create-nextblock 0.9.95 → 0.9.98

package/templates/nextblock-template/app/cms/media/actions.ts

@@ -7,6 +7,8 @@ import type { Database } from "@nextblock-cms/db";
 import { encodedRedirect } from "@nextblock-cms/utils/server";
 import { DeleteObjectCommand, DeleteObjectsCommand, CopyObjectCommand, ListObjectsV2Command, HeadObjectCommand } from "@aws-sdk/client-s3";
 import { getS3Client } from "@nextblock-cms/utils/server";
+import { getStorageBackend, getStorageBucket } from "../../../lib/storage/provider";
+import { supabaseRemoveObjects } from "../../../lib/storage/supabase-storage";
 
 type Media = Database['public']['Tables']['media']['Row'];
 
@@ -85,13 +87,14 @@ export async function deleteMediaItem(mediaId: string, objectKey: string) {
         return encodedRedirect("error", "/cms/media", "Forbidden: Insufficient permissions.");
     }
 
-    const s3Client = await getS3Client();
-    const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
+    const backend = getStorageBackend();
+    const bucket = getStorageBucket();
+    const s3Client = backend === 's3' ? await getS3Client() : null;
 
-    if (!R2_BUCKET_NAME) {
-      return encodedRedirect("error", "/cms/media", "R2 Bucket not configured for deletion.");
+    if (!bucket) {
+      return encodedRedirect("error", "/cms/media", "Storage bucket not configured for deletion.");
     }
-    if (!s3Client) {
+    if (backend === 's3' && !s3Client) {
       return encodedRedirect("error", "/cms/media", "R2 client is not configured for deletion.");
     }
 
@@ -110,15 +113,18 @@ export async function deleteMediaItem(mediaId: string, objectKey: string) {
     }
 
     try {
-        const deleteCommand = new DeleteObjectsCommand({
-            Bucket: R2_BUCKET_NAME,
-            Delete: {
-                Objects: keysToDelete.map(key => ({ Key: key })),
-            },
-        });
-        await s3Client.send(deleteCommand);
+        if (backend === 'supabase') {
+            await supabaseRemoveObjects(keysToDelete);
+        } else {
+            await s3Client!.send(new DeleteObjectsCommand({
+                Bucket: bucket,
+                Delete: {
+                    Objects: keysToDelete.map(key => ({ Key: key })),
+                },
+            }));
+        }
     } catch (r2Error: unknown) {
-        console.error("Error deleting from R2:", r2Error);
+        console.error("Error deleting from storage:", r2Error);
         // Decide if you want to proceed with DB deletion if R2 deletion fails
         // It's often better to proceed and log, or handle more gracefully.
         // For now, we'll let it proceed to DB deletion but the error is logged.
@@ -153,13 +159,14 @@ export async function deleteMultipleMediaItems(items: Array<{ id: string; object
     return { error: "No items selected for deletion." };
   }
 
-  const s3Client = await getS3Client();
-  const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
+  const backend = getStorageBackend();
+  const bucket = getStorageBucket();
+  const s3Client = backend === 's3' ? await getS3Client() : null;
 
-  if (!R2_BUCKET_NAME) {
-    return { error: "R2 Bucket not configured for deletion." };
+  if (!bucket) {
+    return { error: "Storage bucket not configured for deletion." };
   }
-  if (!s3Client) {
+  if (backend === 's3' && !s3Client) {
     return { error: "R2 client is not configured for deletion." };
   }
 
@@ -191,23 +198,26 @@ export async function deleteMultipleMediaItems(items: Array<{ id: string; object
   let r2DeletionError = null;
   let dbDeletionError = null;
 
-  // Batch delete from R2
+  // Batch delete from object storage
   try {
     if (r2ObjectsToDelete.length > 0) {
-      const deleteCommand = new DeleteObjectsCommand({
-        Bucket: R2_BUCKET_NAME,
-        Delete: { Objects: r2ObjectsToDelete },
-      });
-      const output = await s3Client.send(deleteCommand);
-      if (output.Errors && output.Errors.length > 0) {
-        console.error("Errors deleting some objects from R2:", output.Errors);
-        // Collect specific errors if needed, for now a general message
-        r2DeletionError = `Some objects failed to delete from R2: ${output.Errors.map(e => e.Key).join(', ')}`;
+      if (backend === 'supabase') {
+        await supabaseRemoveObjects(allKeysToDelete);
+      } else {
+        const output = await s3Client!.send(new DeleteObjectsCommand({
+          Bucket: bucket,
+          Delete: { Objects: r2ObjectsToDelete },
+        }));
+        if (output.Errors && output.Errors.length > 0) {
+          console.error("Errors deleting some objects from storage:", output.Errors);
+          // Collect specific errors if needed, for now a general message
+          r2DeletionError = `Some objects failed to delete from storage: ${output.Errors.map(e => e.Key).join(', ')}`;
+        }
       }
     }
   } catch (error: unknown) {
-    console.error("Error batch deleting from R2:", error);
-    r2DeletionError = `Failed to delete objects from R2: ${error instanceof Error ? error.message : String(error)}`;
+    console.error("Error batch deleting from storage:", error);
+    r2DeletionError = `Failed to delete objects from storage: ${error instanceof Error ? error.message : String(error)}`;
   }
 
   // Batch delete from Supabase
@@ -264,8 +274,14 @@ export async function moveMultipleMediaItems(
   };
   const folder = sanitizeFolder(destinationFolder);
 
+  // Folder reorganisation uses S3 copy/list semantics that the native Supabase backend
+  // doesn't replicate yet — surface a clear message instead of a generic config error.
+  if (getStorageBackend() === 'supabase') {
+    return { error: "Moving media between folders isn't supported on Supabase Storage yet. Delete and re-upload to relocate a file." };
+  }
+
   const s3Client = await getS3Client();
-  const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
+  const R2_BUCKET_NAME = getStorageBucket();
   const R2_PUBLIC_URL_BASE = process.env.NEXT_PUBLIC_R2_BASE_URL || '';
 
   if (!R2_BUCKET_NAME) {

package/templates/nextblock-template/app/cms/orders/actions.ts

@@ -1,12 +1,12 @@
-'use server';
-
-import { createClient } from '@nextblock-cms/db/server';
-import {
-  applyOrderInventoryDeduction,
-  assignInvoiceMetadata,
-} from '@nextblock-cms/ecommerce/server';
-import { createClient as createSupabaseClient } from '@supabase/supabase-js';
-import { OrderWithDetails } from './types';
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import {
+  applyOrderInventoryDeduction,
+  assignInvoiceMetadata,
+} from '@nextblock-cms/ecommerce/server';
+import { createClient as createSupabaseClient } from '@supabase/supabase-js';
+import { OrderWithDetails } from './types';
 
 const ITEMS_PER_PAGE = 20;
 
@@ -150,7 +150,7 @@ export async function getOrderDetails(orderId: string): Promise<OrderWithDetails
   } as OrderWithDetails;
 }
 
-export async function markOrderAsPaid(orderId: string): Promise<{ success: boolean; error?: string }> {
+export async function markOrderAsPaid(orderId: string): Promise<{ success: boolean; error?: string }> {
     const supabase = createClient();
     
     // 1. Verify Authentication (using user session)
@@ -162,8 +162,8 @@ export async function markOrderAsPaid(orderId: string): Promise<{ success: boole
 
     // 2. Perform Update using Service Role (Bypass RLS)
     
-    const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-    const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+    const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
+    const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
 
     if (!serviceRoleKey || !supabaseUrl) {
          return { success: false, error: 'Server configuration error' };
@@ -176,26 +176,26 @@ export async function markOrderAsPaid(orderId: string): Promise<{ success: boole
         }
     });
 
-    const { data: updatedData, error } = await adminSupabase
-        .from('orders')
-        .update({ status: 'paid' })
-        .eq('id', orderId)
-        .select();
+    const { data: updatedData, error } = await adminSupabase
+        .from('orders')
+        .update({ status: 'paid' })
+        .eq('id', orderId)
+        .select();
 
     if (error) {
         console.error('Mark Paid DB Error:', error);
         return { success: false, error: error.message };
     }
 
-    if (!updatedData || updatedData.length === 0) {
-        return { success: false, error: 'Order not found or update failed.' };
-    }
-
-    await assignInvoiceMetadata({
-        orderId,
-        client: adminSupabase as any,
-    });
-    await applyOrderInventoryDeduction(adminSupabase as any, orderId);
-
-    return { success: true };
-}
+    if (!updatedData || updatedData.length === 0) {
+        return { success: false, error: 'Order not found or update failed.' };
+    }
+
+    await assignInvoiceMetadata({
+        orderId,
+        client: adminSupabase as any,
+    });
+    await applyOrderInventoryDeduction(adminSupabase as any, orderId);
+
+    return { success: true };
+}

package/templates/nextblock-template/app/cms/users/[id]/edit/page.tsx

@@ -1,23 +1,23 @@
 // app/cms/users/[id]/edit/page.tsx
-import UserForm from "../../components/UserForm";
-import { updateUserProfile } from "../../actions";
-import type { Database } from "@nextblock-cms/db";
-import { notFound } from "next/navigation";
-import { getDefaultUserAddresses } from "@nextblock-cms/ecommerce/server";
-
-type Profile = Database['public']['Tables']['profiles']['Row'];
-type AuthUser = {
-    id: string;
-    email: string | undefined;
+import UserForm from "../../components/UserForm";
+import { updateUserProfile } from "../../actions";
+import type { Database } from "@nextblock-cms/db";
+import { notFound } from "next/navigation";
+import { getDefaultUserAddresses } from "@nextblock-cms/ecommerce/server";
+
+type Profile = Database['public']['Tables']['profiles']['Row'];
+type AuthUser = {
+    id: string;
+    email: string | undefined;
     created_at: string | undefined;
     last_sign_in_at: string | undefined;
 };
 
-async function getUserAndProfileData(userId: string): Promise<{
-  authUser: AuthUser;
-  profile: Profile | null;
-  addresses: Awaited<ReturnType<typeof getDefaultUserAddresses>>;
-} | null> {
+async function getUserAndProfileData(userId: string): Promise<{
+  authUser: AuthUser;
+  profile: Profile | null;
+  addresses: Awaited<ReturnType<typeof getDefaultUserAddresses>>;
+} | null> {
 
   // Fetch user from auth.users
   // For admin operations, you might need a service_role client to fetch any user.
@@ -27,9 +27,9 @@ async function getUserAndProfileData(userId: string): Promise<{
 
   // Let's use the admin API for fetching the auth user.
    const { createClient: createServiceRoleClient } = await import('@supabase/supabase-js');
-   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-   const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-   
+   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+   const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
+
    if (!supabaseUrl || !serviceRoleKey) {
      throw new Error('Missing required environment variables');
    }
@@ -62,10 +62,10 @@ async function getUserAndProfileData(userId: string): Promise<{
       last_sign_in_at: authUserData.last_sign_in_at,
   };
 
-  const addresses = await getDefaultUserAddresses(userId, serviceSupabase as any);
-
-  return { authUser: simplifiedAuthUser, profile: profileData as Profile | null, addresses };
-}
+  const addresses = await getDefaultUserAddresses(userId, serviceSupabase as any);
+
+  return { authUser: simplifiedAuthUser, profile: profileData as Profile | null, addresses };
+}
 
 export default async function EditUserPage(props: { params: Promise<{ id: string }> }) {
   const params = await props.params;
@@ -85,12 +85,12 @@ export default async function EditUserPage(props: { params: Promise<{ id: string
   return (
     <div className="max-w-4xl mx-auto">
       <h1 className="text-2xl font-bold mb-6">Edit User: {userData.authUser.email}</h1>
-      <UserForm
-        userToEditAuth={userData.authUser}
-        userToEditProfile={userData.profile}
-        userToEditAddresses={userData.addresses}
-        formAction={updateUserActionWithId}
-      />
+      <UserForm
+        userToEditAuth={userData.authUser}
+        userToEditProfile={userData.profile}
+        userToEditAddresses={userData.addresses}
+        formAction={updateUserActionWithId}
+      />
     </div>
   );
 }

package/templates/nextblock-template/app/cms/users/actions.ts

@@ -1,4 +1,4 @@
-// app/cms/users/actions.ts
+// app/cms/users/actions.ts
 "use server";
 
 import { createClient } from "@nextblock-cms/db/server";
@@ -8,30 +8,31 @@ import type { Database } from "@nextblock-cms/db";
 import { normalizeCustomerAddress } from "@nextblock-cms/ecommerce";
 import { upsertDefaultUserAddresses } from "@nextblock-cms/ecommerce/server";
 import { createClient as createSupabaseClient } from '@supabase/supabase-js';
-
-type UserRole = Database['public']['Enums']['user_role'];
-
-// Helper to check admin role using the server client
-async function verifyAdmin(supabase: ReturnType<typeof createClient>): Promise<{ isAdmin: boolean; error?: string; userId?: string }> {
-  const { data: { user }, error: authError } = await supabase.auth.getUser();
-  if (authError || !user) {
-    return { isAdmin: false, error: "Authentication required." };
-  }
-  const { data: profile, error: profileError } = await supabase
-    .from("profiles")
-    .select("role")
-    .eq("id", user.id)
-    .single();
-
-  if (profileError || !profile) {
-    return { isAdmin: false, error: "Profile not found or error fetching profile." };
-  }
-  if (profile.role !== "ADMIN") {
-    return { isAdmin: false, error: "Admin privileges required." };
-  }
-  return { isAdmin: true, userId: user.id };
-}
-
+import { resolveSupabaseServiceKey, resolveSupabaseUrl } from '../../../lib/setup/env-status';
+
+type UserRole = Database['public']['Enums']['user_role'];
+
+// Helper to check admin role using the server client
+async function verifyAdmin(supabase: ReturnType<typeof createClient>): Promise<{ isAdmin: boolean; error?: string; userId?: string }> {
+  const { data: { user }, error: authError } = await supabase.auth.getUser();
+  if (authError || !user) {
+    return { isAdmin: false, error: "Authentication required." };
+  }
+  const { data: profile, error: profileError } = await supabase
+    .from("profiles")
+    .select("role")
+    .eq("id", user.id)
+    .single();
+
+  if (profileError || !profile) {
+    return { isAdmin: false, error: "Profile not found or error fetching profile." };
+  }
+  if (profile.role !== "ADMIN") {
+    return { isAdmin: false, error: "Admin privileges required." };
+  }
+  return { isAdmin: true, userId: user.id };
+}
+
 type UpdateUserProfilePayload = {
   role: UserRole;
   full_name?: string | null;
@@ -42,8 +43,8 @@ type UpdateUserProfilePayload = {
 };
 
 function createServiceRoleClient() {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const supabaseUrl = resolveSupabaseUrl();
+  const serviceRoleKey = resolveSupabaseServiceKey();
 
   if (!supabaseUrl || !serviceRoleKey) {
     throw new Error('Missing required environment variables');
@@ -60,10 +61,10 @@ function createServiceRoleClient() {
 export async function updateUserProfile(userIdToUpdate: string, formData: FormData) {
   const supabase = createClient();
   const adminCheck = await verifyAdmin(supabase);
-  if (!adminCheck.isAdmin) {
-    return { error: adminCheck.error || "Unauthorized" };
-  }
-
+  if (!adminCheck.isAdmin) {
+    return { error: adminCheck.error || "Unauthorized" };
+  }
+
   const parseAddressField = (fieldName: string) => {
     const rawValue = formData.get(fieldName) as string | null;
     if (!rawValue) {
@@ -99,27 +100,27 @@ export async function updateUserProfile(userIdToUpdate: string, formData: FormDa
     github_username: formData.get("github_username") as string || null,
     phone: formData.get("phone") as string || null,
   };
-
-  if (!rawFormData.role) {
-    return { error: "Role is a required field." };
-  }
-  if (!['ADMIN', 'WRITER', 'USER'].includes(rawFormData.role)) {
-      return { error: "Invalid role specified." };
-  }
-
-  // Prevent an admin from accidentally removing their own admin role if they are the only admin
-  // This is a basic check; a more robust system might count admins.
-  if (userIdToUpdate === adminCheck.userId && rawFormData.role !== 'ADMIN') {
-      const { count } = await supabase
-        .from('profiles')
-        .select('*', { count: 'exact', head: true })
-        .eq('role', 'ADMIN');
-      if (count === 1) {
-          return { error: "Cannot remove the last admin's role." };
-      }
-  }
-
-
+
+  if (!rawFormData.role) {
+    return { error: "Role is a required field." };
+  }
+  if (!['ADMIN', 'WRITER', 'USER'].includes(rawFormData.role)) {
+      return { error: "Invalid role specified." };
+  }
+
+  // Prevent an admin from accidentally removing their own admin role if they are the only admin
+  // This is a basic check; a more robust system might count admins.
+  if (userIdToUpdate === adminCheck.userId && rawFormData.role !== 'ADMIN') {
+      const { count } = await supabase
+        .from('profiles')
+        .select('*', { count: 'exact', head: true })
+        .eq('role', 'ADMIN');
+      if (count === 1) {
+          return { error: "Cannot remove the last admin's role." };
+      }
+  }
+
+
   const profileData: UpdateUserProfilePayload = {
     role: rawFormData.role,
     full_name: rawFormData.full_name,
@@ -135,8 +136,8 @@ export async function updateUserProfile(userIdToUpdate: string, formData: FormDa
     .from("profiles")
     .update(profileData)
     .eq("id", userIdToUpdate);
-
-  if (error) {
+
+  if (error) {
     console.error("Error updating user profile:", error);
     return { error: `Failed to update profile: ${error.message}` };
   }
@@ -154,68 +155,68 @@ export async function updateUserProfile(userIdToUpdate: string, formData: FormDa
   revalidatePath("/checkout");
   redirect(`/cms/users/${userIdToUpdate}/edit?success=User profile updated successfully`);
 }
-
-export async function deleteUserAndProfile(userIdToDelete: string) {
-
-  // For deleting a user, we need to use the Supabase Admin API,
-  // which requires a client initialized with the SERVICE_ROLE_KEY.
-  // This ensures the operation has the necessary privileges.
-  // IMPORTANT: Ensure SUPABASE_SERVICE_ROLE_KEY is set in your .env.local and Vercel env vars.
-  const supabaseAdmin = createClient(
-    // Re-create client with service role. This is a common pattern.
-    // Ensure your createClient function can be called without args to use env vars,
-    // or pass them explicitly if needed. The one from the template should work.
-    // If your createClient is specific to user context (cookies), you might need a separate
-    // admin client factory. For now, assuming `createClient()` can make a service client
-    // if called in a server action without user cookie context, or if it defaults to service key.
-    // A safer way:
-    // const supabaseAdmin = createClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);
-    // However, the template's createClient for server components/actions should handle this by not having cookie access.
-    // Let's assume for now createClient() is sufficient if it can use service role.
-    // A more explicit way for admin actions:
-    // import { createClient as createAdminClient } from '@supabase/supabase-js';
-    // const supabaseAdmin = createAdminClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);
-  );
-
-
-  const adminCheck = await verifyAdmin(supabaseAdmin); // Verify current user is admin
-  if (!adminCheck.isAdmin) {
-    return { error: adminCheck.error || "Unauthorized" };
-  }
-
-  if (userIdToDelete === adminCheck.userId) {
-    return { error: "Admins cannot delete their own account through this panel." };
-  }
-
-  // Use the Supabase Auth Admin API to delete the user
-  // This requires the `SERVICE_ROLE_KEY` to be configured for the Supabase client.
-  // The standard `createClient` from `utils/supabase/server` might not use the service role by default.
-  // You might need a dedicated admin client instance.
-  // For this example, we'll assume `supabase.auth.admin.deleteUser` is available and configured.
-  // If not, this part needs adjustment to use a service_role client.
-
-  // The `createClient()` from `@supabase/ssr` for server context doesn't directly expose `auth.admin`.
-  // We need to create a standard Supabase client with the service role key.
-  const { createClient: createServiceRoleClient } = await import('@supabase/supabase-js');
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-  
-  if (!supabaseUrl || !serviceRoleKey) {
-    throw new Error('Missing required environment variables');
-  }
-  
-  const serviceSupabase = createServiceRoleClient(supabaseUrl, serviceRoleKey);
-
-
-  const { error: deletionError } = await serviceSupabase.auth.admin.deleteUser(userIdToDelete);
-
-  if (deletionError) {
-    console.error("Error deleting user:", deletionError);
-    // If the profile was deleted by cascade but auth user deletion failed, this is an inconsistent state.
-    return { error: `Failed to delete user: ${deletionError.message}` };
-  }
-
-  // The `profiles` table has ON DELETE CASCADE for the user ID, so it should be deleted automatically.
-  revalidatePath("/cms/users");
-  redirect("/cms/users?success=User deleted successfully");
+
+export async function deleteUserAndProfile(userIdToDelete: string) {
+
+  // For deleting a user, we need to use the Supabase Admin API,
+  // which requires a client initialized with the SERVICE_ROLE_KEY.
+  // This ensures the operation has the necessary privileges.
+  // IMPORTANT: Ensure SUPABASE_SERVICE_ROLE_KEY is set in your .env.local and Vercel env vars.
+  const supabaseAdmin = createClient(
+    // Re-create client with service role. This is a common pattern.
+    // Ensure your createClient function can be called without args to use env vars,
+    // or pass them explicitly if needed. The one from the template should work.
+    // If your createClient is specific to user context (cookies), you might need a separate
+    // admin client factory. For now, assuming `createClient()` can make a service client
+    // if called in a server action without user cookie context, or if it defaults to service key.
+    // A safer way:
+    // const supabaseAdmin = createClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);
+    // However, the template's createClient for server components/actions should handle this by not having cookie access.
+    // Let's assume for now createClient() is sufficient if it can use service role.
+    // A more explicit way for admin actions:
+    // import { createClient as createAdminClient } from '@supabase/supabase-js';
+    // const supabaseAdmin = createAdminClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);
+  );
+
+
+  const adminCheck = await verifyAdmin(supabaseAdmin); // Verify current user is admin
+  if (!adminCheck.isAdmin) {
+    return { error: adminCheck.error || "Unauthorized" };
+  }
+
+  if (userIdToDelete === adminCheck.userId) {
+    return { error: "Admins cannot delete their own account through this panel." };
+  }
+
+  // Use the Supabase Auth Admin API to delete the user
+  // This requires the `SERVICE_ROLE_KEY` to be configured for the Supabase client.
+  // The standard `createClient` from `utils/supabase/server` might not use the service role by default.
+  // You might need a dedicated admin client instance.
+  // For this example, we'll assume `supabase.auth.admin.deleteUser` is available and configured.
+  // If not, this part needs adjustment to use a service_role client.
+
+  // The `createClient()` from `@supabase/ssr` for server context doesn't directly expose `auth.admin`.
+  // We need to create a standard Supabase client with the service role key.
+  const { createClient: createServiceRoleClient } = await import('@supabase/supabase-js');
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
+
+  if (!supabaseUrl || !serviceRoleKey) {
+    throw new Error('Missing required environment variables');
+  }
+
+  const serviceSupabase = createServiceRoleClient(supabaseUrl, serviceRoleKey);
+
+
+  const { error: deletionError } = await serviceSupabase.auth.admin.deleteUser(userIdToDelete);
+
+  if (deletionError) {
+    console.error("Error deleting user:", deletionError);
+    // If the profile was deleted by cascade but auth user deletion failed, this is an inconsistent state.
+    return { error: `Failed to delete user: ${deletionError.message}` };
+  }
+
+  // The `profiles` table has ON DELETE CASCADE for the user ID, so it should be deleted automatically.
+  revalidatePath("/cms/users");
+  redirect("/cms/users?success=User deleted successfully");
 }

package/templates/nextblock-template/app/cms/users/page.tsx

@@ -37,9 +37,9 @@ import { DeleteUserButtonClient } from "./components/DeleteUserButton";
 async function getUsersData(currentAdminId: string): Promise<UserWithProfile[]> {
   // This needs to use a service role client to list all users from auth.users
   const { createClient: createServiceRoleClient } = await import('@supabase/supabase-js');
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
-  
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
+
   if (!supabaseUrl || !serviceRoleKey) {
     throw new Error('Missing required environment variables');
   }

package/templates/nextblock-template/app/layout.tsx

@@ -26,7 +26,12 @@ import { verifyPackageOnline } from '@nextblock-cms/db/server';
 import { unstable_cache } from 'next/cache';
 import { createStaticSupabaseClient, getSiteSettings } from './lib/site-settings';
 import { DEFAULT_OG_IMAGE } from './lib/seo';
-import { isSupabaseConfigured } from '../lib/setup/env-status';
+import {
+  isSupabaseConfigured,
+  resolveSupabaseAnonKey,
+  resolveSupabaseUrl,
+} from '../lib/setup/env-status';
+import { resolveMediaBaseUrl } from '../lib/storage/provider';
 
 const defaultUrl = process.env.NEXT_PUBLIC_URL || 'http://localhost:3000';
 
@@ -320,9 +325,7 @@ async function loadLayoutData() {
   const globalCss = typeof globalCssResult === 'string' ? globalCssResult : '';
   const translations = Array.isArray(translationsResult) ? translationsResult : [];
 
-  const hasSupabaseEnv = Boolean(
-    process.env.NEXT_PUBLIC_SUPABASE_URL && process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY
-  );
+  const hasSupabaseEnv = isSupabaseConfigured();
 
   const [profile, headerNavItems, footerNavItems, logo] = await Promise.all([
     user ? getProfileWithRoleServerSide(user.id) : Promise.resolve(null),
@@ -453,8 +456,8 @@ export default async function RootLayout({
   // build-time-inlined NEXT_PUBLIC_* and these just match; it only matters in local dev,
   // where the wizard writes those vars at runtime and the loaded bundle would otherwise
   // hold stale empties until a dev-server restart. Read from server process.env (fresh).
-  const publicSupabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || '';
-  const publicSupabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';
+  const publicSupabaseUrl = resolveSupabaseUrl() || '';
+  const publicSupabaseAnonKey = resolveSupabaseAnonKey() || '';
 
   return (
     <html lang={serverDeterminedLocale} suppressHydrationWarning>
@@ -468,7 +471,7 @@ export default async function RootLayout({
         <PublicEnvBootstrap
           url={publicSupabaseUrl}
           anonKey={publicSupabaseAnonKey}
-          r2Base={process.env.NEXT_PUBLIC_R2_BASE_URL || ''}
+          r2Base={resolveMediaBaseUrl()}
         />
         {/* In development this loads after hydration to avoid browser-hidden nonce comparisons. */}
         <Script