create-nextblock 0.8.11 → 0.9.5

package/templates/nextblock-template/proxy.ts

@@ -1,5 +1,6 @@
 import { createServerClient, type CookieOptions } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
+import type { SupabaseClient } from '@supabase/supabase-js';
 import type { Database } from '@nextblock-cms/db';
 
 type Profile = Database['public']['Tables']['profiles']['Row'];
@@ -42,6 +43,63 @@ function getRequiredRolesForPath(pathname: string): UserRole[] | null {
   return null;
 }
 
+/**
+ * Paths that must stay reachable while the instance is unprovisioned: the wizard,
+ * its server actions/APIs, the auth callback, and framework internals. Everything
+ * else is redirected to /setup until a first admin exists.
+ */
+function isSetupAllowlisted(pathname: string): boolean {
+  return (
+    pathname === '/setup' ||
+    pathname.startsWith('/setup/') ||
+    pathname.startsWith('/api/setup') ||
+    pathname.startsWith('/auth/') ||
+    pathname.startsWith('/_next/') ||
+    pathname.startsWith('/favicon')
+  );
+}
+
+// Module-level cache for the "has the first admin been created?" flag. Middleware
+// modules persist across requests in a worker, so this avoids a per-request DB hit.
+let provisionedAdminCache: { value: boolean; expires: number } | null = null;
+
+/**
+ * Returns true once the system has a first admin (site_settings.is_admin_created).
+ * `is_admin_created` is a non-sensitive, anon-readable key, so the request-scoped
+ * anon client can read it. Cached aggressively once true (it never reverts) and
+ * briefly while false (so the gate releases promptly after the wizard runs).
+ * Fail-open: any read error returns true so a hiccup never traps the whole site.
+ */
+async function hasProvisionedAdmin(supabase: SupabaseClient): Promise<boolean> {
+  const now = Date.now();
+  if (provisionedAdminCache && provisionedAdminCache.expires > now) {
+    return provisionedAdminCache.value;
+  }
+
+  try {
+    const { data, error } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'is_admin_created')
+      .maybeSingle();
+
+    if (error) {
+      return true;
+    }
+
+    const hasAdmin = data?.value === true || data?.value === 'true';
+    // Cache "provisioned" for a long time (it never reverts); keep the unprovisioned
+    // window short so the gate releases promptly once the wizard creates the admin.
+    provisionedAdminCache = {
+      value: hasAdmin,
+      expires: now + (hasAdmin ? 10 * 60_000 : 3_000),
+    };
+    return hasAdmin;
+  } catch {
+    return true;
+  }
+}
+
 function getHttpOrigin(value: string | undefined): string | null {
   if (!value) {
     return null;
@@ -110,11 +168,21 @@ function createRedirectResponse(
   return applySecurityHeaders(NextResponse.redirect(url), contentSecurityPolicy);
 }
 
-function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): string {
+function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | undefined): string {
   const isDev = process.env.NODE_ENV !== 'production';
-  const parsedSupabaseUrl = new URL(supabaseUrl);
-  const supabaseOrigin = parsedSupabaseUrl.origin;
-  const supabaseRealtimeOrigin = `${parsedSupabaseUrl.protocol === 'https:' ? 'wss:' : 'ws:'}//${parsedSupabaseUrl.host}`;
+  // supabaseUrl is absent on an unconfigured instance (pre-/setup). Build the policy
+  // without Supabase origins in that case — uniqueSources() drops the null entries.
+  let supabaseOrigin: string | null = null;
+  let supabaseRealtimeOrigin: string | null = null;
+  if (supabaseUrl) {
+    try {
+      const parsedSupabaseUrl = new URL(supabaseUrl);
+      supabaseOrigin = parsedSupabaseUrl.origin;
+      supabaseRealtimeOrigin = `${parsedSupabaseUrl.protocol === 'https:' ? 'wss:' : 'ws:'}//${parsedSupabaseUrl.host}`;
+    } catch {
+      // malformed URL — treat as unconfigured for CSP purposes
+    }
+  }
   const assetSources = getAssetSources();
 
   const googleSources = [
@@ -126,15 +194,15 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
     'https://stats.g.doubleclick.net',
   ];
 
-  const vercelSources = [
-    'https://vercel.live',
-    'https://vercel.com',
-    'https://assets.vercel.com',
-    'https://vitals.vercel-insights.com',
-    'https://*.vercel-insights.com',
-  ];
-  const vercelToolbarConnectSources = ['wss://ws-us3.pusher.com'];
-  const turnstileSources = ['https://challenges.cloudflare.com'];
+  const vercelSources = [
+    'https://vercel.live',
+    'https://vercel.com',
+    'https://assets.vercel.com',
+    'https://vitals.vercel-insights.com',
+    'https://*.vercel-insights.com',
+  ];
+  const vercelToolbarConnectSources = ['wss://ws-us3.pusher.com'];
+  const turnstileSources = ['https://challenges.cloudflare.com'];
 
   const developmentHttpSources = isDev
     ? [
@@ -161,21 +229,21 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
             "'self'",
             `'nonce-${nonceValue}'`,
             "'unsafe-inline'",
-            "'unsafe-eval'",
-            'blob:',
-            'data:',
-            ...vercelSources,
-            ...turnstileSources,
-            ...developmentHttpSources,
-          ]
-        : [
-            "'self'",
-            `'nonce-${nonceValue}'`,
-            'blob:',
-            ...googleSources,
-            ...vercelSources,
-            ...turnstileSources,
-          ],
+            "'unsafe-eval'",
+            'blob:',
+            'data:',
+            ...vercelSources,
+            ...turnstileSources,
+            ...developmentHttpSources,
+          ]
+        : [
+            "'self'",
+            `'nonce-${nonceValue}'`,
+            'blob:',
+            ...googleSources,
+            ...vercelSources,
+            ...turnstileSources,
+          ],
     ),
     createDirective('script-src-attr', ["'none'"]),
     createDirective('style-src', [
@@ -205,25 +273,25 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
       "'self'",
       supabaseOrigin,
       supabaseRealtimeOrigin,
-      ...assetSources,
-      ...googleSources,
-      ...vercelSources,
-      ...vercelToolbarConnectSources,
-      ...turnstileSources,
-      ...developmentConnectSources,
-    ]),
-    createDirective('frame-src', [
-      "'self'",
-      'blob:',
+      ...assetSources,
+      ...googleSources,
+      ...vercelSources,
+      ...vercelToolbarConnectSources,
+      ...turnstileSources,
+      ...developmentConnectSources,
+    ]),
+    createDirective('frame-src', [
+      "'self'",
+      'blob:',
       'data:',
       'https://checkout.freemius.com',
       'https://www.youtube.com',
       'https://www.youtube-nocookie.com',
-      'https://player.vimeo.com',
-      'https://vercel.live',
-      'https://vercel.com',
-      ...turnstileSources,
-    ]),
+      'https://player.vimeo.com',
+      'https://vercel.live',
+      'https://vercel.com',
+      ...turnstileSources,
+    ]),
     createDirective('media-src', ["'self'", 'data:', 'blob:', supabaseOrigin, ...assetSources]),
     createDirective('worker-src', ["'self'", 'blob:']),
     createDirective('manifest-src', ["'self'"]),
@@ -238,29 +306,44 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
 }
 
 export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-
-  if (!supabaseUrl || !supabaseAnonKey) {
-    throw new Error('Missing required Supabase environment variables');
-  }
+  const configured = Boolean(supabaseUrl && supabaseAnonKey);
+  process.env.NEXTBLOCK_UNCONFIGURED = configured ? 'false' : 'true';
 
   const requestHeaders = new Headers(request.headers);
   const nonce = Buffer.from(crypto.randomUUID()).toString('base64');
   const contentSecurityPolicy = createContentSecurityPolicy(nonce, supabaseUrl);
 
   requestHeaders.set('x-nonce', nonce);
+  requestHeaders.set('x-nextblock-path', pathname);
   if (contentSecurityPolicy) {
     requestHeaders.set('Content-Security-Policy', contentSecurityPolicy);
   }
 
+  const allowlisted = isSetupAllowlisted(pathname);
+
+  // First-boot setup gate (unconfigured): no Supabase env yet, so the browser /setup
+  // wizard is the only thing that can run. Let allowlisted paths render with the
+  // nonce/CSP applied; redirect everything else to /setup. No Supabase work happens.
+  if (!configured) {
+    if (allowlisted) {
+      return applySecurityHeaders(
+        NextResponse.next({ request: { headers: requestHeaders } }),
+        contentSecurityPolicy,
+      );
+    }
+    return createRedirectResponse(new URL('/setup', request.url), contentSecurityPolicy);
+  }
+
   let response = NextResponse.next({
     request: {
       headers: requestHeaders,
     },
   });
 
-  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
+  const supabase = createServerClient(supabaseUrl as string, supabaseAnonKey as string, {
     cookies: {
       get(name: string) {
         return request.cookies.get(name)?.value;
@@ -293,7 +376,18 @@ export async function proxy(request: NextRequest) {
     data: { user },
     error: userError,
   } = await supabase.auth.getUser();
-  const { pathname } = request.nextUrl;
+
+  // First-boot setup gate (configured but no admin yet, and nobody signed in): funnel
+  // anonymous traffic to /setup so the wizard can create the first admin. A logged-in
+  // user is proof the system is provisioned, so never gate them — this also prevents a
+  // redirect loop in the moment right after the wizard signs the new admin in. Cached
+  // + fail-open so a transient status error can't trap the whole site.
+  if (!user && !allowlisted && !(await hasProvisionedAdmin(supabase))) {
+    return createRedirectResponse(
+      new URL('/setup', request.url),
+      contentSecurityPolicy,
+    );
+  }
 
   if (pathname.startsWith('/cms')) {
     if (userError || !user) {

package/templates/nextblock-template/scripts/docker-setup.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+// Zero-dependency Docker setup for a standalone NextBlock project. Runs via `npm run docker:setup`
+// (and is invoked automatically when you pick Docker mode in `npm create nextblock`). Uses only
+// Node built-ins so it works before any host `npm install`.
+//
+// Self-hosted Supabase (GoTrue + PostgREST) validates REAL HS256 JWTs, so we generate a JWT
+// secret and derive properly-signed anon/service_role keys from it — a random string is not a
+// usable key. Then it writes .env and boots the stack via docker compose.
+
+import { randomBytes, createHmac } from 'node:crypto';
+import { readFile, writeFile, access } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, spawnSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = resolve(__dirname, '..');
+const ENV_PATH = resolve(PROJECT_ROOT, '.env');
+
+const TURNSTILE_TEST_SITE_KEY = '1x00000000000000000000AA';
+const TURNSTILE_TEST_SECRET_KEY = '1x0000000000000000000000000000000AA';
+
+const generateSecret = () => randomBytes(32).toString('hex');
+const base64url = (value) =>
+  Buffer.from(value).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+
+function signJwtHS256(payload, secret) {
+  const header = base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const body = base64url(JSON.stringify(payload));
+  const data = `${header}.${body}`;
+  return `${data}.${base64url(createHmac('sha256', secret).update(data).digest())}`;
+}
+
+function generateSupabaseKeys() {
+  const jwtSecret = generateSecret();
+  const iat = Math.floor(Date.now() / 1000);
+  const exp = iat + 60 * 60 * 24 * 365 * 10;
+  return {
+    jwtSecret,
+    anonKey: signJwtHS256({ role: 'anon', iss: 'supabase', iat, exp }, jwtSecret),
+    serviceRoleKey: signJwtHS256({ role: 'service_role', iss: 'supabase', iat, exp }, jwtSecret),
+  };
+}
+
+function readEnvValue(content, key) {
+  for (const line of content.split(/\r?\n/)) {
+    if (line.startsWith(`${key}=`)) {
+      return line.slice(key.length + 1).trim().replace(/^"(.*)"$/, '$1');
+    }
+  }
+  return '';
+}
+
+function upsertEnv(content, replacements) {
+  const applied = new Set();
+  const lines = content.split(/\r?\n/).map((line) => {
+    for (const [key, value] of Object.entries(replacements)) {
+      if (line.startsWith(`${key}=`)) {
+        applied.add(key);
+        return value;
+      }
+    }
+    return line;
+  });
+  for (const [key, value] of Object.entries(replacements)) {
+    if (!applied.has(key)) lines.push(value);
+  }
+  return lines.join('\n');
+}
+
+const pathExists = async (p) => {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const commandWorks = (cmd, args) => spawnSync(cmd, args, { stdio: 'ignore' }).status === 0;
+
+function detectCompose() {
+  if (commandWorks('docker', ['compose', 'version'])) return { cmd: 'docker', args: ['compose'] };
+  if (commandWorks('docker-compose', ['version'])) return { cmd: 'docker-compose', args: [] };
+  return null;
+}
+
+const run = (cmd, args, opts = {}) =>
+  new Promise((res, rej) => {
+    const child = spawn(cmd, args, {
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+      ...opts,
+    });
+    child.on('error', rej);
+    child.on('close', (code) => (code === 0 ? res() : rej(new Error(`${cmd} exited with ${code}`))));
+  });
+
+async function main() {
+  console.log('🐳 NextBlock — Local Self-Hosted Docker Setup\n');
+
+  if (!commandWorks('docker', ['info'])) {
+    console.error('✗ Docker is not installed or not running. Start Docker Desktop, then re-run `npm run docker:setup`.');
+    process.exit(1);
+  }
+  const compose = detectCompose();
+  if (!compose) {
+    console.error('✗ Docker Compose not found. Update Docker Desktop or install the Compose plugin.');
+    process.exit(1);
+  }
+
+  const rl = createInterface({ input, output });
+  const ask = async (q, def = '') => (await rl.question(q)).trim() || def;
+
+  console.log('Optional integrations (press Enter to skip):');
+  let turnstileSiteKey = await ask('  Cloudflare Turnstile Site Key (Enter = sandbox test keys): ');
+  let turnstileSecretKey = '';
+  if (turnstileSiteKey) {
+    turnstileSecretKey = await ask('  Cloudflare Turnstile Secret Key: ');
+  } else {
+    turnstileSiteKey = TURNSTILE_TEST_SITE_KEY;
+    turnstileSecretKey = TURNSTILE_TEST_SECRET_KEY;
+    console.log('  → Using Cloudflare Turnstile test keys (always pass).');
+  }
+
+  const smtp = { host: await ask('  SMTP Host (Enter = no email, auto-confirm sign-ups): '), port: '', user: '', pass: '', fromEmail: '', fromName: '' };
+  let mailerAutoconfirm = 'true';
+  if (smtp.host) {
+    smtp.port = await ask('  SMTP Port (465 = SSL, 587 = STARTTLS): ', '587');
+    smtp.user = await ask('  SMTP User: ');
+    smtp.pass = await ask('  SMTP Password: ');
+    smtp.fromEmail = await ask('  From Email: ');
+    smtp.fromName = await ask('  From Name: ', 'NextBlock');
+    mailerAutoconfirm = 'false';
+  } else {
+    console.log('  → No SMTP: new accounts auto-confirm so your first admin can sign in immediately.');
+  }
+  rl.close();
+
+  let existing = '';
+  if (await pathExists(ENV_PATH)) {
+    existing = await readFile(ENV_PATH, 'utf8');
+    console.log('\n✓ Found existing .env — reusing previously generated secrets where present.');
+  }
+  const reuse = (key, gen) => readEnvValue(existing, key) || gen();
+
+  const postgresPassword = reuse('POSTGRES_PASSWORD', generateSecret);
+  let jwtSecret = readEnvValue(existing, 'JWT_SECRET');
+  let anonKey = readEnvValue(existing, 'ANON_KEY');
+  let serviceRoleKey = readEnvValue(existing, 'SERVICE_ROLE_KEY');
+  if (!jwtSecret || !anonKey || !serviceRoleKey) {
+    ({ jwtSecret, anonKey, serviceRoleKey } = generateSupabaseKeys());
+  }
+  const cronSecret = reuse('CRON_SECRET', generateSecret);
+  const draftSecret = reuse('DRAFT_MODE_SECRET', generateSecret);
+  const revalidateSecret = reuse('REVALIDATE_SECRET_TOKEN', generateSecret);
+  const minioUser = readEnvValue(existing, 'MINIO_ROOT_USER') || 'nextblock';
+  const minioPassword = reuse('MINIO_ROOT_PASSWORD', generateSecret);
+  const bucket = readEnvValue(existing, 'STORAGE_BUCKET') || 'nextblock';
+
+  const replacements = {
+    POSTGRES_PASSWORD: `POSTGRES_PASSWORD=${postgresPassword}`,
+    POSTGRES_DB: 'POSTGRES_DB=postgres',
+    JWT_SECRET: `JWT_SECRET=${jwtSecret}`,
+    JWT_EXP: 'JWT_EXP=3600',
+    ANON_KEY: `ANON_KEY=${anonKey}`,
+    SERVICE_ROLE_KEY: `SERVICE_ROLE_KEY=${serviceRoleKey}`,
+    NEXT_PUBLIC_SUPABASE_URL: 'NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000',
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: `NEXT_PUBLIC_SUPABASE_ANON_KEY=${anonKey}`,
+    SUPABASE_SERVICE_ROLE_KEY: `SUPABASE_SERVICE_ROLE_KEY=${serviceRoleKey}`,
+    API_EXTERNAL_URL: 'API_EXTERNAL_URL=http://localhost:8000',
+    SITE_URL: 'SITE_URL=http://localhost:3000',
+    NEXT_PUBLIC_URL: 'NEXT_PUBLIC_URL=http://localhost:3000',
+    NEXT_PUBLIC_IS_SANDBOX: 'NEXT_PUBLIC_IS_SANDBOX=true',
+    CRON_SECRET: `CRON_SECRET=${cronSecret}`,
+    DRAFT_MODE_SECRET: `DRAFT_MODE_SECRET=${draftSecret}`,
+    REVALIDATE_SECRET_TOKEN: `REVALIDATE_SECRET_TOKEN=${revalidateSecret}`,
+    MINIO_ROOT_USER: `MINIO_ROOT_USER=${minioUser}`,
+    MINIO_ROOT_PASSWORD: `MINIO_ROOT_PASSWORD=${minioPassword}`,
+    STORAGE_BUCKET: `STORAGE_BUCKET=${bucket}`,
+    R2_ACCOUNT_ID: 'R2_ACCOUNT_ID=minio',
+    R2_REGION: 'R2_REGION=us-east-1',
+    R2_S3_ENDPOINT: 'R2_S3_ENDPOINT=http://minio:9000',
+    // Storage URLs use 127.0.0.1 (NOT localhost) on purpose: on localhost, cookies aren't
+    // port-scoped, so the browser would send the app's Supabase auth cookies to MinIO too — and
+    // MinIO rejects oversized header sets (MetadataTooLarge), breaking image display once cookies
+    // grow. 127.0.0.1 is a different cookie host, so the browser never sends them there.
+    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000',
+    R2_FORCE_PATH_STYLE: 'R2_FORCE_PATH_STYLE=true',
+    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_TURNSTILE_SITE_KEY: `NEXT_PUBLIC_TURNSTILE_SITE_KEY=${turnstileSiteKey}`,
+    TURNSTILE_SECRET_KEY: `TURNSTILE_SECRET_KEY=${turnstileSecretKey}`,
+    GOTRUE_MAILER_AUTOCONFIRM: `GOTRUE_MAILER_AUTOCONFIRM=${mailerAutoconfirm}`,
+    SMTP_HOST: `SMTP_HOST=${smtp.host}`,
+    SMTP_PORT: `SMTP_PORT=${smtp.port}`,
+    SMTP_USER: `SMTP_USER=${smtp.user}`,
+    SMTP_PASS: `SMTP_PASS=${smtp.pass}`,
+    SMTP_FROM_EMAIL: `SMTP_FROM_EMAIL=${smtp.fromEmail}`,
+    SMTP_FROM_NAME: `SMTP_FROM_NAME=${smtp.fromName}`,
+  };
+
+  const seed = existing || '# Generated by `npm run docker:setup` — local self-hosted secrets. Do not commit.\n';
+  let nextEnv = upsertEnv(seed, replacements);
+  if (!nextEnv.endsWith('\n')) nextEnv += '\n';
+  await writeFile(ENV_PATH, nextEnv, 'utf8');
+  console.log('✓ Wrote .env (Postgres, JWT secret + signed anon/service keys, MinIO, app secrets).\n');
+
+  // A brand-new .env means brand-new secrets. Postgres only runs its init scripts (which set role
+  // passwords) on an EMPTY volume, so a leftover volume from a previous install would keep the old
+  // credentials and GoTrue/PostgREST could not log in. Reset volumes when the config is fresh.
+  if (!existing) {
+    console.log('Fresh configuration — clearing any previous local sandbox volume so the database matches the new credentials...');
+    try {
+      await run(compose.cmd, [...compose.args, 'down', '-v'], { cwd: PROJECT_ROOT });
+    } catch {
+      /* nothing to tear down */
+    }
+  }
+
+  console.log('Building and starting the stack (first run pulls images + builds the app — a few minutes)...');
+  await run(compose.cmd, [...compose.args, 'up', '-d', '--build'], { cwd: PROJECT_ROOT });
+
+  console.log('\n🎉 Stack is up!');
+  console.log('  1. Open the app:    http://localhost:3000');
+  console.log('  2. Create account:  http://localhost:3000/sign-up  (first sign-up becomes ADMIN)');
+  console.log(
+    mailerAutoconfirm === 'true'
+      ? '     No SMTP → your account is auto-confirmed; just sign in.'
+      : '     Click the confirmation link emailed by your SMTP provider.',
+  );
+  console.log('  3. Supabase API:    http://localhost:8000    MinIO console: http://localhost:9001');
+  const composeStr = `${compose.cmd} ${compose.args.join(' ')}`.trim();
+  console.log(`\n  Logs: ${composeStr} logs -f nextblock-cms   |   Stop: ${composeStr} down   (add -v to wipe data)`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});