create-nextblock 0.9.0 → 0.9.6

package/bin/create-nextblock.js

@@ -104,43 +104,9 @@ async function handleCommand(projectDirectory, options) {
       hostingMode = modeChoice;
     }
 
-    // Prerequisites gate (interactive only) — shown BEFORE we ask for a name, scaffold, or
-    // install, so anyone who isn't ready can cancel without creating anything.
-    if (!yes && hostingMode === 'cloud') {
-      clack.note(
-        [
-          '1. A Supabase project   https://supabase.com/dashboard',
-          '   • Reference ID             — Project Settings > General > "Reference ID"',
-          '   • Connection string        — Connect (top bar) > Direct connection > URI',
-          '   • anon + service_role keys — Project Settings > API Keys',
-          '   • Personal Access Token    — Account > Access Tokens > Generate new token',
-          '',
-          '2. A Cloudflare R2 bucket   https://dash.cloudflare.com  > R2',
-          '   • Create a bucket, then enable its Public Development URL (Bucket > Settings > General)',
-          '   • Create an R2 API token (Object Read & Write); copy the Access Key ID + Secret (shown once)',
-          '',
-          '3. SMTP credentials   SMTP2GO works very well: https://www.smtp2go.com',
-          '   • Required so Supabase can email the confirmation link your first admin needs to sign in',
-        ].join('\n'),
-        'Before you continue, have all of the following ready',
-      );
-
-      const ready = await clack.confirm({
-        message:
-          'Do you have your Supabase, Cloudflare R2, and SMTP details ready?',
-        initialValue: true,
-      });
-      if (clack.isCancel(ready)) {
-        handleWizardCancel('Setup cancelled.');
-      }
-      if (!ready) {
-        clack.note(
-          'No problem — nothing was created. Gather the items above, then run\n`npm create nextblock` again. Full guide: docs/05-DEVELOPER-GUIDE.md',
-          'Come back when ready',
-        );
-        return;
-      }
-    } else if (!yes && hostingMode === 'docker') {
+    // Cloud / local configuration moved to the browser First-Boot Setup Wizard (/setup), so the
+    // CLI no longer asks for Supabase / R2 / SMTP credentials here. Docker still preflights below.
+    if (!yes && hostingMode === 'docker') {
       clack.note(
         [
           'Local Self-Hosted Docker Mode runs everything on your machine — no cloud accounts needed.',
@@ -264,30 +230,13 @@ async function handleCommand(projectDirectory, options) {
       console.log(chalk.yellow('Skipping dependency installation.'));
     }
 
-    // Run the setup flow after dependencies are installed so package assets are available.
-    // When it runs, its own "next steps" outro is the final message, so we don't print a second
-    // closing block here — the whole flow completes in this one command.
-    if (!yes) {
-      if (hostingMode === 'docker') {
-        await runDockerSetup(projectDir, projectName);
-      } else {
-        await runSetupWizard(projectDir, projectName);
-      }
+    // Run the post-scaffold flow after dependencies are installed so package assets are available.
+    // Docker boots the local stack; everything else just materializes Supabase assets and points
+    // the user at the browser First-Boot Setup Wizard at /setup (no terminal credential prompts).
+    if (!yes && hostingMode === 'docker') {
+      await runDockerSetup(projectDir, projectName);
     } else {
-      // Non-interactive path: nothing was configured, so point the user at their env file.
-      console.log(
-        chalk.green(
-          `\nSuccess! Your NextBlock™ CMS project "${projectName}" is scaffolded.\n`,
-        ),
-      );
-      console.log(chalk.cyan('Next steps:'));
-      console.log(chalk.cyan(`  1. cd ${projectName}`));
-      console.log(
-        chalk.gray(
-          '  2. Add your Supabase / R2 / SMTP values to .env.local (template in .env.example)',
-        ),
-      );
-      console.log(chalk.cyan('  3. npm run dev'));
+      await runCloudScaffold(projectDir, projectName);
     }
   } catch (error) {
     console.error(
@@ -955,6 +904,37 @@ async function runSetupWizard(projectDir, projectName) {
 // Local Self-Hosted Docker Mode: materialize the supabase migrations out of the installed
 // @nextblock-cms/db package (the migration-runner container applies them on boot), then hand off
 // to the project's own zero-dependency Docker setup script (prompts + .env + `docker compose up`).
+async function runCloudScaffold(projectDir, projectName) {
+  const projectPath = resolve(projectDir);
+
+  // Materialize the Supabase assets (migrations + config) so `npm run db:migrate` works later,
+  // then hand off entirely to the browser First-Boot Setup Wizard for configuration. No
+  // credentials are collected in the terminal.
+  try {
+    await ensureSupabaseAssets(projectPath, { required: false });
+  } catch {
+    // Non-fatal: the wizard still works; db:migrate just needs these assets present.
+  }
+
+  console.log(
+    chalk.green(
+      `\nSuccess! Your NextBlock™ CMS project "${projectName}" is scaffolded.\n`,
+    ),
+  );
+  console.log(chalk.cyan('Next steps:'));
+  console.log(chalk.cyan(`  1. cd ${projectName}`));
+  console.log(chalk.cyan('  2. npm run dev'));
+  console.log(
+    `  3. Open ${chalk.cyan('/setup')} ${chalk.gray('in your browser (the URL npm run dev prints, e.g. http://localhost:3000/setup)')}`,
+  );
+  console.log(
+    chalk.gray('     Connect Supabase, configure storage / email, and create your administrator.'),
+  );
+  console.log('');
+  console.log(chalk.gray('  Self-hosted Docker instead?   npm run docker:setup'));
+  console.log(chalk.gray('  One-click cloud deploy:       see docs/12-VERCEL-DEPLOYMENT.md'));
+}
+
 async function runDockerSetup(projectDir, projectName) {
   const projectPath = resolve(projectDir);
   process.chdir(projectPath);

package/docker-template/.env.docker.example

@@ -17,7 +17,6 @@ REVALIDATE_SECRET_TOKEN=replace-me-generated
 
 # --- Supabase wiring (internal container network vs browser) ---------------------------------
 NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
-SUPABASE_INTERNAL_URL=http://kong:8000
 NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}
 SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}
 API_EXTERNAL_URL=http://localhost:8000
@@ -36,10 +35,12 @@ STORAGE_BUCKET=nextblock
 R2_ACCOUNT_ID=minio
 R2_REGION=us-east-1
 R2_S3_ENDPOINT=http://minio:9000
-R2_S3_PUBLIC_ENDPOINT=http://localhost:9000
+# 127.0.0.1 (not localhost) so the browser never sends the app's localhost cookies to MinIO,
+# which would otherwise 400 (MetadataTooLarge) once the Supabase auth cookies grow.
+R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000
 R2_FORCE_PATH_STYLE=true
-NEXT_PUBLIC_R2_BASE_URL=http://localhost:9000/nextblock
-NEXT_PUBLIC_R2_PUBLIC_URL=http://localhost:9000/nextblock
+NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/nextblock
+NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/nextblock
 
 # --- Cloudflare Turnstile (optional). Press Enter at setup to skip and use the dev sandbox. ---
 NEXT_PUBLIC_TURNSTILE_SITE_KEY=

package/docker-template/Dockerfile

@@ -50,19 +50,36 @@ RUN npm run build
 ###############################################################################
 FROM node:22-alpine AS runner
 WORKDIR /app
-RUN apk add --no-cache libc6-compat \
+RUN apk add --no-cache libc6-compat socat \
     && addgroup -g 1001 -S nodejs \
     && adduser -u 1001 -S nextjs -G nodejs
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
     PORT=3000 \
-    HOSTNAME=0.0.0.0
+    HOSTNAME=0.0.0.0 \
+    # ipv4first so localhost resolves to the socat IPv4 listener; the larger header limit absorbs
+    # Supabase auth cookies (on localhost they aren't port-scoped, so they pile onto every request).
+    NODE_OPTIONS="--dns-result-order=ipv4first --max-http-header-size=65536"
 
 # A single-app project traces to its own root, so server.js sits at the top of .next/standalone.
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 
+# Loopback proxy: the browser-facing localhost URLs (Supabase :8000, MinIO :9000) are inlined into
+# the build, but server-side code + next/image run INSIDE this container. Forward those ports to the
+# compose services so SSR + image optimization work, and so the Supabase auth cookie key (derived
+# from the URL host) matches between browser and server. Override targets with LOOPBACK_PROXIES.
+RUN printf '%s\n' \
+  '#!/bin/sh' \
+  'set -e' \
+  ': "${LOOPBACK_PROXIES:=8000:kong:8000 9000:minio:9000}"' \
+  'for p in $LOOPBACK_PROXIES; do' \
+  '  socat "TCP4-LISTEN:${p%%:*},fork,reuseaddr,bind=127.0.0.1" "TCP:${p#*:}" 2>/dev/null &' \
+  'done' \
+  'exec node "$(cat .server-entry 2>/dev/null || echo server.js)"' \
+  > /app/docker-entrypoint.sh && chmod +x /app/docker-entrypoint.sh
+
 USER nextjs
 EXPOSE 3000
-CMD ["node", "server.js"]
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

package/docker-template/docker-compose.yml

@@ -98,6 +98,9 @@ services:
       KONG_PLUGINS: request-transformer,cors,key-auth,acl
       KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
       KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
+      # localhost cookies aren't port-scoped, so the app's Supabase auth cookies are also sent to
+      # Kong on every supabase-js request — give nginx room so they don't 431.
+      KONG_NGINX_HTTP_LARGE_CLIENT_HEADER_BUFFERS: 8 32k
       SUPABASE_ANON_KEY: ${ANON_KEY}
       SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
     volumes:
@@ -179,8 +182,9 @@ services:
       NODE_ENV: production
       PORT: 3000
       HOSTNAME: 0.0.0.0
+      # Browser AND server both use localhost:8000; the in-container loopback proxy (see Dockerfile)
+      # forwards it to Kong, keeping the host-derived Supabase auth cookie key consistent for SSR.
       NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
-      SUPABASE_INTERNAL_URL: ${SUPABASE_INTERNAL_URL:-http://kong:8000}
       NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
       SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
       NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}

package/docker-template/scripts/docker-setup.mjs

@@ -168,7 +168,6 @@ async function main() {
     ANON_KEY: `ANON_KEY=${anonKey}`,
     SERVICE_ROLE_KEY: `SERVICE_ROLE_KEY=${serviceRoleKey}`,
     NEXT_PUBLIC_SUPABASE_URL: 'NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000',
-    SUPABASE_INTERNAL_URL: 'SUPABASE_INTERNAL_URL=http://kong:8000',
     NEXT_PUBLIC_SUPABASE_ANON_KEY: `NEXT_PUBLIC_SUPABASE_ANON_KEY=${anonKey}`,
     SUPABASE_SERVICE_ROLE_KEY: `SUPABASE_SERVICE_ROLE_KEY=${serviceRoleKey}`,
     API_EXTERNAL_URL: 'API_EXTERNAL_URL=http://localhost:8000',
@@ -184,10 +183,14 @@ async function main() {
     R2_ACCOUNT_ID: 'R2_ACCOUNT_ID=minio',
     R2_REGION: 'R2_REGION=us-east-1',
     R2_S3_ENDPOINT: 'R2_S3_ENDPOINT=http://minio:9000',
-    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://localhost:9000',
+    // Storage URLs use 127.0.0.1 (NOT localhost) on purpose: on localhost, cookies aren't
+    // port-scoped, so the browser would send the app's Supabase auth cookies to MinIO too — and
+    // MinIO rejects oversized header sets (MetadataTooLarge), breaking image display once cookies
+    // grow. 127.0.0.1 is a different cookie host, so the browser never sends them there.
+    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000',
     R2_FORCE_PATH_STYLE: 'R2_FORCE_PATH_STYLE=true',
-    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://localhost:9000/${bucket}`,
-    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://localhost:9000/${bucket}`,
+    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/${bucket}`,
     NEXT_PUBLIC_TURNSTILE_SITE_KEY: `NEXT_PUBLIC_TURNSTILE_SITE_KEY=${turnstileSiteKey}`,
     TURNSTILE_SECRET_KEY: `TURNSTILE_SECRET_KEY=${turnstileSecretKey}`,
     GOTRUE_MAILER_AUTOCONFIRM: `GOTRUE_MAILER_AUTOCONFIRM=${mailerAutoconfirm}`,
@@ -205,6 +208,18 @@ async function main() {
   await writeFile(ENV_PATH, nextEnv, 'utf8');
   console.log('✓ Wrote .env (Postgres, JWT secret + signed anon/service keys, MinIO, app secrets).\n');
 
+  // A brand-new .env means brand-new secrets. Postgres only runs its init scripts (which set role
+  // passwords) on an EMPTY volume, so a leftover volume from a previous install would keep the old
+  // credentials and GoTrue/PostgREST could not log in. Reset volumes when the config is fresh.
+  if (!existing) {
+    console.log('Fresh configuration — clearing any previous local sandbox volume so the database matches the new credentials...');
+    try {
+      await run(compose.cmd, [...compose.args, 'down', '-v'], { cwd: PROJECT_ROOT });
+    } catch {
+      /* nothing to tear down */
+    }
+  }
+
   console.log('Building and starting the stack (first run pulls images + builds the app — a few minutes)...');
   await run(compose.cmd, [...compose.args, 'up', '-d', '--build'], { cwd: PROJECT_ROOT });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.9.0",
+  "version": "0.9.6",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/Dockerfile

@@ -50,19 +50,36 @@ RUN npm run build
 ###############################################################################
 FROM node:22-alpine AS runner
 WORKDIR /app
-RUN apk add --no-cache libc6-compat \
+RUN apk add --no-cache libc6-compat socat \
     && addgroup -g 1001 -S nodejs \
     && adduser -u 1001 -S nextjs -G nodejs
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
     PORT=3000 \
-    HOSTNAME=0.0.0.0
+    HOSTNAME=0.0.0.0 \
+    # ipv4first so localhost resolves to the socat IPv4 listener; the larger header limit absorbs
+    # Supabase auth cookies (on localhost they aren't port-scoped, so they pile onto every request).
+    NODE_OPTIONS="--dns-result-order=ipv4first --max-http-header-size=65536"
 
 # A single-app project traces to its own root, so server.js sits at the top of .next/standalone.
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 
+# Loopback proxy: the browser-facing localhost URLs (Supabase :8000, MinIO :9000) are inlined into
+# the build, but server-side code + next/image run INSIDE this container. Forward those ports to the
+# compose services so SSR + image optimization work, and so the Supabase auth cookie key (derived
+# from the URL host) matches between browser and server. Override targets with LOOPBACK_PROXIES.
+RUN printf '%s\n' \
+  '#!/bin/sh' \
+  'set -e' \
+  ': "${LOOPBACK_PROXIES:=8000:kong:8000 9000:minio:9000}"' \
+  'for p in $LOOPBACK_PROXIES; do' \
+  '  socat "TCP4-LISTEN:${p%%:*},fork,reuseaddr,bind=127.0.0.1" "TCP:${p#*:}" 2>/dev/null &' \
+  'done' \
+  'exec node "$(cat .server-entry 2>/dev/null || echo server.js)"' \
+  > /app/docker-entrypoint.sh && chmod +x /app/docker-entrypoint.sh
+
 USER nextjs
 EXPOSE 3000
-CMD ["node", "server.js"]
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -38,6 +38,11 @@ interface PageTranslation {
 }
 
 export async function generateStaticParams(): Promise<ResolvedPageParams[]> {
+  // Unconfigured instance (pre-/setup): no DB to read slugs from.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return [];
+  }
+
   const supabase = getSsgSupabaseClient();
   const { data: pages, error } = await supabase
     .from("pages")

package/templates/nextblock-template/app/actions.ts

@@ -1,13 +1,14 @@
 "use server";
 
 import { encodedRedirect } from "@nextblock-cms/utils/server";
-import { createClient } from "@nextblock-cms/db/server";
+import { createClient, getServiceRoleSupabaseClient } from "@nextblock-cms/db/server";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { resolvePostAuthRedirect } from "../lib/auth-redirects";
 import { createEmailChallenge, evaluateTwoFactor } from "../lib/auth/twoFactor";
 import { REMEMBER_INTENT_COOKIE, setSecureCookie } from "../lib/auth/cookies";
 import { sendTwoFactorCodeEmail } from "./actions/twoFactorEmail";
+import { getSystemConfiguration } from "../lib/setup/system-config";
 
 export const signUpAction = async (formData: FormData) => {
   const email = formData.get("email")?.toString();
@@ -29,7 +30,48 @@ export const signUpAction = async (formData: FormData) => {
     );
   }
 
-  const { error } = await supabase.auth.signUp({
+  // Auto-accept mode (system_configuration.auto_accept_signups): create an already-
+  // confirmed account via the service role so the user is active immediately, with no
+  // outbound verification email — regardless of SMTP / project email-confirmation
+  // settings. Falls through to the standard signUp flow if the service role isn't
+  // available. NOTE: keep supabase.auth calls outside any try/catch so the redirect
+  // they (and encodedRedirect) throw internally is never swallowed.
+  const { auto_accept_signups: autoAcceptSignups } = await getSystemConfiguration();
+  if (autoAcceptSignups) {
+    let admin: ReturnType<typeof getServiceRoleSupabaseClient> | null = null;
+    try {
+      admin = getServiceRoleSupabaseClient();
+    } catch {
+      admin = null; // service role missing — use the standard flow below
+    }
+
+    if (admin) {
+      const { error: createError } = await admin.auth.admin.createUser({
+        email,
+        password,
+        email_confirm: true,
+      });
+
+      if (createError) {
+        if (createError.message.toLowerCase().includes("already")) {
+          return encodedRedirect("error", "/sign-up", "auth.signup_existing_account_hint");
+        }
+        return encodedRedirect("error", "/sign-up", createError.message);
+      }
+
+      const { error: signInError } = await supabase.auth.signInWithPassword({
+        email,
+        password,
+      });
+      if (signInError) {
+        return encodedRedirect("error", "/sign-in", signInError.message);
+      }
+
+      return redirect("/post-sign-in");
+    }
+  }
+
+  const { data, error } = await supabase.auth.signUp({
     email,
     password,
     options: {
@@ -57,13 +99,21 @@ export const signUpAction = async (formData: FormData) => {
     }
 
     return encodedRedirect("error", "/sign-up", error.message);
-  } else {
-    return encodedRedirect(
-      "success",
-      "/sign-up",
-      "auth.signup_check_email_profile",
-    );
   }
+
+  // When sign-up returns a session, the account is already confirmed — self-hosted GoTrue with
+  // autoconfirm (no SMTP), or any project without email confirmation. The user is already signed
+  // in, so send them into the app instead of telling them to check an email that was never sent.
+  // (The first account becomes ADMIN and lands in the dashboard; everyone else routes normally.)
+  if (data.session) {
+    return redirect("/post-sign-in");
+  }
+
+  return encodedRedirect(
+    "success",
+    "/sign-up",
+    "auth.signup_check_email_profile",
+  );
 };
 
 export const signInAction = async (formData: FormData) => {

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -7816,6 +7816,89 @@ npm run dev</code></pre>
 ), 0 FROM target_posts tp WHERE tp.slug = 'comment-configurer-nextblock';
 
 
+-- >>> FROM: 00000000000030_setup_system_configuration.sql <<<
+-- 00000000000030_setup_system_configuration.sql
+-- First-Boot Setup Wizard: global system configuration.
+--
+-- Adds a dedicated, RLS-locked \`system_configuration\` table that holds settings the
+-- browser /setup wizard manages and that don't belong in the public key-value
+-- \`site_settings\` store. It is a singleton (exactly one row, id = 1).
+--
+-- Shape:
+--   auto_accept_signups boolean  -- when true, new public sign-ups skip outbound email
+--                                   verification (the signup route uses a service-role
+--                                   admin.createUser({ email_confirm: true }) path).
+--   settings            jsonb    -- forward-compatible catch-all for future feature
+--                                   toggles ({} by default). Do NOT store true secrets
+--                                   here (Turnstile/AI secrets keep living in their
+--                                   existing site_settings sensitive keys).
+--
+-- Access is locked to the ADMIN role for normal clients (NextBlock has no separate
+-- "super-admin" tier — ADMIN is the top level). The service_role retains full access
+-- so the wizard can seed/read it before any admin exists.
+
+CREATE TABLE IF NOT EXISTS public.system_configuration (
+  id integer PRIMARY KEY DEFAULT 1,
+  auto_accept_signups boolean NOT NULL DEFAULT false,
+  settings jsonb NOT NULL DEFAULT '{}'::jsonb,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT system_configuration_singleton CHECK (id = 1)
+);
+
+COMMENT ON TABLE public.system_configuration IS
+  'Singleton (id = 1) of global setup-wizard configuration. ADMIN-only via RLS; never store secrets in settings.';
+
+-- Seed the single row so reads always find it.
+INSERT INTO public.system_configuration (id, auto_accept_signups, settings)
+VALUES (1, false, '{}'::jsonb)
+ON CONFLICT (id) DO NOTHING;
+
+ALTER TABLE public.system_configuration ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.system_configuration TO authenticated;
+GRANT ALL ON public.system_configuration TO service_role;
+
+-- ADMIN-only for every operation by authenticated clients.
+DROP POLICY IF EXISTS system_configuration_admin_select ON public.system_configuration;
+CREATE POLICY system_configuration_admin_select
+  ON public.system_configuration
+  FOR SELECT
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_insert ON public.system_configuration;
+CREATE POLICY system_configuration_admin_insert
+  ON public.system_configuration
+  FOR INSERT
+  TO authenticated
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_update ON public.system_configuration;
+CREATE POLICY system_configuration_admin_update
+  ON public.system_configuration
+  FOR UPDATE
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN')
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+DROP POLICY IF EXISTS system_configuration_admin_delete ON public.system_configuration;
+CREATE POLICY system_configuration_admin_delete
+  ON public.system_configuration
+  FOR DELETE
+  TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN');
+
+-- Service role bypasses the ADMIN checks (used by the wizard before an admin exists,
+-- and by the signup route to read auto_accept_signups as an anonymous visitor).
+DROP POLICY IF EXISTS system_configuration_service_role_all ON public.system_configuration;
+CREATE POLICY system_configuration_service_role_all
+  ON public.system_configuration
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+
   -- Step D: Anchor preserved profiles
   INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
   SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'

package/templates/nextblock-template/app/api/process-image/route.ts

@@ -1,6 +1,6 @@
 // app/api/process-image/route.ts
 import { NextRequest, NextResponse } from 'next/server';
-import { getS3Client } from '@nextblock-cms/utils/server';
+import { getS3Client } from '@nextblock-cms/utils/server';
 import { GetObjectCommand, PutObjectCommand } from '@aws-sdk/client-s3';
 import sharp from 'sharp';
 import { Readable } from 'stream';
@@ -54,13 +54,13 @@ export async function POST(request: NextRequest) {
 
 
   try {
-    const s3Client = await getS3Client();
-    if (!s3Client) {
-      console.error('R2 client is not configured. Check your R2 environment variables.');
-      return NextResponse.json({ error: 'Image processing is not configured on this server.' }, { status: 500 });
-    }
-
-    const { objectKey: originalObjectKey, contentType: originalContentType } = await request.json();
+    const s3Client = await getS3Client();
+    if (!s3Client) {
+      console.error('R2 client is not configured. Check your R2 environment variables.');
+      return NextResponse.json({ error: 'Image processing is not configured on this server.' }, { status: 500 });
+    }
+
+    const { objectKey: originalObjectKey, contentType: originalContentType } = await request.json();
 
     if (!originalObjectKey || !originalContentType) {
       return NextResponse.json({ error: 'Missing objectKey or contentType in request body.' }, { status: 400 });
@@ -127,7 +127,11 @@ export async function POST(request: NextRequest) {
         .toFormat(TARGET_FORMAT, { quality: 75 }) // Adjust quality as needed
         .toBuffer();
       
-      const newObjectKey = `${baseName}_${size.label}.${TARGET_FORMAT}`;
+      // size.label keeps its '_avif' suffix as the stored variantLabel (used for
+      // variant selection), but it's redundant in the filename since the extension is
+      // already .avif — strip it so keys read `..._large.avif`, not `..._large_avif.avif`.
+      const fileSuffix = size.label.replace(/_avif$/, '');
+      const newObjectKey = `${baseName}_${fileSuffix}.${TARGET_FORMAT}`;
       const newPublicUrl = `${R2_PUBLIC_URL_BASE}/${newObjectKey}`;
 
       const putObjectParams = {

package/templates/nextblock-template/app/article/[slug]/page.tsx

@@ -25,6 +25,11 @@ import { getRequestOrigin } from '../../../lib/visual-editing/edit-info';
 
 export const dynamicParams = true;
 export const revalidate = 3600;
+// Render per-request: the shared root layout reads cookies()/headers()/draftMode() (auth + locale),
+// so attempting a statically-cached render throws DYNAMIC_SERVER_USAGE (500). Matches the sibling
+// content routes /[slug] and /product/[slug], which already force dynamic for the same reason.
+export const dynamic = 'force-dynamic';
+export const fetchCache = 'force-no-store';
 
 interface ResolvedPostParams {
   slug: string;

package/templates/nextblock-template/app/cms/components/ContentLanguageSwitcher.tsx

@@ -67,7 +67,13 @@ export default function ContentLanguageSwitcher({
         .eq('translation_group_id', currentItem.translation_group_id);
 
       if (error) {
-        console.error(`Error fetching translations for ${itemType} group ${currentItem.translation_group_id}:`, error);
+        // Surface a useful message: a network "Failed to fetch" (e.g. the browser
+        // Supabase client before the runtime public env is in place) serializes to {},
+        // so log the message/code explicitly.
+        console.error(
+          `Error fetching translations for ${itemType} group ${currentItem.translation_group_id}:`,
+          error.message || error.code || JSON.stringify(error),
+        );
         setTranslations([]);
       } else if (data) {
         const mappedTranslations = data.map(item => {
@@ -116,17 +122,17 @@ export default function ContentLanguageSwitcher({
 
           // Link to create new translation if it doesn't exist
           // This requires a more complex "create translation" flow or pre-created placeholders
-          const tableMap = {
-            'page': 'pages',
-            'post': 'posts',
-            'product': 'products'
-          };
-          const baseUrl = `/cms/${tableMap[itemType]}`;
-          const editUrl = version
-            ? `${baseUrl}/${version.id}/edit`
-            : itemType === 'product'
-              ? `${baseUrl}/${currentItemAny.id}/edit?missing_lang_id=${lang.id}`
-              : `${baseUrl}/new?from_group=${currentItemAny.translation_group_id}&target_lang_id=${lang.id}&base_slug=${currentItemAny.slug}`; // Example URL for creating new translation
+          const tableMap = {
+            'page': 'pages',
+            'post': 'posts',
+            'product': 'products'
+          };
+          const baseUrl = `/cms/${tableMap[itemType]}`;
+          const editUrl = version
+            ? `${baseUrl}/${version.id}/edit`
+            : itemType === 'product'
+              ? `${baseUrl}/${currentItemAny.id}/edit?missing_lang_id=${lang.id}`
+              : `${baseUrl}/new?from_group=${currentItemAny.translation_group_id}&target_lang_id=${lang.id}&base_slug=${currentItemAny.slug}`; // Example URL for creating new translation
 
           if (version) {
             return (
@@ -160,4 +166,4 @@ export default function ContentLanguageSwitcher({
       </DropdownMenuContent>
     </DropdownMenu>
   );
-}
+}

package/templates/nextblock-template/app/cms/settings/security/actions.ts

@@ -24,6 +24,10 @@ import {
   revokeTrustedDevice,
   type TrustedDeviceRow,
 } from '../../../../lib/auth/trustedDevices';
+import {
+  getSystemConfiguration,
+  updateSystemConfiguration,
+} from '../../../../lib/setup/system-config';
 
 export interface SecurityPanelData {
   email: string;
@@ -33,6 +37,7 @@ export interface SecurityPanelData {
   isAdmin: boolean;
   globalSettings: SecuritySettings;
   trustedDevices: TrustedDeviceRow[];
+  autoAcceptSignups: boolean;
 }
 
 async function requireUser() {
@@ -70,6 +75,31 @@ export async function getSecurityPanelData(): Promise<SecurityPanelData> {
     isAdmin: profile?.role === 'ADMIN',
     globalSettings: await readSecuritySettings(),
     trustedDevices: await listTrustedDevices(user.id),
+    autoAcceptSignups: (await getSystemConfiguration()).auto_accept_signups,
+  };
+}
+
+// --- Sign-up policy (admin only) ------------------------------------------------
+
+export async function updateAutoAcceptSignups(formData: FormData) {
+  const { supabase, user } = await requireUser();
+  const { data: profile } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (profile?.role !== 'ADMIN') {
+    throw new Error('Only administrators can change the sign-up policy.');
+  }
+
+  const enabled = formData.get('auto_accept_signups') === 'true';
+  await updateSystemConfiguration({ auto_accept_signups: enabled });
+  revalidatePath('/cms/settings/security');
+  return {
+    success: true,
+    message: enabled
+      ? 'New sign-ups will be auto-approved without email verification.'
+      : 'New sign-ups now require email verification.',
   };
 }