+    host.startsWith("fd")
+  ) {
     return true;
   }
 
+  const mappedIpv4 = unwrapMappedIpv4(host);
+
+  if (mappedIpv4) {
+    return isBlockedImportHost(mappedIpv4);
+  }
+
   const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
 
   if (ipv4) {
@@ -93,15 +134,28 @@ function slugifyFileBase(value: string): string {
 }
 
 /**
- * Download an external image (e.g. an AI-inserted stock photo) and persist it into the
- * NextBlock media library (R2 or Supabase Storage) so it becomes a permanent, optimized
- * asset the page no longer hotlinks. ADMIN/WRITER only.
+ * Establish the ADMIN/WRITER this import is attributed to.
+ *
+ * Two paths: a cookie session (the dashboard) or an explicitly supplied actor (the
+ * MCP server, which has already authenticated the caller by bearer token). Both
+ * end at the same role check, so the second is a different way to *identify* the
+ * uploader, not a way to skip authorization.
  */
-export async function importExternalImageToMedia(input: {
-  url: string;
-  altText?: string;
-  fileName?: string;
-}): Promise<ImportExternalImageResult> {
+async function resolveImportActorId(actorUserId?: string): Promise<{ id: string } | { error: string }> {
+  if (actorUserId) {
+    const { data: profile } = await getServiceRoleSupabaseClient()
+      .from("profiles")
+      .select("role")
+      .eq("id", actorUserId)
+      .single();
+
+    if (!profile || !["ADMIN", "WRITER"].includes(profile.role)) {
+      return { error: "You do not have permission to import media." };
+    }
+
+    return { id: actorUserId };
+  }
+
   const supabase = createClient();
   const {
     data: { user },
@@ -117,6 +171,34 @@ export async function importExternalImageToMedia(input: {
     return { error: "You do not have permission to import media." };
   }
 
+  return { id: user.id };
+}
+
+/**
+ * Download an external image (e.g. an AI-inserted stock photo) and persist it into the
+ * NextBlock media library (R2 or Supabase Storage) so it becomes a permanent, optimized
+ * asset the page no longer hotlinks. ADMIN/WRITER only.
+ */
+export async function importExternalImageToMedia(input: {
+  url: string;
+  altText?: string;
+  fileName?: string;
+  /**
+   * Uploader for callers with no cookie session — the MCP server authenticates by
+   * bearer token, so `auth.getUser()` finds nobody and every import would fail with
+   * "You must be signed in". The role check below still runs against this id, so it
+   * confers no authority the caller did not already establish.
+   */
+  actorUserId?: string;
+}): Promise<ImportExternalImageResult> {
+  const uploaderId = await resolveImportActorId(input.actorUserId);
+
+  if ("error" in uploaderId) {
+    return { error: uploaderId.error };
+  }
+
+  const userId = uploaderId.id;
+
   let target: URL;
 
   try {
@@ -233,7 +315,7 @@ export async function importExternalImageToMedia(input: {
           Bucket: bucket,
           ContentType: resolvedContentType,
           Key: objectKey,
-          Metadata: { "uploader-user-id": user.id },
+          Metadata: { "uploader-user-id": userId },
         })
       );
     }
@@ -258,6 +340,10 @@ export async function importExternalImageToMedia(input: {
 
   const record = await recordMediaUpload(
     {
+      // Carried through so the media row is attributed to the same actor the role
+      // check above passed — without it the recorder falls back to the cookie
+      // session and fails for MCP callers after the upload has already happened.
+      actorUserId: input.actorUserId,
       blurDataUrl: blurDataUrl || undefined,
       description: altText || undefined,
       fileName,