From 414903f16d1738c7800f310d7a1b97b6c97d9b27 Mon Sep 17 00:00:00 2001 From: Marco Sadjadi Date: Wed, 20 May 2026 17:18:58 +0200 Subject: [PATCH] feat(marketplace): dashboard nav link + My-templates filter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The logged-in user can now reach the marketplace and filter to their own templates. Dashboard nav: - Added 'Marketplace' item (Overview · Servers · Marketplace · Audit · Settings). /templates page — login-aware: - Detects session via /v1/auth/me. Logged-in users get a 'Dashboard' + '+ New server' header instead of 'Home' + 'Start building'. - New [All templates | My templates] scope toggle, shown only when logged in. - 'My templates' loads GET /v1/templates/mine and shows EVERY status the user owns (public / hidden / draft / takedown) with a colored status badge on each card — so a template you unshared doesn't appear to have vanished. - Sort tabs (trending/top/newest) hide in 'mine' scope — meaningless for a handful of own templates. Category filter + search still apply (client-side). - Takedown cards link to the source server's Publish tab instead of the detail route (which 410s); everything else opens the detail page. Backend: - GET /v1/templates/mine (requireAuth) — all own templates, any status, registered before /:slug so the static route always wins the match. - GET /v1/templates/:slug — now does an optional session check: the OWNER can view their own hidden/draft template (so a 'My templates' card click never dead-ends in a 404). takedown stays 410 for everyone, owner included — that's an admin decision, not the owner's to reverse. Detail page: - Fork CTA is gated on status === 'public'. For a non-public template the owner sees an amber 'not forkable — re-share from the Publish tab' notice plus a 'Manage in server' link, instead of a Fork button that would fail silently. Verified: - GET /v1/templates/mine → marco's 1 template; 401 without auth - Owner GET of a hidden template → 200 status:hidden; anon → 404 - Dashboard nav shows Marketplace (screenshot) - /templates 'My templates' toggle → only own template, public badge, sort tabs hidden (screenshot) --- apps/api/src/routes/templates.ts | 39 +++- apps/web/app/(dashboard)/layout.tsx | 5 +- apps/web/app/templates/[slug]/page.tsx | 33 ++- apps/web/app/templates/page.tsx | 301 +++++++++++++++++-------- 4 files changed, 276 insertions(+), 102 deletions(-) diff --git a/apps/api/src/routes/templates.ts b/apps/api/src/routes/templates.ts index 8f4b4e0..cf1fd37 100644 --- a/apps/api/src/routes/templates.ts +++ b/apps/api/src/routes/templates.ts @@ -16,6 +16,7 @@ import { users, } from '@bmm/db'; import { GeneratorSpec } from '@bmm/types'; +import { getSession } from '@bmm/auth'; import { requireAuth, requireAdmin } from '../plugins/session.js'; import { audit } from '../lib/audit.js'; import { cacheSpec, cachePrebuiltCode } from '../lib/preview-cache.js'; @@ -345,6 +346,33 @@ export async function templateRoutes(app: FastifyInstance): Promise { return reply.send({ templates: ranked, categories: CATEGORIES }); }); + // ---- My templates (authed — all statuses, for the marketplace "Mine" filter) ---- + // Registered before /:slug so the static segment always wins the router match. + app.get('/v1/templates/mine', { preHandler: requireAuth }, async (req, reply) => { + const user = req.user!; + const rows = await db + .select() + .from(templates) + .where(eq(templates.ownerUserId, user.userId)) + .orderBy(desc(templates.createdAt)); + + const enriched = await Promise.all( + rows.map(async (t) => { + const [active] = await db + .select({ c: count() }) + .from(mcpServers) + .where(and(eq(mcpServers.templateId, t.id), eq(mcpServers.status, 'live'))); + return { + ...t, + ownerName: user.email.split('@')[0], + ownerOrgName: null, + activeDeployments: Number(active?.c ?? 0), + }; + }), + ); + return reply.send({ templates: enriched, categories: CATEGORIES }); + }); + // ---- Detail ---- app.get('/v1/templates/:slug', async (req, reply) => { const Params = z.object({ slug: z.string().regex(SLUG_REGEX) }); @@ -365,16 +393,19 @@ export async function templateRoutes(app: FastifyInstance): Promise { .limit(1); if (!row) return reply.code(404).send({ error: 'not_found' }); if (row.template.status === 'takedown') { + // Takedown is an admin decision — sealed for everyone, including the owner. return reply.code(410).send({ error: 'taken_down', reason: row.template.takedownReason, }); } if (row.template.status !== 'public') { - // hidden / draft — only owner can view - // Note: viewing endpoint is public, so we 404 to non-owners. - // (Owner UI would use a separate auth'd endpoint; out of scope for v1.) - return reply.code(404).send({ error: 'not_found' }); + // hidden / draft — visible only to the owner (optional auth check). + const session = await getSession(req.cookies['bmm_session']); + const isOwner = session != null && session.userId === row.template.ownerUserId; + if (!isOwner) { + return reply.code(404).send({ error: 'not_found' }); + } } const [active] = await db diff --git a/apps/web/app/(dashboard)/layout.tsx b/apps/web/app/(dashboard)/layout.tsx index 72fdc2b..e687907 100644 --- a/apps/web/app/(dashboard)/layout.tsx +++ b/apps/web/app/(dashboard)/layout.tsx @@ -1,6 +1,6 @@ import Link from 'next/link'; import { Logo } from '@/components/logo'; -import { LayoutGrid, Server, Settings, FileClock } from 'lucide-react'; +import { LayoutGrid, Server, Settings, FileClock, Package } from 'lucide-react'; export default function DashboardLayout({ children }: { children: React.ReactNode }) { return ( @@ -16,6 +16,9 @@ export default function DashboardLayout({ children }: { children: React.ReactNod }> Servers + }> + Marketplace + }> Audit diff --git a/apps/web/app/templates/[slug]/page.tsx b/apps/web/app/templates/[slug]/page.tsx index cf3e70e..23cad14 100644 --- a/apps/web/app/templates/[slug]/page.tsx +++ b/apps/web/app/templates/[slug]/page.tsx @@ -28,6 +28,7 @@ interface TemplateDetail { shortDescription: string; longDescription: string | null; category: string; + status: 'draft' | 'public' | 'hidden' | 'takedown'; verified: boolean; forkCount: number; activeDeployments: number; @@ -37,6 +38,7 @@ interface TemplateDetail { scopes: string[]; ownerName: string | null; ownerOrgName: string | null; + sourceServerId: string | null; createdAt: string; } @@ -208,12 +210,31 @@ export default function TemplateDetail() {