create-nextblock 0.16.1 → 0.16.3

package/templates/nextblock-template/lib/blocks/inlineScriptNonce.ts

@@ -1,20 +1,20 @@
-/**
- * Stamp the request's CSP nonce onto inline <script> tags inside block HTML.
- *
- * Rich-text blocks may legitimately carry an inline <script> (an editor or Cortex AI
- * adding a small animation or widget). The site's CSP lists a nonce in `script-src`,
- * and per CSP Level 2 a browser IGNORES `'unsafe-inline'` once a nonce or hash is
- * present — so an un-nonced inline script is silently blocked, with no server-side
- * symptom. Adding the nonce is what makes authored JS actually run.
- *
- * Only inline scripts are touched: a `src=` script loads a remote file and is
- * governed by the host allowlist instead, and re-stamping one that already carries a
- * nonce would corrupt it.
- */
-export function addNonceToInlineScripts(html: string, nonce: string): string {
-  if (!html || !nonce) return html || '';
-
-  return html.replace(/<script(?![^>]*\bsrc=)([^>]*)(?<!nonce=["'][^"']*["'])>/gi, (_match, attrs) => {
-    return `<script nonce="${nonce}"${attrs}>`;
-  });
-}
+/**
+ * Stamp the request's CSP nonce onto inline <script> tags inside block HTML.
+ *
+ * Rich-text blocks may legitimately carry an inline <script> (an editor or Cortex AI
+ * adding a small animation or widget). The site's CSP lists a nonce in `script-src`,
+ * and per CSP Level 2 a browser IGNORES `'unsafe-inline'` once a nonce or hash is
+ * present — so an un-nonced inline script is silently blocked, with no server-side
+ * symptom. Adding the nonce is what makes authored JS actually run.
+ *
+ * Only inline scripts are touched: a `src=` script loads a remote file and is
+ * governed by the host allowlist instead, and re-stamping one that already carries a
+ * nonce would corrupt it.
+ */
+export function addNonceToInlineScripts(html: string, nonce: string): string {
+  if (!html || !nonce) return html || '';
+
+  return html.replace(/<script(?![^>]*\bsrc=)([^>]*)(?<!nonce=["'][^"']*["'])>/gi, (_match, attrs) => {
+    return `<script nonce="${nonce}"${attrs}>`;
+  });
+}

package/templates/nextblock-template/lib/cms/contact-reminder.ts

@@ -1,64 +1,64 @@
-import 'server-only';
-
-import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-
-import { isPlaceholderEmail, usableEmail } from '../email/placeholder-address';
-import { resolveSellerContactEmail } from '../commerce/seller-contact';
-
-/**
- * A contact form that appears to work but delivers nowhere.
- *
- * The starter content ships a contact page whose form is addressed to
- * `contact@example.com`. That is the worst kind of default: every layer downstream treats
- * it as a real setting, the visitor is thanked, the transport accepts the message, and it
- * is delivered to a domain RFC 2606 reserves so that it can never exist. There is no
- * error anywhere for the operator to notice — which is exactly how a site runs for months
- * quietly discarding enquiries.
- *
- * Submissions are still recorded as threads, so nothing is actually lost. But the owner
- * is not being told about them, and they have no way to know that.
- */
-export interface ContactReminder {
-  /** Forms addressed to a reserved placeholder domain. */
-  placeholderForms: Array<{ formKey: string; label: string; recipient: string }>;
-  /** True when nothing anywhere resolves to a deliverable address. */
-  noFallback: boolean;
-}
-
-export async function getContactReminder(): Promise<ContactReminder | null> {
-  // The sandbox is re-seeded on a schedule, so its placeholder is expected and permanent.
-  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') return null;
-
-  try {
-    const supabase = getServiceRoleSupabaseClient();
-    const { data: endpoints } = await supabase
-      .from('form_endpoints')
-      .select('form_key, label, recipient_email');
-
-    const placeholderForms = (endpoints ?? [])
-      .filter((endpoint) => isPlaceholderEmail(endpoint.recipient_email))
-      .map((endpoint) => ({
-        formKey: endpoint.form_key,
-        label: endpoint.label || 'Contact form',
-        recipient: endpoint.recipient_email as string,
-      }));
-
-    // Forms with no deliverable address of their own lean on the site-wide ladder.
-    // Whether a missing fallback matters depends entirely on whether anything needs it:
-    // an install whose every form carries its own real address is correctly configured,
-    // and warning it about an empty fallback would be noise.
-    const dependsOnFallback = (endpoints ?? []).some(
-      (endpoint) => !usableEmail(endpoint.recipient_email)
-    );
-
-    const { email: fallback } = await resolveSellerContactEmail();
-    const noFallback = dependsOnFallback && !fallback;
-
-    if (placeholderForms.length === 0 && !noFallback) return null;
-
-    return { placeholderForms, noFallback };
-  } catch {
-    // Never let a reminder break the CMS shell.
-    return null;
-  }
-}
+import 'server-only';
+
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { isPlaceholderEmail, usableEmail } from '../email/placeholder-address';
+import { resolveSellerContactEmail } from '../commerce/seller-contact';
+
+/**
+ * A contact form that appears to work but delivers nowhere.
+ *
+ * The starter content ships a contact page whose form is addressed to
+ * `contact@example.com`. That is the worst kind of default: every layer downstream treats
+ * it as a real setting, the visitor is thanked, the transport accepts the message, and it
+ * is delivered to a domain RFC 2606 reserves so that it can never exist. There is no
+ * error anywhere for the operator to notice — which is exactly how a site runs for months
+ * quietly discarding enquiries.
+ *
+ * Submissions are still recorded as threads, so nothing is actually lost. But the owner
+ * is not being told about them, and they have no way to know that.
+ */
+export interface ContactReminder {
+  /** Forms addressed to a reserved placeholder domain. */
+  placeholderForms: Array<{ formKey: string; label: string; recipient: string }>;
+  /** True when nothing anywhere resolves to a deliverable address. */
+  noFallback: boolean;
+}
+
+export async function getContactReminder(): Promise<ContactReminder | null> {
+  // The sandbox is re-seeded on a schedule, so its placeholder is expected and permanent.
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') return null;
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data: endpoints } = await supabase
+      .from('form_endpoints')
+      .select('form_key, label, recipient_email');
+
+    const placeholderForms = (endpoints ?? [])
+      .filter((endpoint) => isPlaceholderEmail(endpoint.recipient_email))
+      .map((endpoint) => ({
+        formKey: endpoint.form_key,
+        label: endpoint.label || 'Contact form',
+        recipient: endpoint.recipient_email as string,
+      }));
+
+    // Forms with no deliverable address of their own lean on the site-wide ladder.
+    // Whether a missing fallback matters depends entirely on whether anything needs it:
+    // an install whose every form carries its own real address is correctly configured,
+    // and warning it about an empty fallback would be noise.
+    const dependsOnFallback = (endpoints ?? []).some(
+      (endpoint) => !usableEmail(endpoint.recipient_email)
+    );
+
+    const { email: fallback } = await resolveSellerContactEmail();
+    const noFallback = dependsOnFallback && !fallback;
+
+    if (placeholderForms.length === 0 && !noFallback) return null;
+
+    return { placeholderForms, noFallback };
+  } catch {
+    // Never let a reminder break the CMS shell.
+    return null;
+  }
+}

package/templates/nextblock-template/lib/cms/payments-reminder.test.ts

@@ -0,0 +1,135 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+type ProductRow = {
+  product_type: 'physical' | 'digital';
+  status: 'active' | 'draft';
+};
+
+const mocks = vi.hoisted(() => ({
+  getStoreReadiness: vi.fn(),
+  verifyPackageOnline: vi.fn(),
+  products: [] as ProductRow[],
+}));
+
+vi.mock('server-only', () => ({}));
+
+vi.mock('@nextblock-cms/ecommerce/server', () => ({
+  getStoreReadiness: mocks.getStoreReadiness,
+}));
+
+vi.mock('@nextblock-cms/db/server', () => ({
+  verifyPackageOnline: mocks.verifyPackageOnline,
+  createClient: () => ({
+    auth: {
+      getUser: async () => ({ data: { user: { id: 'admin-1' } } }),
+    },
+    from: (table: string) => {
+      if (table === 'profiles') {
+        return {
+          select: () => ({
+            eq: () => ({
+              maybeSingle: async () => ({ data: { role: 'ADMIN' } }),
+            }),
+          }),
+        };
+      }
+
+      if (table === 'products') {
+        return {
+          select: () => {
+            const filters: Array<(product: ProductRow) => boolean> = [];
+            const query = {
+              eq(column: keyof ProductRow, value: string) {
+                filters.push((product) => product[column] === value);
+                return query;
+              },
+              then(onFulfilled: (value: { count: number }) => unknown) {
+                const count = mocks.products.filter((product) =>
+                  filters.every((filter) => filter(product)),
+                ).length;
+                return Promise.resolve({ count }).then(onFulfilled);
+              },
+            };
+            return query;
+          },
+        };
+      }
+
+      throw new Error(`Unexpected table in test: ${table}`);
+    },
+  }),
+}));
+
+import { getPaymentsReminder } from './payments-reminder';
+
+function providerReadiness({
+  stripeReady,
+  freemiusReady,
+}: {
+  stripeReady: boolean;
+  freemiusReady: boolean;
+}) {
+  return {
+    stripe: {
+      provider: 'stripe',
+      label: 'Stripe',
+      enabled: true,
+      hasKeys: stripeReady,
+      ready: stripeReady,
+      missing: stripeReady ? [] : ['Secret key'],
+    },
+    freemius: {
+      provider: 'freemius',
+      label: 'Freemius',
+      enabled: true,
+      hasKeys: freemiusReady,
+      ready: freemiusReady,
+      missing: freemiusReady ? [] : ['Secret key'],
+    },
+  };
+}
+
+describe('CMS payments reminder', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.products.length = 0;
+    mocks.verifyPackageOnline.mockResolvedValue(true);
+  });
+
+  it('ignores an unconfigured Stripe toggle when the store has only digital products', async () => {
+    mocks.products.push({ product_type: 'digital', status: 'active' });
+    mocks.getStoreReadiness.mockResolvedValue(
+      providerReadiness({ stripeReady: false, freemiusReady: true }),
+    );
+
+    await expect(getPaymentsReminder()).resolves.toBeNull();
+  });
+
+  it('warns about Stripe when any physical product needs it', async () => {
+    mocks.products.push({ product_type: 'physical', status: 'draft' });
+    mocks.getStoreReadiness.mockResolvedValue(
+      providerReadiness({ stripeReady: false, freemiusReady: true }),
+    );
+
+    await expect(getPaymentsReminder()).resolves.toEqual({
+      blocked: [
+        { provider: 'stripe', label: 'Stripe', missing: ['Secret key'] },
+      ],
+      affectedProducts: 0,
+    });
+  });
+
+  it('warns about Freemius when a digital product needs it', async () => {
+    mocks.products.push({ product_type: 'digital', status: 'active' });
+    mocks.getStoreReadiness.mockResolvedValue(
+      providerReadiness({ stripeReady: true, freemiusReady: false }),
+    );
+
+    await expect(getPaymentsReminder()).resolves.toEqual({
+      blocked: [
+        { provider: 'freemius', label: 'Freemius', missing: ['Secret key'] },
+      ],
+      affectedProducts: 1,
+    });
+  });
+});

package/templates/nextblock-template/lib/cms/payments-reminder.ts

@@ -11,7 +11,11 @@ import { getStoreReadiness } from '@nextblock-cms/ecommerce/server';
  */
 export interface PaymentsReminder {
   /** Providers that are not ready, with what each is missing. */
-  blocked: Array<{ provider: 'stripe' | 'freemius'; label: string; missing: string[] }>;
+  blocked: Array<{
+    provider: 'stripe' | 'freemius';
+    label: string;
+    missing: string[];
+  }>;
   /** Published products that currently cannot be bought because of the above. */
   affectedProducts: number;
 }
@@ -51,33 +55,33 @@ export async function getPaymentsReminder(): Promise<PaymentsReminder | null> {
 
     if (unready.length === 0) return null;
 
-    // A provider the store does not sell through is not a problem to be nagged about.
-    // Both providers ship DISABLED (baseline seed), so filtering on readiness alone
-    // would show a permanent "Freemius still needs setting up" banner to every
-    // physical-goods shop that had finished its Stripe setup correctly.
-    //
-    // "In use" means the admin switched the provider on, or the catalogue already
-    // contains products that would need it — counted across ALL statuses, so a shop
-    // building a draft catalogue is warned before it publishes rather than after.
+    // A provider matters to this reminder only when the catalogue contains products
+    // of the type routed through it. Do not treat a stale/accidental provider toggle as
+    // usage: that produced a Stripe warning in digital-only stores with no Stripe keys.
+    // Count across ALL statuses so a shop building a draft catalogue is warned before
+    // it publishes rather than after.
     const usage = await Promise.all(
       unready.map(async (entry) => {
-        const [{ count: totalCount }, { count: activeCount }] = await Promise.all([
-          supabase
-            .from('products')
-            .select('id', { count: 'exact', head: true })
-            .eq('payment_provider', entry.provider),
-          supabase
-            .from('products')
-            .select('id', { count: 'exact', head: true })
-            .eq('status', 'active')
-            .eq('payment_provider', entry.provider),
-        ]);
+        const productType =
+          entry.provider === 'stripe' ? 'physical' : 'digital';
+        const [{ count: totalCount }, { count: activeCount }] =
+          await Promise.all([
+            supabase
+              .from('products')
+              .select('id', { count: 'exact', head: true })
+              .eq('product_type', productType),
+            supabase
+              .from('products')
+              .select('id', { count: 'exact', head: true })
+              .eq('status', 'active')
+              .eq('product_type', productType),
+          ]);
         return {
           entry,
-          inUse: entry.enabled || (totalCount ?? 0) > 0,
+          inUse: (totalCount ?? 0) > 0,
           activeProducts: activeCount ?? 0,
         };
-      })
+      }),
     );
 
     const relevant = usage.filter((item) => item.inUse);
@@ -89,7 +93,10 @@ export async function getPaymentsReminder(): Promise<PaymentsReminder | null> {
         label: entry.label,
         missing: entry.missing,
       })),
-      affectedProducts: relevant.reduce((total, item) => total + item.activeProducts, 0),
+      affectedProducts: relevant.reduce(
+        (total, item) => total + item.activeProducts,
+        0,
+      ),
     };
   } catch {
     // Never let a reminder break the CMS shell.

package/templates/nextblock-template/lib/cms/unread-messages.ts

@@ -1,42 +1,42 @@
-import 'server-only';
-
-import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-
-/**
- * How many messages want attention, for the CMS nav badge.
- *
- * Best-effort in the same shape as the system-alerts loader: any failure — including
- * the tables not existing yet on an install that has not run migration 27 — resolves to
- * zero rather than breaking the whole CMS chrome.
- *
- * Note the two halves count different things. Threads have a real `unread_for_admin`
- * flag. Interactions have no per-user read marker anywhere in the schema, so "pending
- * moderation" stands in for it — which means two admins working the queue see the same
- * number until one of them acts.
- */
-export async function getUnreadMessageCount(isAdmin: boolean): Promise<number> {
-  try {
-    let total = 0;
-
-    if (isAdmin) {
-      const service = getServiceRoleSupabaseClient();
-      const { count } = await service
-        .from('message_threads')
-        .select('id', { count: 'exact', head: true })
-        .eq('unread_for_admin', true);
-      total += count ?? 0;
-    }
-
-    const supabase = createClient();
-    const { count: pending } = await supabase
-      .from('cms_interactions')
-      .select('id', { count: 'exact', head: true })
-      .eq('status', 'pending')
-      .is('parent_id', null);
-    total += pending ?? 0;
-
-    return total;
-  } catch {
-    return 0;
-  }
-}
+import 'server-only';
+
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+/**
+ * How many messages want attention, for the CMS nav badge.
+ *
+ * Best-effort in the same shape as the system-alerts loader: any failure — including
+ * the tables not existing yet on an install that has not run migration 27 — resolves to
+ * zero rather than breaking the whole CMS chrome.
+ *
+ * Note the two halves count different things. Threads have a real `unread_for_admin`
+ * flag. Interactions have no per-user read marker anywhere in the schema, so "pending
+ * moderation" stands in for it — which means two admins working the queue see the same
+ * number until one of them acts.
+ */
+export async function getUnreadMessageCount(isAdmin: boolean): Promise<number> {
+  try {
+    let total = 0;
+
+    if (isAdmin) {
+      const service = getServiceRoleSupabaseClient();
+      const { count } = await service
+        .from('message_threads')
+        .select('id', { count: 'exact', head: true })
+        .eq('unread_for_admin', true);
+      total += count ?? 0;
+    }
+
+    const supabase = createClient();
+    const { count: pending } = await supabase
+      .from('cms_interactions')
+      .select('id', { count: 'exact', head: true })
+      .eq('status', 'pending')
+      .is('parent_id', null);
+    total += pending ?? 0;
+
+    return total;
+  } catch {
+    return 0;
+  }
+}