create-nextblock 0.15.5 → 0.15.9

package/templates/nextblock-template/app/actions/threadActions.ts

@@ -0,0 +1,166 @@
+'use server';
+
+import { headers } from 'next/headers';
+import { after } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { getCookieValue } from '../../lib/auth/cookies';
+import { THREAD_COOKIE, verifyThreadToken } from '../../lib/messages/thread-token';
+import {
+  getFormEndpoint,
+  notifyAdminOfMessage,
+  resolveFormRecipient,
+} from '../../lib/messages/threads';
+import { resolveSellerContactEmail } from '../../lib/commerce/seller-contact';
+import { verifyBotProtection } from '../../lib/botProtection/verify';
+
+/**
+ * A visitor replying on their own thread page.
+ *
+ * The token is read from the HttpOnly COOKIE, never from a form field — so it is never
+ * in a POST body, never in a client-side variable, and cannot be swapped by editing the
+ * request. Everything else here mirrors the enquiry action: bot protection first, a
+ * fail-closed per-IP throttle, then a write.
+ */
+
+const MAX_BODY_LENGTH = 5000;
+const MAX_USER_AGENT_LENGTH = 500;
+const THROTTLE_WINDOW_MINUTES = 10;
+const THROTTLE_MAX_REPLIES = 10;
+const UNKNOWN_IP_BUCKET = 'unknown';
+
+export interface ThreadReplyState {
+  success: boolean;
+  messageKey: 'thread.sent' | 'thread.error' | 'thread.throttled' | 'thread.closed' | '';
+  message?: string;
+}
+
+function firstHop(headerValue: string | null): string | null {
+  const [first] = (headerValue ?? '').split(',');
+  const trimmed = first?.trim() ?? '';
+  return trimmed || null;
+}
+
+function maskIp(ip: string | null): string {
+  if (!ip) return UNKNOWN_IP_BUCKET;
+  if (ip.includes(':')) {
+    const hextets = ip.split(':').filter(Boolean);
+    return `${hextets.slice(0, 3).join(':')}::x`;
+  }
+  const octets = ip.split('.');
+  if (octets.length === 4) {
+    octets[3] = 'x';
+    return octets.join('.');
+  }
+  return UNKNOWN_IP_BUCKET;
+}
+
+export async function submitThreadReply(
+  _prevState: unknown,
+  formData: FormData
+): Promise<ThreadReplyState> {
+  const verification = await verifyBotProtection(formData);
+  if (!verification.ok) {
+    if (verification.reason === 'honeypot') {
+      return { success: true, messageKey: 'thread.sent' };
+    }
+    return { success: false, messageKey: '', message: verification.message };
+  }
+
+  const rawBody = formData.get('body');
+  const body = typeof rawBody === 'string' ? rawBody.trim().slice(0, MAX_BODY_LENGTH) : '';
+  if (!body) return { success: false, messageKey: 'thread.error' };
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+
+    const token = await getCookieValue(THREAD_COOKIE);
+    const check = await verifyThreadToken(supabase, token);
+    if (!check.valid) return { success: false, messageKey: 'thread.error' };
+
+    const thread = check.thread;
+    if (thread.status === 'closed') return { success: false, messageKey: 'thread.closed' };
+
+    const requestHeaders = await headers();
+    const ipMasked = maskIp(
+      firstHop(requestHeaders.get('x-vercel-forwarded-for')) ??
+        firstHop(requestHeaders.get('x-real-ip')) ??
+        firstHop(requestHeaders.get('x-forwarded-for'))
+    );
+    const userAgent = requestHeaders.get('user-agent');
+
+    const since = new Date(Date.now() - THROTTLE_WINDOW_MINUTES * 60_000).toISOString();
+    const { count } = await supabase
+      .from('thread_messages')
+      .select('id', { count: 'exact', head: true })
+      .eq('ip_masked', ipMasked)
+      .gte('created_at', since);
+    if ((count ?? 0) >= THROTTLE_MAX_REPLIES) {
+      return { success: false, messageKey: 'thread.throttled' };
+    }
+
+    const { data: message, error } = await supabase
+      .from('thread_messages')
+      .insert({
+        thread_id: thread.id,
+        direction: 'inbound',
+        body,
+        author_name: thread.sender_name,
+        ip_masked: ipMasked,
+      })
+      .select('id')
+      .single();
+
+    if (error || !message) {
+      console.error('[thread] Could not store a visitor reply:', error?.message);
+      return { success: false, messageKey: 'thread.error' };
+    }
+
+    await supabase
+      .from('message_threads')
+      .update({
+        last_message_at: new Date().toISOString(),
+        unread_for_admin: true,
+        unread_for_visitor: false,
+        // A visitor writing back REOPENS the conversation. Marking it handled was a
+        // statement about the last exchange, not a permanent verdict — leaving it closed
+        // would drop their reply out of the inbox's default view, which is precisely
+        // where someone waiting on an answer must not go.
+        status: 'open',
+        user_agent: userAgent ? userAgent.slice(0, MAX_USER_AGENT_LENGTH) : null,
+      })
+      .eq('id', thread.id);
+
+    after(async () => {
+      // Route the notice the same way the original submission was routed, so a
+      // contact-form conversation keeps reaching that form's address.
+      const recipient =
+        thread.source === 'contact_form'
+          ? await resolveFormRecipient(
+              // Load the ORIGINATING form's endpoint. Passing null here would skip the
+              // per-form address entirely and quietly deliver a careers-form follow-up
+              // to the general mailbox.
+              thread.form_key ? await getFormEndpoint(thread.form_key) : null
+            )
+          : (await resolveSellerContactEmail()).email;
+
+      await notifyAdminOfMessage({
+        threadId: thread.id,
+        source: thread.source as 'product_inquiry' | 'contact_form',
+        messageId: message.id,
+        subjectLabel: thread.subject_label,
+        senderName: thread.sender_name,
+        senderEmail: thread.sender_email,
+        message: body,
+        recipient,
+      });
+    });
+
+    revalidatePath('/thread');
+    return { success: true, messageKey: 'thread.sent' };
+  } catch (error) {
+    console.error('[thread] Visitor reply failed:', error);
+    return { success: false, messageKey: 'thread.error' };
+  }
+}

package/templates/nextblock-template/app/api/checkout/route.ts

@@ -1,146 +1,162 @@
-import { NextResponse } from 'next/server';
-import { getPaymentProvider } from '@nextblock-cms/ecommerce/server';
-import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
-import { normalizeCustomerAddress } from '@nextblock-cms/ecommerce';
-
-function jsonError(errorKey: string, error: string, status: number) {
-  return NextResponse.json({ error, errorKey }, { status });
-}
-
-function resolveProviderFromItem(item: any): 'stripe' | 'freemius' | null {
-  if (item?.provider === 'stripe' || item?.provider === 'freemius') {
-    return item.provider;
-  }
-
-  if (item?.payment_provider === 'stripe' || item?.payment_provider === 'freemius') {
-    return item.payment_provider;
-  }
-
-  if (item?.product_type === 'digital') {
-    return 'freemius';
-  }
-
-  if (item?.product_type === 'physical') {
-    return 'stripe';
-  }
-
-  if (item?.freemius_product_id) {
-    return 'freemius';
-  }
-
-  return null;
-}
-
-export async function POST(req: Request) {
-  try {
-    const isOnline = await verifyPackageOnline('ecommerce');
-    if (!isOnline) {
-      return jsonError(
-        'ecommerce.checkout_license_inactive',
-        'Ecommerce module license is inactive',
-        403
-      );
-    }
-
-    const {
-      items,
-      customerEmail,
-      customerPhone,
-      billingAddress,
-      shippingAddress,
-      shippingMethodId,
-      currencyCode,
-      locale,
-      couponCode,
-      couponContextItems,
-    } = await req.json();
-    
-    if (!items || !Array.isArray(items)) {
-      return jsonError(
-        'ecommerce.checkout_invalid_items',
-        'Invalid items data',
-        400
-      );
-    }
-
-    const providerNames = Array.from(
-      new Set(items.map((item) => resolveProviderFromItem(item)).filter(Boolean))
-    ) as Array<'stripe' | 'freemius'>;
-
-    if (providerNames.length === 0) {
-      return jsonError(
-        'ecommerce.checkout_provider_items_required',
-        'Each checkout request must include provider-aware cart items.',
-        400
-      );
-    }
-
-    if (providerNames.length > 1) {
-      return jsonError(
-        'ecommerce.checkout_mixed_provider_steps',
-        'Mixed-provider carts must be checked out in separate steps.',
-        400
-      );
-    }
-
-    const providerName = providerNames[0];
-
-    if (providerName === 'freemius' && items.length !== 1) {
-      return jsonError(
-        'ecommerce.checkout_freemius_single_item',
-        'Freemius items must be checked out one at a time.',
-        400
-      );
-    }
-
-    if (!billingAddress) {
-      return jsonError(
-        'ecommerce.checkout_billing_address_required',
-        'Billing address is required',
-        400
-      );
-    }
-
-    const supabase = createClient();
-    const provider = getPaymentProvider(providerName);
-
-    const { data: { user } } = await supabase.auth.getUser();
-    const userId = user?.id;
-    const resolvedCustomerEmail = user?.email || customerEmail || null;
-
-    const { url, error, errorKey, errorParams, errorStatus, customProps } =
-      await provider.createCheckoutSession({
-      items,
-      customerEmail: resolvedCustomerEmail,
-      customerPhone,
-      userId,
-      billingAddress: normalizeCustomerAddress(billingAddress) ?? billingAddress,
-      shippingAddress:
-        providerName === 'stripe'
-          ? normalizeCustomerAddress(shippingAddress)
-          : null,
-      shippingMethodId: providerName === 'stripe' ? shippingMethodId : null,
-      currencyCode: typeof currencyCode === 'string' ? currencyCode : null,
-      locale: typeof locale === 'string' ? locale : null,
-      couponCode: typeof couponCode === 'string' ? couponCode : null,
-      couponContextItems: Array.isArray(couponContextItems) ? couponContextItems : items,
-    });
-
-    if (error) {
-      console.error('Checkout Error:', error);
-      return NextResponse.json(
-        { error, errorKey, errorParams },
-        { status: errorStatus ?? 500 }
-      );
-    }
-
-    return NextResponse.json({ url, customProps });
-  } catch (err: any) {
-    console.error('Checkout API Error:', err);
-    return jsonError(
-      'ecommerce.checkout_internal_server_error',
-      'Internal Server Error',
-      500
-    );
-  }
-}
+import { NextResponse } from 'next/server';
+import { getPaymentProvider, getProviderReadiness } from '@nextblock-cms/ecommerce/server';
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+import { normalizeCustomerAddress } from '@nextblock-cms/ecommerce';
+
+function jsonError(errorKey: string, error: string, status: number) {
+  return NextResponse.json({ error, errorKey }, { status });
+}
+
+function resolveProviderFromItem(item: any): 'stripe' | 'freemius' | null {
+  if (item?.provider === 'stripe' || item?.provider === 'freemius') {
+    return item.provider;
+  }
+
+  if (item?.payment_provider === 'stripe' || item?.payment_provider === 'freemius') {
+    return item.payment_provider;
+  }
+
+  if (item?.product_type === 'digital') {
+    return 'freemius';
+  }
+
+  if (item?.product_type === 'physical') {
+    return 'stripe';
+  }
+
+  if (item?.freemius_product_id) {
+    return 'freemius';
+  }
+
+  return null;
+}
+
+export async function POST(req: Request) {
+  try {
+    const isOnline = await verifyPackageOnline('ecommerce');
+    if (!isOnline) {
+      return jsonError(
+        'ecommerce.checkout_license_inactive',
+        'Ecommerce module license is inactive',
+        403
+      );
+    }
+
+    const {
+      items,
+      customerEmail,
+      customerPhone,
+      billingAddress,
+      shippingAddress,
+      shippingMethodId,
+      currencyCode,
+      locale,
+      couponCode,
+      couponContextItems,
+    } = await req.json();
+    
+    if (!items || !Array.isArray(items)) {
+      return jsonError(
+        'ecommerce.checkout_invalid_items',
+        'Invalid items data',
+        400
+      );
+    }
+
+    const providerNames = Array.from(
+      new Set(items.map((item) => resolveProviderFromItem(item)).filter(Boolean))
+    ) as Array<'stripe' | 'freemius'>;
+
+    if (providerNames.length === 0) {
+      return jsonError(
+        'ecommerce.checkout_provider_items_required',
+        'Each checkout request must include provider-aware cart items.',
+        400
+      );
+    }
+
+    if (providerNames.length > 1) {
+      return jsonError(
+        'ecommerce.checkout_mixed_provider_steps',
+        'Mixed-provider carts must be checked out in separate steps.',
+        400
+      );
+    }
+
+    const providerName = providerNames[0];
+
+    if (providerName === 'freemius' && items.length !== 1) {
+      return jsonError(
+        'ecommerce.checkout_freemius_single_item',
+        'Freemius items must be checked out one at a time.',
+        400
+      );
+    }
+
+    if (!billingAddress) {
+      return jsonError(
+        'ecommerce.checkout_billing_address_required',
+        'Billing address is required',
+        400
+      );
+    }
+
+    // Preflight: refuse before the provider writes anything. StripeProvider inserts a
+    // pending `orders` row and can burn a coupon redemption BEFORE it ever calls Stripe,
+    // so an unconfigured store used to accumulate failed orders and spent coupons on
+    // every attempt — and the shopper got Stripe's raw "Invalid API Key" string back.
+    const readiness = await getProviderReadiness(providerName);
+    if (!readiness.ready) {
+      console.error(
+        `Checkout blocked: ${readiness.label} is not ready (missing: ${readiness.missing.join(', ') || 'unknown'})`
+      );
+      return jsonError(
+        'ecommerce.checkout_payments_unavailable',
+        'This store is not able to take payments right now. Please contact the seller to complete your purchase.',
+        503
+      );
+    }
+
+    const supabase = createClient();
+    const provider = getPaymentProvider(providerName);
+
+    const { data: { user } } = await supabase.auth.getUser();
+    const userId = user?.id;
+    const resolvedCustomerEmail = user?.email || customerEmail || null;
+
+    const { url, error, errorKey, errorParams, errorStatus, customProps } =
+      await provider.createCheckoutSession({
+      items,
+      customerEmail: resolvedCustomerEmail,
+      customerPhone,
+      userId,
+      billingAddress: normalizeCustomerAddress(billingAddress) ?? billingAddress,
+      shippingAddress:
+        providerName === 'stripe'
+          ? normalizeCustomerAddress(shippingAddress)
+          : null,
+      shippingMethodId: providerName === 'stripe' ? shippingMethodId : null,
+      currencyCode: typeof currencyCode === 'string' ? currencyCode : null,
+      locale: typeof locale === 'string' ? locale : null,
+      couponCode: typeof couponCode === 'string' ? couponCode : null,
+      couponContextItems: Array.isArray(couponContextItems) ? couponContextItems : items,
+    });
+
+    if (error) {
+      console.error('Checkout Error:', error);
+      return NextResponse.json(
+        { error, errorKey, errorParams },
+        { status: errorStatus ?? 500 }
+      );
+    }
+
+    return NextResponse.json({ url, customProps });
+  } catch (err: any) {
+    console.error('Checkout API Error:', err);
+    return jsonError(
+      'ecommerce.checkout_internal_server_error',
+      'Internal Server Error',
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/cron/reset-sandbox/route.ts

@@ -2621,6 +2621,20 @@ async function seedFakeStoreData(sql: SqlClient, supabaseAdmin: any) {
     console.log(`[Sandbox Reset] Created new demo user with ID: ${demoUser.id}`);
   } else {
     console.log(`[Sandbox Reset] Found existing demo user with ID: ${demoUser.id}`);
+    // The demo credentials are published (README + community posts), so any visitor can
+    // change this account's password and lock everyone else out. The SQL reset below does
+    // not touch auth.users, so re-assert the known-good password on every run — otherwise a
+    // single password change survives every future reset.
+    const { error: resetPwError } = await supabaseAdmin.auth.admin.updateUserById(demoUser.id, {
+      password: 'password',
+      email_confirm: true,
+    });
+    if (resetPwError) {
+      // Non-fatal: the rest of the sandbox reset is still worth doing.
+      console.error('[Sandbox Reset] Failed to restore demo password:', resetPwError);
+    } else {
+      console.log('[Sandbox Reset] Restored demo user password to the published default.');
+    }
   }
 
   const userId = demoUser.id;