create-nextblock 0.16.1 → 0.16.3

package/templates/nextblock-template/app/api/media/record/route.ts

@@ -1,160 +1,160 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { revalidatePath } from 'next/cache';
-import { createClient } from '@nextblock-cms/db/server';
-import type { Database } from '@nextblock-cms/db';
-
-type Media = Database['public']['Tables']['media']['Row'];
-
-type ImageVariant = {
-  objectKey: string;
-  url?: string;
-  width?: number;
-  height?: number;
-  fileType?: string;
-  sizeBytes?: number;
-  variantLabel?: string;
-};
-
-type RecordMediaPayload = {
-  fileName?: string;
-  description?: string | null;
-  r2OriginalKey?: string;
-  r2Variants?: ImageVariant[];
-  originalImageDetails?: ImageVariant | null;
-  blurDataUrl?: string | null;
-  blurDataURL?: string | null;
-};
-
-function deriveAltFromFilename(name: string) {
-  const lastDot = name.lastIndexOf('.');
-  const base = lastDot > 0 ? name.substring(0, lastDot) : name;
-  const spaced = base.replace(/[-+_\\]+/g, ' ').replace(/\s+/g, ' ').trim();
-  return spaced.replace(/\b\w+/g, (word) => word.charAt(0).toUpperCase() + word.slice(1));
-}
-
-function buildFallbackVariant(payload: RecordMediaPayload): Required<ImageVariant> {
-  return {
-    objectKey: payload.r2OriginalKey || '',
-    url: '',
-    width: 0,
-    height: 0,
-    fileType: 'application/octet-stream',
-    sizeBytes: 0,
-    variantLabel: 'fallback_original',
-  };
-}
-
-export async function POST(request: NextRequest) {
-  try {
-    const payload = (await request.json()) as RecordMediaPayload;
-
-    if (!payload.fileName || !payload.r2OriginalKey) {
-      return NextResponse.json(
-        { error: 'Missing required media payload fields.' },
-        { status: 400 }
-      );
-    }
-
-    const supabase = createClient();
-    const {
-      data: { user },
-      error: authError,
-    } = await supabase.auth.getUser();
-
-    if (authError || !user) {
-      return NextResponse.json({ error: 'User not authenticated.' }, { status: 401 });
-    }
-
-    const { data: profile } = await supabase
-      .from('profiles')
-      .select('role')
-      .eq('id', user.id)
-      .single();
-
-    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
-      return NextResponse.json(
-        { error: 'Forbidden: Insufficient permissions to record media.' },
-        { status: 403 }
-      );
-    }
-
-    const variants = payload.r2Variants || [];
-    let primaryVariant =
-      variants.find((variant) => variant.variantLabel === 'original_avif') ||
-      variants.find((variant) => variant.variantLabel === 'xlarge_avif') ||
-      variants[0] ||
-      payload.originalImageDetails ||
-      buildFallbackVariant(payload);
-
-    if (!primaryVariant.objectKey) {
-      primaryVariant = buildFallbackVariant(payload);
-    }
-
-    const originalVariant = payload.originalImageDetails;
-    const allVariantsToStore = [
-      ...(originalVariant && originalVariant.objectKey !== primaryVariant.objectKey
-        ? [originalVariant]
-        : []),
-      ...variants,
-    ].filter(
-      (variant, index, self) =>
-        Boolean(variant?.objectKey) &&
-        index === self.findIndex((entry) => entry.objectKey === variant.objectKey)
-    );
-
-    const computedDescription =
-      payload.description ??
-      ((primaryVariant.fileType?.startsWith('image/') ||
-        originalVariant?.fileType?.startsWith('image/'))
-        ? deriveAltFromFilename(payload.fileName)
-        : null);
-
-    const objectKey = primaryVariant.objectKey.replace(/^\/+/, '');
-    const folderMatch = objectKey.match(/^(.*\/)?.*$/);
-    const folder = folderMatch && folderMatch[1] ? folderMatch[1] : null;
-
-    const mediaData: Omit<Media, 'id' | 'created_at' | 'updated_at'> & {
-      uploader_id: string;
-    } = {
-      uploader_id: user.id,
-      file_name: payload.fileName,
-      object_key: objectKey,
-      file_path: objectKey,
-      folder,
-      file_type: primaryVariant.fileType || 'application/octet-stream',
-      size_bytes: primaryVariant.sizeBytes || 0,
-      description: computedDescription,
-      width: primaryVariant.width || 0,
-      height: primaryVariant.height || 0,
-      variants: allVariantsToStore as any,
-      blur_data_url: payload.blurDataUrl ?? payload.blurDataURL ?? null,
-    };
-
-    const { data: newMedia, error } = await supabase
-      .from('media')
-      .insert(mediaData)
-      .select()
-      .single();
-
-    if (error) {
-      console.error('Error recording media upload:', error);
-      return NextResponse.json(
-        { error: `Failed to record media: ${error.message}` },
-        { status: 500 }
-      );
-    }
-
-    revalidatePath('/cms/media');
-
-    return NextResponse.json(
-      { success: true, data: newMedia as Media },
-      { status: 201 }
-    );
-  } catch (error) {
-    console.error('Unexpected error recording media upload:', error);
-    return NextResponse.json(
-      { error: 'Unexpected error while recording media.' },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { createClient } from '@nextblock-cms/db/server';
+import type { Database } from '@nextblock-cms/db';
+
+type Media = Database['public']['Tables']['media']['Row'];
+
+type ImageVariant = {
+  objectKey: string;
+  url?: string;
+  width?: number;
+  height?: number;
+  fileType?: string;
+  sizeBytes?: number;
+  variantLabel?: string;
+};
+
+type RecordMediaPayload = {
+  fileName?: string;
+  description?: string | null;
+  r2OriginalKey?: string;
+  r2Variants?: ImageVariant[];
+  originalImageDetails?: ImageVariant | null;
+  blurDataUrl?: string | null;
+  blurDataURL?: string | null;
+};
+
+function deriveAltFromFilename(name: string) {
+  const lastDot = name.lastIndexOf('.');
+  const base = lastDot > 0 ? name.substring(0, lastDot) : name;
+  const spaced = base.replace(/[-+_\\]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return spaced.replace(/\b\w+/g, (word) => word.charAt(0).toUpperCase() + word.slice(1));
+}
+
+function buildFallbackVariant(payload: RecordMediaPayload): Required<ImageVariant> {
+  return {
+    objectKey: payload.r2OriginalKey || '',
+    url: '',
+    width: 0,
+    height: 0,
+    fileType: 'application/octet-stream',
+    sizeBytes: 0,
+    variantLabel: 'fallback_original',
+  };
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const payload = (await request.json()) as RecordMediaPayload;
+
+    if (!payload.fileName || !payload.r2OriginalKey) {
+      return NextResponse.json(
+        { error: 'Missing required media payload fields.' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'User not authenticated.' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions to record media.' },
+        { status: 403 }
+      );
+    }
+
+    const variants = payload.r2Variants || [];
+    let primaryVariant =
+      variants.find((variant) => variant.variantLabel === 'original_avif') ||
+      variants.find((variant) => variant.variantLabel === 'xlarge_avif') ||
+      variants[0] ||
+      payload.originalImageDetails ||
+      buildFallbackVariant(payload);
+
+    if (!primaryVariant.objectKey) {
+      primaryVariant = buildFallbackVariant(payload);
+    }
+
+    const originalVariant = payload.originalImageDetails;
+    const allVariantsToStore = [
+      ...(originalVariant && originalVariant.objectKey !== primaryVariant.objectKey
+        ? [originalVariant]
+        : []),
+      ...variants,
+    ].filter(
+      (variant, index, self) =>
+        Boolean(variant?.objectKey) &&
+        index === self.findIndex((entry) => entry.objectKey === variant.objectKey)
+    );
+
+    const computedDescription =
+      payload.description ??
+      ((primaryVariant.fileType?.startsWith('image/') ||
+        originalVariant?.fileType?.startsWith('image/'))
+        ? deriveAltFromFilename(payload.fileName)
+        : null);
+
+    const objectKey = primaryVariant.objectKey.replace(/^\/+/, '');
+    const folderMatch = objectKey.match(/^(.*\/)?.*$/);
+    const folder = folderMatch && folderMatch[1] ? folderMatch[1] : null;
+
+    const mediaData: Omit<Media, 'id' | 'created_at' | 'updated_at'> & {
+      uploader_id: string;
+    } = {
+      uploader_id: user.id,
+      file_name: payload.fileName,
+      object_key: objectKey,
+      file_path: objectKey,
+      folder,
+      file_type: primaryVariant.fileType || 'application/octet-stream',
+      size_bytes: primaryVariant.sizeBytes || 0,
+      description: computedDescription,
+      width: primaryVariant.width || 0,
+      height: primaryVariant.height || 0,
+      variants: allVariantsToStore as any,
+      blur_data_url: payload.blurDataUrl ?? payload.blurDataURL ?? null,
+    };
+
+    const { data: newMedia, error } = await supabase
+      .from('media')
+      .insert(mediaData)
+      .select()
+      .single();
+
+    if (error) {
+      console.error('Error recording media upload:', error);
+      return NextResponse.json(
+        { error: `Failed to record media: ${error.message}` },
+        { status: 500 }
+      );
+    }
+
+    revalidatePath('/cms/media');
+
+    return NextResponse.json(
+      { success: true, data: newMedia as Media },
+      { status: 201 }
+    );
+  } catch (error) {
+    console.error('Unexpected error recording media upload:', error);
+    return NextResponse.json(
+      { error: 'Unexpected error while recording media.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/search/route.ts

@@ -1,43 +1,43 @@
-import { NextResponse, type NextRequest } from 'next/server';
-import { searchPublicContent } from '../../../lib/search/server';
-import type { GlobalSearchFilter } from '../../../lib/search/types';
-
-export const dynamic = 'force-dynamic';
-
-const VALID_FILTERS = new Set<GlobalSearchFilter>(['all', 'page', 'post', 'product']);
-
-function readFilter(value: string | null): GlobalSearchFilter {
-  return VALID_FILTERS.has(value as GlobalSearchFilter)
-    ? (value as GlobalSearchFilter)
-    : 'all';
-}
-
-export async function GET(request: NextRequest) {
-  const { searchParams } = new URL(request.url);
-  const q = searchParams.get('q') || '';
-  const locale = searchParams.get('locale');
-  const filter = readFilter(searchParams.get('type'));
-  const limit = Number.parseInt(searchParams.get('limit') || '', 10);
-
-  try {
-    const response = await searchPublicContent({
-      query: q,
-      locale,
-      filter,
-      limit: Number.isFinite(limit) ? limit : undefined,
-    });
-
-    return NextResponse.json(response);
-  } catch (error) {
-    console.error('Global search failed:', error);
-    return NextResponse.json(
-      {
-        query: q,
-        results: [],
-        counts: { all: 0, page: 0, post: 0, product: 0 },
-        error: 'Search failed',
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse, type NextRequest } from 'next/server';
+import { searchPublicContent } from '../../../lib/search/server';
+import type { GlobalSearchFilter } from '../../../lib/search/types';
+
+export const dynamic = 'force-dynamic';
+
+const VALID_FILTERS = new Set<GlobalSearchFilter>(['all', 'page', 'post', 'product']);
+
+function readFilter(value: string | null): GlobalSearchFilter {
+  return VALID_FILTERS.has(value as GlobalSearchFilter)
+    ? (value as GlobalSearchFilter)
+    : 'all';
+}
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const q = searchParams.get('q') || '';
+  const locale = searchParams.get('locale');
+  const filter = readFilter(searchParams.get('type'));
+  const limit = Number.parseInt(searchParams.get('limit') || '', 10);
+
+  try {
+    const response = await searchPublicContent({
+      query: q,
+      locale,
+      filter,
+      limit: Number.isFinite(limit) ? limit : undefined,
+    });
+
+    return NextResponse.json(response);
+  } catch (error) {
+    console.error('Global search failed:', error);
+    return NextResponse.json(
+      {
+        query: q,
+        results: [],
+        counts: { all: 0, page: 0, post: 0, product: 0 },
+        error: 'Search failed',
+      },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/view/route.ts

@@ -1,114 +1,114 @@
-import { draftMode } from "next/headers";
-import { NextRequest, NextResponse } from "next/server";
-import { getCurrentUserCanEdit } from "../../../lib/visual-editing/draft-content";
-import {
-  normalizeDraftRedirectPath,
-  resolveDraftPathTarget,
-  resolveRequestOrigin,
-} from "../../../lib/visual-editing/draft-route";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-/**
- * Entry point behind the CMS "Preview" and "View Live" buttons.
- *
- * The public site carries no locale in its URLs: `/[slug]`, `/article/[slug]`,
- * `/product/[slug]` and `/` all resolve their language per-request from the
- * `NEXT_USER_LOCALE` cookie (see proxy.ts). A link built from the slug alone
- * therefore renders in whatever language the *editor's own* cookie says — which,
- * for an admin working in the CMS, is almost always the default one. Opening the
- * French version of a page landed you on the English one, three different ways:
- *
- *   1. `getPageDataBySlug(slug, cookieLocale)` prefers the row matching the
- *      cookie, so when two translations share a slug the cookie's language wins.
- *   2. `PageClientContent` / `PostClientContent` navigate to
- *      `translatedSlugs[currentLocale]` whenever the rendered row's language
- *      differs from the cookie — bouncing distinct French slugs back to English.
- *   3. `/` (the homepage) resolves its language from the cookie with no slug to
- *      go on at all, so the French homepage was unreachable by URL.
- *
- * Pinning the locale here fixes all three at once, because after the redirect the
- * cookie *agrees* with the content: the server picks the right row, the client
- * effect is a no-op, and the surrounding chrome (nav, footer, UI strings) renders
- * in the same language as the body — so the preview isn't lying about the page.
- *
- * The alternative, a `?lang=` param read by each route, would leave a second
- * cacheable variant of every public URL behind and can leak into shares and
- * search indexes as duplicate content. The redirect lands on the clean canonical
- * URL instead, and the param never reaches the public route.
- */
-
-const LANGUAGE_COOKIE_KEY = "NEXT_USER_LOCALE";
-
-function redirectNoStore(url: URL) {
-  const response = NextResponse.redirect(url);
-  response.headers.set("Cache-Control", "no-store");
-  return response;
-}
-
-function redirectToSignIn(request: NextRequest, search: string) {
-  const origin = resolveRequestOrigin(request);
-  const signInUrl = new URL("/sign-in", origin);
-  signInUrl.searchParams.set("redirect", `${request.nextUrl.pathname}${search}`);
-  return redirectNoStore(signInUrl);
-}
-
-export async function GET(request: NextRequest) {
-  const params = request.nextUrl.searchParams;
-  const normalizedPath = normalizeDraftRedirectPath(params.get("path") ?? "/");
-
-  if (!normalizedPath) {
-    return NextResponse.json({ error: "Invalid path." }, { status: 400 });
-  }
-
-  const target = resolveDraftPathTarget(normalizedPath);
-  if (!target) {
-    return NextResponse.json({ error: "Unsupported target path." }, { status: 400 });
-  }
-
-  const wantsDraft = params.get("draft") === "1";
-
-  const auth = await getCurrentUserCanEdit();
-  if (!auth.user) {
-    return redirectToSignIn(request, request.nextUrl.search);
-  }
-  if (!auth.canEdit) {
-    return NextResponse.json(
-      { error: "You do not have permission to preview content." },
-      { status: 403 },
-    );
-  }
-
-  // Only ever write a language the CMS actually has configured — the value lands
-  // in a cookie every public request reads, so it must not be attacker-supplied.
-  let locale: string | null = null;
-  const requestedLang = params.get("lang")?.trim();
-  if (requestedLang) {
-    const { data: language } = await (auth.supabase as any)
-      .from("languages")
-      .select("code")
-      .eq("code", requestedLang)
-      .maybeSingle();
-    locale = (language as { code?: string } | null)?.code ?? null;
-  }
-
-  if (wantsDraft) {
-    const draft = await draftMode();
-    draft.enable();
-  }
-
-  const response = redirectNoStore(new URL(target.path, resolveRequestOrigin(request)));
-
-  if (locale) {
-    // Session-scoped on purpose: previewing French shouldn't pin the editor's own
-    // browsing language for a year. The proxy leaves a matching cookie alone, so
-    // this survives the preview and expires with the browser session.
-    response.cookies.set(LANGUAGE_COOKIE_KEY, locale, {
-      path: "/",
-      sameSite: "lax",
-    });
-  }
-
-  return response;
-}
+import { draftMode } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUserCanEdit } from "../../../lib/visual-editing/draft-content";
+import {
+  normalizeDraftRedirectPath,
+  resolveDraftPathTarget,
+  resolveRequestOrigin,
+} from "../../../lib/visual-editing/draft-route";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Entry point behind the CMS "Preview" and "View Live" buttons.
+ *
+ * The public site carries no locale in its URLs: `/[slug]`, `/article/[slug]`,
+ * `/product/[slug]` and `/` all resolve their language per-request from the
+ * `NEXT_USER_LOCALE` cookie (see proxy.ts). A link built from the slug alone
+ * therefore renders in whatever language the *editor's own* cookie says — which,
+ * for an admin working in the CMS, is almost always the default one. Opening the
+ * French version of a page landed you on the English one, three different ways:
+ *
+ *   1. `getPageDataBySlug(slug, cookieLocale)` prefers the row matching the
+ *      cookie, so when two translations share a slug the cookie's language wins.
+ *   2. `PageClientContent` / `PostClientContent` navigate to
+ *      `translatedSlugs[currentLocale]` whenever the rendered row's language
+ *      differs from the cookie — bouncing distinct French slugs back to English.
+ *   3. `/` (the homepage) resolves its language from the cookie with no slug to
+ *      go on at all, so the French homepage was unreachable by URL.
+ *
+ * Pinning the locale here fixes all three at once, because after the redirect the
+ * cookie *agrees* with the content: the server picks the right row, the client
+ * effect is a no-op, and the surrounding chrome (nav, footer, UI strings) renders
+ * in the same language as the body — so the preview isn't lying about the page.
+ *
+ * The alternative, a `?lang=` param read by each route, would leave a second
+ * cacheable variant of every public URL behind and can leak into shares and
+ * search indexes as duplicate content. The redirect lands on the clean canonical
+ * URL instead, and the param never reaches the public route.
+ */
+
+const LANGUAGE_COOKIE_KEY = "NEXT_USER_LOCALE";
+
+function redirectNoStore(url: URL) {
+  const response = NextResponse.redirect(url);
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}
+
+function redirectToSignIn(request: NextRequest, search: string) {
+  const origin = resolveRequestOrigin(request);
+  const signInUrl = new URL("/sign-in", origin);
+  signInUrl.searchParams.set("redirect", `${request.nextUrl.pathname}${search}`);
+  return redirectNoStore(signInUrl);
+}
+
+export async function GET(request: NextRequest) {
+  const params = request.nextUrl.searchParams;
+  const normalizedPath = normalizeDraftRedirectPath(params.get("path") ?? "/");
+
+  if (!normalizedPath) {
+    return NextResponse.json({ error: "Invalid path." }, { status: 400 });
+  }
+
+  const target = resolveDraftPathTarget(normalizedPath);
+  if (!target) {
+    return NextResponse.json({ error: "Unsupported target path." }, { status: 400 });
+  }
+
+  const wantsDraft = params.get("draft") === "1";
+
+  const auth = await getCurrentUserCanEdit();
+  if (!auth.user) {
+    return redirectToSignIn(request, request.nextUrl.search);
+  }
+  if (!auth.canEdit) {
+    return NextResponse.json(
+      { error: "You do not have permission to preview content." },
+      { status: 403 },
+    );
+  }
+
+  // Only ever write a language the CMS actually has configured — the value lands
+  // in a cookie every public request reads, so it must not be attacker-supplied.
+  let locale: string | null = null;
+  const requestedLang = params.get("lang")?.trim();
+  if (requestedLang) {
+    const { data: language } = await (auth.supabase as any)
+      .from("languages")
+      .select("code")
+      .eq("code", requestedLang)
+      .maybeSingle();
+    locale = (language as { code?: string } | null)?.code ?? null;
+  }
+
+  if (wantsDraft) {
+    const draft = await draftMode();
+    draft.enable();
+  }
+
+  const response = redirectNoStore(new URL(target.path, resolveRequestOrigin(request)));
+
+  if (locale) {
+    // Session-scoped on purpose: previewing French shouldn't pin the editor's own
+    // browsing language for a year. The proxy leaves a matching cookie alone, so
+    // this survives the preview and expires with the browser session.
+    response.cookies.set(LANGUAGE_COOKIE_KEY, locale, {
+      path: "/",
+      sameSite: "lax",
+    });
+  }
+
+  return response;
+}