create-nextblock 0.16.3 → 0.17.0

package/templates/nextblock-template/lib/custom-block-r2-upload-shared.ts

@@ -1,178 +1,178 @@
-import { randomUUID } from 'node:crypto';
-
-export const R2_PRESIGNED_UPLOAD_MAX_BYTES = 10 * 1024 * 1024;
-export const R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS = 300;
-export const R2_PRESIGNED_UPLOAD_DEFAULT_FOLDER = 'custom-blocks';
-
-export const R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES = [
-  'image/avif',
-  'image/gif',
-  'image/jpeg',
-  'image/png',
-  'image/webp',
-] as const;
-
-const EXTENSION_BY_CONTENT_TYPE: Record<
-  (typeof R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES)[number],
-  string
-> = {
-  'image/avif': 'avif',
-  'image/gif': 'gif',
-  'image/jpeg': 'jpg',
-  'image/png': 'png',
-  'image/webp': 'webp',
-};
-
-type R2PresignedUploadPayload = {
-  contentType?: unknown;
-  filename?: unknown;
-  folder?: unknown;
-  size?: unknown;
-};
-
-export type ValidR2PresignedUploadPayload = {
-  contentType: (typeof R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES)[number];
-  filename: string;
-  folder: string;
-  size: number;
-};
-
-export type R2PresignedUploadResult = {
-  expiresIn: number;
-  headers: Record<string, string>;
-  method: 'PUT';
-  objectKey: string;
-  presignedUrl: string;
-  publicUrl: string;
-  uploadUrl: string;
-};
-
-export class R2PresignedUploadError extends Error {
-  constructor(message: string, public readonly status = 400) {
-    super(message);
-    this.name = 'R2PresignedUploadError';
-  }
-}
-
-function isAllowedContentType(
-  contentType: string
-): contentType is ValidR2PresignedUploadPayload['contentType'] {
-  return R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES.includes(
-    contentType as ValidR2PresignedUploadPayload['contentType']
-  );
-}
-
-export function sanitizeR2UploadFolder(input?: unknown) {
-  const raw = typeof input === 'string' ? input.trim() : '';
-  const fallback = R2_PRESIGNED_UPLOAD_DEFAULT_FOLDER;
-  const normalized = (raw || fallback).replace(/\\/g, '/').replace(/^\/+/, '');
-  const segments = normalized
-    .split('/')
-    .map((segment) =>
-      segment
-        .trim()
-        .replace(/\.{2,}/g, '')
-        .replace(/[^a-zA-Z0-9_.-]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-    )
-    .filter((segment) => segment && segment !== '.' && segment !== '..');
-
-  const folder = segments.join('/') || fallback;
-  return folder.endsWith('/') ? folder : `${folder}/`;
-}
-
-function sanitizeFilenameBase(filename: string) {
-  const lastDotIndex = filename.lastIndexOf('.');
-  const base = lastDotIndex > 0 ? filename.slice(0, lastDotIndex) : filename;
-  const sanitized = base
-    .toLowerCase()
-    .replace(/\s+/g, '-')
-    .replace(/[^a-z0-9_.-]+/g, '')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 120);
-
-  return sanitized || 'asset';
-}
-
-function getFileExtension(
-  filename: string,
-  contentType: ValidR2PresignedUploadPayload['contentType']
-) {
-  const lastDotIndex = filename.lastIndexOf('.');
-  const extension = lastDotIndex > 0 ? filename.slice(lastDotIndex + 1).toLowerCase() : '';
-  const normalizedExtension = extension.replace(/[^a-z0-9]+/g, '');
-  const expectedExtension = EXTENSION_BY_CONTENT_TYPE[contentType];
-
-  if (!normalizedExtension) {
-    return expectedExtension;
-  }
-
-  if (['jpeg', 'jpg'].includes(normalizedExtension) && contentType === 'image/jpeg') {
-    return normalizedExtension;
-  }
-
-  return normalizedExtension === expectedExtension ? normalizedExtension : expectedExtension;
-}
-
-function formatUploadTimestamp(date: Date) {
-  const parts = [
-    date.getUTCFullYear(),
-    `${date.getUTCMonth() + 1}`.padStart(2, '0'),
-    `${date.getUTCDate()}`.padStart(2, '0'),
-    `${date.getUTCHours()}`.padStart(2, '0'),
-    `${date.getUTCMinutes()}`.padStart(2, '0'),
-    `${date.getUTCSeconds()}`.padStart(2, '0'),
-    `${date.getUTCMilliseconds()}`.padStart(3, '0'),
-  ];
-
-  return parts.join('');
-}
-
-export function validateR2PresignedUploadPayload(
-  payload: R2PresignedUploadPayload
-): ValidR2PresignedUploadPayload {
-  const filename = typeof payload.filename === 'string' ? payload.filename.trim() : '';
-  const contentType =
-    typeof payload.contentType === 'string' ? payload.contentType.trim().toLowerCase() : '';
-  const size =
-    typeof payload.size === 'number'
-      ? payload.size
-      : typeof payload.size === 'string'
-        ? Number(payload.size)
-        : Number.NaN;
-
-  if (!filename || filename.length > 255) {
-    throw new R2PresignedUploadError('A valid filename is required.');
-  }
-
-  if (!isAllowedContentType(contentType)) {
-    throw new R2PresignedUploadError('Only AVIF, GIF, JPEG, PNG, and WebP images are supported.');
-  }
-
-  if (!Number.isInteger(size) || size <= 0) {
-    throw new R2PresignedUploadError('A positive file size is required.');
-  }
-
-  if (size > R2_PRESIGNED_UPLOAD_MAX_BYTES) {
-    throw new R2PresignedUploadError('Image uploads are limited to 10 MB.');
-  }
-
-  return {
-    contentType,
-    filename,
-    folder: sanitizeR2UploadFolder(payload.folder),
-    size,
-  };
-}
-
-export function buildR2UploadObjectKey(
-  payload: ValidR2PresignedUploadPayload,
-  options: { now?: Date; nonce?: string } = {}
-) {
-  const base = sanitizeFilenameBase(payload.filename);
-  const extension = getFileExtension(payload.filename, payload.contentType);
-  const timestamp = formatUploadTimestamp(options.now ?? new Date());
-  const nonce = (options.nonce ?? randomUUID().slice(0, 8)).replace(/[^a-zA-Z0-9-]/g, '');
-
-  return `${payload.folder}${base}-${timestamp}-${nonce}.${extension}`;
-}
+import { randomUUID } from 'node:crypto';
+
+export const R2_PRESIGNED_UPLOAD_MAX_BYTES = 10 * 1024 * 1024;
+export const R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS = 300;
+export const R2_PRESIGNED_UPLOAD_DEFAULT_FOLDER = 'custom-blocks';
+
+export const R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES = [
+  'image/avif',
+  'image/gif',
+  'image/jpeg',
+  'image/png',
+  'image/webp',
+] as const;
+
+const EXTENSION_BY_CONTENT_TYPE: Record<
+  (typeof R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES)[number],
+  string
+> = {
+  'image/avif': 'avif',
+  'image/gif': 'gif',
+  'image/jpeg': 'jpg',
+  'image/png': 'png',
+  'image/webp': 'webp',
+};
+
+type R2PresignedUploadPayload = {
+  contentType?: unknown;
+  filename?: unknown;
+  folder?: unknown;
+  size?: unknown;
+};
+
+export type ValidR2PresignedUploadPayload = {
+  contentType: (typeof R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES)[number];
+  filename: string;
+  folder: string;
+  size: number;
+};
+
+export type R2PresignedUploadResult = {
+  expiresIn: number;
+  headers: Record<string, string>;
+  method: 'PUT';
+  objectKey: string;
+  presignedUrl: string;
+  publicUrl: string;
+  uploadUrl: string;
+};
+
+export class R2PresignedUploadError extends Error {
+  constructor(message: string, public readonly status = 400) {
+    super(message);
+    this.name = 'R2PresignedUploadError';
+  }
+}
+
+function isAllowedContentType(
+  contentType: string
+): contentType is ValidR2PresignedUploadPayload['contentType'] {
+  return R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES.includes(
+    contentType as ValidR2PresignedUploadPayload['contentType']
+  );
+}
+
+export function sanitizeR2UploadFolder(input?: unknown) {
+  const raw = typeof input === 'string' ? input.trim() : '';
+  const fallback = R2_PRESIGNED_UPLOAD_DEFAULT_FOLDER;
+  const normalized = (raw || fallback).replace(/\\/g, '/').replace(/^\/+/, '');
+  const segments = normalized
+    .split('/')
+    .map((segment) =>
+      segment
+        .trim()
+        .replace(/\.{2,}/g, '')
+        .replace(/[^a-zA-Z0-9_.-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+    )
+    .filter((segment) => segment && segment !== '.' && segment !== '..');
+
+  const folder = segments.join('/') || fallback;
+  return folder.endsWith('/') ? folder : `${folder}/`;
+}
+
+function sanitizeFilenameBase(filename: string) {
+  const lastDotIndex = filename.lastIndexOf('.');
+  const base = lastDotIndex > 0 ? filename.slice(0, lastDotIndex) : filename;
+  const sanitized = base
+    .toLowerCase()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9_.-]+/g, '')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 120);
+
+  return sanitized || 'asset';
+}
+
+function getFileExtension(
+  filename: string,
+  contentType: ValidR2PresignedUploadPayload['contentType']
+) {
+  const lastDotIndex = filename.lastIndexOf('.');
+  const extension = lastDotIndex > 0 ? filename.slice(lastDotIndex + 1).toLowerCase() : '';
+  const normalizedExtension = extension.replace(/[^a-z0-9]+/g, '');
+  const expectedExtension = EXTENSION_BY_CONTENT_TYPE[contentType];
+
+  if (!normalizedExtension) {
+    return expectedExtension;
+  }
+
+  if (['jpeg', 'jpg'].includes(normalizedExtension) && contentType === 'image/jpeg') {
+    return normalizedExtension;
+  }
+
+  return normalizedExtension === expectedExtension ? normalizedExtension : expectedExtension;
+}
+
+function formatUploadTimestamp(date: Date) {
+  const parts = [
+    date.getUTCFullYear(),
+    `${date.getUTCMonth() + 1}`.padStart(2, '0'),
+    `${date.getUTCDate()}`.padStart(2, '0'),
+    `${date.getUTCHours()}`.padStart(2, '0'),
+    `${date.getUTCMinutes()}`.padStart(2, '0'),
+    `${date.getUTCSeconds()}`.padStart(2, '0'),
+    `${date.getUTCMilliseconds()}`.padStart(3, '0'),
+  ];
+
+  return parts.join('');
+}
+
+export function validateR2PresignedUploadPayload(
+  payload: R2PresignedUploadPayload
+): ValidR2PresignedUploadPayload {
+  const filename = typeof payload.filename === 'string' ? payload.filename.trim() : '';
+  const contentType =
+    typeof payload.contentType === 'string' ? payload.contentType.trim().toLowerCase() : '';
+  const size =
+    typeof payload.size === 'number'
+      ? payload.size
+      : typeof payload.size === 'string'
+        ? Number(payload.size)
+        : Number.NaN;
+
+  if (!filename || filename.length > 255) {
+    throw new R2PresignedUploadError('A valid filename is required.');
+  }
+
+  if (!isAllowedContentType(contentType)) {
+    throw new R2PresignedUploadError('Only AVIF, GIF, JPEG, PNG, and WebP images are supported.');
+  }
+
+  if (!Number.isInteger(size) || size <= 0) {
+    throw new R2PresignedUploadError('A positive file size is required.');
+  }
+
+  if (size > R2_PRESIGNED_UPLOAD_MAX_BYTES) {
+    throw new R2PresignedUploadError('Image uploads are limited to 10 MB.');
+  }
+
+  return {
+    contentType,
+    filename,
+    folder: sanitizeR2UploadFolder(payload.folder),
+    size,
+  };
+}
+
+export function buildR2UploadObjectKey(
+  payload: ValidR2PresignedUploadPayload,
+  options: { now?: Date; nonce?: string } = {}
+) {
+  const base = sanitizeFilenameBase(payload.filename);
+  const extension = getFileExtension(payload.filename, payload.contentType);
+  const timestamp = formatUploadTimestamp(options.now ?? new Date());
+  const nonce = (options.nonce ?? randomUUID().slice(0, 8)).replace(/[^a-zA-Z0-9-]/g, '');
+
+  return `${payload.folder}${base}-${timestamp}-${nonce}.${extension}`;
+}

package/templates/nextblock-template/lib/custom-block-r2-upload.test.ts

@@ -1,140 +1,140 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('server-only', () => ({}));
-
-const mocks = vi.hoisted(() => ({
-  getS3PresignClientMock: vi.fn(),
-  getSignedUrlMock: vi.fn(),
-  getUserMock: vi.fn(),
-  profileSingleMock: vi.fn(),
-}));
-
-vi.mock('@nextblock-cms/db/server', () => ({
-  createClient: () => ({
-    auth: {
-      getUser: mocks.getUserMock,
-    },
-    from: () => ({
-      eq: () => ({
-        single: mocks.profileSingleMock,
-      }),
-      select: () => ({
-        eq: () => ({
-          single: mocks.profileSingleMock,
-        }),
-      }),
-    }),
-  }),
-}));
-
-vi.mock('@nextblock-cms/utils/server', () => ({
-  getS3PresignClient: mocks.getS3PresignClientMock,
-}));
-
-vi.mock('@aws-sdk/client-s3', () => ({
-  PutObjectCommand: class PutObjectCommand {
-    constructor(public readonly input: unknown) {}
-  },
-}));
-
-vi.mock('@aws-sdk/s3-request-presigner', () => ({
-  getSignedUrl: mocks.getSignedUrlMock,
-}));
-
-import {
-  buildR2UploadObjectKey,
-  validateR2PresignedUploadPayload,
-} from './custom-block-r2-upload';
-import { POST } from '../app/api/media/r2-presigned/route';
-
-describe('custom block R2 presigned upload flow', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    process.env.R2_BUCKET_NAME = 'nextblock-test';
-    process.env.NEXT_PUBLIC_R2_BASE_URL = 'https://cdn.nextblock.test';
-  });
-
-  it('validates and sanitizes image upload keys', () => {
-    const payload = validateR2PresignedUploadPayload({
-      contentType: 'image/webp',
-      filename: 'Hero Portrait!!!.webp',
-      folder: '../custom blocks//testimonials',
-      size: 1024,
-    });
-
-    expect(payload.folder).toBe('custom-blocks/testimonials/');
-    expect(
-      buildR2UploadObjectKey(payload, {
-        nonce: 'abc123',
-        now: new Date('2026-05-28T12:34:56.789Z'),
-      })
-    ).toBe('custom-blocks/testimonials/hero-portrait-20260528123456789-abc123.webp');
-  });
-
-  it('rejects anonymous users before creating an upload URL', async () => {
-    mocks.getUserMock.mockResolvedValueOnce({ data: { user: null }, error: null });
-
-    const response = await POST(
-      new Request('https://nextblock.test/api/media/r2-presigned', {
-        body: JSON.stringify({}),
-        method: 'POST',
-      }) as any
-    );
-
-    expect(response.status).toBe(401);
-    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
-  });
-
-  it('rejects oversized files for authorized writers', async () => {
-    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
-    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'WRITER' }, error: null });
-
-    const response = await POST(
-      new Request('https://nextblock.test/api/media/r2-presigned', {
-        body: JSON.stringify({
-          contentType: 'image/png',
-          filename: 'too-large.png',
-          size: 11 * 1024 * 1024,
-        }),
-        method: 'POST',
-      }) as any
-    );
-    const payload = await response.json();
-
-    expect(response.status).toBe(400);
-    expect(payload.error).toContain('10 MB');
-    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
-  });
-
-  it('returns a direct PUT upload space for authorized writers', async () => {
-    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
-    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'ADMIN' }, error: null });
-    mocks.getS3PresignClientMock.mockResolvedValueOnce({ send: vi.fn() });
-    mocks.getSignedUrlMock.mockResolvedValueOnce('https://r2.example.test/presigned-put');
-
-    const response = await POST(
-      new Request('https://nextblock.test/api/media/r2-presigned', {
-        body: JSON.stringify({
-          contentType: 'image/jpeg',
-          filename: 'Customer Headshot.jpg',
-          folder: 'custom-blocks/testimonials',
-          size: 512_000,
-        }),
-        method: 'POST',
-      }) as any
-    );
-    const payload = await response.json();
-
-    expect(response.status).toBe(200);
-    expect(payload).toMatchObject({
-      headers: { 'Content-Type': 'image/jpeg' },
-      method: 'PUT',
-      presignedUrl: 'https://r2.example.test/presigned-put',
-      uploadUrl: 'https://r2.example.test/presigned-put',
-    });
-    expect(payload.objectKey).toMatch(
-      /^custom-blocks\/testimonials\/customer-headshot-\d{17}-[a-f0-9-]+\.jpg$/
-    );
-    expect(payload.publicUrl).toContain('https://cdn.nextblock.test/custom-blocks/testimonials/');
-  });
-});
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('server-only', () => ({}));
+
+const mocks = vi.hoisted(() => ({
+  getS3PresignClientMock: vi.fn(),
+  getSignedUrlMock: vi.fn(),
+  getUserMock: vi.fn(),
+  profileSingleMock: vi.fn(),
+}));
+
+vi.mock('@nextblock-cms/db/server', () => ({
+  createClient: () => ({
+    auth: {
+      getUser: mocks.getUserMock,
+    },
+    from: () => ({
+      eq: () => ({
+        single: mocks.profileSingleMock,
+      }),
+      select: () => ({
+        eq: () => ({
+          single: mocks.profileSingleMock,
+        }),
+      }),
+    }),
+  }),
+}));
+
+vi.mock('@nextblock-cms/utils/server', () => ({
+  getS3PresignClient: mocks.getS3PresignClientMock,
+}));
+
+vi.mock('@aws-sdk/client-s3', () => ({
+  PutObjectCommand: class PutObjectCommand {
+    constructor(public readonly input: unknown) {}
+  },
+}));
+
+vi.mock('@aws-sdk/s3-request-presigner', () => ({
+  getSignedUrl: mocks.getSignedUrlMock,
+}));
+
+import {
+  buildR2UploadObjectKey,
+  validateR2PresignedUploadPayload,
+} from './custom-block-r2-upload';
+import { POST } from '../app/api/media/r2-presigned/route';
+
+describe('custom block R2 presigned upload flow', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    process.env.R2_BUCKET_NAME = 'nextblock-test';
+    process.env.NEXT_PUBLIC_R2_BASE_URL = 'https://cdn.nextblock.test';
+  });
+
+  it('validates and sanitizes image upload keys', () => {
+    const payload = validateR2PresignedUploadPayload({
+      contentType: 'image/webp',
+      filename: 'Hero Portrait!!!.webp',
+      folder: '../custom blocks//testimonials',
+      size: 1024,
+    });
+
+    expect(payload.folder).toBe('custom-blocks/testimonials/');
+    expect(
+      buildR2UploadObjectKey(payload, {
+        nonce: 'abc123',
+        now: new Date('2026-05-28T12:34:56.789Z'),
+      })
+    ).toBe('custom-blocks/testimonials/hero-portrait-20260528123456789-abc123.webp');
+  });
+
+  it('rejects anonymous users before creating an upload URL', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: null }, error: null });
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({}),
+        method: 'POST',
+      }) as any
+    );
+
+    expect(response.status).toBe(401);
+    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
+  });
+
+  it('rejects oversized files for authorized writers', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
+    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'WRITER' }, error: null });
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({
+          contentType: 'image/png',
+          filename: 'too-large.png',
+          size: 11 * 1024 * 1024,
+        }),
+        method: 'POST',
+      }) as any
+    );
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toContain('10 MB');
+    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
+  });
+
+  it('returns a direct PUT upload space for authorized writers', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
+    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'ADMIN' }, error: null });
+    mocks.getS3PresignClientMock.mockResolvedValueOnce({ send: vi.fn() });
+    mocks.getSignedUrlMock.mockResolvedValueOnce('https://r2.example.test/presigned-put');
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({
+          contentType: 'image/jpeg',
+          filename: 'Customer Headshot.jpg',
+          folder: 'custom-blocks/testimonials',
+          size: 512_000,
+        }),
+        method: 'POST',
+      }) as any
+    );
+    const payload = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(payload).toMatchObject({
+      headers: { 'Content-Type': 'image/jpeg' },
+      method: 'PUT',
+      presignedUrl: 'https://r2.example.test/presigned-put',
+      uploadUrl: 'https://r2.example.test/presigned-put',
+    });
+    expect(payload.objectKey).toMatch(
+      /^custom-blocks\/testimonials\/customer-headshot-\d{17}-[a-f0-9-]+\.jpg$/
+    );
+    expect(payload.publicUrl).toContain('https://cdn.nextblock.test/custom-blocks/testimonials/');
+  });
+});