create-nextblock 0.2.77 → 0.8.0

package/templates/nextblock-template/lib/auth/twoFactor.ts

@@ -0,0 +1,167 @@
+// Server-only two-factor orchestration: email-code challenges, the signed
+// "email second factor satisfied" session cookie, and the gate that decides
+// whether a signed-in user still owes a second factor before reaching the CMS.
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import { generateNumericCode, hmacSign, safeEqual, sha256Hex } from './crypto';
+import {
+  TWO_FACTOR_COOKIE,
+  clearCookie,
+  getCookieValue,
+  setSecureCookie,
+} from './cookies';
+import { hasValidTrustedDevice } from './trustedDevices';
+
+const EMAIL_CODE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const TWO_FACTOR_SESSION_TTL_SECONDS = 12 * 60 * 60; // 12 hours
+
+/**
+ * Create and persist a hashed 6-digit email code and return the RAW code so the
+ * caller can email it. Prior unconsumed codes for the user are invalidated.
+ */
+export async function createEmailChallenge(userId: string): Promise<string> {
+  const code = generateNumericCode(6);
+  const svc = getServiceRoleSupabaseClient();
+  const nowIso = new Date().toISOString();
+
+  // Invalidate any earlier pending codes so only the newest one works.
+  await svc
+    .from('email_2fa_challenges')
+    .update({ consumed_at: nowIso })
+    .eq('user_id', userId)
+    .is('consumed_at', null);
+
+  await svc.from('email_2fa_challenges').insert({
+    user_id: userId,
+    token_hash: sha256Hex(code),
+    expires_at: new Date(Date.now() + EMAIL_CODE_TTL_MS).toISOString(),
+  });
+
+  return code;
+}
+
+/** True when the user has an unconsumed, unexpired email code awaiting entry. */
+export async function hasPendingEmailChallenge(userId: string): Promise<boolean> {
+  const svc = getServiceRoleSupabaseClient();
+  const { data } = await svc
+    .from('email_2fa_challenges')
+    .select('id')
+    .eq('user_id', userId)
+    .is('consumed_at', null)
+    .gt('expires_at', new Date().toISOString())
+    .limit(1);
+  return Boolean(data && data.length > 0);
+}
+
+/** Verify a submitted email code against the newest live challenge. */
+export async function verifyEmailChallenge(userId: string, code: string): Promise<boolean> {
+  const trimmed = (code || '').trim();
+  if (!/^\d{6}$/.test(trimmed)) return false;
+
+  const svc = getServiceRoleSupabaseClient();
+  const nowIso = new Date().toISOString();
+  const { data } = await svc
+    .from('email_2fa_challenges')
+    .select('id, token_hash, expires_at')
+    .eq('user_id', userId)
+    .is('consumed_at', null)
+    .gt('expires_at', nowIso)
+    .order('created_at', { ascending: false })
+    .limit(5);
+
+  if (!data || data.length === 0) return false;
+  const candidateHash = sha256Hex(trimmed);
+  const match = data.find((row) => safeEqual(row.token_hash, candidateHash));
+  if (!match) return false;
+
+  await svc.from('email_2fa_challenges').update({ consumed_at: nowIso }).eq('id', match.id);
+  return true;
+}
+
+/** Issue the signed cookie that marks the email second factor satisfied. */
+export async function issueTwoFactorVerifiedCookie(userId: string): Promise<void> {
+  const exp = Date.now() + TWO_FACTOR_SESSION_TTL_SECONDS * 1000;
+  const payload = `${userId}.${exp}`;
+  await setSecureCookie(
+    TWO_FACTOR_COOKIE,
+    `${payload}.${hmacSign(payload)}`,
+    TWO_FACTOR_SESSION_TTL_SECONDS,
+  );
+}
+
+export async function clearTwoFactorVerifiedCookie(): Promise<void> {
+  await clearCookie(TWO_FACTOR_COOKIE);
+}
+
+/** Validate the signed email-2FA cookie for a specific user. */
+export async function hasValidTwoFactorCookie(userId: string): Promise<boolean> {
+  const raw = await getCookieValue(TWO_FACTOR_COOKIE);
+  if (!raw) return false;
+  const parts = raw.split('.');
+  if (parts.length !== 3) return false;
+  const [uid, expStr, sig] = parts;
+  if (uid !== userId) return false;
+  const exp = Number(expStr);
+  if (!Number.isFinite(exp) || Date.now() > exp) return false;
+  return safeEqual(hmacSign(`${uid}.${expStr}`), sig);
+}
+
+export type TwoFactorStatus =
+  | 'not_required'
+  | 'satisfied'
+  | 'totp_required'
+  | 'email_required';
+
+export interface TwoFactorEvaluation {
+  status: TwoFactorStatus;
+  userId: string | null;
+  mfaType: 'totp' | 'email' | null;
+}
+
+/**
+ * Decide whether the currently signed-in user still owes a second factor.
+ * Used both to route sign-in and to guard /cms server-side.
+ */
+export async function evaluateTwoFactor(): Promise<TwoFactorEvaluation> {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return { status: 'not_required', userId: null, mfaType: null };
+
+  // Sandbox/demo mode runs on a single shared public account. Never enforce a
+  // second factor there — otherwise anyone enrolling the demo account in 2FA
+  // would lock out every other visitor until the next sandbox reset.
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
+    return { status: 'satisfied', userId: user.id, mfaType: null };
+  }
+
+  const { data: settings } = await supabase
+    .from('user_security_settings')
+    .select('mfa_enabled, mfa_type')
+    .eq('user_id', user.id)
+    .maybeSingle();
+
+  const mfaType = (settings?.mfa_type as 'totp' | 'email' | null) ?? null;
+  if (!settings || !settings.mfa_enabled || !mfaType) {
+    return { status: 'satisfied', userId: user.id, mfaType: null };
+  }
+
+  // A live trusted device bypasses the second factor entirely.
+  if (await hasValidTrustedDevice(user.id)) {
+    return { status: 'satisfied', userId: user.id, mfaType };
+  }
+
+  if (mfaType === 'totp') {
+    const { data: aal } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel();
+    if (aal?.currentLevel === 'aal2') {
+      return { status: 'satisfied', userId: user.id, mfaType };
+    }
+    return { status: 'totp_required', userId: user.id, mfaType };
+  }
+
+  // Email path.
+  if (await hasValidTwoFactorCookie(user.id)) {
+    return { status: 'satisfied', userId: user.id, mfaType };
+  }
+  return { status: 'email_required', userId: user.id, mfaType };
+}

package/templates/nextblock-template/lib/auth-redirects.ts

@@ -0,0 +1,46 @@
+import type { Database } from '@nextblock-cms/db';
+
+type AuthProfile = Pick<Database['public']['Tables']['profiles']['Row'], 'role' | 'full_name'> | null;
+
+const DASHBOARD_PATH = '/cms/dashboard';
+const HOME_PATH = '/';
+const PROFILE_PATH = '/profile';
+const PASSWORD_RESET_PATH = '/profile/password';
+
+function isSafeInternalPath(path?: string | null) {
+  return Boolean(path && path.startsWith('/') && !path.startsWith('//'));
+}
+
+function isDashboardPath(path: string) {
+  return path === DASHBOARD_PATH || path.startsWith(`${DASHBOARD_PATH}/`);
+}
+
+export function isCustomerProfileComplete(profile: AuthProfile) {
+  return Boolean(profile?.full_name?.trim());
+}
+
+export function resolvePostAuthRedirect(
+  profile: AuthProfile,
+  requestedPath?: string | null
+) {
+  const safePath = isSafeInternalPath(requestedPath) ? requestedPath : null;
+  const role = profile?.role ?? null;
+
+  if (safePath === PASSWORD_RESET_PATH) {
+    return PASSWORD_RESET_PATH;
+  }
+
+  if (role === 'ADMIN' || role === 'WRITER') {
+    return safePath ?? DASHBOARD_PATH;
+  }
+
+  if (!isCustomerProfileComplete(profile)) {
+    return PROFILE_PATH;
+  }
+
+  if (safePath && !isDashboardPath(safePath)) {
+    return safePath;
+  }
+
+  return HOME_PATH;
+}

package/templates/nextblock-template/lib/blocks/FeaturedProductBlock.tsx

@@ -0,0 +1,94 @@
+import { FeaturedProduct } from '@nextblock-cms/ecommerce/components/FeaturedProduct';
+import { getProduct } from '@nextblock-cms/ecommerce/server';
+import { normalizePriceMap, normalizeSalePriceMap } from '@nextblock-cms/ecommerce/currency';
+import { getVariantEffectivePriceRange } from '@nextblock-cms/ecommerce/variation-utils';
+
+import type { FeaturedProductBlockContent } from './ecommerce-block-schemas';
+import { getSsgSupabaseClient } from '@nextblock-cms/db/server';
+
+// Component (Server Component)
+export const FeaturedProductBlock = async ({ content }: { content: FeaturedProductBlockContent }) => {
+  const supabase = getSsgSupabaseClient();
+  const { data: product } = await getProduct(supabase, content.productId); // Assuming getProduct takes ID or Slug. Usually ID for blocks.
+  const productRecord = product as any;
+
+  if (!productRecord) {
+      return null; // Or render placeholder in edit mode
+  }
+
+  // Image Resolution
+  let imageUrl = undefined;
+  const mediaItem = productRecord.product_media?.[0]?.media;
+  if (mediaItem?.file_path) {
+     if (mediaItem.file_path.startsWith('http')) {
+       imageUrl = mediaItem.file_path;
+     } else if (process.env.NEXT_PUBLIC_R2_BASE_URL) {
+       imageUrl = `${process.env.NEXT_PUBLIC_R2_BASE_URL}/${mediaItem.file_path}`;
+     } else {
+       imageUrl = `${process.env.NEXT_PUBLIC_SUPABASE_URL}/storage/v1/object/public/media/${mediaItem.file_path}`;
+     }
+  }
+
+  const variantPriceRange = getVariantEffectivePriceRange(
+    ((product as any).product_variants || []).map((variant: any) => ({
+      price: variant.price,
+      sale_price: variant.sale_price,
+      sale_start_at: variant.sale_start_at ?? null,
+      sale_end_at: variant.sale_end_at ?? null,
+    }))
+  );
+  const uiProduct = {
+    id: productRecord.id,
+    title: productRecord.title,
+    slug: productRecord.slug,
+    sku: productRecord.sku,
+    upc: productRecord.upc || undefined,
+    price: productRecord.price,
+    prices: normalizePriceMap(productRecord.prices),
+    sale_price:
+      typeof productRecord.sale_price === 'number' ? productRecord.sale_price : undefined,
+    sale_prices: normalizeSalePriceMap(productRecord.sale_prices),
+    sale_start_at: productRecord.sale_start_at ?? null,
+    sale_end_at: productRecord.sale_end_at ?? null,
+    scheduled_price:
+      typeof productRecord.scheduled_price === 'number' ? productRecord.scheduled_price : undefined,
+    scheduled_prices: normalizePriceMap(productRecord.scheduled_prices),
+    scheduled_price_at: productRecord.scheduled_price_at ?? null,
+    is_taxable: productRecord.is_taxable ?? true,
+    product_type: productRecord.product_type ?? undefined,
+    payment_provider: productRecord.payment_provider ?? undefined,
+    price_range_min: variantPriceRange?.min ?? null,
+    price_range_max: variantPriceRange?.max ?? null,
+    image_url: imageUrl,
+    short_description: productRecord.short_description || undefined,
+    stock: productRecord.stock,
+    freemius_product_id: productRecord.freemius_product_id || undefined,
+    freemius_plan_id: productRecord.freemius_plan_id || undefined,
+    trial_period_days: productRecord.trial_period_days ?? 0,
+    trial_requires_payment_method: productRecord.trial_requires_payment_method ?? false,
+    freemius_plans: productRecord.freemius_plans,
+    language_id: productRecord.language_id,
+    translation_group_id: productRecord.translation_group_id || "",
+    has_variants: (productRecord.product_variants?.length || 0) > 0,
+    product_variants: (productRecord.product_variants || []).map((variant: any) => ({
+      id: variant.id,
+      price: variant.price,
+      prices: normalizePriceMap(variant.prices),
+      sale_price: variant.sale_price,
+      sale_prices: normalizeSalePriceMap(variant.sale_prices),
+      sale_start_at: variant.sale_start_at ?? null,
+      sale_end_at: variant.sale_end_at ?? null,
+      scheduled_price: variant.scheduled_price ?? null,
+      scheduled_prices: normalizePriceMap(variant.scheduled_prices),
+      scheduled_price_at: variant.scheduled_price_at ?? null,
+    })),
+  };
+
+  return (
+    <section className={`py-12 ${content.showBackground ? 'bg-secondary/30' : ''}`}>
+       <div className="container">
+          <FeaturedProduct product={uiProduct} imagePosition={content.imagePosition} />
+       </div>
+    </section>
+  );
+};

package/templates/nextblock-template/lib/blocks/ProductGridBlock.tsx

@@ -0,0 +1,137 @@
+import { ProductGrid } from '@nextblock-cms/ecommerce/components/ProductGrid';
+import { getProducts } from '@nextblock-cms/ecommerce/server';
+import { normalizePriceMap, normalizeSalePriceMap } from '@nextblock-cms/ecommerce/currency';
+import { getVariantEffectivePriceRange } from '@nextblock-cms/ecommerce/variation-utils';
+
+
+import type { ProductGridBlockContent } from './ecommerce-block-schemas';
+
+import { getSsgSupabaseClient } from '@nextblock-cms/db/server';
+
+interface ProductGridBlockProps {
+  content: ProductGridBlockContent;
+  languageId?: number;
+  excludeProductId?: string;
+  excludeTranslationGroupId?: string | null;
+}
+
+// Component (Server Component)
+export const ProductGridBlock = async ({ 
+  content, 
+  languageId,
+  excludeProductId,
+  excludeTranslationGroupId,
+}: ProductGridBlockProps) => {
+  const supabase = getSsgSupabaseClient();
+  // Fetch products filtered by language
+  // We fetch more to ensure we have enough after manual checks
+  const { data: products } = await getProducts(supabase, {
+    languageId,
+    categoryId: content.type === 'category' ? content.categoryId : undefined,
+    limit: content.limit + 2, 
+  }); 
+  
+  const productRows = (products || []) as any[];
+
+  if (productRows.length === 0) {
+      return null; // Silent fail if no products
+  }
+
+  // 1. Filter out current product and its translations
+  const filteredProducts = productRows.filter((p) => {
+    if (excludeProductId && p.id === excludeProductId) return false;
+    if (excludeTranslationGroupId && p.translation_group_id === excludeTranslationGroupId) return false;
+    return true;
+  });
+
+  // 2. Hide if no products remain
+  if (filteredProducts.length === 0) {
+      return null;
+  }
+
+  // 3. Transform DB products to UI products
+  const uiProducts = filteredProducts.slice(0, content.limit).map(p => {
+      const productRecord = p as any;
+      let imageUrl = undefined;
+      // Accessing the nested media object correctly (array of objects with media property)
+      // The type from getProducts select is: product_media: { media: { file_path: string | null } | null }[]
+      const mediaItem = p.product_media?.[0]?.media;
+      if (mediaItem?.file_path) {
+         if (mediaItem.file_path.startsWith('http')) {
+           imageUrl = mediaItem.file_path;
+         } else if (process.env.NEXT_PUBLIC_R2_BASE_URL) {
+           imageUrl = `${process.env.NEXT_PUBLIC_R2_BASE_URL}/${mediaItem.file_path}`;
+         } else {
+           imageUrl = `${process.env.NEXT_PUBLIC_SUPABASE_URL}/storage/v1/object/public/media/${mediaItem.file_path}`;
+         }
+      }
+
+      const variantPriceRange = getVariantEffectivePriceRange(
+        (p.product_variants || []).map((variant: any) => ({
+          price: variant.price,
+          sale_price: variant.sale_price,
+          sale_start_at: variant.sale_start_at ?? null,
+          sale_end_at: variant.sale_end_at ?? null,
+        }))
+      );
+
+      return {
+        id: p.id,
+        title: p.title,
+        slug: p.slug,
+        sku: p.sku,
+        upc: p.upc || undefined,
+        price: p.price,
+        prices: normalizePriceMap(p.prices),
+        sale_price: typeof p.sale_price === 'number' ? p.sale_price : undefined,
+        sale_prices: normalizeSalePriceMap(p.sale_prices),
+        sale_start_at: p.sale_start_at ?? null,
+        sale_end_at: p.sale_end_at ?? null,
+        scheduled_price: typeof p.scheduled_price === 'number' ? p.scheduled_price : undefined,
+        scheduled_prices: normalizePriceMap(p.scheduled_prices),
+        scheduled_price_at: p.scheduled_price_at ?? null,
+        is_taxable: p.is_taxable ?? true,
+        product_type: productRecord.product_type ?? undefined,
+        payment_provider: productRecord.payment_provider ?? undefined,
+        price_range_min: variantPriceRange?.min ?? null,
+        price_range_max: variantPriceRange?.max ?? null,
+        image_url: imageUrl,
+        short_description: p.short_description || undefined,
+        categories: (p.product_categories || []).map((pc: any) => pc.category).filter(Boolean),
+        language_id: p.language_id as number,
+        translation_group_id: p.translation_group_id || "",
+        freemius_product_id: productRecord.freemius_product_id || undefined,
+        freemius_plan_id: productRecord.freemius_plan_id || undefined,
+        trial_period_days: productRecord.trial_period_days ?? 0,
+        trial_requires_payment_method:
+          productRecord.trial_requires_payment_method ?? false,
+        freemius_plans: productRecord.freemius_plans,
+        has_variants: (p.product_variants?.length || 0) > 0,
+        product_variants: (p.product_variants || []).map((variant: any) => ({
+          id: variant.id,
+          price: variant.price,
+          prices: normalizePriceMap(variant.prices),
+          sale_price: variant.sale_price,
+          sale_prices: normalizeSalePriceMap(variant.sale_prices),
+          sale_start_at: variant.sale_start_at ?? null,
+          sale_end_at: variant.sale_end_at ?? null,
+          scheduled_price: variant.scheduled_price ?? null,
+          scheduled_prices: normalizePriceMap(variant.scheduled_prices),
+          scheduled_price_at: variant.scheduled_price_at ?? null,
+        })),
+      };
+  });
+
+  return (
+    <section className="py-12">
+       {content.title && (
+         <div className="container mb-8">
+            <h2 className="text-3xl font-bold tracking-tight">{content.title}</h2>
+         </div>
+       )}
+       <div className="container">
+          <ProductGrid products={uiProducts} />
+       </div>
+    </section>
+  );
+};