Files
Leon SerfatyandClaude Opus 5 3e9ba07175 feat: Cloudflare Turnstile on auth, CSP fixes, admin/SEO/analytics additions
Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
  provider; endpoints listed explicitly rather than relying on defaults.
  /reset-password is intentionally excluded — it is reached only via a
  single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
  so each form resets the challenge after a failed submit; submit stays
  disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
  does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
  secret is set without a site key (that combination would demand a token
  no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
  the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.

CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
  iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
  compiles with eval(), so the strict policy threw EvalError and killed
  hydration — no client JS ran at all, which also meant form submit
  handlers never fired. Production policy is unchanged and still strict.

Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
  OG/Twitter images, manifest), Umami analytics, not-found page.

Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).

Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-07 11:10:55 -04:00

95 lines
2.9 KiB
TypeScript

import type { Metadata } from "next";
import { requireAuth } from "@/lib/auth/guards";
import { getEffectivePlan, subjectHasFeature } from "@/lib/billing/subscription";
import { prisma } from "@/lib/db";
import { PageHeader } from "@/components/app/page-header";
import { UpgradeGate } from "@/components/app/upgrade-gate";
import { TeamClient } from "@/components/app/team-client";
export const metadata: Metadata = { title: "Team" };
export default async function TeamPage() {
const session = await requireAuth();
const allowed = await subjectHasFeature(
session.user.id,
"team_workspace",
session.session.activeOrganizationId
);
if (!allowed) {
return (
<>
<PageHeader title="Team workspace" description="Collaborate with your team." />
<UpgradeGate
title="Team workspaces are an Agency feature"
description="Upgrade to Agency for a 5-seat workspace, white-label mode, and custom branding."
requiredPlan="Agency"
/>
</>
);
}
const { plan } = await getEffectivePlan(session.user.id, session.session.activeOrganizationId);
const membership = await prisma.member.findFirst({
where: { userId: session.user.id },
include: {
organization: {
include: {
branding: true,
members: { include: { user: { select: { name: true, email: true } } } },
},
},
},
});
const org = membership?.organization ?? null;
const members =
org?.members.map((m) => ({
id: m.id,
userId: m.userId,
name: m.user.name,
email: m.user.email,
role: m.role,
})) ?? [];
// Pending invitations hold a seat until accepted or revoked, so they belong on
// this screen next to members — otherwise a workspace can look under-capacity
// while every seat is actually spoken for.
const invitations = org
? (
await prisma.invitation.findMany({
where: { organizationId: org.id, status: "pending" },
orderBy: { expiresAt: "desc" },
select: { id: true, email: true, role: true, expiresAt: true },
})
).map((i) => ({
id: i.id,
email: i.email,
role: i.role ?? "member",
expiresAt: i.expiresAt.toISOString(),
}))
: [];
return (
<>
<PageHeader title="Team workspace" description="Members, seats, and white-label branding." />
<TeamClient
org={org ? { id: org.id, name: org.name } : null}
members={members}
invitations={invitations}
currentUserId={session.user.id}
branding={
org?.branding
? {
brandName: org.branding.brandName,
primaryColor: org.branding.primaryColor,
logoUrl: org.branding.logoUrl,
removePoweredBy: org.branding.removePoweredBy,
}
: null
}
seats={plan.limits.seats}
/>
</>
);
}