create-nextblock 0.15.8 → 0.15.9

package/templates/nextblock-template/lib/cms/contact-reminder.ts

@@ -0,0 +1,64 @@
+import 'server-only';
+
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { isPlaceholderEmail, usableEmail } from '../email/placeholder-address';
+import { resolveSellerContactEmail } from '../commerce/seller-contact';
+
+/**
+ * A contact form that appears to work but delivers nowhere.
+ *
+ * The starter content ships a contact page whose form is addressed to
+ * `contact@example.com`. That is the worst kind of default: every layer downstream treats
+ * it as a real setting, the visitor is thanked, the transport accepts the message, and it
+ * is delivered to a domain RFC 2606 reserves so that it can never exist. There is no
+ * error anywhere for the operator to notice — which is exactly how a site runs for months
+ * quietly discarding enquiries.
+ *
+ * Submissions are still recorded as threads, so nothing is actually lost. But the owner
+ * is not being told about them, and they have no way to know that.
+ */
+export interface ContactReminder {
+  /** Forms addressed to a reserved placeholder domain. */
+  placeholderForms: Array<{ formKey: string; label: string; recipient: string }>;
+  /** True when nothing anywhere resolves to a deliverable address. */
+  noFallback: boolean;
+}
+
+export async function getContactReminder(): Promise<ContactReminder | null> {
+  // The sandbox is re-seeded on a schedule, so its placeholder is expected and permanent.
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') return null;
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data: endpoints } = await supabase
+      .from('form_endpoints')
+      .select('form_key, label, recipient_email');
+
+    const placeholderForms = (endpoints ?? [])
+      .filter((endpoint) => isPlaceholderEmail(endpoint.recipient_email))
+      .map((endpoint) => ({
+        formKey: endpoint.form_key,
+        label: endpoint.label || 'Contact form',
+        recipient: endpoint.recipient_email as string,
+      }));
+
+    // Forms with no deliverable address of their own lean on the site-wide ladder.
+    // Whether a missing fallback matters depends entirely on whether anything needs it:
+    // an install whose every form carries its own real address is correctly configured,
+    // and warning it about an empty fallback would be noise.
+    const dependsOnFallback = (endpoints ?? []).some(
+      (endpoint) => !usableEmail(endpoint.recipient_email)
+    );
+
+    const { email: fallback } = await resolveSellerContactEmail();
+    const noFallback = dependsOnFallback && !fallback;
+
+    if (placeholderForms.length === 0 && !noFallback) return null;
+
+    return { placeholderForms, noFallback };
+  } catch {
+    // Never let a reminder break the CMS shell.
+    return null;
+  }
+}

package/templates/nextblock-template/lib/cms/payments-reminder.ts

@@ -0,0 +1,98 @@
+import 'server-only';
+
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+import { getStoreReadiness } from '@nextblock-cms/ecommerce/server';
+
+/**
+ * A store that has commerce switched on but cannot actually take money. This is easy to
+ * end up in — the products, prices and pages all look finished — and the only symptom
+ * used to be a shopper hitting a payment error at checkout. The banner makes the gap
+ * visible in the CMS instead of on the storefront.
+ */
+export interface PaymentsReminder {
+  /** Providers that are not ready, with what each is missing. */
+  blocked: Array<{ provider: 'stripe' | 'freemius'; label: string; missing: string[] }>;
+  /** Published products that currently cannot be bought because of the above. */
+  affectedProducts: number;
+}
+
+/**
+ * Best-effort reminder state for the CMS layout. Returns null (no banner) whenever
+ * nagging would be wrong or the answer can't be determined — an unmigrated database,
+ * an instance without commerce, or the sandbox.
+ */
+export async function getPaymentsReminder(): Promise<PaymentsReminder | null> {
+  // The sandbox refuses to store live credentials at all (savePaymentCredentials throws),
+  // so a "finish setting up payments" nag there is noise the operator cannot act on.
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') return null;
+
+  try {
+    if (!(await verifyPackageOnline('ecommerce'))) return null;
+
+    const supabase = createClient();
+
+    // Only ADMINs can act on this (the /cms/payments route is admin-only), so don't do
+    // the work for anyone else.
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+    if (!user) return null;
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .maybeSingle();
+    if (profile?.role !== 'ADMIN') return null;
+
+    const readiness = await getStoreReadiness();
+    const unready = (['stripe', 'freemius'] as const)
+      .map((provider) => readiness[provider])
+      .filter((entry) => !entry.ready);
+
+    if (unready.length === 0) return null;
+
+    // A provider the store does not sell through is not a problem to be nagged about.
+    // Both providers ship DISABLED (baseline seed), so filtering on readiness alone
+    // would show a permanent "Freemius still needs setting up" banner to every
+    // physical-goods shop that had finished its Stripe setup correctly.
+    //
+    // "In use" means the admin switched the provider on, or the catalogue already
+    // contains products that would need it — counted across ALL statuses, so a shop
+    // building a draft catalogue is warned before it publishes rather than after.
+    const usage = await Promise.all(
+      unready.map(async (entry) => {
+        const [{ count: totalCount }, { count: activeCount }] = await Promise.all([
+          supabase
+            .from('products')
+            .select('id', { count: 'exact', head: true })
+            .eq('payment_provider', entry.provider),
+          supabase
+            .from('products')
+            .select('id', { count: 'exact', head: true })
+            .eq('status', 'active')
+            .eq('payment_provider', entry.provider),
+        ]);
+        return {
+          entry,
+          inUse: entry.enabled || (totalCount ?? 0) > 0,
+          activeProducts: activeCount ?? 0,
+        };
+      })
+    );
+
+    const relevant = usage.filter((item) => item.inUse);
+    if (relevant.length === 0) return null;
+
+    return {
+      blocked: relevant.map(({ entry }) => ({
+        provider: entry.provider,
+        label: entry.label,
+        missing: entry.missing,
+      })),
+      affectedProducts: relevant.reduce((total, item) => total + item.activeProducts, 0),
+    };
+  } catch {
+    // Never let a reminder break the CMS shell.
+    return null;
+  }
+}

package/templates/nextblock-template/lib/cms/unread-messages.ts

@@ -0,0 +1,42 @@
+import 'server-only';
+
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+/**
+ * How many messages want attention, for the CMS nav badge.
+ *
+ * Best-effort in the same shape as the system-alerts loader: any failure — including
+ * the tables not existing yet on an install that has not run migration 27 — resolves to
+ * zero rather than breaking the whole CMS chrome.
+ *
+ * Note the two halves count different things. Threads have a real `unread_for_admin`
+ * flag. Interactions have no per-user read marker anywhere in the schema, so "pending
+ * moderation" stands in for it — which means two admins working the queue see the same
+ * number until one of them acts.
+ */
+export async function getUnreadMessageCount(isAdmin: boolean): Promise<number> {
+  try {
+    let total = 0;
+
+    if (isAdmin) {
+      const service = getServiceRoleSupabaseClient();
+      const { count } = await service
+        .from('message_threads')
+        .select('id', { count: 'exact', head: true })
+        .eq('unread_for_admin', true);
+      total += count ?? 0;
+    }
+
+    const supabase = createClient();
+    const { count: pending } = await supabase
+      .from('cms_interactions')
+      .select('id', { count: 'exact', head: true })
+      .eq('status', 'pending')
+      .is('parent_id', null);
+    total += pending ?? 0;
+
+    return total;
+  } catch {
+    return 0;
+  }
+}

package/templates/nextblock-template/lib/commerce/seller-contact.ts

@@ -0,0 +1,162 @@
+import 'server-only';
+
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { isEmailConfigured } from '../config/email-settings';
+import { isPlaceholderEmail } from '../email/placeholder-address';
+import { getPrivacySettings } from '../privacy/settings';
+
+/**
+ * Where a storefront enquiry should be delivered.
+ *
+ * This address MUST NEVER reach the browser. The public enquiry form posts a product id
+ * and the visitor's own details; the server resolves the destination here. That is the
+ * whole point of the form — a `mailto:` to the shop owner would publish a working inbox
+ * address to every scraper that visits the catalogue.
+ *
+ * Resolution order, most specific first:
+ *   1. The explicit "seller contact email" an ADMIN set in CMS → Payments.
+ *   2. The invoice/merchant email — already the business address printed on invoices.
+ *   3. The privacy/support email from CMS Settings → Privacy (skipping the neutral
+ *      @example.com placeholder that ships with a fresh install).
+ *   4. The oldest ADMIN account's login address, as a last resort so a store that
+ *      configured nothing still reaches a human.
+ *
+ * The sandbox overrides everything: its database is wiped and re-seeded on a schedule,
+ * so any address stored there is dummy data by construction.
+ */
+export const STORE_CONTACT_SETTINGS_KEY = 'store_contact';
+
+export interface SellerContactResolution {
+  email: string | null;
+  /** Which rung of the ladder answered — for CMS diagnostics, never shown publicly. */
+  source: 'sandbox' | 'store_contact' | 'invoice' | 'privacy' | 'first_admin' | 'none';
+}
+
+function clean(value: unknown): string {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+/**
+ * An address is only usable if it can actually receive mail. Seeded @example.com values
+ * look configured to every check downstream while delivering nowhere, so they are
+ * treated as unset and the ladder continues past them.
+ */
+function usable(value: string): boolean {
+  return value.length > 0 && !isPlaceholderEmail(value);
+}
+
+/** The ADMIN-set override, or '' when unset. Safe to render inside the CMS. */
+export async function getStoreContactEmail(): Promise<string> {
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', STORE_CONTACT_SETTINGS_KEY)
+      .maybeSingle();
+    const value = data?.value;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      return clean((value as Record<string, unknown>)['contactEmail']);
+    }
+  } catch {
+    // Unconfigured or unmigrated instance — fall through to the other sources.
+  }
+  return '';
+}
+
+/** Only ever a handful of admins; bounded so a pathological role assignment can't fan out. */
+const MAX_ADMIN_LOOKUPS = 10;
+
+/**
+ * The founding ADMIN's login address. Kept last in the ladder because it mails a
+ * personal account rather than a business address.
+ *
+ * `public.profiles` carries neither an email nor a created_at column, so "oldest" has
+ * to come from auth: read the ADMIN ids, then resolve each one individually. That is
+ * deliberately not `auth.admin.listUsers()`, which would page through every user on the
+ * instance to answer a question about two or three of them.
+ */
+async function getFirstAdminEmail(): Promise<string> {
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data: admins } = await supabase
+      .from('profiles')
+      .select('id')
+      .eq('role', 'ADMIN')
+      .limit(MAX_ADMIN_LOOKUPS);
+
+    if (!admins || admins.length === 0) return '';
+
+    const resolved = await Promise.all(
+      admins.map(async ({ id }) => {
+        const { data } = await supabase.auth.admin.getUserById(id);
+        const email = clean(data?.user?.email);
+        return email ? { email, createdAt: data?.user?.created_at ?? '' } : null;
+      })
+    );
+
+    const candidates = resolved.filter(
+      (entry): entry is { email: string; createdAt: string } => entry !== null
+    );
+    if (candidates.length === 0) return '';
+
+    // Earliest signup wins, so the answer is stable as staff come and go.
+    candidates.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    return candidates[0].email;
+  } catch {
+    return '';
+  }
+}
+
+export async function resolveSellerContactEmail(): Promise<SellerContactResolution> {
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
+    const sandbox = clean(process.env['SANDBOX_CONTACT_EMAIL']);
+    if (sandbox) return { email: sandbox, source: 'sandbox' };
+  }
+
+  const configured = await getStoreContactEmail();
+  if (usable(configured)) return { email: configured, source: 'store_contact' };
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'invoice_settings')
+      .maybeSingle();
+    const value = data?.value;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      const invoiceEmail = clean((value as Record<string, unknown>)['email']);
+      if (usable(invoiceEmail)) return { email: invoiceEmail, source: 'invoice' };
+    }
+  } catch {
+    // Fall through.
+  }
+
+  try {
+    const privacy = await getPrivacySettings();
+    const supportEmail = clean(privacy.corporate.support_email);
+    if (usable(supportEmail)) return { email: supportEmail, source: 'privacy' };
+  } catch {
+    // Fall through.
+  }
+
+  const adminEmail = await getFirstAdminEmail();
+  if (usable(adminEmail)) return { email: adminEmail, source: 'first_admin' };
+
+  return { email: null, source: 'none' };
+}
+
+/**
+ * Whether an enquiry sent right now would actually reach someone by email. Used by the
+ * CMS to warn an admin, and to decide whether a stored enquiry is the only record.
+ * Never exposes the address itself.
+ */
+export async function canNotifySeller(): Promise<boolean> {
+  const [{ email }, smtpReady] = await Promise.all([
+    resolveSellerContactEmail(),
+    isEmailConfigured().catch(() => false),
+  ]);
+  return Boolean(email) && smtpReady;
+}