create-nextblock 0.9.0 → 0.9.5

package/templates/nextblock-template/proxy.ts

@@ -1,5 +1,6 @@
 import { createServerClient, type CookieOptions } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
+import type { SupabaseClient } from '@supabase/supabase-js';
 import type { Database } from '@nextblock-cms/db';
 
 type Profile = Database['public']['Tables']['profiles']['Row'];
@@ -42,6 +43,63 @@ function getRequiredRolesForPath(pathname: string): UserRole[] | null {
   return null;
 }
 
+/**
+ * Paths that must stay reachable while the instance is unprovisioned: the wizard,
+ * its server actions/APIs, the auth callback, and framework internals. Everything
+ * else is redirected to /setup until a first admin exists.
+ */
+function isSetupAllowlisted(pathname: string): boolean {
+  return (
+    pathname === '/setup' ||
+    pathname.startsWith('/setup/') ||
+    pathname.startsWith('/api/setup') ||
+    pathname.startsWith('/auth/') ||
+    pathname.startsWith('/_next/') ||
+    pathname.startsWith('/favicon')
+  );
+}
+
+// Module-level cache for the "has the first admin been created?" flag. Middleware
+// modules persist across requests in a worker, so this avoids a per-request DB hit.
+let provisionedAdminCache: { value: boolean; expires: number } | null = null;
+
+/**
+ * Returns true once the system has a first admin (site_settings.is_admin_created).
+ * `is_admin_created` is a non-sensitive, anon-readable key, so the request-scoped
+ * anon client can read it. Cached aggressively once true (it never reverts) and
+ * briefly while false (so the gate releases promptly after the wizard runs).
+ * Fail-open: any read error returns true so a hiccup never traps the whole site.
+ */
+async function hasProvisionedAdmin(supabase: SupabaseClient): Promise<boolean> {
+  const now = Date.now();
+  if (provisionedAdminCache && provisionedAdminCache.expires > now) {
+    return provisionedAdminCache.value;
+  }
+
+  try {
+    const { data, error } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'is_admin_created')
+      .maybeSingle();
+
+    if (error) {
+      return true;
+    }
+
+    const hasAdmin = data?.value === true || data?.value === 'true';
+    // Cache "provisioned" for a long time (it never reverts); keep the unprovisioned
+    // window short so the gate releases promptly once the wizard creates the admin.
+    provisionedAdminCache = {
+      value: hasAdmin,
+      expires: now + (hasAdmin ? 10 * 60_000 : 3_000),
+    };
+    return hasAdmin;
+  } catch {
+    return true;
+  }
+}
+
 function getHttpOrigin(value: string | undefined): string | null {
   if (!value) {
     return null;
@@ -110,11 +168,21 @@ function createRedirectResponse(
   return applySecurityHeaders(NextResponse.redirect(url), contentSecurityPolicy);
 }
 
-function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): string {
+function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | undefined): string {
   const isDev = process.env.NODE_ENV !== 'production';
-  const parsedSupabaseUrl = new URL(supabaseUrl);
-  const supabaseOrigin = parsedSupabaseUrl.origin;
-  const supabaseRealtimeOrigin = `${parsedSupabaseUrl.protocol === 'https:' ? 'wss:' : 'ws:'}//${parsedSupabaseUrl.host}`;
+  // supabaseUrl is absent on an unconfigured instance (pre-/setup). Build the policy
+  // without Supabase origins in that case — uniqueSources() drops the null entries.
+  let supabaseOrigin: string | null = null;
+  let supabaseRealtimeOrigin: string | null = null;
+  if (supabaseUrl) {
+    try {
+      const parsedSupabaseUrl = new URL(supabaseUrl);
+      supabaseOrigin = parsedSupabaseUrl.origin;
+      supabaseRealtimeOrigin = `${parsedSupabaseUrl.protocol === 'https:' ? 'wss:' : 'ws:'}//${parsedSupabaseUrl.host}`;
+    } catch {
+      // malformed URL — treat as unconfigured for CSP purposes
+    }
+  }
   const assetSources = getAssetSources();
 
   const googleSources = [
@@ -126,15 +194,15 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
     'https://stats.g.doubleclick.net',
   ];
 
-  const vercelSources = [
-    'https://vercel.live',
-    'https://vercel.com',
-    'https://assets.vercel.com',
-    'https://vitals.vercel-insights.com',
-    'https://*.vercel-insights.com',
-  ];
-  const vercelToolbarConnectSources = ['wss://ws-us3.pusher.com'];
-  const turnstileSources = ['https://challenges.cloudflare.com'];
+  const vercelSources = [
+    'https://vercel.live',
+    'https://vercel.com',
+    'https://assets.vercel.com',
+    'https://vitals.vercel-insights.com',
+    'https://*.vercel-insights.com',
+  ];
+  const vercelToolbarConnectSources = ['wss://ws-us3.pusher.com'];
+  const turnstileSources = ['https://challenges.cloudflare.com'];
 
   const developmentHttpSources = isDev
     ? [
@@ -161,21 +229,21 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
             "'self'",
             `'nonce-${nonceValue}'`,
             "'unsafe-inline'",
-            "'unsafe-eval'",
-            'blob:',
-            'data:',
-            ...vercelSources,
-            ...turnstileSources,
-            ...developmentHttpSources,
-          ]
-        : [
-            "'self'",
-            `'nonce-${nonceValue}'`,
-            'blob:',
-            ...googleSources,
-            ...vercelSources,
-            ...turnstileSources,
-          ],
+            "'unsafe-eval'",
+            'blob:',
+            'data:',
+            ...vercelSources,
+            ...turnstileSources,
+            ...developmentHttpSources,
+          ]
+        : [
+            "'self'",
+            `'nonce-${nonceValue}'`,
+            'blob:',
+            ...googleSources,
+            ...vercelSources,
+            ...turnstileSources,
+          ],
     ),
     createDirective('script-src-attr', ["'none'"]),
     createDirective('style-src', [
@@ -205,25 +273,25 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
       "'self'",
       supabaseOrigin,
       supabaseRealtimeOrigin,
-      ...assetSources,
-      ...googleSources,
-      ...vercelSources,
-      ...vercelToolbarConnectSources,
-      ...turnstileSources,
-      ...developmentConnectSources,
-    ]),
-    createDirective('frame-src', [
-      "'self'",
-      'blob:',
+      ...assetSources,
+      ...googleSources,
+      ...vercelSources,
+      ...vercelToolbarConnectSources,
+      ...turnstileSources,
+      ...developmentConnectSources,
+    ]),
+    createDirective('frame-src', [
+      "'self'",
+      'blob:',
       'data:',
       'https://checkout.freemius.com',
       'https://www.youtube.com',
       'https://www.youtube-nocookie.com',
-      'https://player.vimeo.com',
-      'https://vercel.live',
-      'https://vercel.com',
-      ...turnstileSources,
-    ]),
+      'https://player.vimeo.com',
+      'https://vercel.live',
+      'https://vercel.com',
+      ...turnstileSources,
+    ]),
     createDirective('media-src', ["'self'", 'data:', 'blob:', supabaseOrigin, ...assetSources]),
     createDirective('worker-src', ["'self'", 'blob:']),
     createDirective('manifest-src', ["'self'"]),
@@ -238,29 +306,44 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string): s
 }
 
 export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-
-  if (!supabaseUrl || !supabaseAnonKey) {
-    throw new Error('Missing required Supabase environment variables');
-  }
+  const configured = Boolean(supabaseUrl && supabaseAnonKey);
+  process.env.NEXTBLOCK_UNCONFIGURED = configured ? 'false' : 'true';
 
   const requestHeaders = new Headers(request.headers);
   const nonce = Buffer.from(crypto.randomUUID()).toString('base64');
   const contentSecurityPolicy = createContentSecurityPolicy(nonce, supabaseUrl);
 
   requestHeaders.set('x-nonce', nonce);
+  requestHeaders.set('x-nextblock-path', pathname);
   if (contentSecurityPolicy) {
     requestHeaders.set('Content-Security-Policy', contentSecurityPolicy);
   }
 
+  const allowlisted = isSetupAllowlisted(pathname);
+
+  // First-boot setup gate (unconfigured): no Supabase env yet, so the browser /setup
+  // wizard is the only thing that can run. Let allowlisted paths render with the
+  // nonce/CSP applied; redirect everything else to /setup. No Supabase work happens.
+  if (!configured) {
+    if (allowlisted) {
+      return applySecurityHeaders(
+        NextResponse.next({ request: { headers: requestHeaders } }),
+        contentSecurityPolicy,
+      );
+    }
+    return createRedirectResponse(new URL('/setup', request.url), contentSecurityPolicy);
+  }
+
   let response = NextResponse.next({
     request: {
       headers: requestHeaders,
     },
   });
 
-  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
+  const supabase = createServerClient(supabaseUrl as string, supabaseAnonKey as string, {
     cookies: {
       get(name: string) {
         return request.cookies.get(name)?.value;
@@ -293,7 +376,18 @@ export async function proxy(request: NextRequest) {
     data: { user },
     error: userError,
   } = await supabase.auth.getUser();
-  const { pathname } = request.nextUrl;
+
+  // First-boot setup gate (configured but no admin yet, and nobody signed in): funnel
+  // anonymous traffic to /setup so the wizard can create the first admin. A logged-in
+  // user is proof the system is provisioned, so never gate them — this also prevents a
+  // redirect loop in the moment right after the wizard signs the new admin in. Cached
+  // + fail-open so a transient status error can't trap the whole site.
+  if (!user && !allowlisted && !(await hasProvisionedAdmin(supabase))) {
+    return createRedirectResponse(
+      new URL('/setup', request.url),
+      contentSecurityPolicy,
+    );
+  }
 
   if (pathname.startsWith('/cms')) {
     if (userError || !user) {

package/templates/nextblock-template/scripts/docker-setup.mjs

@@ -168,7 +168,6 @@ async function main() {
     ANON_KEY: `ANON_KEY=${anonKey}`,
     SERVICE_ROLE_KEY: `SERVICE_ROLE_KEY=${serviceRoleKey}`,
     NEXT_PUBLIC_SUPABASE_URL: 'NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000',
-    SUPABASE_INTERNAL_URL: 'SUPABASE_INTERNAL_URL=http://kong:8000',
     NEXT_PUBLIC_SUPABASE_ANON_KEY: `NEXT_PUBLIC_SUPABASE_ANON_KEY=${anonKey}`,
     SUPABASE_SERVICE_ROLE_KEY: `SUPABASE_SERVICE_ROLE_KEY=${serviceRoleKey}`,
     API_EXTERNAL_URL: 'API_EXTERNAL_URL=http://localhost:8000',
@@ -184,10 +183,14 @@ async function main() {
     R2_ACCOUNT_ID: 'R2_ACCOUNT_ID=minio',
     R2_REGION: 'R2_REGION=us-east-1',
     R2_S3_ENDPOINT: 'R2_S3_ENDPOINT=http://minio:9000',
-    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://localhost:9000',
+    // Storage URLs use 127.0.0.1 (NOT localhost) on purpose: on localhost, cookies aren't
+    // port-scoped, so the browser would send the app's Supabase auth cookies to MinIO too — and
+    // MinIO rejects oversized header sets (MetadataTooLarge), breaking image display once cookies
+    // grow. 127.0.0.1 is a different cookie host, so the browser never sends them there.
+    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000',
     R2_FORCE_PATH_STYLE: 'R2_FORCE_PATH_STYLE=true',
-    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://localhost:9000/${bucket}`,
-    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://localhost:9000/${bucket}`,
+    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/${bucket}`,
     NEXT_PUBLIC_TURNSTILE_SITE_KEY: `NEXT_PUBLIC_TURNSTILE_SITE_KEY=${turnstileSiteKey}`,
     TURNSTILE_SECRET_KEY: `TURNSTILE_SECRET_KEY=${turnstileSecretKey}`,
     GOTRUE_MAILER_AUTOCONFIRM: `GOTRUE_MAILER_AUTOCONFIRM=${mailerAutoconfirm}`,
@@ -205,6 +208,18 @@ async function main() {
   await writeFile(ENV_PATH, nextEnv, 'utf8');
   console.log('✓ Wrote .env (Postgres, JWT secret + signed anon/service keys, MinIO, app secrets).\n');
 
+  // A brand-new .env means brand-new secrets. Postgres only runs its init scripts (which set role
+  // passwords) on an EMPTY volume, so a leftover volume from a previous install would keep the old
+  // credentials and GoTrue/PostgREST could not log in. Reset volumes when the config is fresh.
+  if (!existing) {
+    console.log('Fresh configuration — clearing any previous local sandbox volume so the database matches the new credentials...');
+    try {
+      await run(compose.cmd, [...compose.args, 'down', '-v'], { cwd: PROJECT_ROOT });
+    } catch {
+      /* nothing to tear down */
+    }
+  }
+
   console.log('Building and starting the stack (first run pulls images + builds the app — a few minutes)...');
   await run(compose.cmd, [...compose.args, 'up', '-d', '--build'], { cwd: PROJECT_ROOT });