create-nextblock 0.2.78 → 0.8.0

package/templates/nextblock-template/app/actions.ts

@@ -4,6 +4,10 @@ import { encodedRedirect } from "@nextblock-cms/utils/server";
 import { createClient } from "@nextblock-cms/db/server";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
+import { resolvePostAuthRedirect } from "../lib/auth-redirects";
+import { createEmailChallenge, evaluateTwoFactor } from "../lib/auth/twoFactor";
+import { REMEMBER_INTENT_COOKIE, setSecureCookie } from "../lib/auth/cookies";
+import { sendTwoFactorCodeEmail } from "./actions/twoFactorEmail";
 
 export const signUpAction = async (formData: FormData) => {
   const email = formData.get("email")?.toString();
@@ -11,7 +15,11 @@ export const signUpAction = async (formData: FormData) => {
   const supabase = await createClient();
   const origin = (await headers()).get("origin");
   const nextPublicUrl = process.env.NEXT_PUBLIC_URL;
-  const redirectBase = nextPublicUrl ? `https://${nextPublicUrl}` : origin;
+  const redirectBase = nextPublicUrl
+    ? nextPublicUrl.startsWith("http")
+      ? nextPublicUrl
+      : `https://${nextPublicUrl}`
+    : origin;
 
   if (!email || !password) {
     return encodedRedirect(
@@ -25,18 +33,35 @@ export const signUpAction = async (formData: FormData) => {
     email,
     password,
     options: {
-      emailRedirectTo: `${redirectBase}/auth/callback`,
+      emailRedirectTo: `${redirectBase}/auth/callback?redirect_to=/profile`,
     },
   });
 
   if (error) {
     console.error(error.code + " " + error.message);
+
+    if (error.message.toLowerCase().includes("rate limit")) {
+      return encodedRedirect(
+        "error",
+        "/sign-up",
+        "auth.signup_rate_limit"
+      );
+    }
+
+    if (error.message.toLowerCase().includes("already")) {
+      return encodedRedirect(
+        "error",
+        "/sign-up",
+        "auth.signup_existing_account_hint"
+      );
+    }
+
     return encodedRedirect("error", "/sign-up", error.message);
   } else {
     return encodedRedirect(
       "success",
       "/sign-up",
-      "Thanks for signing up! Please check your email for a verification link.",
+      "auth.signup_check_email_profile",
     );
   }
 };
@@ -44,6 +69,10 @@ export const signUpAction = async (formData: FormData) => {
 export const signInAction = async (formData: FormData) => {
   const email = formData.get("email") as string;
   const password = formData.get("password") as string;
+  const requestedRedirect = formData.get("redirect")?.toString();
+  const rememberDevice =
+    formData.get("remember_device") === "on" ||
+    formData.get("remember_device") === "true";
   const supabase = await createClient();
 
   const { data, error } = await supabase.auth.signInWithPassword({
@@ -58,13 +87,35 @@ export const signInAction = async (formData: FormData) => {
   if (data.user) {
     const { data: profile } = await supabase
       .from('profiles')
-      .select('role')
+      .select('role, full_name')
       .eq('id', data.user.id)
       .single();
 
-    if (profile && (profile.role === 'ADMIN' || profile.role === 'WRITER')) {
-      return redirect("/post-sign-in?redirect_to=/cms/dashboard");
+    const nextPath = resolvePostAuthRedirect(profile ?? null, requestedRedirect);
+
+    // Decide whether a second factor is still owed. A live trusted device, or
+    // an account without MFA, resolves to "satisfied" and skips the challenge.
+    const evaluation = await evaluateTwoFactor();
+    if (evaluation.status === "satisfied" || evaluation.status === "not_required") {
+      return redirect(`/post-sign-in?redirect_to=${encodeURIComponent(nextPath)}`);
     }
+
+    // Carry the "remember this device" intent through the 2FA challenge.
+    if (rememberDevice) {
+      await setSecureCookie(REMEMBER_INTENT_COOKIE, "1", 15 * 60);
+    }
+
+    // Email factor: send the first code now so the challenge page has one waiting.
+    if (evaluation.status === "email_required" && data.user.email) {
+      try {
+        const code = await createEmailChallenge(data.user.id);
+        await sendTwoFactorCodeEmail(data.user.email, code);
+      } catch (sendError) {
+        console.error("Failed to send 2FA email code:", sendError);
+      }
+    }
+
+    return redirect(`/two-factor?redirect_to=${encodeURIComponent(nextPath)}`);
   }
 
   return redirect("/post-sign-in");
@@ -75,7 +126,11 @@ export const forgotPasswordAction = async (formData: FormData) => {
   const supabase = await createClient();
   const origin = (await headers()).get("origin");
   const nextPublicUrl = process.env.NEXT_PUBLIC_URL;
-  const redirectBase = nextPublicUrl ? `https://${nextPublicUrl}` : origin;
+  const redirectBase = nextPublicUrl
+    ? nextPublicUrl.startsWith("http")
+      ? nextPublicUrl
+      : `https://${nextPublicUrl}`
+    : origin;
   const callbackUrl = formData.get("callbackUrl")?.toString();
 
   if (!email) {
@@ -83,7 +138,7 @@ export const forgotPasswordAction = async (formData: FormData) => {
   }
 
   const { error } = await supabase.auth.resetPasswordForEmail(email, {
-    redirectTo: `${redirectBase}/auth/callback?redirect_to=/reset-password`,
+    redirectTo: `${redirectBase}/auth/callback?redirect_to=/profile/password`,
   });
 
   if (error) {
@@ -115,7 +170,7 @@ export const resetPasswordAction = async (formData: FormData) => {
   if (!password || !confirmPassword) {
     encodedRedirect(
       "error",
-      "/reset-password",
+      "/profile/password",
       "Password and confirm password are required",
     );
   }
@@ -123,7 +178,7 @@ export const resetPasswordAction = async (formData: FormData) => {
   if (password !== confirmPassword) {
     encodedRedirect(
       "error",
-      "/reset-password",
+      "/profile/password",
       "Passwords do not match",
     );
   }
@@ -135,12 +190,12 @@ export const resetPasswordAction = async (formData: FormData) => {
   if (error) {
     encodedRedirect(
       "error",
-      "/reset-password",
+      "/profile/password",
       "Password update failed",
     );
   }
 
-  encodedRedirect("success", "/reset-password", "Password updated");
+  encodedRedirect("success", "/profile/password", "Password updated");
 };
 
 export const signOutAction = async () => {

package/templates/nextblock-template/app/api/ai/cortex/build-widget/route.ts

@@ -0,0 +1,153 @@
+import { NextResponse } from 'next/server';
+import { revalidatePath, revalidateTag } from 'next/cache';
+
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+
+import { generateCortexWidgetDefinition } from '../../../../../lib/ai-cortex-widget-builder';
+import {
+  cortexWidgetBuildRequestSchema,
+} from '../../../../../lib/cortex-widget-schema';
+import {
+  CortexWidgetRegistryInsertError,
+  insertCortexWidgetDefinition,
+} from '../../../../../lib/cortex-widget-registry';
+import {
+  CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG,
+  getCustomBlockDefinitionCacheTag,
+} from '../../../../../lib/custom-block-definitions';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '../../../../../lib/ai-model-registry';
+
+export const dynamic = 'force-dynamic';
+
+const DYNAMIC_LAYOUT_ENGINE_CACHE_TAG = 'dynamic-layout-engine';
+
+type SupabaseServerClient = ReturnType<typeof createClient>;
+
+async function requireCmsWriterAccess(supabase: SupabaseServerClient) {
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return null;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+    return null;
+  }
+
+  return { userId: user.id };
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+function getDynamicLayoutDefinitionCacheTag(idOrSlug: string) {
+  return `${DYNAMIC_LAYOUT_ENGINE_CACHE_TAG}:definition:${idOrSlug}`;
+}
+
+function revalidateCortexWidgetDefinition(definition: { id: string; slug: string }) {
+  revalidateTag(CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG, 'max');
+  revalidateTag(getCustomBlockDefinitionCacheTag(definition.id), 'max');
+  revalidateTag(getCustomBlockDefinitionCacheTag(definition.slug), 'max');
+  revalidateTag(DYNAMIC_LAYOUT_ENGINE_CACHE_TAG, 'max');
+  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.id), 'max');
+  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.slug), 'max');
+  revalidatePath('/cms/blocks');
+  revalidatePath('/cms/custom-blocks');
+}
+
+export async function POST(request: Request) {
+  try {
+    const supabase = createClient();
+    const access = await requireCmsWriterAccess(supabase);
+
+    if (!access) {
+      return jsonError('You do not have permission to build Cortex widgets.', 403);
+    }
+
+    const isCortexAiActive = await verifyPackageOnline('cortex-ai');
+
+    if (!isCortexAiActive) {
+      return jsonError('NextBlock Cortex AI is not active for this workspace.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = cortexWidgetBuildRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex widget build request.', 400);
+    }
+
+    const sandboxKey =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-key')
+        : null;
+    const sandboxModelRaw =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-model')
+        : null;
+
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore malformed sandbox model headers.
+      }
+    }
+
+    const generation = await generateCortexWidgetDefinition({
+      ...parsedRequest.data,
+      apiKey: sandboxKey || undefined,
+      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
+    });
+    const definition = await insertCortexWidgetDefinition(supabase, generation.definition);
+
+    revalidateCortexWidgetDefinition(definition);
+
+    return NextResponse.json(
+      {
+        attempts: generation.attempts,
+        credentialSource: generation.credentialSource,
+        definition,
+        modelId: generation.modelId,
+        success: true,
+      },
+      {
+        headers: {
+          'x-cortex-ai-credential-source': generation.credentialSource,
+          'x-cortex-ai-model': generation.modelId,
+        },
+      }
+    );
+  } catch (error) {
+    if (error instanceof CortexWidgetRegistryInsertError) {
+      return jsonError(error.message, error.status);
+    }
+
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to build widget after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+
+    console.error('[Cortex AI] Failed to build widget:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to build Cortex widget.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/ai/generate-blocks/route.ts

@@ -0,0 +1,96 @@
+import { NextResponse } from 'next/server';
+
+import { createClient } from '@nextblock-cms/db/server';
+
+import {
+  generateEditorHtmlFragment,
+  generateEditorBlocksRequestSchema,
+} from '../../../../lib/ai-block-generation';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '../../../../lib/ai-model-registry';
+
+export const dynamic = 'force-dynamic';
+
+async function requireCmsEditorAccess() {
+  const supabase = createClient();
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return false;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  return !profileError && (profile?.role === 'ADMIN' || profile?.role === 'WRITER');
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+export async function POST(request: Request) {
+  try {
+    const hasAccess = await requireCmsEditorAccess();
+
+    if (!hasAccess) {
+      return jsonError('You do not have permission to generate editor blocks.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = generateEditorBlocksRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex AI block generation request.', 400);
+    }
+
+    const sandboxKey = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-key') : null;
+    const sandboxModelRaw = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-model') : null;
+    
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore parse errors from headers
+      }
+    }
+
+    const result = await generateEditorHtmlFragment({
+      ...parsedRequest.data,
+      apiKey: sandboxKey || undefined,
+      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
+    });
+
+    return NextResponse.json({
+      credentialSource: result.credentialSource,
+      html: result.html,
+      modelId: result.modelId,
+    }, {
+      headers: {
+        'x-cortex-ai-credential-source': result.credentialSource,
+        'x-cortex-ai-model': result.modelId,
+      },
+    });
+  } catch (error) {
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to generate editor HTML after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+    console.error('[Cortex AI] Failed to generate editor HTML:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to generate editor HTML.'),
+      500
+    );
+  }
+}