create-nextblock 0.16.4 → 0.17.0

package/templates/nextblock-template/lib/auth/crypto.ts

@@ -1,45 +1,45 @@
-// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
-// signed "second factor satisfied" session marker. Uses Node's crypto module.
-import crypto from 'node:crypto';
-
-/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
-export function sha256Hex(input: string): string {
-  return crypto.createHash('sha256').update(input).digest('hex');
-}
-
-/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
-export function randomToken(bytes = 32): string {
-  return crypto.randomBytes(bytes).toString('base64url');
-}
-
-/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
-export function generateNumericCode(digits = 6): string {
-  const max = 10 ** digits;
-  return crypto.randomInt(0, max).toString().padStart(digits, '0');
-}
-
-function getSecret(): string {
-  // Dedicated secret if provided, otherwise fall back to the service-role key
-  // (server-only, never shipped to the client).
-  const secret =
-    process.env.NB_2FA_SECRET ||
-    process.env.SUPABASE_SERVICE_ROLE_KEY ||
-    process.env.SUPABASE_SECRET_KEY;
-  if (!secret) {
-    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
-  }
-  return secret;
-}
-
-/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
-export function hmacSign(payload: string): string {
-  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
-}
-
-/** Constant-time string comparison that never throws on length mismatch. */
-export function safeEqual(a: string, b: string): boolean {
-  const ab = Buffer.from(a);
-  const bb = Buffer.from(b);
-  if (ab.length !== bb.length) return false;
-  return crypto.timingSafeEqual(ab, bb);
-}
+// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
+// signed "second factor satisfied" session marker. Uses Node's crypto module.
+import crypto from 'node:crypto';
+
+/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
+export function sha256Hex(input: string): string {
+  return crypto.createHash('sha256').update(input).digest('hex');
+}
+
+/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
+export function randomToken(bytes = 32): string {
+  return crypto.randomBytes(bytes).toString('base64url');
+}
+
+/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
+export function generateNumericCode(digits = 6): string {
+  const max = 10 ** digits;
+  return crypto.randomInt(0, max).toString().padStart(digits, '0');
+}
+
+function getSecret(): string {
+  // Dedicated secret if provided, otherwise fall back to the service-role key
+  // (server-only, never shipped to the client).
+  const secret =
+    process.env.NB_2FA_SECRET ||
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.SUPABASE_SECRET_KEY;
+  if (!secret) {
+    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
+  }
+  return secret;
+}
+
+/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
+export function hmacSign(payload: string): string {
+  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
+}
+
+/** Constant-time string comparison that never throws on length mismatch. */
+export function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}

package/templates/nextblock-template/lib/auth/trustedDevices.ts

@@ -1,92 +1,92 @@
-// Server-only trusted-device ("Remember this device") helpers.
-//
-// Trust is server-validated: the cookie holds only a random token, and a bypass
-// is honoured ONLY when a non-expired user_trusted_devices row matches its
-// SHA-256. Deleting the row instantly revokes trust, regardless of the cookie.
-import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-import { getSecuritySettings } from '../privacy/settings';
-import { randomToken, sha256Hex } from './crypto';
-import {
-  TRUSTED_DEVICE_COOKIE,
-  clearCookie,
-  getCookieValue,
-  setSecureCookie,
-} from './cookies';
-
-export interface TrustedDeviceRow {
-  id: string;
-  browser_metadata: string | null;
-  created_at: string;
-  expires_at: string;
-}
-
-/** Mint a trusted-device token, persist its hash, and set the cookie. */
-export async function issueTrustedDevice(
-  userId: string,
-  browserMetadata: string | null,
-): Promise<void> {
-  const { trusted_device_days } = await getSecuritySettings();
-  const maxAgeSeconds = trusted_device_days * 24 * 60 * 60;
-  const token = randomToken(32);
-  const expiresAt = new Date(Date.now() + maxAgeSeconds * 1000).toISOString();
-
-  const svc = getServiceRoleSupabaseClient();
-  const { error } = await svc.from('user_trusted_devices').insert({
-    user_id: userId,
-    device_hash: sha256Hex(token),
-    browser_metadata: browserMetadata ? browserMetadata.slice(0, 500) : null,
-    expires_at: expiresAt,
-  });
-  if (error) {
-    console.error('Failed to persist trusted device:', error.message);
-    return; // Non-fatal: the user simply isn't remembered.
-  }
-  await setSecureCookie(TRUSTED_DEVICE_COOKIE, token, maxAgeSeconds);
-}
-
-/** True when the current request carries a cookie matching a live trusted row. */
-export async function hasValidTrustedDevice(userId: string): Promise<boolean> {
-  const token = await getCookieValue(TRUSTED_DEVICE_COOKIE);
-  if (!token) return false;
-  const svc = getServiceRoleSupabaseClient();
-  const { data } = await svc
-    .from('user_trusted_devices')
-    .select('id')
-    .eq('user_id', userId)
-    .eq('device_hash', sha256Hex(token))
-    .gt('expires_at', new Date().toISOString())
-    .maybeSingle();
-  return Boolean(data);
-}
-
-/** List the signed-in user's trusted devices (RLS scopes to their own rows). */
-export async function listTrustedDevices(userId: string): Promise<TrustedDeviceRow[]> {
-  const supabase = createClient();
-  const { data } = await supabase
-    .from('user_trusted_devices')
-    .select('id, browser_metadata, created_at, expires_at')
-    .eq('user_id', userId)
-    .order('created_at', { ascending: false });
-  return data ?? [];
-}
-
-/** Revoke one trusted device the user owns (RLS prevents touching others'). */
-export async function revokeTrustedDevice(userId: string, id: string): Promise<void> {
-  const supabase = createClient();
-  const { error } = await supabase
-    .from('user_trusted_devices')
-    .delete()
-    .eq('id', id)
-    .eq('user_id', userId);
-  if (error) {
-    console.error('Failed to revoke trusted device:', error.message);
-    throw new Error('Failed to revoke device.');
-  }
-}
-
-/** Drop all of a user's trusted devices and the local cookie (e.g. on MFA disable). */
-export async function revokeAllTrustedDevices(userId: string): Promise<void> {
-  const svc = getServiceRoleSupabaseClient();
-  await svc.from('user_trusted_devices').delete().eq('user_id', userId);
-  await clearCookie(TRUSTED_DEVICE_COOKIE);
-}
+// Server-only trusted-device ("Remember this device") helpers.
+//
+// Trust is server-validated: the cookie holds only a random token, and a bypass
+// is honoured ONLY when a non-expired user_trusted_devices row matches its
+// SHA-256. Deleting the row instantly revokes trust, regardless of the cookie.
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import { getSecuritySettings } from '../privacy/settings';
+import { randomToken, sha256Hex } from './crypto';
+import {
+  TRUSTED_DEVICE_COOKIE,
+  clearCookie,
+  getCookieValue,
+  setSecureCookie,
+} from './cookies';
+
+export interface TrustedDeviceRow {
+  id: string;
+  browser_metadata: string | null;
+  created_at: string;
+  expires_at: string;
+}
+
+/** Mint a trusted-device token, persist its hash, and set the cookie. */
+export async function issueTrustedDevice(
+  userId: string,
+  browserMetadata: string | null,
+): Promise<void> {
+  const { trusted_device_days } = await getSecuritySettings();
+  const maxAgeSeconds = trusted_device_days * 24 * 60 * 60;
+  const token = randomToken(32);
+  const expiresAt = new Date(Date.now() + maxAgeSeconds * 1000).toISOString();
+
+  const svc = getServiceRoleSupabaseClient();
+  const { error } = await svc.from('user_trusted_devices').insert({
+    user_id: userId,
+    device_hash: sha256Hex(token),
+    browser_metadata: browserMetadata ? browserMetadata.slice(0, 500) : null,
+    expires_at: expiresAt,
+  });
+  if (error) {
+    console.error('Failed to persist trusted device:', error.message);
+    return; // Non-fatal: the user simply isn't remembered.
+  }
+  await setSecureCookie(TRUSTED_DEVICE_COOKIE, token, maxAgeSeconds);
+}
+
+/** True when the current request carries a cookie matching a live trusted row. */
+export async function hasValidTrustedDevice(userId: string): Promise<boolean> {
+  const token = await getCookieValue(TRUSTED_DEVICE_COOKIE);
+  if (!token) return false;
+  const svc = getServiceRoleSupabaseClient();
+  const { data } = await svc
+    .from('user_trusted_devices')
+    .select('id')
+    .eq('user_id', userId)
+    .eq('device_hash', sha256Hex(token))
+    .gt('expires_at', new Date().toISOString())
+    .maybeSingle();
+  return Boolean(data);
+}
+
+/** List the signed-in user's trusted devices (RLS scopes to their own rows). */
+export async function listTrustedDevices(userId: string): Promise<TrustedDeviceRow[]> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('user_trusted_devices')
+    .select('id, browser_metadata, created_at, expires_at')
+    .eq('user_id', userId)
+    .order('created_at', { ascending: false });
+  return data ?? [];
+}
+
+/** Revoke one trusted device the user owns (RLS prevents touching others'). */
+export async function revokeTrustedDevice(userId: string, id: string): Promise<void> {
+  const supabase = createClient();
+  const { error } = await supabase
+    .from('user_trusted_devices')
+    .delete()
+    .eq('id', id)
+    .eq('user_id', userId);
+  if (error) {
+    console.error('Failed to revoke trusted device:', error.message);
+    throw new Error('Failed to revoke device.');
+  }
+}
+
+/** Drop all of a user's trusted devices and the local cookie (e.g. on MFA disable). */
+export async function revokeAllTrustedDevices(userId: string): Promise<void> {
+  const svc = getServiceRoleSupabaseClient();
+  await svc.from('user_trusted_devices').delete().eq('user_id', userId);
+  await clearCookie(TRUSTED_DEVICE_COOKIE);
+}

package/templates/nextblock-template/lib/blocks/README.md

@@ -1,13 +1,13 @@
-# NextBlock™ Block System
-
-The built-in block registry for the app lives in this directory. The current
-source of truth is `blockRegistry.ts`, which defines block types, schemas,
-defaults, and editor or renderer wiring for the CMS.
-
-## Read This First
-
-- [CMS and Editor](../../../../docs/03-CMS-AND-EDITOR.md)
-- [Block SDK and Extensibility](../../../../docs/07-BLOCK-SDK-AND-EXTENSIBILITY.md)
-- [Custom Blocks (Data-Driven CRUD)](../../../../docs/10-CUSTOM-BLOCKS.md)
-
-Use those docs instead of maintaining a second long-form block tutorial here.
+# NextBlock™ Block System
+
+The built-in block registry for the app lives in this directory. The current
+source of truth is `blockRegistry.ts`, which defines block types, schemas,
+defaults, and editor or renderer wiring for the CMS.
+
+## Read This First
+
+- [CMS and Editor](../../../../docs/03-CMS-AND-EDITOR.md)
+- [Block SDK and Extensibility](../../../../docs/07-BLOCK-SDK-AND-EXTENSIBILITY.md)
+- [Custom Blocks (Data-Driven CRUD)](../../../../docs/10-CUSTOM-BLOCKS.md)
+
+Use those docs instead of maintaining a second long-form block tutorial here.

package/templates/nextblock-template/lib/botProtection/verify.ts

@@ -1,134 +1,134 @@
-// lib/botProtection/verify.ts
-//
-// Shared server-side bot-protection verification: the honeypot check plus
-// Cloudflare Turnstile / Google reCAPTCHA token verification. This is the single
-// source of truth used by BOTH the page contact-form handler
-// (app/actions/formActions.ts) and the account-signup action (app/actions.ts).
-//
-// Server-only: it reads the RLS-bypassing service-role client, which throws if
-// imported into a Client Component.
-
-import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-
-export type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
-
-// Shared field names — the client widgets emit these, the verifier reads them.
-export const HONEYPOT_FIELD = 'verification_secondary_email';
-export const TURNSTILE_TOKEN_FIELD = 'cf-turnstile-response';
-export const RECAPTCHA_TOKEN_FIELD = 'g-recaptcha-response';
-
-export type BotProtectionResult =
-  // Passed (or nothing configured beyond the honeypot).
-  | { ok: true }
-  // The honeypot was filled — almost certainly a bot. Callers should silently
-  // discard the submission and fake a success so the bot learns nothing.
-  | { ok: false; reason: 'honeypot' }
-  // The captcha was missing, failed, or could not be checked. `message` is a
-  // human-readable explanation safe to surface to the user.
-  | { ok: false; reason: 'captcha'; message: string };
-
-type VerifyOptions = {
-  // A block/form may pin a specific provider; otherwise the site-wide setting
-  // (site_settings.bot_protection_public.provider) is used.
-  botProtectionProvider?: BotProtectionProvider;
-};
-
-/**
- * Verify a submitted FormData against the configured bot protection.
- *
- * Phase 1 (honeypot) needs no network/DB and always runs — it is the always-on
- * baseline. Phase 2 (captcha) reads the global provider + secret from
- * `site_settings` and calls the provider's siteverify endpoint.
- */
-export async function verifyBotProtection(
-  formData: FormData,
-  options?: VerifyOptions
-): Promise<BotProtectionResult> {
-  // Phase 1: Honeypot validation
-  const honeypot = formData.get(HONEYPOT_FIELD);
-  if (honeypot && typeof honeypot === 'string' && honeypot.length > 0) {
-    console.warn('[Bot Protection] Honeypot triggered. Discarding submission from bot.');
-    return { ok: false, reason: 'honeypot' };
-  }
-
-  // Phase 2: Advanced captcha verification
-  try {
-    const supabase = getServiceRoleSupabaseClient();
-
-    const { data: publicSetting } = await supabase
-      .from('site_settings')
-      .select('value')
-      .eq('key', 'bot_protection_public')
-      .maybeSingle();
-
-    const { data: secretSetting } = await supabase
-      .from('site_settings')
-      .select('value')
-      .eq('key', 'bot_protection_secret')
-      .maybeSingle();
-
-    const publicVal = (publicSetting?.value || {}) as Record<string, any>;
-    const secretVal = (secretSetting?.value || {}) as Record<string, any>;
-
-    const pinnedProvider =
-      options?.botProtectionProvider === 'turnstile' || options?.botProtectionProvider === 'recaptcha'
-        ? options.botProtectionProvider
-        : undefined;
-    const provider: BotProtectionProvider = pinnedProvider || publicVal.provider || 'none';
-    const secretKey =
-      secretVal.secretKey ||
-      (provider === 'turnstile'
-        ? process.env.TURNSTILE_SECRET_KEY
-        : process.env.RECAPTCHA_SECRET_KEY) ||
-      '';
-
-    if (provider === 'turnstile') {
-      const token = formData.get(TURNSTILE_TOKEN_FIELD) as string;
-      if (!token) {
-        return { ok: false, reason: 'captcha', message: 'Security verification token is missing. Please try again.' };
-      }
-      if (!secretKey) {
-        console.error('[Bot Protection] Turnstile secret key is not configured.');
-        return { ok: false, reason: 'captcha', message: 'Bot protection is misconfigured. Please contact support.' };
-      }
-
-      const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
-      });
-
-      const outcome = await res.json();
-      if (!outcome.success) {
-        console.warn('[Bot Protection] Turnstile verification failed:', outcome);
-        return { ok: false, reason: 'captcha', message: 'Security verification failed. Please try again.' };
-      }
-    } else if (provider === 'recaptcha') {
-      const token = formData.get(RECAPTCHA_TOKEN_FIELD) as string;
-      if (!token) {
-        return { ok: false, reason: 'captcha', message: 'Security verification token is missing. Please try again.' };
-      }
-      if (!secretKey) {
-        console.error('[Bot Protection] reCAPTCHA secret key is not configured.');
-        return { ok: false, reason: 'captcha', message: 'Bot protection is misconfigured. Please contact support.' };
-      }
-
-      const res = await fetch('https://www.google.com/recaptcha/api/siteverify', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
-      });
-
-      const outcome = await res.json();
-      if (!outcome.success || outcome.score < 0.5) {
-        console.warn('[Bot Protection] reCAPTCHA verification failed:', outcome);
-        return { ok: false, reason: 'captcha', message: 'Security verification failed. Please try again.' };
-      }
-    }
-  } catch (error) {
-    console.error('[Bot Protection] Error during validation:', error);
-    return { ok: false, reason: 'captcha', message: 'Sorry, security verification could not be completed at this time.' };
-  }
-
-  return { ok: true };
-}
+// lib/botProtection/verify.ts
+//
+// Shared server-side bot-protection verification: the honeypot check plus
+// Cloudflare Turnstile / Google reCAPTCHA token verification. This is the single
+// source of truth used by BOTH the page contact-form handler
+// (app/actions/formActions.ts) and the account-signup action (app/actions.ts).
+//
+// Server-only: it reads the RLS-bypassing service-role client, which throws if
+// imported into a Client Component.
+
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+export type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
+
+// Shared field names — the client widgets emit these, the verifier reads them.
+export const HONEYPOT_FIELD = 'verification_secondary_email';
+export const TURNSTILE_TOKEN_FIELD = 'cf-turnstile-response';
+export const RECAPTCHA_TOKEN_FIELD = 'g-recaptcha-response';
+
+export type BotProtectionResult =
+  // Passed (or nothing configured beyond the honeypot).
+  | { ok: true }
+  // The honeypot was filled — almost certainly a bot. Callers should silently
+  // discard the submission and fake a success so the bot learns nothing.
+  | { ok: false; reason: 'honeypot' }
+  // The captcha was missing, failed, or could not be checked. `message` is a
+  // human-readable explanation safe to surface to the user.
+  | { ok: false; reason: 'captcha'; message: string };
+
+type VerifyOptions = {
+  // A block/form may pin a specific provider; otherwise the site-wide setting
+  // (site_settings.bot_protection_public.provider) is used.
+  botProtectionProvider?: BotProtectionProvider;
+};
+
+/**
+ * Verify a submitted FormData against the configured bot protection.
+ *
+ * Phase 1 (honeypot) needs no network/DB and always runs — it is the always-on
+ * baseline. Phase 2 (captcha) reads the global provider + secret from
+ * `site_settings` and calls the provider's siteverify endpoint.
+ */
+export async function verifyBotProtection(
+  formData: FormData,
+  options?: VerifyOptions
+): Promise<BotProtectionResult> {
+  // Phase 1: Honeypot validation
+  const honeypot = formData.get(HONEYPOT_FIELD);
+  if (honeypot && typeof honeypot === 'string' && honeypot.length > 0) {
+    console.warn('[Bot Protection] Honeypot triggered. Discarding submission from bot.');
+    return { ok: false, reason: 'honeypot' };
+  }
+
+  // Phase 2: Advanced captcha verification
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+
+    const { data: publicSetting } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'bot_protection_public')
+      .maybeSingle();
+
+    const { data: secretSetting } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'bot_protection_secret')
+      .maybeSingle();
+
+    const publicVal = (publicSetting?.value || {}) as Record<string, any>;
+    const secretVal = (secretSetting?.value || {}) as Record<string, any>;
+
+    const pinnedProvider =
+      options?.botProtectionProvider === 'turnstile' || options?.botProtectionProvider === 'recaptcha'
+        ? options.botProtectionProvider
+        : undefined;
+    const provider: BotProtectionProvider = pinnedProvider || publicVal.provider || 'none';
+    const secretKey =
+      secretVal.secretKey ||
+      (provider === 'turnstile'
+        ? process.env.TURNSTILE_SECRET_KEY
+        : process.env.RECAPTCHA_SECRET_KEY) ||
+      '';
+
+    if (provider === 'turnstile') {
+      const token = formData.get(TURNSTILE_TOKEN_FIELD) as string;
+      if (!token) {
+        return { ok: false, reason: 'captcha', message: 'Security verification token is missing. Please try again.' };
+      }
+      if (!secretKey) {
+        console.error('[Bot Protection] Turnstile secret key is not configured.');
+        return { ok: false, reason: 'captcha', message: 'Bot protection is misconfigured. Please contact support.' };
+      }
+
+      const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
+      });
+
+      const outcome = await res.json();
+      if (!outcome.success) {
+        console.warn('[Bot Protection] Turnstile verification failed:', outcome);
+        return { ok: false, reason: 'captcha', message: 'Security verification failed. Please try again.' };
+      }
+    } else if (provider === 'recaptcha') {
+      const token = formData.get(RECAPTCHA_TOKEN_FIELD) as string;
+      if (!token) {
+        return { ok: false, reason: 'captcha', message: 'Security verification token is missing. Please try again.' };
+      }
+      if (!secretKey) {
+        console.error('[Bot Protection] reCAPTCHA secret key is not configured.');
+        return { ok: false, reason: 'captcha', message: 'Bot protection is misconfigured. Please contact support.' };
+      }
+
+      const res = await fetch('https://www.google.com/recaptcha/api/siteverify', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
+      });
+
+      const outcome = await res.json();
+      if (!outcome.success || outcome.score < 0.5) {
+        console.warn('[Bot Protection] reCAPTCHA verification failed:', outcome);
+        return { ok: false, reason: 'captcha', message: 'Security verification failed. Please try again.' };
+      }
+    }
+  } catch (error) {
+    console.error('[Bot Protection] Error during validation:', error);
+    return { ok: false, reason: 'captcha', message: 'Sorry, security verification could not be completed at this time.' };
+  }
+
+  return { ok: true };
+}