create-nextblock 0.15.8 → 0.15.9

package/templates/nextblock-template/app/cms/inquiries/actions.ts

@@ -0,0 +1,66 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { createClient } from '@nextblock-cms/db/server';
+
+import { STORE_CONTACT_SETTINGS_KEY } from '../../../lib/commerce/seller-contact';
+
+async function assertAdmin() {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) throw new Error('Unauthorized');
+
+  const { data: profile } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (!profile || profile.role !== 'ADMIN') throw new Error('Forbidden');
+}
+
+export interface InquiryActionState {
+  success: boolean;
+  message: string;
+}
+
+/**
+ * Set where storefront enquiries are emailed. Stored in the public settings row — it is
+ * a business address, not a credential — but never rendered to the storefront: the
+ * public form posts a product id and the server resolves the recipient.
+ */
+export async function saveStoreContactEmail(
+  _prevState: unknown,
+  formData: FormData
+): Promise<InquiryActionState> {
+  try {
+    await assertAdmin();
+
+    const contactEmail = String(formData.get('contact_email') ?? '').trim();
+    if (contactEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(contactEmail)) {
+      return { success: false, message: "That doesn't look like a valid email address." };
+    }
+
+    const supabase = createClient();
+    const { error } = await supabase
+      .from('site_settings')
+      .upsert({ key: STORE_CONTACT_SETTINGS_KEY, value: { contactEmail } });
+
+    if (error) {
+      console.error('Error saving store contact email:', error.message);
+      return { success: false, message: 'Could not save the contact address.' };
+    }
+
+    revalidatePath('/cms/inquiries');
+    return {
+      success: true,
+      message: contactEmail
+        ? 'Enquiries will now be sent to that address.'
+        : 'Cleared — enquiries will fall back to your invoice or support address.',
+    };
+  } catch (error) {
+    console.error('saveStoreContactEmail failed:', error);
+    return { success: false, message: 'You do not have permission to change this.' };
+  }
+}

package/templates/nextblock-template/app/cms/inquiries/page.tsx

@@ -0,0 +1,12 @@
+import { redirect } from 'next/navigation';
+
+/**
+ * Product enquiries are a tab of the unified Messages inbox now.
+ *
+ * Kept as a redirect rather than deleted: this path was linked from the CMS nav and may
+ * still be bookmarked, and any stale client bundle will keep routing here until it
+ * reloads.
+ */
+export default function InquiriesRedirect() {
+  redirect('/cms/messages?source=product_inquiry');
+}

package/templates/nextblock-template/app/cms/interactions/page.tsx

@@ -1,51 +1,12 @@
-import { redirect } from "next/navigation";
-import { createClient, getProfileWithRoleServerSide } from "@nextblock-cms/db/server";
-import InteractionsModerationClient from "./InteractionsModerationClient";
-
-export const dynamic = "force-dynamic";
-
-export default async function InteractionsPage() {
-  const supabase = createClient();
-  
-  // 1. Authenticate user
-  const { data: { user } } = await supabase.auth.getUser();
-  if (!user) {
-    redirect("/login?redirect_to=/cms/interactions");
-  }
-
-  // 2. Authorize user (requires ADMIN or WRITER roles to access CMS)
-  const profile = await getProfileWithRoleServerSide(user.id);
-  if (!profile || (profile.role !== "ADMIN" && profile.role !== "WRITER")) {
-    redirect("/cms/dashboard");
-  }
-
-  // 3. Fetch initial interactions (reviews and comments)
-  const { data: interactions, error } = await supabase
-    .from("cms_interactions" as any)
-    .select(`
-      id,
-      type,
-      status,
-      content,
-      rating,
-      reactions,
-      created_at,
-      product_id,
-      post_id,
-      profiles(full_name, avatar_url),
-      products(title, slug),
-      posts(title, slug)
-    `)
-    .order("created_at", { ascending: false });
-
-  if (error) {
-    console.error("Error fetching initial interactions:", error);
-  }
-
-  return (
-    <InteractionsModerationClient
-      initialInteractions={interactions || []}
-      isAdmin={profile.role === "ADMIN"}
-    />
-  );
-}
+import { redirect } from 'next/navigation';
+
+/**
+ * Reviews and comments are tabs of the unified Messages inbox now.
+ *
+ * Kept as a redirect rather than deleted: the "new interaction" notification email
+ * builds a call-to-action link straight to this path, so old mail in an admin's inbox
+ * must keep working.
+ */
+export default function InteractionsRedirect() {
+  redirect('/cms/messages?source=review');
+}

package/templates/nextblock-template/app/cms/layout.tsx

@@ -1,73 +1,101 @@
-import 'katex/dist/katex.min.css';
-import { redirect } from 'next/navigation';
-import { after } from 'next/server';
-import CmsClientLayout from "./CmsClientLayout";
-import { verifyPackageOnline, createClient } from '@nextblock-cms/db/server';
-import { evaluateTwoFactor, getStaffTwoFactorReminder } from '../../lib/auth/twoFactor';
-import { maybeRefreshUpstreamStatus } from '../../lib/updates/check-upstream';
-import type { SystemAlertItem } from './components/SystemAlertsBanner';
-
-/**
- * Unresolved system alerts for the dashboard banner. Runs as the signed-in user, so the
- * system_alerts SELECT RLS policy returns rows only for ADMINs (WRITERs get an empty
- * list). Best-effort: any failure (e.g. the table not yet migrated) yields no banner.
- */
-async function getUnresolvedSystemAlerts(): Promise<SystemAlertItem[]> {
-  try {
-    const supabase = createClient();
-    const { data, error } = await supabase
-      .from('system_alerts')
-      .select('id, alert_type, title, message, metadata')
-      .eq('is_resolved', false)
-      .in('alert_type', ['merge_conflict', 'runtime_update_available'])
-      .order('created_at', { ascending: false })
-      .limit(20);
-    if (error || !data) return [];
-    return data.map((a) => ({
-      id: a.id,
-      alert_type: a.alert_type,
-      title: a.title,
-      message: a.message,
-      metadata: (a.metadata ?? null) as Record<string, unknown> | null,
-    }));
-  } catch {
-    return [];
-  }
-}
-
-export default async function CmsLayout({
-  children,
-}: {
-  children: React.ReactNode;
-}) {
-  // Enforce any outstanding second factor before rendering the CMS. This guards
-  // direct navigation to /cms/* with an aal1 (password-only) session.
-  const twoFactor = await evaluateTwoFactor();
-  if (twoFactor.status === 'totp_required' || twoFactor.status === 'email_required') {
-    redirect('/two-factor?redirect_to=/cms/dashboard');
-  }
-
-  const [isEcommerceActive, isCortexAiActive, showTwoFactorReminder, systemAlerts] =
-    await Promise.all([
-      verifyPackageOnline('ecommerce'),
-      verifyPackageOnline('cortex-ai'),
-      getStaffTwoFactorReminder(),
-      getUnresolvedSystemAlerts(),
-    ]);
-
-  // After the response, refresh upstream update/conflict status in the background
-  // (throttled to ~6h, see maybeRefreshUpstreamStatus). This keeps the banner current
-  // without a cron — so it works on Vercel Hobby (limited crons) and self-hosted alike.
-  after(() => maybeRefreshUpstreamStatus());
-
-  return (
-    <CmsClientLayout
-      isCortexAiActive={isCortexAiActive}
-      isEcommerceActive={isEcommerceActive}
-      showTwoFactorReminder={showTwoFactorReminder}
-      systemAlerts={systemAlerts}
-    >
-      {children}
-    </CmsClientLayout>
-  );
-}
+import 'katex/dist/katex.min.css';
+import { redirect } from 'next/navigation';
+import { after } from 'next/server';
+import CmsClientLayout from "./CmsClientLayout";
+import { verifyPackageOnline, createClient } from '@nextblock-cms/db/server';
+import { evaluateTwoFactor, getStaffTwoFactorReminder } from '../../lib/auth/twoFactor';
+import { maybeRefreshUpstreamStatus } from '../../lib/updates/check-upstream';
+import { getPaymentsReminder } from '../../lib/cms/payments-reminder';
+import { getUnreadMessageCount } from '../../lib/cms/unread-messages';
+import { getContactReminder } from '../../lib/cms/contact-reminder';
+import type { SystemAlertItem } from './components/SystemAlertsBanner';
+
+/**
+ * Unresolved system alerts for the dashboard banner. Runs as the signed-in user, so the
+ * system_alerts SELECT RLS policy returns rows only for ADMINs (WRITERs get an empty
+ * list). Best-effort: any failure (e.g. the table not yet migrated) yields no banner.
+ */
+async function getUnresolvedSystemAlerts(): Promise<SystemAlertItem[]> {
+  try {
+    const supabase = createClient();
+    const { data, error } = await supabase
+      .from('system_alerts')
+      .select('id, alert_type, title, message, metadata')
+      .eq('is_resolved', false)
+      .in('alert_type', ['merge_conflict', 'runtime_update_available'])
+      .order('created_at', { ascending: false })
+      .limit(20);
+    if (error || !data) return [];
+    return data.map((a) => ({
+      id: a.id,
+      alert_type: a.alert_type,
+      title: a.title,
+      message: a.message,
+      metadata: (a.metadata ?? null) as Record<string, unknown> | null,
+    }));
+  } catch {
+    return [];
+  }
+}
+
+export default async function CmsLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  // Enforce any outstanding second factor before rendering the CMS. This guards
+  // direct navigation to /cms/* with an aal1 (password-only) session.
+  const twoFactor = await evaluateTwoFactor();
+  if (twoFactor.status === 'totp_required' || twoFactor.status === 'email_required') {
+    redirect('/two-factor?redirect_to=/cms/dashboard');
+  }
+
+  const supabaseForRole = createClient();
+  const {
+    data: { user: cmsUser },
+  } = await supabaseForRole.auth.getUser();
+  const { data: cmsProfile } = cmsUser
+    ? await supabaseForRole.from('profiles').select('role').eq('id', cmsUser.id).maybeSingle()
+    : { data: null };
+  const isAdmin = cmsProfile?.role === 'ADMIN';
+
+  const [
+    isEcommerceActive,
+    isCortexAiActive,
+    showTwoFactorReminder,
+    systemAlerts,
+    paymentsReminder,
+    messagesUnread,
+    contactReminder,
+  ] =
+    await Promise.all([
+      verifyPackageOnline('ecommerce'),
+      verifyPackageOnline('cortex-ai'),
+      getStaffTwoFactorReminder(),
+      getUnresolvedSystemAlerts(),
+      // Re-checks ecommerce activation itself; verifyPackageOnline is unstable_cache'd
+      // for 60s, so the second call costs nothing.
+      getPaymentsReminder(),
+      getUnreadMessageCount(isAdmin),
+      isAdmin ? getContactReminder() : Promise.resolve(null),
+    ]);
+
+  // After the response, refresh upstream update/conflict status in the background
+  // (throttled to ~6h, see maybeRefreshUpstreamStatus). This keeps the banner current
+  // without a cron — so it works on Vercel Hobby (limited crons) and self-hosted alike.
+  after(() => maybeRefreshUpstreamStatus());
+
+  return (
+    <CmsClientLayout
+      isCortexAiActive={isCortexAiActive}
+      isEcommerceActive={isEcommerceActive}
+      showTwoFactorReminder={showTwoFactorReminder}
+      systemAlerts={systemAlerts}
+      paymentsReminder={paymentsReminder}
+      messagesUnread={messagesUnread}
+      contactReminder={contactReminder}
+    >
+      {children}
+    </CmsClientLayout>
+  );
+}