create-nextblock 0.8.11 → 0.9.5

package/templates/nextblock-template/lib/setup/schema-apply.ts

@@ -0,0 +1,379 @@
+import 'server-only';
+// Server-side schema applier for the /setup wizard. Two backends, preferred in order:
+//
+//   1. Supabase Management API (HTTPS) — used when a SUPABASE_ACCESS_TOKEN + project ref
+//      are available. Robust on any network (IPv4, no direct-DB host to resolve) and
+//      needs no Postgres connection string. This is the default for Supabase Cloud.
+//   2. Direct Postgres connection via POSTGRES_URL (the 'postgres' driver, same pattern
+//      as app/api/cron/reset-sandbox/route.ts) — fallback for self-hosted / no-token.
+//
+// Either way, migrations run in version order; each file is applied AND recorded in
+// supabase_migrations.schema_migrations inside one transaction, so a failure rolls back
+// cleanly and a retry re-runs from a clean state (critical: some migrations aren't
+// idempotent). Applied versions are tracked exactly like the Supabase CLI.
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import postgres from 'postgres';
+import { isLocalWritableEnv } from './env-status';
+
+export interface SchemaApplyResult {
+  ok: boolean;
+  applied: number;
+  error?: string;
+}
+
+/**
+ * Locate the migrations directory: the Nx monorepo keeps them at
+ * <workspaceRoot>/libs/db/src/supabase/migrations; a standalone create-nextblock
+ * project materializes them at <projectRoot>/supabase/migrations.
+ */
+function resolveMigrationsDir(): string | null {
+  // Monorepo first: find the nearest nx.json ancestor (the workspace root) and use its
+  // libs/db migrations. Checking nx.json before any supabase/ dir avoids accidentally
+  // picking up a stray app-level supabase/migrations folder.
+  let dir = process.cwd();
+  for (let i = 0; i < 8; i++) {
+    if (existsSync(path.join(dir, 'nx.json'))) {
+      const monorepo = path.join(dir, 'libs', 'db', 'src', 'supabase', 'migrations');
+      if (existsSync(monorepo)) return monorepo;
+      break;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+
+  // Standalone create-nextblock project: nearest supabase/migrations from cwd upward.
+  dir = process.cwd();
+  for (let i = 0; i < 8; i++) {
+    const standalone = path.join(dir, 'supabase', 'migrations');
+    if (existsSync(standalone)) return standalone;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+
+  return null;
+}
+
+/** Supabase project ref, from SUPABASE_PROJECT_ID or the project URL host. */
+function resolveProjectRef(): string | null {
+  const fromId = process.env.SUPABASE_PROJECT_ID?.trim();
+  if (fromId) return fromId;
+  try {
+    const host = new URL(process.env.NEXT_PUBLIC_SUPABASE_URL ?? '').hostname;
+    if (host.endsWith('.supabase.co') || host.endsWith('.supabase.in')) {
+      return host.split('.')[0];
+    }
+  } catch {
+    // not a cloud URL
+  }
+  return null;
+}
+
+/** Turn a non-2xx Management API response into a short, non-HTML error message. */
+function summarizeApiError(status: number, body: string): string {
+  const isHtml = /<!doctype|<html/i.test(body);
+  const detail = isHtml ? 'gateway error (HTML response)' : body.slice(0, 200).trim();
+  return `Supabase Management API ${status}${detail ? `: ${detail}` : ''}`;
+}
+
+/**
+ * Run a SQL query via the Supabase Management API with retry + timeout. Transient
+ * gateway/server errors (5xx) and rate limits (429) are retried with backoff — applying
+ * ~31 migrations is many sequential calls, and the gateway occasionally returns a 502
+ * HTML page. 4xx errors fail fast (they won't get better on retry). Returns the parsed
+ * JSON body (or null).
+ */
+async function managementApiQuery(ref: string, token: string, query: string): Promise<unknown> {
+  const endpoint = `https://api.supabase.com/v1/projects/${ref}/database/query`;
+  const maxAttempts = 4;
+  let lastError = 'unknown error';
+
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    if (attempt > 0) {
+      await new Promise((resolve) => setTimeout(resolve, 700 * attempt));
+    }
+
+    let res: Response;
+    try {
+      res = await fetch(endpoint, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ query }),
+        signal: AbortSignal.timeout(45_000),
+      });
+    } catch (caught) {
+      // Network error / timeout — retry.
+      lastError = caught instanceof Error ? caught.message : 'network error';
+      continue;
+    }
+
+    if (res.ok) {
+      try {
+        return await res.json();
+      } catch {
+        return null;
+      }
+    }
+
+    let body = '';
+    try {
+      body = await res.text();
+    } catch {
+      /* ignore */
+    }
+    lastError = summarizeApiError(res.status, body);
+
+    // Retry transient gateway/server errors and rate limits; fail fast on 4xx.
+    if (res.status >= 500 || res.status === 429) {
+      continue;
+    }
+    throw new Error(lastError);
+  }
+
+  throw new Error(`${lastError} (after ${maxAttempts} attempts)`);
+}
+
+const TRACKING_DDL =
+  'create schema if not exists supabase_migrations;' +
+  'create table if not exists supabase_migrations.schema_migrations ' +
+  '(version text primary key, name text, statements text[]);';
+
+function recordSql(version: string, file: string): string {
+  return (
+    `insert into supabase_migrations.schema_migrations (version, name) ` +
+    `values ('${version}', '${file.replace(/'/g, "''")}') on conflict (version) do nothing;`
+  );
+}
+
+/**
+ * Wrap a migration file + its version record in one explicit transaction. A mid-file
+ * failure aborts the whole thing (nothing applied, nothing recorded) so a retry re-runs
+ * from a clean state — essential for non-idempotent migrations (e.g. 25's ADD CONSTRAINT).
+ */
+function transactionalMigration(version: string, file: string, sqlText: string): string {
+  return `begin;\n${sqlText}\n;\n${recordSql(version, file)}\ncommit;`;
+}
+
+// Destructive reset: drop the public schema (all app tables + triggers) and the
+// migration history (separate schema — survives a plain DROP SCHEMA public). Wrapped in
+// one transaction so it's all-or-nothing. Auth users are NOT cleared here (SQL on the
+// auth schema can be permission-restricted via the Management API); the caller clears
+// them with the admin API instead. The ONLY caller (completeSetup) gates this on BOTH
+// assertNotProvisioned() (no admin exists — a live site is immune) AND isLocalWritableEnv()
+// (local dev only). Plus this function self-guards on isLocalWritableEnv(). Never unguarded.
+const RESET_SQL =
+  'begin;' +
+  'drop schema if exists public cascade;' +
+  'create schema public;' +
+  'grant all on schema public to postgres;' +
+  'grant all on schema public to anon;' +
+  'grant all on schema public to authenticated;' +
+  'grant all on schema public to service_role;' +
+  'drop schema if exists supabase_migrations cascade;' +
+  'commit;';
+
+export async function resetDatabase(): Promise<{ ok: boolean; error?: string }> {
+  // Defense-in-depth: refuse to wipe anything outside local development, regardless of
+  // the caller. This is the last line guarding an irreversible, destructive operation.
+  if (!isLocalWritableEnv()) {
+    return { ok: false, error: 'Database reset is only allowed in local development.' };
+  }
+
+  const ref = resolveProjectRef();
+  const token = process.env.SUPABASE_ACCESS_TOKEN?.trim();
+
+  if (ref && token) {
+    try {
+      await managementApiQuery(ref, token, RESET_SQL);
+      return { ok: true };
+    } catch (caught) {
+      return {
+        ok: false,
+        error: caught instanceof Error ? caught.message : 'unknown error resetting the database',
+      };
+    }
+  }
+
+  const dbUrl = process.env.POSTGRES_URL || process.env.DATABASE_URL;
+  if (dbUrl) {
+    const db = postgres(dbUrl, { ssl: 'require', onnotice: () => undefined, max: 1 });
+    try {
+      await db.unsafe(RESET_SQL);
+      return { ok: true };
+    } catch (caught) {
+      return {
+        ok: false,
+        error: caught instanceof Error ? caught.message : 'unknown error resetting the database',
+      };
+    } finally {
+      try {
+        await db.end({ timeout: 5 });
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+
+  return {
+    ok: false,
+    error: 'No Supabase access token or Postgres connection string is available to reset.',
+  };
+}
+
+export async function applyMigrations(): Promise<SchemaApplyResult> {
+  const migrationsDir = resolveMigrationsDir();
+  if (!migrationsDir) {
+    return { ok: false, applied: 0, error: 'Could not locate the migrations directory.' };
+  }
+
+  const files = (await readdir(migrationsDir))
+    .filter((name) => /^\d+_.*\.sql$/.test(name))
+    .sort();
+  const readSql = (file: string) => readFile(path.join(migrationsDir, file), 'utf8');
+
+  const ref = resolveProjectRef();
+  const token = process.env.SUPABASE_ACCESS_TOKEN?.trim();
+  if (ref && token) {
+    return applyViaManagementApi(ref, token, files, readSql);
+  }
+
+  const dbUrl = process.env.POSTGRES_URL || process.env.DATABASE_URL;
+  if (dbUrl) {
+    return applyViaPostgres(dbUrl, files, readSql);
+  }
+
+  return {
+    ok: false,
+    applied: 0,
+    error:
+      'No Supabase access token or Postgres connection string is available to apply the schema.',
+  };
+}
+
+/** Backend 1: Supabase Management API (HTTPS). */
+async function applyViaManagementApi(
+  ref: string,
+  token: string,
+  files: string[],
+  readSql: (file: string) => Promise<string>,
+): Promise<SchemaApplyResult> {
+  const run = (query: string) => managementApiQuery(ref, token, query);
+
+  const toRows = (raw: unknown): Array<Record<string, unknown>> => {
+    if (Array.isArray(raw)) return raw as Array<Record<string, unknown>>;
+    const obj = raw as { result?: unknown; data?: unknown } | null;
+    if (Array.isArray(obj?.result)) return obj!.result as Array<Record<string, unknown>>;
+    if (Array.isArray(obj?.data)) return obj!.data as Array<Record<string, unknown>>;
+    return [];
+  };
+
+  let applied = 0;
+  try {
+    await run(TRACKING_DDL);
+    const done = new Set(
+      toRows(await run('select version from supabase_migrations.schema_migrations;'))
+        .map((r) => r.version)
+        .filter(Boolean) as string[],
+    );
+
+    // Self-heal stale history: if versions are recorded but a core table is missing
+    // (e.g. someone ran DROP SCHEMA public CASCADE without clearing the history, which
+    // lives in the separate supabase_migrations schema), those records are lying — clear
+    // them and re-apply everything from scratch.
+    if (done.size > 0) {
+      const exists =
+        toRows(await run("select to_regclass('public.site_settings') as t;"))[0]?.t != null;
+      if (!exists) {
+        await run('delete from supabase_migrations.schema_migrations;');
+        done.clear();
+      }
+    }
+
+    for (const file of files) {
+      const version = file.split('_')[0];
+      if (done.has(version)) continue;
+      const sqlText = await readSql(file);
+      await run(transactionalMigration(version, file, sqlText));
+      applied += 1;
+    }
+
+    await run("notify pgrst, 'reload schema';");
+    return { ok: true, applied };
+  } catch (caught) {
+    return {
+      ok: false,
+      applied,
+      error:
+        caught instanceof Error
+          ? caught.message
+          : 'unknown error applying migrations via the Management API',
+    };
+  }
+}
+
+/** Backend 2: direct Postgres connection. */
+async function applyViaPostgres(
+  dbUrl: string,
+  files: string[],
+  readSql: (file: string) => Promise<string>,
+): Promise<SchemaApplyResult> {
+  const db = postgres(dbUrl, { ssl: 'require', onnotice: () => undefined, max: 1 });
+  let applied = 0;
+  try {
+    await db.unsafe(TRACKING_DDL);
+    const rows = await db<{ version: string }[]>`
+      select version from supabase_migrations.schema_migrations
+    `;
+    const done = new Set(rows.map((r) => r.version));
+
+    // Self-heal stale history (see Management API backend): recorded versions but a core
+    // table missing means the schema was wiped without clearing history — re-apply all.
+    if (done.size > 0) {
+      const sentinel = await db<{ t: string | null }[]>`
+        select to_regclass('public.site_settings')::text as t
+      `;
+      if (!sentinel[0]?.t) {
+        await db`delete from supabase_migrations.schema_migrations`;
+        done.clear();
+      }
+    }
+
+    for (const file of files) {
+      const version = file.split('_')[0];
+      if (done.has(version)) continue;
+      const sqlText = await readSql(file);
+      await db.unsafe(transactionalMigration(version, file, sqlText));
+      applied += 1;
+    }
+
+    if (applied > 0) {
+      await db.unsafe("notify pgrst, 'reload schema';");
+    }
+    return { ok: true, applied };
+  } catch (caught) {
+    const message =
+      caught instanceof Error ? caught.message : 'unknown error applying migrations';
+    // Newer Supabase projects expose no IPv4 address for the DIRECT db.<ref>.supabase.co
+    // host, so on an IPv4-only network DNS fails (ENOTFOUND/ENOENT). The Session pooler
+    // host is IPv4 — point users there.
+    const isUnreachable = /ENOTFOUND|ENOENT|EAI_AGAIN|getaddrinfo|ECONNREFUSED|ETIMEDOUT/i.test(
+      message,
+    );
+    return {
+      ok: false,
+      applied,
+      error: isUnreachable
+        ? `Could not reach the database host (${message}). Provide a Supabase access token (so the wizard can use the Management API over HTTPS), or use the Session pooler connection string (Supabase dashboard → Connect → Session pooler), which works on IPv4 networks.`
+        : message,
+    };
+  } finally {
+    try {
+      await db.end({ timeout: 5 });
+    } catch {
+      // Closing a connection should never mask the real result.
+    }
+  }
+}

package/templates/nextblock-template/lib/setup/system-config.ts

@@ -0,0 +1,105 @@
+import 'server-only';
+// Server-only read/write for the `system_configuration` singleton table.
+// Mirrors lib/privacy/settings.ts, but the data lives in a dedicated ADMIN-only
+// table (migration 00000000000030) rather than the public site_settings store.
+import { createClient, getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import type { Json } from '@nextblock-cms/db';
+import { DEFAULT_SYSTEM_CONFIGURATION, type SystemConfiguration } from './types';
+
+function asBool(value: unknown, fallback: boolean): boolean {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') return value === 'true' || value === 'on';
+  return fallback;
+}
+
+function asSettings(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+type ConfigPatch = Partial<Pick<SystemConfiguration, 'auto_accept_signups'>> & {
+  settings?: Record<string, unknown>;
+};
+
+/** Build a row payload, casting the loosely-typed settings object to the DB Json type. */
+function toRow(patch: ConfigPatch): {
+  auto_accept_signups?: boolean;
+  settings?: Json;
+  updated_at: string;
+} {
+  const row: { auto_accept_signups?: boolean; settings?: Json; updated_at: string } = {
+    updated_at: new Date().toISOString(),
+  };
+  if (patch.auto_accept_signups !== undefined) {
+    row.auto_accept_signups = patch.auto_accept_signups;
+  }
+  if (patch.settings !== undefined) {
+    row.settings = patch.settings as unknown as Json;
+  }
+  return row;
+}
+
+/**
+ * Read the singleton config. Uses the service-role client so it works from any
+ * context — including the anonymous public sign-up path, which must read
+ * `auto_accept_signups` even though the table is otherwise ADMIN-only. Falls back to
+ * safe defaults when the service-role key is absent (unconfigured instance).
+ */
+export async function getSystemConfiguration(): Promise<SystemConfiguration> {
+  let supabase: ReturnType<typeof getServiceRoleSupabaseClient>;
+  try {
+    supabase = getServiceRoleSupabaseClient();
+  } catch {
+    return DEFAULT_SYSTEM_CONFIGURATION;
+  }
+
+  const { data, error } = await supabase
+    .from('system_configuration')
+    .select('auto_accept_signups, settings')
+    .eq('id', 1)
+    .maybeSingle();
+
+  if (error || !data) {
+    return DEFAULT_SYSTEM_CONFIGURATION;
+  }
+
+  return {
+    auto_accept_signups: asBool(data.auto_accept_signups, false),
+    settings: asSettings(data.settings),
+  };
+}
+
+/**
+ * Persist a partial update via the request-scoped client. RLS enforces ADMIN — used
+ * by the CMS security settings page. The wizard (which runs before any admin exists)
+ * uses setSystemConfigurationServiceRole instead.
+ */
+export async function updateSystemConfiguration(patch: ConfigPatch): Promise<void> {
+  const supabase = createClient();
+  const { error } = await supabase
+    .from('system_configuration')
+    .update(toRow(patch))
+    .eq('id', 1);
+
+  if (error) {
+    console.error('Error saving system configuration:', error.message);
+    throw new Error('Failed to save system configuration.');
+  }
+}
+
+/**
+ * Seed/update the singleton with the service-role client (bypasses RLS). Used by the
+ * /setup wizard before the first admin exists.
+ */
+export async function setSystemConfigurationServiceRole(patch: ConfigPatch): Promise<void> {
+  const supabase = getServiceRoleSupabaseClient();
+  const { error } = await supabase
+    .from('system_configuration')
+    .upsert({ id: 1, ...toRow(patch) });
+
+  if (error) {
+    console.error('Error seeding system configuration:', error.message);
+    throw new Error('Failed to seed system configuration.');
+  }
+}

package/templates/nextblock-template/lib/setup/types.ts

@@ -0,0 +1,18 @@
+// Pure, client-safe types for the system_configuration singleton.
+// No server-only dependencies — importable from client and server modules.
+
+export interface SystemConfiguration {
+  /**
+   * When true, new public sign-ups skip outbound email verification: the signup
+   * route creates an already-confirmed account via the service role instead of
+   * relying on an SMTP confirmation link. Default false (defense-in-depth).
+   */
+  auto_accept_signups: boolean;
+  /** Forward-compatible feature toggles. Never holds secrets. */
+  settings: Record<string, unknown>;
+}
+
+export const DEFAULT_SYSTEM_CONFIGURATION: SystemConfiguration = {
+  auto_accept_signups: false,
+  settings: {},
+};

package/templates/nextblock-template/next.config.js

@@ -81,8 +81,17 @@ const securityHeaders = [
   },
 ];
 
+// Self-hosted Docker images build a standalone server (`node apps/nextblock/server.js`) instead
+// of `next start` + a full node_modules tree. Gated on DOCKER_BUILD so Vercel/cloud builds are
+// completely untouched. outputFileTracingRoot is pinned to the monorepo root so the standalone
+// output nests predictably under apps/nextblock (see the root Dockerfile runner stage).
+const isDockerStandalone = process.env.DOCKER_BUILD === 'true';
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  ...(isDockerStandalone
+    ? { output: 'standalone', outputFileTracingRoot: path.join(__dirname, '../../') }
+    : {}),
   experimental: {
     optimizePackageImports: ['@nextblock-cms/ui', '@nextblock-cms/utils'],
   },

package/templates/nextblock-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.8.11",
+  "version": "0.9.5",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -8,7 +8,11 @@
     "start": "next start",
     "lint": "next lint",
     "deploy:supabase": "node tools/deploy-supabase.js",
-    "configure:supabase-auth": "node tools/configure-supabase-auth.js"
+    "configure:supabase-auth": "node tools/configure-supabase-auth.js",
+    "docker:setup": "node scripts/docker-setup.mjs",
+    "docker:up": "docker compose up -d --build",
+    "docker:down": "docker compose down",
+    "docker:logs": "docker compose logs -f nextblock-cms"
   },
   "dependencies": {
     "@ai-sdk/openai-compatible": "^2.0.42",