create-nextblock 0.9.0 → 0.9.6

package/templates/nextblock-template/app/cms/settings/security/components/SecurityPanel.tsx

@@ -28,6 +28,7 @@ import {
   revokeTrustedDeviceAction,
   sendEmailEnrollmentCode,
   startTotpEnrollment,
+  updateAutoAcceptSignups,
   updateGlobalSecuritySettings,
   verifyEmailEnrollment,
   verifyTotpEnrollment,
@@ -369,10 +370,78 @@ export default function SecurityPanel({ data }: { data: SecurityPanelData }) {
           onSave={(formData) => run(() => updateGlobalSecuritySettings(formData))}
         />
       )}
+
+      {/* Sign-up policy (admin only) */}
+      {data.isAdmin && (
+        <SignupPolicyCard
+          initial={data.autoAcceptSignups}
+          isPending={isPending}
+          onSave={(formData) => run(() => updateAutoAcceptSignups(formData))}
+        />
+      )}
     </>
   );
 }
 
+function SignupPolicyCard({
+  initial,
+  isPending,
+  onSave,
+}: {
+  initial: boolean;
+  isPending: boolean;
+  onSave: (formData: FormData) => void;
+}) {
+  const [enabled, setEnabled] = useState(initial);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Sign-up Policy (Admin)</CardTitle>
+        <CardDescription>
+          Controls how new public registrations are handled across the whole site.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            const formData = new FormData();
+            formData.append('auto_accept_signups', String(enabled));
+            onSave(formData);
+          }}
+          className="space-y-6"
+        >
+          <div className="flex items-start gap-3">
+            <Checkbox
+              id="auto_accept_signups"
+              checked={enabled}
+              onCheckedChange={(checked) => setEnabled(checked === true)}
+              className="mt-1"
+            />
+            <div className="space-y-1">
+              <Label htmlFor="auto_accept_signups">
+                Auto-approve registrations (skip outbound email verification)
+              </Label>
+              <p className="text-xs text-slate-500">
+                New accounts become active immediately, even without SMTP configured. Convenient
+                for local / self-hosted use; leave off for public production sites.
+              </p>
+            </div>
+          </div>
+
+          <Separator />
+
+          <Button type="submit" disabled={isPending}>
+            {isPending ? <Spinner className="mr-2 h-4 w-4 animate-spin" /> : null}
+            Save Policy
+          </Button>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}
+
 function AdminPolicyCard({
   initial,
   isPending,

package/templates/nextblock-template/app/layout.tsx

@@ -8,6 +8,7 @@ import { DeferredCartDrawer } from '../components/DeferredCartDrawer';
 import { CURRENCY_COOKIE_NAME } from '@nextblock-cms/ecommerce/currency-constants';
 import { ToasterProvider } from './ToasterProvider';
 import { AppShell } from '../components/AppShell';
+import { PublicEnvBootstrap } from '../components/PublicEnvBootstrap';
 import { ConsentGatedAnalytics } from '../components/privacy/ConsentGatedAnalytics';
 import { ConsentBanner } from '../components/privacy/ConsentBanner';
 import { getPrivacySettings } from '../lib/privacy/settings';
@@ -25,6 +26,7 @@ import { verifyPackageOnline } from '@nextblock-cms/db/server';
 import { unstable_cache } from 'next/cache';
 import { createStaticSupabaseClient, getSiteSettings } from './lib/site-settings';
 import { DEFAULT_OG_IMAGE } from './lib/seo';
+import { isSupabaseConfigured } from '../lib/setup/env-status';
 
 const defaultUrl = process.env.NEXT_PUBLIC_URL || 'http://localhost:3000';
 
@@ -230,11 +232,40 @@ const getCachedActiveLogo = unstable_cache(
 );
 
 async function loadLayoutData() {
-  const supabase = createSupabaseServerClient();
-
   const headerList = await headers();
-  const cookieStore = await cookies();
   const nonce = headerList.get('x-nonce') || '';
+  const requestPath = headerList.get('x-nextblock-path') || '';
+
+  // Skip the public-chrome data loading when there's nothing to render it on: an
+  // unconfigured instance, OR the standalone /setup wizard. On /setup, AppShell shows no
+  // header/footer anyway, and the DB schema may not exist yet (configured-but-pre-migrate)
+  // — querying it just produces noisy "table not found" errors for data nobody displays.
+  if (!isSupabaseConfigured() || requestPath.startsWith('/setup')) {
+    return {
+      user: null,
+      profile: null,
+      serverDeterminedLocale: DEFAULT_LOCALE_FOR_LAYOUT,
+      availableCurrencies: [] as StoreCurrency[],
+      serverCurrencyCode: null,
+      availableLanguages: [] as Language[],
+      defaultLanguage: null,
+      translations: [] as Awaited<ReturnType<typeof getCachedTranslations>>,
+      copyrightText: '',
+      nonce,
+      hasSupabaseEnv: false,
+      headerNavItems: [] as NavigationItem[],
+      footerNavItems: [] as NavigationItem[],
+      logo: null as HeaderLogo | null,
+      canAccessCms: false,
+      siteTitle: 'NextBlock',
+      isEcommerceActive: false,
+      globalCss: '',
+      privacySettings: DEFAULT_PRIVACY_SETTINGS,
+    };
+  }
+
+  const supabase = createSupabaseServerClient();
+  const cookieStore = await cookies();
 
   const xUserLocaleHeader = headerList.get('x-user-locale');
   const nextUserLocaleCookie = cookieStore.get('NEXT_USER_LOCALE')?.value;
@@ -417,6 +448,14 @@ export default async function RootLayout({
     ? (await import('@vercel/toolbar/next')).VercelToolbar
     : null;
 
+  // Expose the PUBLIC Supabase values (url + anon key — both safe to ship to the browser)
+  // to the client at runtime via <PublicEnvBootstrap>. In production the client uses the
+  // build-time-inlined NEXT_PUBLIC_* and these just match; it only matters in local dev,
+  // where the wizard writes those vars at runtime and the loaded bundle would otherwise
+  // hold stale empties until a dev-server restart. Read from server process.env (fresh).
+  const publicSupabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || '';
+  const publicSupabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';
+
   return (
     <html lang={serverDeterminedLocale} suppressHydrationWarning>
       <head>
@@ -424,6 +463,13 @@ export default async function RootLayout({
         {globalCss && <style dangerouslySetInnerHTML={{ __html: globalCss }} />}
       </head>
       <body className="min-h-screen">
+        {/* Sets window.__NEXTBLOCK_PUBLIC_ENV__ synchronously during render, before any
+            descendant calls the browser Supabase client — the local-dev runtime fallback. */}
+        <PublicEnvBootstrap
+          url={publicSupabaseUrl}
+          anonKey={publicSupabaseAnonKey}
+          r2Base={process.env.NEXT_PUBLIC_R2_BASE_URL || ''}
+        />
         {/* In development this loads after hydration to avoid browser-hidden nonce comparisons. */}
         <Script
           id="trusted-types-bootstrap"

package/templates/nextblock-template/app/lib/site-settings.ts

@@ -23,13 +23,16 @@ export interface SiteSettings {
  * route `generateMetadata` functions.
  */
 export function createStaticSupabaseClient() {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  // Fall back to a dummy host when unconfigured (fresh clone, pre-/setup) so the
+  // root layout can still render rather than crashing the whole app on boot. Callers
+  // (getSiteSettings + the getCached* helpers) already swallow failures and use
+  // fallbacks, and loadLayoutData short-circuits before reaching here when there is
+  // no Supabase env at all.
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://dummy.supabase.co';
   const supabaseKey =
-    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-
-  if (!supabaseUrl || !supabaseKey) {
-    throw new Error('Missing Supabase environment variables for public layout data');
-  }
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+    'dummy-anon-key';
 
   return createSupabaseJsClient<Database>(supabaseUrl, supabaseKey, {
     auth: {
@@ -53,6 +56,13 @@ export const getSiteSettings = unstable_cache(
       siteKeywords: DEFAULT_SITE_KEYWORDS,
     };
 
+    // Unconfigured instance (pre-/setup): the static client would point at the dummy
+    // host, so the fetch fails with a noisy DNS error before falling back. Skip it and
+    // return SEO defaults directly. (generateMetadata calls this even on /setup.)
+    if (!process.env.NEXT_PUBLIC_SUPABASE_URL) {
+      return fallback;
+    }
+
     try {
       const supabase = createStaticSupabaseClient();
       const { data, error } = await supabase
@@ -61,7 +71,12 @@ export const getSiteSettings = unstable_cache(
         .in('key', ['site_title', 'site_description', 'site_keywords']);
 
       if (error || !data) {
-        console.error('Error fetching cached site settings:', error);
+        // PGRST205 = table not found: the schema isn't migrated yet (e.g. mid-setup,
+        // right after the connection is saved but before `npm run db:migrate`). That's an
+        // expected transient state — don't shout about it. Real errors still log.
+        if (error && error.code !== 'PGRST205') {
+          console.error('Error fetching cached site settings:', error);
+        }
         return fallback;
       }
 

package/templates/nextblock-template/app/page.tsx

@@ -63,6 +63,12 @@ async function getPreferredLocale() {
 }
 
 export async function generateMetadata(): Promise<Metadata> {
+  // Unconfigured instance (pre-/setup): skip all DB work so metadata generation
+  // can't crash the boot. The proxy redirects unconfigured traffic to /setup anyway.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return { title: 'NextBlock' };
+  }
+
   const preferredLocale = await getPreferredLocale();
   const homepageSlug = await getHomepageSlugForLocale(preferredLocale);
   const pageData = await getPageDataBySlug(homepageSlug, preferredLocale);

package/templates/nextblock-template/app/product/[slug]/page.tsx

@@ -74,6 +74,11 @@ function resolveCategoryName(category: any, languageCode?: string | null) {
 }
 
 export async function generateStaticParams() {
+  // Unconfigured instance (pre-/setup): no DB to read product slugs from.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return [];
+  }
+
   const supabase = getSsgSupabaseClient();
   const { data: products } = await getProducts(supabase);
   const productRows = ((products || []) as any[]).filter(

package/templates/nextblock-template/app/providers.tsx

@@ -65,7 +65,7 @@ export function Providers({ children, ...props }: { children: React.ReactNode;[k
             <TranslationBridge translations={translations}>
               <ThemeProvider
                 attribute="class"
-                defaultTheme="system"
+                defaultTheme="light"
                 enableSystem
                 disableTransitionOnChange
                 nonce={nonce}