create-nextblock 0.2.78 → 0.8.0

package/templates/nextblock-template/app/api/cron/sync-currencies/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+import { syncStoreCurrencyRates } from '@nextblock-cms/ecommerce/server';
+
+export const dynamic = 'force-dynamic';
+export const maxDuration = 30;
+
+export async function GET(request: NextRequest) {
+  const authHeader = request.headers.get('authorization');
+
+  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
+    return new NextResponse('Unauthorized', {
+      status: 401,
+    });
+  }
+
+  try {
+    const result = await syncStoreCurrencyRates();
+
+    return NextResponse.json({
+      success: true,
+      ...result,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : 'Failed to sync currency exchange rates.',
+      },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/custom-blocks/db-relations/route.ts

@@ -0,0 +1,92 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient } from '@nextblock-cms/db/server';
+
+import {
+  getCustomBlockRelationTargetsResponse,
+  searchCustomBlockRelationRows,
+} from '../../../../lib/custom-block-relations';
+
+export const dynamic = 'force-dynamic';
+
+function parseFilters(rawFilters: string | null) {
+  if (!rawFilters) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(rawFilters);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function parseValues(rawValues: string | null) {
+  if (!rawValues) {
+    return null;
+  }
+
+  return rawValues
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    const { searchParams } = new URL(request.url);
+    const mode = searchParams.get('mode');
+    const table = searchParams.get('table')?.trim();
+
+    if (mode === 'tables' || !table) {
+      return NextResponse.json(getCustomBlockRelationTargetsResponse(), { status: 200 });
+    }
+
+    const result = await searchCustomBlockRelationRows(supabase, {
+      displayColumn: searchParams.get('displayColumn'),
+      filters: parseFilters(searchParams.get('filters')),
+      limit: searchParams.get('limit'),
+      query: searchParams.get('q'),
+      table,
+      valueColumn: searchParams.get('valueColumn'),
+      values: parseValues(searchParams.get('values')),
+    });
+
+    if ('error' in result) {
+      return NextResponse.json({ error: result.error }, { status: result.status });
+    }
+
+    return NextResponse.json(result, { status: 200 });
+  } catch (error) {
+    console.error('[Custom Block Relations API] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Unexpected relation selector error.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/custom-blocks/editor-definitions/route.ts

@@ -0,0 +1,43 @@
+import { NextResponse } from 'next/server';
+import { createClient } from '@nextblock-cms/db/server';
+
+import { loadDynamicCustomBlockExtensionDefinitions } from '../../../../lib/editor/dynamic-extension-loader';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    const definitions = await loadDynamicCustomBlockExtensionDefinitions();
+
+    return NextResponse.json({ definitions }, { status: 200 });
+  } catch (error) {
+    console.error('[Custom Block Editor Definitions API] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Unexpected custom block editor definition error.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/draft/disable/route.ts

@@ -0,0 +1,25 @@
+import { draftMode } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { normalizeDraftRedirectPath } from "../../../../lib/visual-editing/draft-route";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function getRequestedPath(request: NextRequest) {
+  return request.nextUrl.searchParams.get("path") ?? request.nextUrl.searchParams.get("redirect") ?? "/";
+}
+
+export async function GET(request: NextRequest) {
+  const normalizedPath = normalizeDraftRedirectPath(getRequestedPath(request));
+
+  if (!normalizedPath) {
+    return NextResponse.json({ error: "Invalid draft redirect path." }, { status: 400 });
+  }
+
+  const draft = await draftMode();
+  draft.disable();
+
+  const response = NextResponse.redirect(new URL(normalizedPath, request.url));
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}

package/templates/nextblock-template/app/api/draft/route.ts

@@ -0,0 +1,93 @@
+import { draftMode } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { createVerificationClient } from "../../../lib/visual-editing/draft-content";
+import {
+  normalizeDraftRedirectPath,
+  resolveDraftPathTarget,
+  type DraftPathTarget,
+} from "../../../lib/visual-editing/draft-route";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function getRequestedPath(request: NextRequest) {
+  const { searchParams } = request.nextUrl;
+  const explicitPath = searchParams.get("path") ?? searchParams.get("redirect");
+  const slug = searchParams.get("slug");
+  const parentType = searchParams.get("type");
+
+  if (explicitPath) {
+    return explicitPath;
+  }
+
+  if (slug) {
+    if (parentType === "post") {
+      return `/article/${slug}`;
+    }
+
+    if (parentType === "product") {
+      return `/product/${slug}`;
+    }
+
+    return `/${slug}`;
+  }
+
+  return "/";
+}
+
+async function targetExists(target: DraftPathTarget) {
+  const supabase = createVerificationClient() as any;
+  const tableByType: Record<DraftPathTarget["parentType"], string> = {
+    page: "pages",
+    post: "posts",
+    product: "products",
+  };
+  const table = tableByType[target.parentType];
+  const { data, error } = await supabase
+    .from(table)
+    .select("id")
+    .eq("slug", target.slug)
+    .limit(1);
+
+  return !error && Array.isArray(data) && data.length > 0;
+}
+
+export async function GET(request: NextRequest) {
+  const configuredSecret = process.env.DRAFT_MODE_SECRET;
+
+  if (!configuredSecret) {
+    return NextResponse.json(
+      { error: "Draft Mode is not configured." },
+      { status: 500 }
+    );
+  }
+
+  const providedSecret =
+    request.nextUrl.searchParams.get("secret") ??
+    request.nextUrl.searchParams.get("token");
+
+  if (providedSecret !== configuredSecret) {
+    return NextResponse.json({ error: "Invalid Draft Mode secret." }, { status: 401 });
+  }
+
+  const normalizedPath = normalizeDraftRedirectPath(getRequestedPath(request));
+  if (!normalizedPath) {
+    return NextResponse.json({ error: "Invalid draft redirect path." }, { status: 400 });
+  }
+
+  const target = resolveDraftPathTarget(normalizedPath);
+  if (!target) {
+    return NextResponse.json({ error: "Unsupported draft target path." }, { status: 400 });
+  }
+
+  if (!(await targetExists(target))) {
+    return NextResponse.json({ error: "Draft target was not found." }, { status: 404 });
+  }
+
+  const draft = await draftMode();
+  draft.enable();
+
+  const response = NextResponse.redirect(new URL(target.path, request.url));
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}

package/templates/nextblock-template/app/api/draft/start/route.ts

@@ -0,0 +1,77 @@
+import { draftMode } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUserCanEdit } from "../../../../lib/visual-editing/draft-content";
+import {
+  normalizeDraftRedirectPath,
+  resolveDraftPathTarget,
+  type DraftPathTarget,
+} from "../../../../lib/visual-editing/draft-route";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function getRequestedPath(request: NextRequest) {
+  return request.nextUrl.searchParams.get("path") ?? request.nextUrl.searchParams.get("redirect");
+}
+
+function redirectToSignIn(request: NextRequest, normalizedPath: string) {
+  const retryUrl = new URL(request.nextUrl.pathname, request.url);
+  retryUrl.searchParams.set("path", normalizedPath);
+
+  const signInUrl = new URL("/sign-in", request.url);
+  signInUrl.searchParams.set("redirect", `${retryUrl.pathname}${retryUrl.search}`);
+  return redirectNoStore(signInUrl);
+}
+
+function redirectNoStore(url: URL) {
+  const response = NextResponse.redirect(url);
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}
+
+async function targetExists(supabase: unknown, target: DraftPathTarget) {
+  const tableByType: Record<DraftPathTarget["parentType"], string> = {
+    page: "pages",
+    post: "posts",
+    product: "products",
+  };
+  const table = tableByType[target.parentType];
+  const { data, error } = await (supabase as any)
+    .from(table)
+    .select("id")
+    .eq("slug", target.slug)
+    .limit(1);
+
+  return !error && Array.isArray(data) && data.length > 0;
+}
+
+export async function GET(request: NextRequest) {
+  const normalizedPath = normalizeDraftRedirectPath(getRequestedPath(request) ?? "/");
+
+  if (!normalizedPath) {
+    return NextResponse.json({ error: "Invalid draft redirect path." }, { status: 400 });
+  }
+
+  const target = resolveDraftPathTarget(normalizedPath);
+  if (!target) {
+    return NextResponse.json({ error: "Unsupported draft target path." }, { status: 400 });
+  }
+
+  const auth = await getCurrentUserCanEdit();
+  if (!auth.user) {
+    return redirectToSignIn(request, normalizedPath);
+  }
+
+  if (!auth.canEdit) {
+    return NextResponse.json({ error: "You do not have permission to enter Draft Mode." }, { status: 403 });
+  }
+
+  if (!(await targetExists(auth.supabase, target))) {
+    return NextResponse.json({ error: "Draft target was not found." }, { status: 404 });
+  }
+
+  const draft = await draftMode();
+  draft.enable();
+
+  return redirectNoStore(new URL(target.path, request.url));
+}

package/templates/nextblock-template/app/api/media/library/route.ts

@@ -0,0 +1,65 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient as createSupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '@nextblock-cms/db';
+
+const MAX_MEDIA_LIBRARY_ITEMS = 100;
+const DEFAULT_MEDIA_LIBRARY_ITEMS = 50;
+export const dynamic = 'force-dynamic';
+
+function getMediaLibrarySupabaseClient() {
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+
+  if (!supabaseUrl || !supabaseAnonKey) {
+    throw new Error('Missing Supabase environment variables for media library API');
+  }
+
+  return createSupabaseClient<Database>(supabaseUrl, supabaseAnonKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  });
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const query = searchParams.get('q')?.trim() ?? '';
+    const limitParam = Number.parseInt(searchParams.get('limit') ?? '', 10);
+    const limit =
+      Number.isFinite(limitParam) && limitParam > 0
+        ? Math.min(limitParam, MAX_MEDIA_LIBRARY_ITEMS)
+        : DEFAULT_MEDIA_LIBRARY_ITEMS;
+
+    const supabase = getMediaLibrarySupabaseClient();
+
+    let mediaQuery = supabase
+      .from('media')
+      .select('*')
+      .order('created_at', { ascending: false })
+      .limit(limit);
+
+    if (query) {
+      mediaQuery = mediaQuery.ilike('file_name', `%${query}%`);
+    }
+
+    const { data, error } = await mediaQuery;
+
+    if (error) {
+      console.error('[Media Library API] Failed to load media:', error);
+      return NextResponse.json(
+        { error: 'Failed to load media library.' },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({ items: data ?? [] }, { status: 200 });
+  } catch (error) {
+    console.error('[Media Library API] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Unexpected media library error.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/media/r2-presigned/route.ts

@@ -0,0 +1,53 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient } from '@nextblock-cms/db/server';
+
+import {
+  createR2PresignedUpload,
+  R2PresignedUploadError,
+  validateR2PresignedUploadPayload,
+} from '../../../../lib/custom-block-r2-upload';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function POST(request: NextRequest) {
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    const payload = validateR2PresignedUploadPayload(await request.json());
+    const upload = await createR2PresignedUpload(payload, { userId: user.id });
+
+    return NextResponse.json(upload, { status: 200 });
+  } catch (error) {
+    if (error instanceof R2PresignedUploadError) {
+      return NextResponse.json({ error: error.message }, { status: error.status });
+    }
+
+    console.error('[R2 Presigned Upload] Unexpected error:', error);
+    return NextResponse.json(
+      { error: 'Failed to generate upload URL.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/media/record/route.ts

@@ -0,0 +1,160 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { createClient } from '@nextblock-cms/db/server';
+import type { Database } from '@nextblock-cms/db';
+
+type Media = Database['public']['Tables']['media']['Row'];
+
+type ImageVariant = {
+  objectKey: string;
+  url?: string;
+  width?: number;
+  height?: number;
+  fileType?: string;
+  sizeBytes?: number;
+  variantLabel?: string;
+};
+
+type RecordMediaPayload = {
+  fileName?: string;
+  description?: string | null;
+  r2OriginalKey?: string;
+  r2Variants?: ImageVariant[];
+  originalImageDetails?: ImageVariant | null;
+  blurDataUrl?: string | null;
+  blurDataURL?: string | null;
+};
+
+function deriveAltFromFilename(name: string) {
+  const lastDot = name.lastIndexOf('.');
+  const base = lastDot > 0 ? name.substring(0, lastDot) : name;
+  const spaced = base.replace(/[-+_\\]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return spaced.replace(/\b\w+/g, (word) => word.charAt(0).toUpperCase() + word.slice(1));
+}
+
+function buildFallbackVariant(payload: RecordMediaPayload): Required<ImageVariant> {
+  return {
+    objectKey: payload.r2OriginalKey || '',
+    url: '',
+    width: 0,
+    height: 0,
+    fileType: 'application/octet-stream',
+    sizeBytes: 0,
+    variantLabel: 'fallback_original',
+  };
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const payload = (await request.json()) as RecordMediaPayload;
+
+    if (!payload.fileName || !payload.r2OriginalKey) {
+      return NextResponse.json(
+        { error: 'Missing required media payload fields.' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = createClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+
+    if (authError || !user) {
+      return NextResponse.json({ error: 'User not authenticated.' }, { status: 401 });
+    }
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .single();
+
+    if (!profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+      return NextResponse.json(
+        { error: 'Forbidden: Insufficient permissions to record media.' },
+        { status: 403 }
+      );
+    }
+
+    const variants = payload.r2Variants || [];
+    let primaryVariant =
+      variants.find((variant) => variant.variantLabel === 'original_avif') ||
+      variants.find((variant) => variant.variantLabel === 'xlarge_avif') ||
+      variants[0] ||
+      payload.originalImageDetails ||
+      buildFallbackVariant(payload);
+
+    if (!primaryVariant.objectKey) {
+      primaryVariant = buildFallbackVariant(payload);
+    }
+
+    const originalVariant = payload.originalImageDetails;
+    const allVariantsToStore = [
+      ...(originalVariant && originalVariant.objectKey !== primaryVariant.objectKey
+        ? [originalVariant]
+        : []),
+      ...variants,
+    ].filter(
+      (variant, index, self) =>
+        Boolean(variant?.objectKey) &&
+        index === self.findIndex((entry) => entry.objectKey === variant.objectKey)
+    );
+
+    const computedDescription =
+      payload.description ??
+      ((primaryVariant.fileType?.startsWith('image/') ||
+        originalVariant?.fileType?.startsWith('image/'))
+        ? deriveAltFromFilename(payload.fileName)
+        : null);
+
+    const objectKey = primaryVariant.objectKey.replace(/^\/+/, '');
+    const folderMatch = objectKey.match(/^(.*\/)?.*$/);
+    const folder = folderMatch && folderMatch[1] ? folderMatch[1] : null;
+
+    const mediaData: Omit<Media, 'id' | 'created_at' | 'updated_at'> & {
+      uploader_id: string;
+    } = {
+      uploader_id: user.id,
+      file_name: payload.fileName,
+      object_key: objectKey,
+      file_path: objectKey,
+      folder,
+      file_type: primaryVariant.fileType || 'application/octet-stream',
+      size_bytes: primaryVariant.sizeBytes || 0,
+      description: computedDescription,
+      width: primaryVariant.width || 0,
+      height: primaryVariant.height || 0,
+      variants: allVariantsToStore as any,
+      blur_data_url: payload.blurDataUrl ?? payload.blurDataURL ?? null,
+    };
+
+    const { data: newMedia, error } = await supabase
+      .from('media')
+      .insert(mediaData)
+      .select()
+      .single();
+
+    if (error) {
+      console.error('Error recording media upload:', error);
+      return NextResponse.json(
+        { error: `Failed to record media: ${error.message}` },
+        { status: 500 }
+      );
+    }
+
+    revalidatePath('/cms/media');
+
+    return NextResponse.json(
+      { success: true, data: newMedia as Media },
+      { status: 201 }
+    );
+  } catch (error) {
+    console.error('Unexpected error recording media upload:', error);
+    return NextResponse.json(
+      { error: 'Unexpected error while recording media.' },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/search/route.ts

@@ -0,0 +1,43 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { searchPublicContent } from '../../../lib/search/server';
+import type { GlobalSearchFilter } from '../../../lib/search/types';
+
+export const dynamic = 'force-dynamic';
+
+const VALID_FILTERS = new Set<GlobalSearchFilter>(['all', 'page', 'post', 'product']);
+
+function readFilter(value: string | null): GlobalSearchFilter {
+  return VALID_FILTERS.has(value as GlobalSearchFilter)
+    ? (value as GlobalSearchFilter)
+    : 'all';
+}
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const q = searchParams.get('q') || '';
+  const locale = searchParams.get('locale');
+  const filter = readFilter(searchParams.get('type'));
+  const limit = Number.parseInt(searchParams.get('limit') || '', 10);
+
+  try {
+    const response = await searchPublicContent({
+      query: q,
+      locale,
+      filter,
+      limit: Number.isFinite(limit) ? limit : undefined,
+    });
+
+    return NextResponse.json(response);
+  } catch (error) {
+    console.error('Global search failed:', error);
+    return NextResponse.json(
+      {
+        query: q,
+        results: [],
+        counts: { all: 0, page: 0, post: 0, product: 0 },
+        error: 'Search failed',
+      },
+      { status: 500 }
+    );
+  }
+}