create-nextblock 0.8.11 → 0.9.5

package/templates/nextblock-template/app/actions.ts

@@ -1,13 +1,14 @@
 "use server";
 
 import { encodedRedirect } from "@nextblock-cms/utils/server";
-import { createClient } from "@nextblock-cms/db/server";
+import { createClient, getServiceRoleSupabaseClient } from "@nextblock-cms/db/server";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { resolvePostAuthRedirect } from "../lib/auth-redirects";
 import { createEmailChallenge, evaluateTwoFactor } from "../lib/auth/twoFactor";
 import { REMEMBER_INTENT_COOKIE, setSecureCookie } from "../lib/auth/cookies";
 import { sendTwoFactorCodeEmail } from "./actions/twoFactorEmail";
+import { getSystemConfiguration } from "../lib/setup/system-config";
 
 export const signUpAction = async (formData: FormData) => {
   const email = formData.get("email")?.toString();
@@ -29,7 +30,48 @@ export const signUpAction = async (formData: FormData) => {
     );
   }
 
-  const { error } = await supabase.auth.signUp({
+  // Auto-accept mode (system_configuration.auto_accept_signups): create an already-
+  // confirmed account via the service role so the user is active immediately, with no
+  // outbound verification email — regardless of SMTP / project email-confirmation
+  // settings. Falls through to the standard signUp flow if the service role isn't
+  // available. NOTE: keep supabase.auth calls outside any try/catch so the redirect
+  // they (and encodedRedirect) throw internally is never swallowed.
+  const { auto_accept_signups: autoAcceptSignups } = await getSystemConfiguration();
+  if (autoAcceptSignups) {
+    let admin: ReturnType<typeof getServiceRoleSupabaseClient> | null = null;
+    try {
+      admin = getServiceRoleSupabaseClient();
+    } catch {
+      admin = null; // service role missing — use the standard flow below
+    }
+
+    if (admin) {
+      const { error: createError } = await admin.auth.admin.createUser({
+        email,
+        password,
+        email_confirm: true,
+      });
+
+      if (createError) {
+        if (createError.message.toLowerCase().includes("already")) {
+          return encodedRedirect("error", "/sign-up", "auth.signup_existing_account_hint");
+        }
+        return encodedRedirect("error", "/sign-up", createError.message);
+      }
+
+      const { error: signInError } = await supabase.auth.signInWithPassword({
+        email,
+        password,
+      });
+      if (signInError) {
+        return encodedRedirect("error", "/sign-in", signInError.message);
+      }
+
+      return redirect("/post-sign-in");
+    }
+  }
+
+  const { data, error } = await supabase.auth.signUp({
     email,
     password,
     options: {
@@ -57,13 +99,21 @@ export const signUpAction = async (formData: FormData) => {
     }
 
     return encodedRedirect("error", "/sign-up", error.message);
-  } else {
-    return encodedRedirect(
-      "success",
-      "/sign-up",
-      "auth.signup_check_email_profile",
-    );
   }
+
+  // When sign-up returns a session, the account is already confirmed — self-hosted GoTrue with
+  // autoconfirm (no SMTP), or any project without email confirmation. The user is already signed
+  // in, so send them into the app instead of telling them to check an email that was never sent.
+  // (The first account becomes ADMIN and lands in the dashboard; everyone else routes normally.)
+  if (data.session) {
+    return redirect("/post-sign-in");
+  }
+
+  return encodedRedirect(
+    "success",
+    "/sign-up",
+    "auth.signup_check_email_profile",
+  );
 };
 
 export const signInAction = async (formData: FormData) => {

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -7816,6 +7816,89 @@ npm run dev</code></pre>
 ), 0 FROM target_posts tp WHERE tp.slug = 'comment-configurer-nextblock';
 
 
+-- >>> FROM: 00000000000030_setup_system_configuration.sql <<<
+-- 00000000000030_setup_system_configuration.sql
+-- First-Boot Setup Wizard: global system configuration.
+--
+-- Adds a dedicated, RLS-locked \`system_configuration\` table that holds settings the
+-- browser /setup wizard manages and that don't belong in the public key-value
+-- \`site_settings\` store. It is a singleton (exactly one row, id = 1).
+--
+-- Shape:
+--   auto_accept_signups boolean  -- when true, new public sign-ups skip outbound email
+--                                   verification (the signup route uses a service-role
+--                                   admin.createUser({ email_confirm: true }) path).
+--   settings            jsonb    -- forward-compatible catch-all for future feature
+--                                   toggles ({} by default). Do NOT store true secrets
+--                                   here (Turnstile/AI secrets keep living in their
+--                                   existing site_settings sensitive keys).
+--
+-- Access is locked to the ADMIN role for normal clients (NextBlock has no separate
+-- "super-admin" tier — ADMIN is the top level). The service_role retains full access
+-- so the wizard can seed/read it before any admin exists.
+
+CREATE TABLE IF NOT EXISTS public.system_configuration (
+  id integer PRIMARY KEY DEFAULT 1,
+  auto_accept_signups boolean NOT NULL DEFAULT false,
+  settings jsonb NOT NULL DEFAULT '{}'::jsonb,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT system_configuration_singleton CHECK (id = 1)
+);
+
+COMMENT ON TABLE public.system_configuration IS
+  'Singleton (id = 1) of global setup-wizard configuration. ADMIN-only via RLS; never store secrets in settings.';
+
+-- Seed the single row so reads always find it.
+INSERT INTO public.system_configuration (id, auto_accept_signups, settings)
+VALUES (1, false, '{}'::jsonb)
+ON CONFLICT (id) DO NOTHING;
+
+ALTER TABLE public.system_configuration ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.system_configuration TO authenticated;
+GRANT ALL ON public.system_configuration TO service_role;
+
+-- ADMIN-only for every operation by authenticated clients.
+DROP POLICY IF EXISTS system_configuration_admin_select ON public.system_configuration;
+CREATE POLICY system_configuration_admin_select
+  ON public.system_configuration
+  FOR SELECT
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_insert ON public.system_configuration;
+CREATE POLICY system_configuration_admin_insert
+  ON public.system_configuration
+  FOR INSERT
+  TO authenticated
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_update ON public.system_configuration;
+CREATE POLICY system_configuration_admin_update
+  ON public.system_configuration
+  FOR UPDATE
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN')
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_delete ON public.system_configuration;
+CREATE POLICY system_configuration_admin_delete
+  ON public.system_configuration
+  FOR DELETE
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+-- Service role bypasses the ADMIN checks (used by the wizard before an admin exists,
+-- and by the signup route to read auto_accept_signups as an anonymous visitor).
+DROP POLICY IF EXISTS system_configuration_service_role_all ON public.system_configuration;
+CREATE POLICY system_configuration_service_role_all
+  ON public.system_configuration
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+
   -- Step D: Anchor preserved profiles
   INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
   SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'

package/templates/nextblock-template/app/api/upload/presigned-url/route.ts

@@ -1,7 +1,7 @@
 // app/api/upload/presigned-url/route.ts
 import { NextRequest, NextResponse } from "next/server";
-import { createClient } from "@nextblock-cms/db/server"; // Server client for auth
-import { getS3Client } from "@nextblock-cms/utils/server";
+import { createClient } from "@nextblock-cms/db/server"; // Server client for auth
+import { getS3PresignClient } from "@nextblock-cms/utils/server";
 import { PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
@@ -32,13 +32,13 @@ export async function POST(request: NextRequest) {
   }
 
   try {
-    const s3Client = await getS3Client();
-    if (!s3Client) {
-      console.error('R2 client is not configured. Check your R2 environment variables.');
-      return NextResponse.json({ error: 'File uploads are not configured on this server.' }, { status: 500 });
-    }
-
-    const { filename, contentType, size, folder: rawFolder } = await request.json();
+    const s3Client = await getS3PresignClient();
+    if (!s3Client) {
+      console.error('R2 client is not configured. Check your R2 environment variables.');
+      return NextResponse.json({ error: 'File uploads are not configured on this server.' }, { status: 500 });
+    }
+
+    const { filename, contentType, size, folder: rawFolder } = await request.json();
 
     if (!filename || !contentType || !size) {
       return NextResponse.json({ error: "Missing filename, contentType, or size" }, { status: 400 });

package/templates/nextblock-template/app/article/[slug]/page.tsx

@@ -25,6 +25,11 @@ import { getRequestOrigin } from '../../../lib/visual-editing/edit-info';
 
 export const dynamicParams = true;
 export const revalidate = 3600;
+// Render per-request: the shared root layout reads cookies()/headers()/draftMode() (auth + locale),
+// so attempting a statically-cached render throws DYNAMIC_SERVER_USAGE (500). Matches the sibling
+// content routes /[slug] and /product/[slug], which already force dynamic for the same reason.
+export const dynamic = 'force-dynamic';
+export const fetchCache = 'force-no-store';
 
 interface ResolvedPostParams {
   slug: string;

package/templates/nextblock-template/app/cms/settings/security/actions.ts

@@ -24,6 +24,10 @@ import {
   revokeTrustedDevice,
   type TrustedDeviceRow,
 } from '../../../../lib/auth/trustedDevices';
+import {
+  getSystemConfiguration,
+  updateSystemConfiguration,
+} from '../../../../lib/setup/system-config';
 
 export interface SecurityPanelData {
   email: string;
@@ -33,6 +37,7 @@ export interface SecurityPanelData {
   isAdmin: boolean;
   globalSettings: SecuritySettings;
   trustedDevices: TrustedDeviceRow[];
+  autoAcceptSignups: boolean;
 }
 
 async function requireUser() {
@@ -70,6 +75,31 @@ export async function getSecurityPanelData(): Promise<SecurityPanelData> {
     isAdmin: profile?.role === 'ADMIN',
     globalSettings: await readSecuritySettings(),
     trustedDevices: await listTrustedDevices(user.id),
+    autoAcceptSignups: (await getSystemConfiguration()).auto_accept_signups,
+  };
+}
+
+// --- Sign-up policy (admin only) ------------------------------------------------
+
+export async function updateAutoAcceptSignups(formData: FormData) {
+  const { supabase, user } = await requireUser();
+  const { data: profile } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (profile?.role !== 'ADMIN') {
+    throw new Error('Only administrators can change the sign-up policy.');
+  }
+
+  const enabled = formData.get('auto_accept_signups') === 'true';
+  await updateSystemConfiguration({ auto_accept_signups: enabled });
+  revalidatePath('/cms/settings/security');
+  return {
+    success: true,
+    message: enabled
+      ? 'New sign-ups will be auto-approved without email verification.'
+      : 'New sign-ups now require email verification.',
   };
 }
 

package/templates/nextblock-template/app/cms/settings/security/components/SecurityPanel.tsx

@@ -28,6 +28,7 @@ import {
   revokeTrustedDeviceAction,
   sendEmailEnrollmentCode,
   startTotpEnrollment,
+  updateAutoAcceptSignups,
   updateGlobalSecuritySettings,
   verifyEmailEnrollment,
   verifyTotpEnrollment,
@@ -369,10 +370,78 @@ export default function SecurityPanel({ data }: { data: SecurityPanelData }) {
           onSave={(formData) => run(() => updateGlobalSecuritySettings(formData))}
         />
       )}
+
+      {/* Sign-up policy (admin only) */}
+      {data.isAdmin && (
+        <SignupPolicyCard
+          initial={data.autoAcceptSignups}
+          isPending={isPending}
+          onSave={(formData) => run(() => updateAutoAcceptSignups(formData))}
+        />
+      )}
     </>
   );
 }
 
+function SignupPolicyCard({
+  initial,
+  isPending,
+  onSave,
+}: {
+  initial: boolean;
+  isPending: boolean;
+  onSave: (formData: FormData) => void;
+}) {
+  const [enabled, setEnabled] = useState(initial);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Sign-up Policy (Admin)</CardTitle>
+        <CardDescription>
+          Controls how new public registrations are handled across the whole site.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            const formData = new FormData();
+            formData.append('auto_accept_signups', String(enabled));
+            onSave(formData);
+          }}
+          className="space-y-6"
+        >
+          <div className="flex items-start gap-3">
+            <Checkbox
+              id="auto_accept_signups"
+              checked={enabled}
+              onCheckedChange={(checked) => setEnabled(checked === true)}
+              className="mt-1"
+            />
+            <div className="space-y-1">
+              <Label htmlFor="auto_accept_signups">
+                Auto-approve registrations (skip outbound email verification)
+              </Label>
+              <p className="text-xs text-slate-500">
+                New accounts become active immediately, even without SMTP configured. Convenient
+                for local / self-hosted use; leave off for public production sites.
+              </p>
+            </div>
+          </div>
+
+          <Separator />
+
+          <Button type="submit" disabled={isPending}>
+            {isPending ? <Spinner className="mr-2 h-4 w-4 animate-spin" /> : null}
+            Save Policy
+          </Button>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}
+
 function AdminPolicyCard({
   initial,
   isPending,

package/templates/nextblock-template/app/layout.tsx

@@ -25,6 +25,7 @@ import { verifyPackageOnline } from '@nextblock-cms/db/server';
 import { unstable_cache } from 'next/cache';
 import { createStaticSupabaseClient, getSiteSettings } from './lib/site-settings';
 import { DEFAULT_OG_IMAGE } from './lib/seo';
+import { isSupabaseConfigured } from '../lib/setup/env-status';
 
 const defaultUrl = process.env.NEXT_PUBLIC_URL || 'http://localhost:3000';
 
@@ -230,11 +231,40 @@ const getCachedActiveLogo = unstable_cache(
 );
 
 async function loadLayoutData() {
-  const supabase = createSupabaseServerClient();
-
   const headerList = await headers();
-  const cookieStore = await cookies();
   const nonce = headerList.get('x-nonce') || '';
+  const requestPath = headerList.get('x-nextblock-path') || '';
+
+  // Skip the public-chrome data loading when there's nothing to render it on: an
+  // unconfigured instance, OR the standalone /setup wizard. On /setup, AppShell shows no
+  // header/footer anyway, and the DB schema may not exist yet (configured-but-pre-migrate)
+  // — querying it just produces noisy "table not found" errors for data nobody displays.
+  if (!isSupabaseConfigured() || requestPath.startsWith('/setup')) {
+    return {
+      user: null,
+      profile: null,
+      serverDeterminedLocale: DEFAULT_LOCALE_FOR_LAYOUT,
+      availableCurrencies: [] as StoreCurrency[],
+      serverCurrencyCode: null,
+      availableLanguages: [] as Language[],
+      defaultLanguage: null,
+      translations: [] as Awaited<ReturnType<typeof getCachedTranslations>>,
+      copyrightText: '',
+      nonce,
+      hasSupabaseEnv: false,
+      headerNavItems: [] as NavigationItem[],
+      footerNavItems: [] as NavigationItem[],
+      logo: null as HeaderLogo | null,
+      canAccessCms: false,
+      siteTitle: 'NextBlock',
+      isEcommerceActive: false,
+      globalCss: '',
+      privacySettings: DEFAULT_PRIVACY_SETTINGS,
+    };
+  }
+
+  const supabase = createSupabaseServerClient();
+  const cookieStore = await cookies();
 
   const xUserLocaleHeader = headerList.get('x-user-locale');
   const nextUserLocaleCookie = cookieStore.get('NEXT_USER_LOCALE')?.value;
@@ -417,6 +447,22 @@ export default async function RootLayout({
     ? (await import('@vercel/toolbar/next')).VercelToolbar
     : null;
 
+  // Expose the PUBLIC Supabase values (url + anon key — both safe to ship to the
+  // browser) at runtime. In production the client uses the build-time-inlined
+  // NEXT_PUBLIC_* and ignores this; it only matters in local dev, where the wizard
+  // writes those vars at runtime and the already-loaded browser bundle would otherwise
+  // hold stale empties until a dev-server restart. Read from server process.env here,
+  // so it's always fresh.
+  const publicEnvBootstrap = (() => {
+    const url = process.env.NEXT_PUBLIC_SUPABASE_URL || '';
+    const anonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';
+    if (!url || !anonKey) return '';
+    return `window.__NEXTBLOCK_PUBLIC_ENV__=${JSON.stringify({ url, anonKey }).replace(
+      /</g,
+      '\\u003c',
+    )};`;
+  })();
+
   return (
     <html lang={serverDeterminedLocale} suppressHydrationWarning>
       <head>
@@ -424,6 +470,14 @@ export default async function RootLayout({
         {globalCss && <style dangerouslySetInnerHTML={{ __html: globalCss }} />}
       </head>
       <body className="min-h-screen">
+        {publicEnvBootstrap && (
+          <Script
+            id="nextblock-public-env"
+            strategy={TRUSTED_TYPES_SCRIPT_STRATEGY}
+            nonce={nonce}
+            dangerouslySetInnerHTML={{ __html: publicEnvBootstrap }}
+          />
+        )}
         {/* In development this loads after hydration to avoid browser-hidden nonce comparisons. */}
         <Script
           id="trusted-types-bootstrap"

package/templates/nextblock-template/app/lib/site-settings.ts

@@ -23,13 +23,16 @@ export interface SiteSettings {
  * route `generateMetadata` functions.
  */
 export function createStaticSupabaseClient() {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  // Fall back to a dummy host when unconfigured (fresh clone, pre-/setup) so the
+  // root layout can still render rather than crashing the whole app on boot. Callers
+  // (getSiteSettings + the getCached* helpers) already swallow failures and use
+  // fallbacks, and loadLayoutData short-circuits before reaching here when there is
+  // no Supabase env at all.
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://dummy.supabase.co';
   const supabaseKey =
-    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-
-  if (!supabaseUrl || !supabaseKey) {
-    throw new Error('Missing Supabase environment variables for public layout data');
-  }
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+    'dummy-anon-key';
 
   return createSupabaseJsClient<Database>(supabaseUrl, supabaseKey, {
     auth: {
@@ -53,6 +56,13 @@ export const getSiteSettings = unstable_cache(
       siteKeywords: DEFAULT_SITE_KEYWORDS,
     };
 
+    // Unconfigured instance (pre-/setup): the static client would point at the dummy
+    // host, so the fetch fails with a noisy DNS error before falling back. Skip it and
+    // return SEO defaults directly. (generateMetadata calls this even on /setup.)
+    if (!process.env.NEXT_PUBLIC_SUPABASE_URL) {
+      return fallback;
+    }
+
     try {
       const supabase = createStaticSupabaseClient();
       const { data, error } = await supabase
@@ -61,7 +71,12 @@ export const getSiteSettings = unstable_cache(
         .in('key', ['site_title', 'site_description', 'site_keywords']);
 
       if (error || !data) {
-        console.error('Error fetching cached site settings:', error);
+        // PGRST205 = table not found: the schema isn't migrated yet (e.g. mid-setup,
+        // right after the connection is saved but before `npm run db:migrate`). That's an
+        // expected transient state — don't shout about it. Real errors still log.
+        if (error && error.code !== 'PGRST205') {
+          console.error('Error fetching cached site settings:', error);
+        }
         return fallback;
       }
 

package/templates/nextblock-template/app/page.tsx

@@ -63,6 +63,12 @@ async function getPreferredLocale() {
 }
 
 export async function generateMetadata(): Promise<Metadata> {
+  // Unconfigured instance (pre-/setup): skip all DB work so metadata generation
+  // can't crash the boot. The proxy redirects unconfigured traffic to /setup anyway.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return { title: 'NextBlock' };
+  }
+
   const preferredLocale = await getPreferredLocale();
   const homepageSlug = await getHomepageSlugForLocale(preferredLocale);
   const pageData = await getPageDataBySlug(homepageSlug, preferredLocale);

package/templates/nextblock-template/app/product/[slug]/page.tsx

@@ -74,6 +74,11 @@ function resolveCategoryName(category: any, languageCode?: string | null) {
 }
 
 export async function generateStaticParams() {
+  // Unconfigured instance (pre-/setup): no DB to read product slugs from.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return [];
+  }
+
   const supabase = getSsgSupabaseClient();
   const { data: products } = await getProducts(supabase);
   const productRows = ((products || []) as any[]).filter(