create-nextblock 0.2.77 → 0.8.0

package/templates/nextblock-template/lib/custom-block-r2-upload.test.ts

@@ -0,0 +1,140 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('server-only', () => ({}));
+
+const mocks = vi.hoisted(() => ({
+  getS3ClientMock: vi.fn(),
+  getSignedUrlMock: vi.fn(),
+  getUserMock: vi.fn(),
+  profileSingleMock: vi.fn(),
+}));
+
+vi.mock('@nextblock-cms/db/server', () => ({
+  createClient: () => ({
+    auth: {
+      getUser: mocks.getUserMock,
+    },
+    from: () => ({
+      eq: () => ({
+        single: mocks.profileSingleMock,
+      }),
+      select: () => ({
+        eq: () => ({
+          single: mocks.profileSingleMock,
+        }),
+      }),
+    }),
+  }),
+}));
+
+vi.mock('@nextblock-cms/utils/server', () => ({
+  getS3Client: mocks.getS3ClientMock,
+}));
+
+vi.mock('@aws-sdk/client-s3', () => ({
+  PutObjectCommand: class PutObjectCommand {
+    constructor(public readonly input: unknown) {}
+  },
+}));
+
+vi.mock('@aws-sdk/s3-request-presigner', () => ({
+  getSignedUrl: mocks.getSignedUrlMock,
+}));
+
+import {
+  buildR2UploadObjectKey,
+  validateR2PresignedUploadPayload,
+} from './custom-block-r2-upload';
+import { POST } from '../app/api/media/r2-presigned/route';
+
+describe('custom block R2 presigned upload flow', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    process.env.R2_BUCKET_NAME = 'nextblock-test';
+    process.env.NEXT_PUBLIC_R2_BASE_URL = 'https://cdn.nextblock.test';
+  });
+
+  it('validates and sanitizes image upload keys', () => {
+    const payload = validateR2PresignedUploadPayload({
+      contentType: 'image/webp',
+      filename: 'Hero Portrait!!!.webp',
+      folder: '../custom blocks//testimonials',
+      size: 1024,
+    });
+
+    expect(payload.folder).toBe('custom-blocks/testimonials/');
+    expect(
+      buildR2UploadObjectKey(payload, {
+        nonce: 'abc123',
+        now: new Date('2026-05-28T12:34:56.789Z'),
+      })
+    ).toBe('custom-blocks/testimonials/hero-portrait-20260528123456789-abc123.webp');
+  });
+
+  it('rejects anonymous users before creating an upload URL', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: null }, error: null });
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({}),
+        method: 'POST',
+      }) as any
+    );
+
+    expect(response.status).toBe(401);
+    expect(mocks.getS3ClientMock).not.toHaveBeenCalled();
+  });
+
+  it('rejects oversized files for authorized writers', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
+    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'WRITER' }, error: null });
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({
+          contentType: 'image/png',
+          filename: 'too-large.png',
+          size: 11 * 1024 * 1024,
+        }),
+        method: 'POST',
+      }) as any
+    );
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toContain('10 MB');
+    expect(mocks.getS3ClientMock).not.toHaveBeenCalled();
+  });
+
+  it('returns a direct PUT upload space for authorized writers', async () => {
+    mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
+    mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'ADMIN' }, error: null });
+    mocks.getS3ClientMock.mockResolvedValueOnce({ send: vi.fn() });
+    mocks.getSignedUrlMock.mockResolvedValueOnce('https://r2.example.test/presigned-put');
+
+    const response = await POST(
+      new Request('https://nextblock.test/api/media/r2-presigned', {
+        body: JSON.stringify({
+          contentType: 'image/jpeg',
+          filename: 'Customer Headshot.jpg',
+          folder: 'custom-blocks/testimonials',
+          size: 512_000,
+        }),
+        method: 'POST',
+      }) as any
+    );
+    const payload = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(payload).toMatchObject({
+      headers: { 'Content-Type': 'image/jpeg' },
+      method: 'PUT',
+      presignedUrl: 'https://r2.example.test/presigned-put',
+      uploadUrl: 'https://r2.example.test/presigned-put',
+    });
+    expect(payload.objectKey).toMatch(
+      /^custom-blocks\/testimonials\/customer-headshot-\d{17}-[a-f0-9-]+\.jpg$/
+    );
+    expect(payload.publicUrl).toContain('https://cdn.nextblock.test/custom-blocks/testimonials/');
+  });
+});

package/templates/nextblock-template/lib/custom-block-r2-upload.ts

@@ -0,0 +1,68 @@
+import 'server-only';
+
+import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { getS3Client } from '@nextblock-cms/utils/server';
+
+import { resolveMediaUrl } from './media/resolveMediaUrl';
+import {
+  buildR2UploadObjectKey,
+  R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
+  R2PresignedUploadError,
+  type R2PresignedUploadResult,
+  type ValidR2PresignedUploadPayload,
+} from './custom-block-r2-upload-shared';
+
+export {
+  buildR2UploadObjectKey,
+  R2_PRESIGNED_UPLOAD_ALLOWED_CONTENT_TYPES,
+  R2_PRESIGNED_UPLOAD_DEFAULT_FOLDER,
+  R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
+  R2_PRESIGNED_UPLOAD_MAX_BYTES,
+  R2PresignedUploadError,
+  sanitizeR2UploadFolder,
+  validateR2PresignedUploadPayload,
+  type R2PresignedUploadResult,
+  type ValidR2PresignedUploadPayload,
+} from './custom-block-r2-upload-shared';
+
+export async function createR2PresignedUpload(
+  payload: ValidR2PresignedUploadPayload,
+  options: { now?: Date; nonce?: string; userId: string }
+): Promise<R2PresignedUploadResult> {
+  const bucketName = process.env.R2_BUCKET_NAME;
+  if (!bucketName) {
+    throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
+  }
+
+  const s3Client = await getS3Client();
+  if (!s3Client) {
+    throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
+  }
+
+  const objectKey = buildR2UploadObjectKey(payload, options);
+  const command = new PutObjectCommand({
+    Bucket: bucketName,
+    ContentType: payload.contentType,
+    Key: objectKey,
+    Metadata: {
+      'uploader-user-id': options.userId,
+    },
+  });
+  const presignedUrl = await getSignedUrl(s3Client, command, {
+    expiresIn: R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
+  });
+  const publicUrl = resolveMediaUrl(objectKey) ?? `/${objectKey}`;
+
+  return {
+    expiresIn: R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
+    headers: {
+      'Content-Type': payload.contentType,
+    },
+    method: 'PUT',
+    objectKey,
+    presignedUrl,
+    publicUrl,
+    uploadUrl: presignedUrl,
+  };
+}

package/templates/nextblock-template/lib/custom-block-relation-registry.ts

@@ -0,0 +1,256 @@
+export const CUSTOM_BLOCK_RELATION_MAX_RESULTS = 50;
+export const CUSTOM_BLOCK_RELATION_DEFAULT_RESULTS = 20;
+
+export type CustomBlockRelationValueType = 'number' | 'string';
+
+export type CustomBlockRelationTarget = {
+  activeFilters?: Array<{
+    column: string;
+    value: boolean | number | string;
+  }>;
+  descriptionColumns: readonly string[];
+  displayColumn: string;
+  label: string;
+  orderBy: string;
+  searchableColumns: readonly string[];
+  selectColumns: readonly string[];
+  table: string;
+  valueColumn: string;
+  valueType: CustomBlockRelationValueType;
+};
+
+export type CustomBlockRelationTargetSummary = Pick<
+  CustomBlockRelationTarget,
+  | 'descriptionColumns'
+  | 'displayColumn'
+  | 'label'
+  | 'searchableColumns'
+  | 'table'
+  | 'valueColumn'
+  | 'valueType'
+  | 'selectColumns'
+>;
+
+const RELATION_TARGETS: readonly CustomBlockRelationTarget[] = [
+  {
+    activeFilters: [{ column: 'status', value: 'published' }],
+    descriptionColumns: ['slug', 'status'],
+    displayColumn: 'title',
+    label: 'Pages',
+    orderBy: 'title',
+    searchableColumns: ['title', 'slug'],
+    selectColumns: ['id', 'title', 'slug', 'status', 'feature_image_id', 'updated_at', 'language_id'],
+    table: 'pages',
+    valueColumn: 'id',
+    valueType: 'number',
+  },
+  {
+    activeFilters: [{ column: 'status', value: 'published' }],
+    descriptionColumns: ['slug', 'status'],
+    displayColumn: 'title',
+    label: 'Posts',
+    orderBy: 'title',
+    searchableColumns: ['title', 'slug', 'excerpt', 'subtitle'],
+    selectColumns: ['id', 'title', 'slug', 'excerpt', 'subtitle', 'status', 'feature_image_id', 'published_at', 'language_id'],
+    table: 'posts',
+    valueColumn: 'id',
+    valueType: 'number',
+  },
+  {
+    activeFilters: [{ column: 'status', value: 'active' }],
+    descriptionColumns: ['sku', 'slug', 'status'],
+    displayColumn: 'title',
+    label: 'Products',
+    orderBy: 'title',
+    searchableColumns: ['title', 'slug', 'sku', 'short_description'],
+    selectColumns: [
+      'id',
+      'language_id',
+      'translation_group_id',
+      'sku',
+      'title',
+      'slug',
+      'product_type',
+      'payment_provider',
+      'price',
+      'prices',
+      'sale_price',
+      'sale_prices',
+      'stock',
+      'status',
+      'trial_period_days',
+      'trial_requires_payment_method',
+      'is_taxable',
+      'meta_title',
+      'meta_description',
+      'short_description',
+      'description_json',
+      'metadata',
+      'freemius_plan_id',
+      'freemius_product_id',
+      'upc',
+      'created_at',
+      'updated_at',
+      'main_image',
+      'object_key',
+    ],
+    table: 'products',
+    valueColumn: 'id',
+    valueType: 'string',
+  },
+  {
+    descriptionColumns: ['sku', 'price', 'stock_quantity'],
+    displayColumn: 'sku',
+    label: 'Product Variations',
+    orderBy: 'sku',
+    searchableColumns: ['sku', 'upc'],
+    selectColumns: [
+      'id',
+      'product_id',
+      'sku',
+      'price_adjustment',
+      'price',
+      'prices',
+      'sale_price',
+      'sale_prices',
+      'stock_quantity',
+      'upc',
+      'main_media_id',
+      'created_at',
+      'updated_at',
+    ],
+    table: 'product_variants',
+    valueColumn: 'id',
+    valueType: 'string',
+  },
+  {
+    descriptionColumns: ['object_key', 'file_type'],
+    displayColumn: 'file_name',
+    label: 'Media',
+    orderBy: 'file_name',
+    searchableColumns: ['file_name', 'description', 'object_key'],
+    selectColumns: [
+      'id',
+      'file_name',
+      'description',
+      'object_key',
+      'file_type',
+      'width',
+      'height',
+      'updated_at',
+    ],
+    table: 'media',
+    valueColumn: 'id',
+    valueType: 'string',
+  },
+  {
+    descriptionColumns: ['slug'],
+    displayColumn: 'name',
+    label: 'Categories',
+    orderBy: 'name',
+    searchableColumns: ['name', 'slug', 'description'],
+    selectColumns: ['id', 'name', 'slug', 'description'],
+    table: 'categories',
+    valueColumn: 'id',
+    valueType: 'string',
+  },
+  {
+    descriptionColumns: ['github_username', 'website'],
+    displayColumn: 'full_name',
+    label: 'Profiles',
+    orderBy: 'full_name',
+    searchableColumns: ['full_name', 'github_username', 'website'],
+    selectColumns: ['id', 'full_name', 'avatar_url', 'github_username', 'website', 'role'],
+    table: 'profiles',
+    valueColumn: 'id',
+    valueType: 'string',
+  },
+  {
+    activeFilters: [{ column: 'is_active', value: true }],
+    descriptionColumns: ['code'],
+    displayColumn: 'name',
+    label: 'Languages',
+    orderBy: 'name',
+    searchableColumns: ['name', 'code'],
+    selectColumns: ['id', 'name', 'code', 'is_default', 'is_active'],
+    table: 'languages',
+    valueColumn: 'id',
+    valueType: 'number',
+  },
+] as const;
+
+const RELATION_TARGET_BY_TABLE = new Map(
+  RELATION_TARGETS.map((target) => [target.table, target])
+);
+
+export function listCustomBlockRelationTargets(): CustomBlockRelationTargetSummary[] {
+  return RELATION_TARGETS.map(
+    ({
+      descriptionColumns,
+      displayColumn,
+      label,
+      searchableColumns,
+      table,
+      valueColumn,
+      valueType,
+      selectColumns,
+    }) => ({
+      descriptionColumns: [...descriptionColumns],
+      displayColumn,
+      label,
+      searchableColumns: [...searchableColumns],
+      table,
+      valueColumn,
+      valueType,
+      selectColumns: [...selectColumns],
+    })
+  );
+}
+
+export function getCustomBlockRelationTarget(table: string) {
+  return RELATION_TARGET_BY_TABLE.get(table);
+}
+
+export function isAllowedCustomBlockRelationTable(table: string) {
+  return RELATION_TARGET_BY_TABLE.has(table);
+}
+
+export function clampCustomBlockRelationLimit(limit: unknown) {
+  const parsed =
+    typeof limit === 'number'
+      ? limit
+      : typeof limit === 'string'
+        ? Number.parseInt(limit, 10)
+        : Number.NaN;
+
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return CUSTOM_BLOCK_RELATION_DEFAULT_RESULTS;
+  }
+
+  return Math.min(Math.floor(parsed), CUSTOM_BLOCK_RELATION_MAX_RESULTS);
+}
+
+export function resolveCustomBlockRelationColumn(
+  target: CustomBlockRelationTarget,
+  column: string | null | undefined,
+  fallback: string
+) {
+  const candidate = column?.trim() || fallback;
+  return target.selectColumns.includes(candidate) ? candidate : null;
+}
+
+export function normalizeCustomBlockRelationValue(
+  target: CustomBlockRelationTarget,
+  value: unknown
+) {
+  if (value === null || value === undefined || value === '') {
+    return null;
+  }
+
+  if (target.valueType === 'number') {
+    const parsed = typeof value === 'number' ? value : Number.parseInt(String(value), 10);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+
+  return String(value);
+}

package/templates/nextblock-template/lib/custom-block-relations.test.ts

@@ -0,0 +1,227 @@
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('server-only', () => ({}));
+
+import {
+  getCustomBlockRelationTarget,
+  listCustomBlockRelationTargets,
+} from './custom-block-relation-registry';
+import { searchCustomBlockRelationRows } from './custom-block-relations';
+
+class MockSupabaseQuery {
+  operations: Array<{ args: unknown[]; op: string }> = [];
+
+  constructor(private readonly rows: Array<Record<string, unknown>>) {}
+
+  select(...args: unknown[]) {
+    this.operations.push({ args, op: 'select' });
+    return this;
+  }
+
+  limit(...args: unknown[]) {
+    this.operations.push({ args, op: 'limit' });
+    return this;
+  }
+
+  eq(...args: unknown[]) {
+    this.operations.push({ args, op: 'eq' });
+    return this;
+  }
+
+  in(...args: unknown[]) {
+    this.operations.push({ args, op: 'in' });
+    return this;
+  }
+
+  or(...args: unknown[]) {
+    this.operations.push({ args, op: 'or' });
+    return this;
+  }
+
+  order(...args: unknown[]) {
+    this.operations.push({ args, op: 'order' });
+    return this;
+  }
+
+  then(resolve: (value: { data: Array<Record<string, unknown>>; error: null }) => unknown) {
+    return Promise.resolve({ data: this.rows, error: null }).then(resolve);
+  }
+}
+
+describe('custom block relation registry and search', () => {
+  it('exposes a curated allowlist of relation targets', () => {
+    expect(listCustomBlockRelationTargets().map((target) => target.table)).toEqual([
+      'pages',
+      'posts',
+      'products',
+      'product_variants',
+      'media',
+      'categories',
+      'profiles',
+      'languages',
+    ]);
+    expect(getCustomBlockRelationTarget('orders')).toBeUndefined();
+  });
+
+  it('rejects tables outside the allowlist', async () => {
+    const result = await searchCustomBlockRelationRows({} as any, {
+      table: 'orders',
+    });
+
+    expect(result).toEqual({
+      error: 'Relation table "orders" is not available.',
+      status: 400,
+    });
+  });
+
+  it('searches allowed tables with capped limits and active filters', async () => {
+    const query = new MockSupabaseQuery([
+      {
+        id: 1,
+        slug: 'home',
+        status: 'published',
+        title: 'Home',
+      },
+    ]);
+    const from = vi.fn(() => query);
+
+    const result = await searchCustomBlockRelationRows({ from } as any, {
+      limit: '500',
+      query: 'home',
+      table: 'pages',
+    });
+
+    expect(from).toHaveBeenCalledWith('pages');
+    expect(query.operations).toContainEqual({ args: [50], op: 'limit' });
+    expect(query.operations).toContainEqual({ args: ['status', 'published'], op: 'eq' });
+    expect(query.operations.some((operation) => operation.op === 'or')).toBe(true);
+    expect(result).toMatchObject({
+      items: [
+        {
+          description: 'home - published',
+          label: 'Home',
+          table: 'pages',
+          value: '1',
+        },
+      ],
+    });
+  });
+
+  it('fetches requested values with normalized numeric IDs', async () => {
+    const query = new MockSupabaseQuery([
+      {
+        code: 'en',
+        id: 1,
+        is_active: true,
+        name: 'English',
+      },
+    ]);
+    const result = await searchCustomBlockRelationRows({ from: () => query } as any, {
+      table: 'languages',
+      values: ['1', 'not-a-number'],
+    });
+
+    expect(query.operations).toContainEqual({ args: ['id', [1]], op: 'in' });
+    expect(result).toMatchObject({
+      items: [
+        {
+          description: 'en',
+          label: 'English',
+          value: '1',
+        },
+      ],
+    });
+  });
+
+  it('maps products product_media joins to a flat virtual images list and default image', async () => {
+    const query = new MockSupabaseQuery([
+      {
+        id: 'p-1',
+        title: 'Wireless Headphones',
+        short_description: 'Premium headphones',
+        product_media: [
+          {
+            media: {
+              id: 'm-1',
+              object_key: 'headphone-image.png',
+              file_name: 'headphones.png',
+              file_type: 'image/png',
+            },
+          },
+        ],
+      },
+    ]);
+    const result = await searchCustomBlockRelationRows({ from: () => query } as any, {
+      table: 'products',
+      values: ['p-1'],
+    });
+
+    expect(result).toMatchObject({
+      items: [
+        {
+          label: 'Wireless Headphones',
+          value: 'p-1',
+          record: {
+            images: [
+              {
+                id: 'm-1',
+                object_key: 'headphone-image.png',
+                file_name: 'headphones.png',
+                file_type: 'image/png',
+              },
+            ],
+            image: {
+              id: 'm-1',
+              object_key: 'headphone-image.png',
+            },
+            object_key: 'headphone-image.png',
+            main_image: 'headphone-image.png',
+          },
+        },
+      ],
+    });
+  });
+
+  it('maps product_variants parent products (as object or array) to a friendly label', async () => {
+    const query = new MockSupabaseQuery([
+      {
+        id: 'v-1',
+        sku: 'NB-SIGNAL-CAP-L',
+        price: 2600,
+        products: {
+          id: 'p-1',
+          title: 'Signal Cap',
+        },
+      },
+      {
+        id: 'v-2',
+        sku: 'NB-STUDIO-TEE-M',
+        price: 3200,
+        products: [
+          {
+            id: 'p-2',
+            title: 'Studio Tee',
+          },
+        ],
+      },
+    ]);
+
+    const result = await searchCustomBlockRelationRows({ from: () => query } as any, {
+      table: 'product_variants',
+      values: ['v-1', 'v-2'],
+    });
+
+    expect(result).toMatchObject({
+      items: [
+        {
+          label: 'Signal Cap (NB-SIGNAL-CAP-L)',
+          value: 'v-1',
+        },
+        {
+          label: 'Studio Tee (NB-STUDIO-TEE-M)',
+          value: 'v-2',
+        },
+      ],
+    });
+  });
+});