Turnstile bot protection (sign-in, sign-up, password-reset): - Register Better Auth's captcha plugin with the cloudflare-turnstile provider; endpoints listed explicitly rather than relying on defaults. /reset-password is intentionally excluded — it is reached only via a single-use emailed token. - Add an explicit-render Turnstile widget component. Tokens are single-use, so each form resets the challenge after a failed submit; submit stays disabled until a token is held. - Read the site key server-side and pass it down as a prop, so rotating it does not require a rebuild. - Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a secret is set without a site key (that combination would demand a token no form can produce, locking every user out). - Pass a throwaway secret during `next build` in the Dockerfile, mirroring the existing BETTER_AUTH_SECRET treatment, so image builds don't need it. CSP fixes in middleware (these blocked Turnstile entirely): - Add frame-src for challenges.cloudflare.com. Without it the widget's iframe fell back to default-src 'self' and was blocked outright. - Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev` compiles with eval(), so the strict policy threw EvalError and killed hydration — no client JS ran at all, which also meant form submit handlers never fired. Production policy is unchanged and still strict. Also included (concurrent work in the tree): - Admin organizations pages and lib/admin/orgs. - Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD, OG/Twitter images, manifest), Umami analytics, not-found page. Local dev database: docker-compose.dev.yml provisions Postgres 18 on port 5443 (5432-5442 are in use by other local projects). Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an `invitations` prop the component does not accept. This predates the commit and will fail `next build` until fixed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
95 lines
2.9 KiB
TypeScript
95 lines
2.9 KiB
TypeScript
import type { Metadata } from "next";
|
|
import { requireAuth } from "@/lib/auth/guards";
|
|
import { getEffectivePlan, subjectHasFeature } from "@/lib/billing/subscription";
|
|
import { prisma } from "@/lib/db";
|
|
import { PageHeader } from "@/components/app/page-header";
|
|
import { UpgradeGate } from "@/components/app/upgrade-gate";
|
|
import { TeamClient } from "@/components/app/team-client";
|
|
|
|
export const metadata: Metadata = { title: "Team" };
|
|
|
|
export default async function TeamPage() {
|
|
const session = await requireAuth();
|
|
const allowed = await subjectHasFeature(
|
|
session.user.id,
|
|
"team_workspace",
|
|
session.session.activeOrganizationId
|
|
);
|
|
|
|
if (!allowed) {
|
|
return (
|
|
<>
|
|
<PageHeader title="Team workspace" description="Collaborate with your team." />
|
|
<UpgradeGate
|
|
title="Team workspaces are an Agency feature"
|
|
description="Upgrade to Agency for a 5-seat workspace, white-label mode, and custom branding."
|
|
requiredPlan="Agency"
|
|
/>
|
|
</>
|
|
);
|
|
}
|
|
|
|
const { plan } = await getEffectivePlan(session.user.id, session.session.activeOrganizationId);
|
|
const membership = await prisma.member.findFirst({
|
|
where: { userId: session.user.id },
|
|
include: {
|
|
organization: {
|
|
include: {
|
|
branding: true,
|
|
members: { include: { user: { select: { name: true, email: true } } } },
|
|
},
|
|
},
|
|
},
|
|
});
|
|
const org = membership?.organization ?? null;
|
|
const members =
|
|
org?.members.map((m) => ({
|
|
id: m.id,
|
|
userId: m.userId,
|
|
name: m.user.name,
|
|
email: m.user.email,
|
|
role: m.role,
|
|
})) ?? [];
|
|
|
|
// Pending invitations hold a seat until accepted or revoked, so they belong on
|
|
// this screen next to members — otherwise a workspace can look under-capacity
|
|
// while every seat is actually spoken for.
|
|
const invitations = org
|
|
? (
|
|
await prisma.invitation.findMany({
|
|
where: { organizationId: org.id, status: "pending" },
|
|
orderBy: { expiresAt: "desc" },
|
|
select: { id: true, email: true, role: true, expiresAt: true },
|
|
})
|
|
).map((i) => ({
|
|
id: i.id,
|
|
email: i.email,
|
|
role: i.role ?? "member",
|
|
expiresAt: i.expiresAt.toISOString(),
|
|
}))
|
|
: [];
|
|
|
|
return (
|
|
<>
|
|
<PageHeader title="Team workspace" description="Members, seats, and white-label branding." />
|
|
<TeamClient
|
|
org={org ? { id: org.id, name: org.name } : null}
|
|
members={members}
|
|
invitations={invitations}
|
|
currentUserId={session.user.id}
|
|
branding={
|
|
org?.branding
|
|
? {
|
|
brandName: org.branding.brandName,
|
|
primaryColor: org.branding.primaryColor,
|
|
logoUrl: org.branding.logoUrl,
|
|
removePoweredBy: org.branding.removePoweredBy,
|
|
}
|
|
: null
|
|
}
|
|
seats={plan.limits.seats}
|
|
/>
|
|
</>
|
|
);
|
|
}
|