@10x-media/form-builder 0.1.0-beta.0 → 0.1.0-beta.10

package/dist/spam/providers/turnstile.js

@@ -0,0 +1,18 @@
+import { defineCaptchaProvider } from "../captcha.js";
+import { postSiteverify, siteverifyParams } from "./siteverify.js";
+//#region src/spam/providers/turnstile.ts
+const TURNSTILE_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+* Cloudflare Turnstile verification adapter. Network errors, timeouts, and non-2xx responses
+* fail closed (the submission is rejected).
+*/
+const turnstileProvider = (options) => defineCaptchaProvider({
+	type: "turnstile",
+	verify: async ({ token, req }) => {
+		return (await postSiteverify(options.verifyUrl ?? TURNSTILE_VERIFY_URL, siteverifyParams(options, token, req), options.timeoutMs ?? 5e3))?.success === true;
+	}
+});
+//#endregion
+export { turnstileProvider };
+
+//# sourceMappingURL=turnstile.js.map

package/dist/spam/providers/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.js","names":[],"sources":["../../../src/spam/providers/turnstile.ts"],"sourcesContent":["import { defineCaptchaProvider } from '../captcha'\nimport type { CaptchaProvider } from '../types'\nimport { DEFAULT_SITEVERIFY_TIMEOUT, postSiteverify, siteverifyParams } from './siteverify'\n\nconst TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'\n\nexport type TurnstileProviderOptions = {\n\t/** Turnstile secret key (server-side, never the site key). */\n\tsecretKey: string\n\t/** Override the siteverify endpoint. */\n\tverifyUrl?: string\n\t/** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */\n\tipHeader?: string\n\t/** Verification request timeout in ms. Default 5000. */\n\ttimeoutMs?: number\n}\n\n/**\n * Cloudflare Turnstile verification adapter. Network errors, timeouts, and non-2xx responses\n * fail closed (the submission is rejected).\n */\nexport const turnstileProvider = (options: TurnstileProviderOptions): CaptchaProvider =>\n\tdefineCaptchaProvider({\n\t\ttype: 'turnstile',\n\t\tverify: async ({ token, req }) => {\n\t\t\tconst result = await postSiteverify(\n\t\t\t\toptions.verifyUrl ?? TURNSTILE_VERIFY_URL,\n\t\t\t\tsiteverifyParams(options, token, req),\n\t\t\t\toptions.timeoutMs ?? DEFAULT_SITEVERIFY_TIMEOUT\n\t\t\t)\n\t\t\treturn result?.success === true\n\t\t},\n\t})\n"],"mappings":";;;AAIA,MAAM,uBAAuB;;;;;AAiB7B,MAAa,qBAAqB,YACjC,sBAAsB;CACrB,MAAM;CACN,QAAQ,OAAO,EAAE,OAAO,UAAU;EAMjC,QAAO,MALc,eACpB,QAAQ,aAAa,sBACrB,iBAAiB,SAAS,OAAO,GAAG,GACpC,QAAQ,aAAA,GACT,IACe,YAAY;CAC5B;AACD,CAAC"}

package/dist/spam/rateLimiter.d.ts

@@ -0,0 +1,18 @@
+import { RateLimiter } from "./types.js";
+
+//#region src/spam/rateLimiter.d.ts
+/**
+ * The default rate limiter: a read-modify-write window counter over Payload's `payload.kv`
+ * (always present; default `DatabaseKVAdapter`, durable + cross-instance). Because the KV interface
+ * has no atomic increment, the get-then-set is NON-ATOMIC, so a concurrent burst can slightly undercount.
+ * This is a SOFT limit, acceptable for spam basics and complemented by edge/WAF limiting. The window
+ * expires lazily on read; stale keys for one-time identities linger (minor; the count self-resets).
+ * `now` is injectable for tests.
+ */
+declare const createKvRateLimiter: (options?: {
+  now?: () => number;
+  namespace?: string;
+}) => RateLimiter;
+//#endregion
+export { createKvRateLimiter };
+//# sourceMappingURL=rateLimiter.d.ts.map

package/dist/spam/rateLimiter.js

@@ -0,0 +1,41 @@
+//#region src/spam/rateLimiter.ts
+/**
+* The default rate limiter: a read-modify-write window counter over Payload's `payload.kv`
+* (always present; default `DatabaseKVAdapter`, durable + cross-instance). Because the KV interface
+* has no atomic increment, the get-then-set is NON-ATOMIC, so a concurrent burst can slightly undercount.
+* This is a SOFT limit, acceptable for spam basics and complemented by edge/WAF limiting. The window
+* expires lazily on read; stale keys for one-time identities linger (minor; the count self-resets).
+* `now` is injectable for tests.
+*/
+const createKvRateLimiter = (options = {}) => {
+	const now = options.now ?? (() => Date.now());
+	const prefix = options.namespace ?? "fb:rl:";
+	return { async check({ key, max, window, req }) {
+		const kv = req.payload.kv;
+		const storeKey = `${prefix}${key}`;
+		const current = now();
+		const existing = await kv.get(storeKey).catch(() => null);
+		let count;
+		let windowStart;
+		if (!existing || current - existing.windowStart >= window) {
+			count = 1;
+			windowStart = current;
+		} else {
+			count = existing.count + 1;
+			windowStart = existing.windowStart;
+		}
+		await kv.set(storeKey, {
+			count,
+			windowStart
+		}).catch(() => void 0);
+		return {
+			ok: count <= max,
+			remaining: Math.max(0, max - count),
+			resetAt: windowStart + window
+		};
+	} };
+};
+//#endregion
+export { createKvRateLimiter };
+
+//# sourceMappingURL=rateLimiter.js.map

package/dist/spam/rateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.js","names":[],"sources":["../../src/spam/rateLimiter.ts"],"sourcesContent":["import type { RateLimiter } from './types'\n\ntype WindowState = { count: number; windowStart: number }\n\n/**\n * The default rate limiter: a read-modify-write window counter over Payload's `payload.kv`\n * (always present; default `DatabaseKVAdapter`, durable + cross-instance). Because the KV interface\n * has no atomic increment, the get-then-set is NON-ATOMIC, so a concurrent burst can slightly undercount.\n * This is a SOFT limit, acceptable for spam basics and complemented by edge/WAF limiting. The window\n * expires lazily on read; stale keys for one-time identities linger (minor; the count self-resets).\n * `now` is injectable for tests.\n */\nexport const createKvRateLimiter = (\n\toptions: { now?: () => number; namespace?: string } = {}\n): RateLimiter => {\n\tconst now = options.now ?? (() => Date.now())\n\tconst prefix = options.namespace ?? 'fb:rl:'\n\treturn {\n\t\tasync check({ key, max, window, req }) {\n\t\t\tconst kv = req.payload.kv\n\t\t\tconst storeKey = `${prefix}${key}`\n\t\t\tconst current = now()\n\t\t\tconst existing = await kv.get<WindowState>(storeKey).catch(() => null)\n\t\t\tlet count: number\n\t\t\tlet windowStart: number\n\t\t\tif (!existing || current - existing.windowStart >= window) {\n\t\t\t\tcount = 1\n\t\t\t\twindowStart = current\n\t\t\t} else {\n\t\t\t\tcount = existing.count + 1\n\t\t\t\twindowStart = existing.windowStart\n\t\t\t}\n\t\t\tawait kv.set(storeKey, { count, windowStart }).catch(() => undefined)\n\t\t\treturn {\n\t\t\t\tok: count <= max,\n\t\t\t\tremaining: Math.max(0, max - count),\n\t\t\t\tresetAt: windowStart + window,\n\t\t\t}\n\t\t},\n\t}\n}\n"],"mappings":";;;;;;;;;AAYA,MAAa,uBACZ,UAAsD,CAAC,MACtC;CACjB,MAAM,MAAM,QAAQ,cAAc,KAAK,IAAI;CAC3C,MAAM,SAAS,QAAQ,aAAa;CACpC,OAAO,EACN,MAAM,MAAM,EAAE,KAAK,KAAK,QAAQ,OAAO;EACtC,MAAM,KAAK,IAAI,QAAQ;EACvB,MAAM,WAAW,GAAG,SAAS;EAC7B,MAAM,UAAU,IAAI;EACpB,MAAM,WAAW,MAAM,GAAG,IAAiB,QAAQ,EAAE,YAAY,IAAI;EACrE,IAAI;EACJ,IAAI;EACJ,IAAI,CAAC,YAAY,UAAU,SAAS,eAAe,QAAQ;GAC1D,QAAQ;GACR,cAAc;EACf,OAAO;GACN,QAAQ,SAAS,QAAQ;GACzB,cAAc,SAAS;EACxB;EACA,MAAM,GAAG,IAAI,UAAU;GAAE;GAAO;EAAY,CAAC,EAAE,YAAY,KAAA,CAAS;EACpE,OAAO;GACN,IAAI,SAAS;GACb,WAAW,KAAK,IAAI,GAAG,MAAM,KAAK;GAClC,SAAS,cAAc;EACxB;CACD,EACD;AACD"}

package/dist/spam/reserved.js

@@ -0,0 +1,30 @@
+import "./constants.js";
+//#region src/spam/reserved.ts
+/**
+* Split reserved entries (honeypot decoy, captcha token) out of the submitted `values`. The honeypot
+* rides a configurable, innocuous field name; the captcha token rides a fixed reserved key. Real field
+* values pass through unchanged. `runSubmission` would already ignore unknown field names, but stripping
+* here keeps them out of storage and out of the validation pass.
+*/
+const extractReservedValues = (values, honeypotField) => {
+	const cleaned = [];
+	const result = { cleaned };
+	for (const entry of values) {
+		if (entry.field === "__fb_captcha") {
+			if (typeof entry.value === "string") result.captchaToken = entry.value;
+			continue;
+		}
+		if (honeypotField !== null && entry.field === honeypotField) {
+			result.honeypot = entry.value;
+			continue;
+		}
+		cleaned.push(entry);
+	}
+	return result;
+};
+/** A honeypot is tripped when the decoy carries any non-empty value (a real user never fills it). */
+const isHoneypotTripped = (value) => value != null && value !== "" && !(Array.isArray(value) && value.length === 0);
+//#endregion
+export { extractReservedValues, isHoneypotTripped };
+
+//# sourceMappingURL=reserved.js.map

package/dist/spam/reserved.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved.js","names":[],"sources":["../../src/spam/reserved.ts"],"sourcesContent":["import type { SubmissionValue } from '../submissions/types'\nimport { CAPTCHA_TOKEN_KEY } from './constants'\n\nexport type ExtractedReserved = {\n\t/** Real field values with reserved entries removed. */\n\tcleaned: SubmissionValue[]\n\t/** The honeypot decoy value, if a honeypot field name was active and present. */\n\thoneypot?: unknown\n\t/** A captcha token carried by the client. */\n\tcaptchaToken?: string\n}\n\n/**\n * Split reserved entries (honeypot decoy, captcha token) out of the submitted `values`. The honeypot\n * rides a configurable, innocuous field name; the captcha token rides a fixed reserved key. Real field\n * values pass through unchanged. `runSubmission` would already ignore unknown field names, but stripping\n * here keeps them out of storage and out of the validation pass.\n */\nexport const extractReservedValues = (\n\tvalues: SubmissionValue[],\n\thoneypotField: string | null\n): ExtractedReserved => {\n\tconst cleaned: SubmissionValue[] = []\n\tconst result: ExtractedReserved = { cleaned }\n\tfor (const entry of values) {\n\t\tif (entry.field === CAPTCHA_TOKEN_KEY) {\n\t\t\tif (typeof entry.value === 'string') {\n\t\t\t\tresult.captchaToken = entry.value\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif (honeypotField !== null && entry.field === honeypotField) {\n\t\t\tresult.honeypot = entry.value\n\t\t\tcontinue\n\t\t}\n\t\tcleaned.push(entry)\n\t}\n\treturn result\n}\n\n/** A honeypot is tripped when the decoy carries any non-empty value (a real user never fills it). */\nexport const isHoneypotTripped = (value: unknown): boolean =>\n\tvalue != null && value !== '' && !(Array.isArray(value) && value.length === 0)\n"],"mappings":";;;;;;;;AAkBA,MAAa,yBACZ,QACA,kBACuB;CACvB,MAAM,UAA6B,CAAC;CACpC,MAAM,SAA4B,EAAE,QAAQ;CAC5C,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,MAAM,UAAA,gBAA6B;GACtC,IAAI,OAAO,MAAM,UAAU,UAC1B,OAAO,eAAe,MAAM;GAE7B;EACD;EACA,IAAI,kBAAkB,QAAQ,MAAM,UAAU,eAAe;GAC5D,OAAO,WAAW,MAAM;GACxB;EACD;EACA,QAAQ,KAAK,KAAK;CACnB;CACA,OAAO;AACR;;AAGA,MAAa,qBAAqB,UACjC,SAAS,QAAQ,UAAU,MAAM,EAAE,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW"}

package/dist/spam/resolveSpam.d.ts

@@ -0,0 +1,12 @@
+import { ResolvedSpamConfig, SpamOption } from "./types.js";
+
+//#region src/spam/resolveSpam.d.ts
+/**
+ * Resolve the `spam` plugin option into a concrete config. `false` disables the whole subsystem.
+ * Otherwise honeypot + both rate limits default on, captcha + metadata capture default off, and the
+ * identity seam defaults to user id / trusted IP header.
+ */
+declare const resolveSpamConfig: (option: SpamOption | undefined) => ResolvedSpamConfig | false;
+//#endregion
+export { resolveSpamConfig };
+//# sourceMappingURL=resolveSpam.d.ts.map

package/dist/spam/resolveSpam.js

@@ -0,0 +1,43 @@
+import "./constants.js";
+import { defaultIdentify } from "./identify.js";
+import { createKvRateLimiter } from "./rateLimiter.js";
+//#region src/spam/resolveSpam.ts
+const DEFAULT_WINDOW = 6e4;
+const DEFAULT_SUBMISSION_MAX = 5;
+const DEFAULT_UPLOAD_MAX = 20;
+const resolveRateLimit = (option, defaultMax) => {
+	if (option === false) return false;
+	const cfg = option ?? {};
+	return {
+		window: cfg.window ?? DEFAULT_WINDOW,
+		max: cfg.max ?? defaultMax,
+		limiter: cfg.limiter ?? createKvRateLimiter()
+	};
+};
+/**
+* Resolve the `spam` plugin option into a concrete config. `false` disables the whole subsystem.
+* Otherwise honeypot + both rate limits default on, captcha + metadata capture default off, and the
+* identity seam defaults to user id / trusted IP header.
+*/
+const resolveSpamConfig = (option) => {
+	if (option === false) return false;
+	const cfg = option ?? {};
+	const ipHeader = cfg.ipHeader ?? "x-forwarded-for";
+	return {
+		honeypot: cfg.honeypot === false ? false : { fieldName: cfg.honeypot?.fieldName ?? "website" },
+		rateLimit: resolveRateLimit(cfg.rateLimit, DEFAULT_SUBMISSION_MAX),
+		uploadRateLimit: resolveRateLimit(cfg.uploadRateLimit, DEFAULT_UPLOAD_MAX),
+		captcha: cfg.captcha,
+		identify: cfg.identify ?? defaultIdentify(ipHeader),
+		ipHeader,
+		metadata: {
+			ip: cfg.metadata?.ip ?? false,
+			ua: cfg.metadata?.ua ?? false
+		},
+		uploadOwnership: cfg.uploadOwnership ?? "lenient"
+	};
+};
+//#endregion
+export { resolveSpamConfig };
+
+//# sourceMappingURL=resolveSpam.js.map

package/dist/spam/resolveSpam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSpam.js","names":[],"sources":["../../src/spam/resolveSpam.ts"],"sourcesContent":["import { DEFAULT_HONEYPOT_FIELD } from './constants'\nimport { defaultIdentify } from './identify'\nimport { createKvRateLimiter } from './rateLimiter'\nimport type {\n\tRateLimitConfig,\n\tResolvedRateLimit,\n\tResolvedSpamConfig,\n\tSpamConfig,\n\tSpamOption,\n} from './types'\n\nconst DEFAULT_WINDOW = 60_000\nconst DEFAULT_SUBMISSION_MAX = 5\nconst DEFAULT_UPLOAD_MAX = 20\n\nconst resolveRateLimit = (\n\toption: false | RateLimitConfig | undefined,\n\tdefaultMax: number\n): false | ResolvedRateLimit => {\n\tif (option === false) {\n\t\treturn false\n\t}\n\tconst cfg = option ?? {}\n\treturn {\n\t\twindow: cfg.window ?? DEFAULT_WINDOW,\n\t\tmax: cfg.max ?? defaultMax,\n\t\tlimiter: cfg.limiter ?? createKvRateLimiter(),\n\t}\n}\n\n/**\n * Resolve the `spam` plugin option into a concrete config. `false` disables the whole subsystem.\n * Otherwise honeypot + both rate limits default on, captcha + metadata capture default off, and the\n * identity seam defaults to user id / trusted IP header.\n */\nexport const resolveSpamConfig = (option: SpamOption | undefined): ResolvedSpamConfig | false => {\n\tif (option === false) {\n\t\treturn false\n\t}\n\tconst cfg: SpamConfig = option ?? {}\n\tconst ipHeader = cfg.ipHeader ?? 'x-forwarded-for'\n\treturn {\n\t\thoneypot:\n\t\t\tcfg.honeypot === false\n\t\t\t\t? false\n\t\t\t\t: { fieldName: cfg.honeypot?.fieldName ?? DEFAULT_HONEYPOT_FIELD },\n\t\trateLimit: resolveRateLimit(cfg.rateLimit, DEFAULT_SUBMISSION_MAX),\n\t\tuploadRateLimit: resolveRateLimit(cfg.uploadRateLimit, DEFAULT_UPLOAD_MAX),\n\t\tcaptcha: cfg.captcha,\n\t\tidentify: cfg.identify ?? defaultIdentify(ipHeader),\n\t\tipHeader,\n\t\tmetadata: { ip: cfg.metadata?.ip ?? false, ua: cfg.metadata?.ua ?? false },\n\t\tuploadOwnership: cfg.uploadOwnership ?? 'lenient',\n\t}\n}\n"],"mappings":";;;;AAWA,MAAM,iBAAiB;AACvB,MAAM,yBAAyB;AAC/B,MAAM,qBAAqB;AAE3B,MAAM,oBACL,QACA,eAC+B;CAC/B,IAAI,WAAW,OACd,OAAO;CAER,MAAM,MAAM,UAAU,CAAC;CACvB,OAAO;EACN,QAAQ,IAAI,UAAU;EACtB,KAAK,IAAI,OAAO;EAChB,SAAS,IAAI,WAAW,oBAAoB;CAC7C;AACD;;;;;;AAOA,MAAa,qBAAqB,WAA+D;CAChG,IAAI,WAAW,OACd,OAAO;CAER,MAAM,MAAkB,UAAU,CAAC;CACnC,MAAM,WAAW,IAAI,YAAY;CACjC,OAAO;EACN,UACC,IAAI,aAAa,QACd,QACA,EAAE,WAAW,IAAI,UAAU,aAAA,UAAoC;EACnE,WAAW,iBAAiB,IAAI,WAAW,sBAAsB;EACjE,iBAAiB,iBAAiB,IAAI,iBAAiB,kBAAkB;EACzE,SAAS,IAAI;EACb,UAAU,IAAI,YAAY,gBAAgB,QAAQ;EAClD;EACA,UAAU;GAAE,IAAI,IAAI,UAAU,MAAM;GAAO,IAAI,IAAI,UAAU,MAAM;EAAM;EACzE,iBAAiB,IAAI,mBAAmB;CACzC;AACD"}

package/dist/spam/spamGuard.js

@@ -0,0 +1,81 @@
+import { keys } from "../translations/keys.js";
+import { asTranslate } from "../translations/server.js";
+import { firstHop } from "./clientIp.js";
+import { HONEYPOT_VALUE_KEY, IDENTITY_CONTEXT_KEY } from "./constants.js";
+import { extractReservedValues, isHoneypotTripped } from "./reserved.js";
+import { APIError } from "payload";
+//#region src/spam/spamGuard.ts
+let warnedRateLimitSkipped = false;
+/** Warn once per process when rate limiting is configured but skipped for lack of a request identity. */
+const warnRateLimitSkippedOnce = (req) => {
+	if (warnedRateLimitSkipped) return;
+	warnedRateLimitSkipped = true;
+	req.payload.logger?.warn("@10x-media/form-builder: submission rate limiting is configured but skipped for a request with no resolvable identity (no user and no client IP). Set spam.ipHeader for your proxy or provide a custom spam.identify.");
+};
+/**
+* Submissions spam guard, prepended before `validateSubmission` in `beforeValidate` so it rejects before
+* the form load + field validation. On create it: resolves the request identity once (stashing it on
+* `req.context` for upload-ownership verification downstream); rate-limits per form + identity (429,
+* fail-open when identity is null); strips reserved `values` entries (honeypot, captcha token); rejects a
+* filled honeypot with a generic error; verifies a configured captcha; and writes a server-authoritative
+* `meta` (timestamp + spam signal, with opt-in ip/ua). App-level rate limiting is defense-in-depth that
+* complements edge/CDN/WAF limiting, not a DoS replacement.
+*/
+const buildSpamGuard = (spam) => async ({ data, operation, req }) => {
+	if (operation !== "create" || !data) return data;
+	const t = asTranslate(req.i18n.t);
+	const authenticated = Boolean(req.user);
+	const identity = await spam.identify(req);
+	if (identity != null) req.context[IDENTITY_CONTEXT_KEY] = identity;
+	let rateLimitState;
+	if (spam.rateLimit === false) rateLimitState = "disabled";
+	else if (identity == null) {
+		rateLimitState = "skipped-no-identity";
+		warnRateLimitSkippedOnce(req);
+	} else {
+		const formKey = data.form != null ? String(data.form) : "unknown";
+		const { ok } = await spam.rateLimit.limiter.check({
+			key: `submissions:${formKey}:${identity}`,
+			max: spam.rateLimit.max,
+			window: spam.rateLimit.window,
+			req
+		});
+		if (!ok) throw new APIError(t(keys.spamRateLimited), 429);
+		rateLimitState = "enforced";
+	}
+	const honeypotKey = spam.honeypot === false ? null : HONEYPOT_VALUE_KEY;
+	const { cleaned, honeypot, captchaToken } = extractReservedValues(data.values ?? [], honeypotKey);
+	data.values = cleaned;
+	if (!authenticated && honeypotKey !== null && isHoneypotTripped(honeypot)) throw new APIError(t(keys.spamRejected), 400);
+	const captchaChecked = Boolean(spam.captcha) && !authenticated;
+	if (spam.captcha && !authenticated) {
+		if (!(typeof captchaToken === "string" && captchaToken.length > 0 ? await spam.captcha.verify({
+			token: captchaToken,
+			req
+		}).catch(() => false) : false)) throw new APIError(t(keys.spamCaptchaFailed), 400);
+	}
+	const serverMeta = {
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		spam: {
+			captcha: captchaChecked ? "passed" : "skipped",
+			rateLimit: rateLimitState
+		}
+	};
+	if (spam.metadata.ip) {
+		const ip = firstHop(req.headers, spam.ipHeader);
+		if (ip) serverMeta.ip = ip;
+	}
+	if (spam.metadata.ua) {
+		const ua = req.headers?.get("user-agent");
+		if (ua) serverMeta.ua = ua;
+	}
+	data.meta = {
+		...authenticated && data.meta != null && typeof data.meta === "object" ? data.meta : {},
+		...serverMeta
+	};
+	return data;
+};
+//#endregion
+export { buildSpamGuard };
+
+//# sourceMappingURL=spamGuard.js.map

package/dist/spam/spamGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spamGuard.js","names":[],"sources":["../../src/spam/spamGuard.ts"],"sourcesContent":["import { APIError, type CollectionBeforeValidateHook, type PayloadRequest } from 'payload'\nimport type { SubmissionValue } from '../submissions/types'\nimport { keys } from '../translations/keys'\nimport { asTranslate } from '../translations/server'\nimport { firstHop } from './clientIp'\nimport { HONEYPOT_VALUE_KEY, IDENTITY_CONTEXT_KEY } from './constants'\nimport { extractReservedValues, isHoneypotTripped } from './reserved'\nimport type { ResolvedSpamConfig } from './types'\n\nlet warnedRateLimitSkipped = false\n\n/** Warn once per process when rate limiting is configured but skipped for lack of a request identity. */\nconst warnRateLimitSkippedOnce = (req: PayloadRequest): void => {\n\tif (warnedRateLimitSkipped) {\n\t\treturn\n\t}\n\twarnedRateLimitSkipped = true\n\treq.payload.logger?.warn(\n\t\t'@10x-media/form-builder: submission rate limiting is configured but skipped for a request with no resolvable identity (no user and no client IP). Set spam.ipHeader for your proxy or provide a custom spam.identify.'\n\t)\n}\n\n/**\n * Submissions spam guard, prepended before `validateSubmission` in `beforeValidate` so it rejects before\n * the form load + field validation. On create it: resolves the request identity once (stashing it on\n * `req.context` for upload-ownership verification downstream); rate-limits per form + identity (429,\n * fail-open when identity is null); strips reserved `values` entries (honeypot, captcha token); rejects a\n * filled honeypot with a generic error; verifies a configured captcha; and writes a server-authoritative\n * `meta` (timestamp + spam signal, with opt-in ip/ua). App-level rate limiting is defense-in-depth that\n * complements edge/CDN/WAF limiting, not a DoS replacement.\n */\nexport const buildSpamGuard =\n\t(spam: ResolvedSpamConfig): CollectionBeforeValidateHook =>\n\tasync ({ data, operation, req }) => {\n\t\tif (operation !== 'create' || !data) {\n\t\t\treturn data\n\t\t}\n\t\tconst t = asTranslate(req.i18n.t)\n\t\t// Honeypot + captcha are anti-bot measures for the anonymous public path; an authenticated request\n\t\t// (admin panel, logged-in API client) is already gated by auth and never carries a decoy/token, so\n\t\t// checking it would falsely reject legitimate authed creates. Rate-limit + ownership still apply.\n\t\tconst authenticated = Boolean(req.user)\n\n\t\tconst identity = await spam.identify(req)\n\t\tif (identity != null) {\n\t\t\treq.context[IDENTITY_CONTEXT_KEY] = identity\n\t\t}\n\n\t\tlet rateLimitState: 'enforced' | 'skipped-no-identity' | 'disabled'\n\t\tif (spam.rateLimit === false) {\n\t\t\trateLimitState = 'disabled'\n\t\t} else if (identity == null) {\n\t\t\t// Fail open (an unidentifiable submitter cannot be keyed) but never silently: record it on\n\t\t\t// meta.spam and warn once, so a deployment with no proxy or a misconfigured ipHeader is visible.\n\t\t\trateLimitState = 'skipped-no-identity'\n\t\t\twarnRateLimitSkippedOnce(req)\n\t\t} else {\n\t\t\tconst formKey = data.form != null ? String(data.form) : 'unknown'\n\t\t\tconst { ok } = await spam.rateLimit.limiter.check({\n\t\t\t\tkey: `submissions:${formKey}:${identity}`,\n\t\t\t\tmax: spam.rateLimit.max,\n\t\t\t\twindow: spam.rateLimit.window,\n\t\t\t\treq,\n\t\t\t})\n\t\t\tif (!ok) {\n\t\t\t\tthrow new APIError(t(keys.spamRateLimited), 429)\n\t\t\t}\n\t\t\trateLimitState = 'enforced'\n\t\t}\n\n\t\t// The decoy rides a fixed reserved key (not its cosmetic DOM name), so a real field sharing that\n\t\t// name is never stripped or mistaken for the honeypot. `spam.honeypot.fieldName` is now only the\n\t\t// client's DOM-input name hint and no longer participates in server matching.\n\t\tconst honeypotKey = spam.honeypot === false ? null : HONEYPOT_VALUE_KEY\n\t\tconst values = (data.values as SubmissionValue[] | undefined) ?? []\n\t\tconst { cleaned, honeypot, captchaToken } = extractReservedValues(values, honeypotKey)\n\t\tdata.values = cleaned\n\n\t\tif (!authenticated && honeypotKey !== null && isHoneypotTripped(honeypot)) {\n\t\t\tthrow new APIError(t(keys.spamRejected), 400)\n\t\t}\n\n\t\tconst captchaChecked = Boolean(spam.captcha) && !authenticated\n\t\tif (spam.captcha && !authenticated) {\n\t\t\tconst passed =\n\t\t\t\ttypeof captchaToken === 'string' && captchaToken.length > 0\n\t\t\t\t\t? await spam.captcha.verify({ token: captchaToken, req }).catch(() => false)\n\t\t\t\t\t: false\n\t\t\tif (!passed) {\n\t\t\t\tthrow new APIError(t(keys.spamCaptchaFailed), 400)\n\t\t\t}\n\t\t}\n\n\t\tconst serverMeta: Record<string, unknown> = {\n\t\t\tat: new Date().toISOString(),\n\t\t\tspam: { captcha: captchaChecked ? 'passed' : 'skipped', rateLimit: rateLimitState },\n\t\t}\n\t\tif (spam.metadata.ip) {\n\t\t\tconst ip = firstHop(req.headers, spam.ipHeader)\n\t\t\tif (ip) {\n\t\t\t\tserverMeta.ip = ip\n\t\t\t}\n\t\t}\n\t\tif (spam.metadata.ua) {\n\t\t\tconst ua = req.headers?.get('user-agent')\n\t\t\tif (ua) {\n\t\t\t\tserverMeta.ua = ua\n\t\t\t}\n\t\t}\n\t\t// Preserve an authenticated (trusted) caller's own `meta` keys, with server fields winning. Anonymous\n\t\t// `meta` is never trusted, so it is discarded.\n\t\tconst clientMeta =\n\t\t\tauthenticated && data.meta != null && typeof data.meta === 'object'\n\t\t\t\t? (data.meta as Record<string, unknown>)\n\t\t\t\t: {}\n\t\tdata.meta = { ...clientMeta, ...serverMeta }\n\n\t\treturn data\n\t}\n"],"mappings":";;;;;;;AASA,IAAI,yBAAyB;;AAG7B,MAAM,4BAA4B,QAA8B;CAC/D,IAAI,wBACH;CAED,yBAAyB;CACzB,IAAI,QAAQ,QAAQ,KACnB,uNACD;AACD;;;;;;;;;;AAWA,MAAa,kBACX,SACD,OAAO,EAAE,MAAM,WAAW,UAAU;CACnC,IAAI,cAAc,YAAY,CAAC,MAC9B,OAAO;CAER,MAAM,IAAI,YAAY,IAAI,KAAK,CAAC;CAIhC,MAAM,gBAAgB,QAAQ,IAAI,IAAI;CAEtC,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;CACxC,IAAI,YAAY,MACf,IAAI,QAAQ,wBAAwB;CAGrC,IAAI;CACJ,IAAI,KAAK,cAAc,OACtB,iBAAiB;MACX,IAAI,YAAY,MAAM;EAG5B,iBAAiB;EACjB,yBAAyB,GAAG;CAC7B,OAAO;EACN,MAAM,UAAU,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,IAAI;EACxD,MAAM,EAAE,OAAO,MAAM,KAAK,UAAU,QAAQ,MAAM;GACjD,KAAK,eAAe,QAAQ,GAAG;GAC/B,KAAK,KAAK,UAAU;GACpB,QAAQ,KAAK,UAAU;GACvB;EACD,CAAC;EACD,IAAI,CAAC,IACJ,MAAM,IAAI,SAAS,EAAE,KAAK,eAAe,GAAG,GAAG;EAEhD,iBAAiB;CAClB;CAKA,MAAM,cAAc,KAAK,aAAa,QAAQ,OAAO;CAErD,MAAM,EAAE,SAAS,UAAU,iBAAiB,sBAD5B,KAAK,UAA4C,CAAC,GACQ,WAAW;CACrF,KAAK,SAAS;CAEd,IAAI,CAAC,iBAAiB,gBAAgB,QAAQ,kBAAkB,QAAQ,GACvE,MAAM,IAAI,SAAS,EAAE,KAAK,YAAY,GAAG,GAAG;CAG7C,MAAM,iBAAiB,QAAQ,KAAK,OAAO,KAAK,CAAC;CACjD,IAAI,KAAK,WAAW,CAAC;MAKhB,EAHH,OAAO,iBAAiB,YAAY,aAAa,SAAS,IACvD,MAAM,KAAK,QAAQ,OAAO;GAAE,OAAO;GAAc;EAAI,CAAC,EAAE,YAAY,KAAK,IACzE,QAEH,MAAM,IAAI,SAAS,EAAE,KAAK,iBAAiB,GAAG,GAAG;CAAA;CAInD,MAAM,aAAsC;EAC3C,qBAAI,IAAI,KAAK,GAAE,YAAY;EAC3B,MAAM;GAAE,SAAS,iBAAiB,WAAW;GAAW,WAAW;EAAe;CACnF;CACA,IAAI,KAAK,SAAS,IAAI;EACrB,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;EAC9C,IAAI,IACH,WAAW,KAAK;CAElB;CACA,IAAI,KAAK,SAAS,IAAI;EACrB,MAAM,KAAK,IAAI,SAAS,IAAI,YAAY;EACxC,IAAI,IACH,WAAW,KAAK;CAElB;CAOA,KAAK,OAAO;EAAE,GAHb,iBAAiB,KAAK,QAAQ,QAAQ,OAAO,KAAK,SAAS,WACvD,KAAK,OACN,CAAC;EACwB,GAAG;CAAW;CAE3C,OAAO;AACR"}

package/dist/spam/types.d.ts

@@ -0,0 +1,88 @@
+import { PayloadRequest } from "payload";
+
+//#region src/spam/types.d.ts
+/** Stable identity key for a request, or null/undefined when the client cannot be identified (rate-limiting then skips: fail-open). */
+type IdentifyFn = (req: PayloadRequest) => null | string | undefined | Promise<null | string | undefined>;
+type RateLimitResult = {
+  ok: boolean; /** Remaining requests in the current window (>= 0). */
+  remaining: number; /** Epoch ms when the current window resets. */
+  resetAt: number;
+};
+type RateLimitCheckArgs = {
+  key: string; /** Max requests per window. */
+  max: number; /** Window length in ms. */
+  window: number;
+  req: PayloadRequest;
+};
+/** Pluggable limiter. The default is a window counter over `payload.kv`; swap for Redis/etc. */
+type RateLimiter = {
+  check(args: RateLimitCheckArgs): Promise<RateLimitResult>;
+};
+type CaptchaVerifyArgs = {
+  token: string;
+  req: PayloadRequest;
+};
+/** A captcha adapter. Use a bundled provider (Turnstile/reCAPTCHA/hCaptcha) or build one with `defineCaptchaProvider`. */
+type CaptchaProvider = {
+  type: string;
+  verify(args: CaptchaVerifyArgs): Promise<boolean>;
+};
+type RateLimitConfig = {
+  /** Window length in ms. Default 60000. */window?: number; /** Max creates per identity per window. */
+  max?: number; /** Override the limiter (default: KV window counter). */
+  limiter?: RateLimiter;
+};
+type SpamMetadataConfig = {
+  /** Persist the client IP (from the trusted header) onto the submission `meta`. Default false (privacy). */ip?: boolean; /** Persist the user-agent onto the submission `meta`. Default false. */
+  ua?: boolean;
+};
+type SpamConfig = {
+  /**
+   * Honeypot decoy. Default on. `false` disables. `fieldName` is accepted for backward compatibility
+   * but no longer participates in server matching: the decoy is submitted under a fixed reserved key,
+   * so it never collides with a real field, and its DOM input name is set on the client via `<Form honeypot>`.
+   */
+  honeypot?: false | {
+    fieldName?: string;
+  }; /** Per-identity rate limit on submission create. Default on (60s window, max 5). `false` disables. */
+  rateLimit?: false | RateLimitConfig; /** Per-identity rate limit on upload create. Default on (60s window, max 20). `false` disables. */
+  uploadRateLimit?: false | RateLimitConfig; /** A captcha provider (none by default): `turnstileProvider`/`recaptchaProvider`/`hcaptchaProvider` or a custom adapter. */
+  captcha?: CaptchaProvider; /** Identity resolution for rate-limiting, upload ownership, and (future) poll dedup. Default: user id, else trusted IP header. */
+  identify?: IdentifyFn;
+  /**
+   * How strictly a submitted file's upload-ownership is enforced. `'lenient'` (default) only rejects a
+   * stamped upload when the submitter is identified and does not match, and passes an owned upload
+   * through when the submitter cannot be identified (fail-open, consistent with rate-limiting).
+   * `'strict'` also rejects a stamped upload whenever the submitter cannot be identified, so a
+   * deployment that always identifies requests (a proxy setting the trusted IP header, or a custom
+   * `identify`) never lets an unverifiable claim capture an owned upload.
+   */
+  uploadOwnership?: 'lenient' | 'strict'; /** Header read for the client IP (proxy-dependent, best-effort). Default 'x-forwarded-for'. */
+  ipHeader?: string; /** Opt-in capture of client metadata onto the submission `meta`. Off by default. */
+  metadata?: SpamMetadataConfig;
+};
+/** `false` disables the whole subsystem; an object configures it (all controls default on except captcha + metadata). */
+type SpamOption = false | SpamConfig;
+type ResolvedRateLimit = {
+  window: number;
+  max: number;
+  limiter: RateLimiter;
+};
+type ResolvedSpamConfig = {
+  honeypot: false | {
+    fieldName: string;
+  };
+  rateLimit: false | ResolvedRateLimit;
+  uploadRateLimit: false | ResolvedRateLimit;
+  captcha?: CaptchaProvider;
+  identify: IdentifyFn;
+  ipHeader: string;
+  metadata: {
+    ip: boolean;
+    ua: boolean;
+  };
+  uploadOwnership: 'lenient' | 'strict';
+};
+//#endregion
+export { CaptchaProvider, CaptchaVerifyArgs, IdentifyFn, RateLimitCheckArgs, RateLimitConfig, RateLimitResult, RateLimiter, ResolvedSpamConfig, SpamConfig, SpamMetadataConfig, SpamOption };
+//# sourceMappingURL=types.d.ts.map

package/dist/spam/uploadHooks.js

@@ -0,0 +1,33 @@
+import { keys } from "../translations/keys.js";
+import { asTranslate } from "../translations/server.js";
+import { APIError } from "payload";
+//#region src/spam/uploadHooks.ts
+/**
+* Stamp the resolved request identity onto a new upload's `owner`. `captureFileRef` later requires the
+* referencing submission's identity to match, so an anonymous submitter cannot capture another identity's
+* upload. No identity (no user, no trusted IP header) means no stamp, so the upload stays unscoped (a
+* deliberate fail-open; identity granularity is IP-level, so same-network clients share scope -- documented).
+*/
+const buildUploadOwnerStamp = (spam) => async ({ data, operation, req }) => {
+	if (operation !== "create" || !data) return data;
+	const identity = await spam.identify(req);
+	if (identity != null && data.owner == null) data.owner = identity;
+	return data;
+};
+/** Reject upload floods per identity before the file is written to `staticDir`. Fail-open without identity. */
+const buildUploadRateLimit = (spam) => async ({ operation, req }) => {
+	if (operation !== "create" || spam.uploadRateLimit === false) return;
+	const identity = await spam.identify(req);
+	if (identity == null) return;
+	const { ok } = await spam.uploadRateLimit.limiter.check({
+		key: `uploads:${identity}`,
+		max: spam.uploadRateLimit.max,
+		window: spam.uploadRateLimit.window,
+		req
+	});
+	if (!ok) throw new APIError(asTranslate(req.i18n.t)(keys.spamRateLimited), 429);
+};
+//#endregion
+export { buildUploadOwnerStamp, buildUploadRateLimit };
+
+//# sourceMappingURL=uploadHooks.js.map

package/dist/spam/uploadHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadHooks.js","names":[],"sources":["../../src/spam/uploadHooks.ts"],"sourcesContent":["import {\n\tAPIError,\n\ttype CollectionBeforeOperationHook,\n\ttype CollectionBeforeValidateHook,\n} from 'payload'\nimport { keys } from '../translations/keys'\nimport { asTranslate } from '../translations/server'\nimport type { ResolvedSpamConfig } from './types'\n\n/**\n * Stamp the resolved request identity onto a new upload's `owner`. `captureFileRef` later requires the\n * referencing submission's identity to match, so an anonymous submitter cannot capture another identity's\n * upload. No identity (no user, no trusted IP header) means no stamp, so the upload stays unscoped (a\n * deliberate fail-open; identity granularity is IP-level, so same-network clients share scope -- documented).\n */\nexport const buildUploadOwnerStamp =\n\t(spam: ResolvedSpamConfig): CollectionBeforeValidateHook =>\n\tasync ({ data, operation, req }) => {\n\t\tif (operation !== 'create' || !data) {\n\t\t\treturn data\n\t\t}\n\t\tconst identity = await spam.identify(req)\n\t\tif (identity != null && (data as { owner?: unknown }).owner == null) {\n\t\t\t;(data as { owner?: string }).owner = identity\n\t\t}\n\t\treturn data\n\t}\n\n/** Reject upload floods per identity before the file is written to `staticDir`. Fail-open without identity. */\nexport const buildUploadRateLimit =\n\t(spam: ResolvedSpamConfig): CollectionBeforeOperationHook =>\n\tasync ({ operation, req }) => {\n\t\tif (operation !== 'create' || spam.uploadRateLimit === false) {\n\t\t\treturn\n\t\t}\n\t\tconst identity = await spam.identify(req)\n\t\tif (identity == null) {\n\t\t\treturn\n\t\t}\n\t\tconst { ok } = await spam.uploadRateLimit.limiter.check({\n\t\t\tkey: `uploads:${identity}`,\n\t\t\tmax: spam.uploadRateLimit.max,\n\t\t\twindow: spam.uploadRateLimit.window,\n\t\t\treq,\n\t\t})\n\t\tif (!ok) {\n\t\t\tthrow new APIError(asTranslate(req.i18n.t)(keys.spamRateLimited), 429)\n\t\t}\n\t}\n"],"mappings":";;;;;;;;;;AAeA,MAAa,yBACX,SACD,OAAO,EAAE,MAAM,WAAW,UAAU;CACnC,IAAI,cAAc,YAAY,CAAC,MAC9B,OAAO;CAER,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;CACxC,IAAI,YAAY,QAAS,KAA6B,SAAS,MAC7D,KAA6B,QAAQ;CAEvC,OAAO;AACR;;AAGD,MAAa,wBACX,SACD,OAAO,EAAE,WAAW,UAAU;CAC7B,IAAI,cAAc,YAAY,KAAK,oBAAoB,OACtD;CAED,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;CACxC,IAAI,YAAY,MACf;CAED,MAAM,EAAE,OAAO,MAAM,KAAK,gBAAgB,QAAQ,MAAM;EACvD,KAAK,WAAW;EAChB,KAAK,KAAK,gBAAgB;EAC1B,QAAQ,KAAK,gBAAgB;EAC7B;CACD,CAAC;CACD,IAAI,CAAC,IACJ,MAAM,IAAI,SAAS,YAAY,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,GAAG,GAAG;AAEvE"}

package/dist/submissions/SubmissionAnswers.d.ts

@@ -0,0 +1,14 @@
+import { UIFieldServerProps } from "payload";
+
+//#region src/submissions/SubmissionAnswers.d.ts
+/**
+ * Server component. Formats submission data into serializable props and delegates
+ * rendering to the client component which uses Payload's UI components.
+ */
+declare const SubmissionAnswers: ({
+  data,
+  req
+}: UIFieldServerProps) => import("react/jsx-runtime").JSX.Element;
+//#endregion
+export { SubmissionAnswers };
+//# sourceMappingURL=SubmissionAnswers.d.ts.map

package/dist/submissions/SubmissionAnswers.js

@@ -0,0 +1,137 @@
+import { keys } from "../translations/keys.js";
+import { asFieldTranslate } from "../translations/server.js";
+import { defaultFieldDefinitions } from "../fields/builtin/index.js";
+import { buildRegistry } from "../fields/registry.js";
+import { SubmissionAnswersClient } from "./SubmissionAnswersClient.js";
+import { jsx } from "react/jsx-runtime";
+//#region src/submissions/SubmissionAnswers.tsx
+const registry = buildRegistry(defaultFieldDefinitions);
+const formatDate = (iso, locale) => {
+	try {
+		return new Intl.DateTimeFormat(locale, {
+			dateStyle: "medium",
+			timeStyle: "short"
+		}).format(new Date(iso));
+	} catch {
+		return iso;
+	}
+};
+/**
+* Server component. Formats submission data into serializable props and delegates
+* rendering to the client component which uses Payload's UI components.
+*/
+const SubmissionAnswers = ({ data, req }) => {
+	const doc = data ?? {};
+	const descriptors = doc.descriptors ?? [];
+	const values = doc.values ?? [];
+	const locale = doc.locale ?? req.locale ?? "en";
+	const t = asFieldTranslate(req.i18n.t);
+	const rawConsent = doc.consent ?? [];
+	const meta = doc.meta;
+	const valueByField = new Map(values.map((entry) => [entry.field, entry.value]));
+	const answers = [];
+	const repeaters = [];
+	for (const descriptor of descriptors) {
+		const raw = valueByField.get(descriptor.field);
+		if (descriptor.fieldType === "repeater") {
+			const rows = Array.isArray(raw) ? raw : [];
+			const subDescs = descriptor.subFieldDescriptors ?? [];
+			repeaters.push({
+				field: descriptor.field,
+				label: descriptor.label,
+				rows: rows.map((row, rowIndex) => ({
+					id: String(rowIndex),
+					subFields: subDescs.map((sub) => {
+						const subDef = registry.get(sub.fieldType);
+						const subRaw = row[sub.field];
+						const formatted = subDef?.format ? subDef.format({
+							value: subRaw,
+							config: {},
+							optionLabels: sub.optionLabels,
+							locale,
+							t
+						}) : subRaw == null ? "" : String(subRaw);
+						return {
+							label: sub.label,
+							value: formatted || "—"
+						};
+					})
+				}))
+			});
+			continue;
+		}
+		const def = registry.get(descriptor.fieldType);
+		const formatted = def?.format ? def.format({
+			value: raw,
+			config: {},
+			optionLabels: descriptor.optionLabels,
+			locale,
+			t
+		}) : raw == null ? "" : String(raw);
+		if (descriptor.fieldType === "file") {
+			const ref = raw && typeof raw === "object" && "url" in raw ? raw : null;
+			const url = typeof ref?.url === "string" ? ref.url : void 0;
+			const filename = typeof ref?.filename === "string" ? ref.filename : url ?? "";
+			answers.push({
+				field: descriptor.field,
+				label: descriptor.label,
+				value: filename,
+				href: url
+			});
+		} else answers.push({
+			field: descriptor.field,
+			label: descriptor.label,
+			value: formatted || "—",
+			multiline: descriptor.fieldType === "textarea",
+			...descriptor.width ? { width: descriptor.width } : {}
+		});
+	}
+	const consent = rawConsent.map((entry) => ({
+		...entry,
+		at: formatDate(entry.at, locale)
+	}));
+	const metaItems = [{
+		label: t(keys.submissionMetaLocale),
+		value: locale
+	}];
+	if (meta) {
+		if (meta.at) metaItems.push({
+			label: t(keys.submissionMetaReceivedAt),
+			value: formatDate(meta.at, locale)
+		});
+		if (meta.ip) metaItems.push({
+			label: t(keys.submissionMetaIp),
+			value: meta.ip
+		});
+		if (meta.ua) metaItems.push({
+			label: t(keys.submissionMetaUserAgent),
+			value: String(meta.ua)
+		});
+		if (meta.spam) {
+			const captcha = typeof meta.spam === "object" && "captcha" in meta.spam ? String(meta.spam.captcha) : "—";
+			metaItems.push({
+				label: t(keys.submissionMetaCaptcha),
+				value: captcha
+			});
+		}
+	}
+	return /* @__PURE__ */ jsx(SubmissionAnswersClient, {
+		answers,
+		repeaters,
+		consent,
+		meta: metaItems,
+		labels: {
+			answers: t(keys.submissionAnswers),
+			consent: t(keys.submissionConsent),
+			submissionDetails: t(keys.submissionDetails),
+			agreed: t(keys.submissionConsentAgreed),
+			declined: t(keys.submissionConsentDeclined),
+			row: t(keys.repeaterRow),
+			empty: t(keys.submissionNoAnswers)
+		}
+	});
+};
+//#endregion
+export { SubmissionAnswers };
+
+//# sourceMappingURL=SubmissionAnswers.js.map

package/dist/submissions/SubmissionAnswers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubmissionAnswers.js","names":[],"sources":["../../src/submissions/SubmissionAnswers.tsx"],"sourcesContent":["import type { UIFieldServerProps } from 'payload'\nimport { defaultFieldDefinitions } from '../fields/builtin'\nimport { buildRegistry } from '../fields/registry'\nimport { keys } from '../translations/keys'\nimport { asFieldTranslate } from '../translations/server'\nimport type {\n\tAnswerItem,\n\tConsentItem,\n\tMetaItem,\n\tRepeaterItem,\n\tSubmissionAnswersLabels,\n} from './SubmissionAnswersClient'\nimport { SubmissionAnswersClient } from './SubmissionAnswersClient'\nimport type { SubmissionDescriptor, SubmissionValue } from './types'\n\nconst registry = buildRegistry(defaultFieldDefinitions)\n\ntype ConsentEntry = {\n\tfield: string\n\tagreed: boolean\n\t/** The consent source's name at submit time (see `ConsentProof.name`). */\n\tname?: string\n\t/** The plain-text snapshot of the wording agreed to (see `ConsentProof.statementText`). */\n\tstatementText?: string\n\tversionRef?: string\n\tat: string\n}\n\ntype MetaSpam = { captcha?: string }\n\ntype SubmissionMeta = {\n\tat?: string\n\tip?: string\n\tua?: string\n\tspam?: MetaSpam\n\t[key: string]: unknown\n}\n\ntype SubmissionDoc = {\n\tvalues?: SubmissionValue[]\n\tdescriptors?: SubmissionDescriptor[]\n\tlocale?: string\n\tconsent?: ConsentEntry[]\n\tmeta?: SubmissionMeta\n}\n\nconst formatDate = (iso: string, locale: string): string => {\n\ttry {\n\t\treturn new Intl.DateTimeFormat(locale, { dateStyle: 'medium', timeStyle: 'short' }).format(\n\t\t\tnew Date(iso)\n\t\t)\n\t} catch {\n\t\treturn iso\n\t}\n}\n\n/**\n * Server component. Formats submission data into serializable props and delegates\n * rendering to the client component which uses Payload's UI components.\n */\nexport const SubmissionAnswers = ({ data, req }: UIFieldServerProps) => {\n\tconst doc = (data ?? {}) as SubmissionDoc\n\tconst descriptors = doc.descriptors ?? []\n\tconst values = doc.values ?? []\n\tconst locale = doc.locale ?? req.locale ?? 'en'\n\tconst t = asFieldTranslate(req.i18n.t)\n\tconst rawConsent = doc.consent ?? []\n\tconst meta = doc.meta\n\n\tconst valueByField = new Map(values.map((entry) => [entry.field, entry.value]))\n\n\tconst answers: AnswerItem[] = []\n\tconst repeaters: RepeaterItem[] = []\n\n\tfor (const descriptor of descriptors) {\n\t\tconst raw = valueByField.get(descriptor.field)\n\n\t\tif (descriptor.fieldType === 'repeater') {\n\t\t\tconst rows = Array.isArray(raw) ? (raw as Array<Record<string, unknown>>) : []\n\t\t\tconst subDescs = descriptor.subFieldDescriptors ?? []\n\t\t\trepeaters.push({\n\t\t\t\tfield: descriptor.field,\n\t\t\t\tlabel: descriptor.label,\n\t\t\t\trows: rows.map((row, rowIndex) => ({\n\t\t\t\t\tid: String(rowIndex),\n\t\t\t\t\tsubFields: subDescs.map((sub) => {\n\t\t\t\t\t\tconst subDef = registry.get(sub.fieldType)\n\t\t\t\t\t\tconst subRaw = row[sub.field]\n\t\t\t\t\t\tconst formatted = subDef?.format\n\t\t\t\t\t\t\t? subDef.format({\n\t\t\t\t\t\t\t\t\tvalue: subRaw,\n\t\t\t\t\t\t\t\t\tconfig: {},\n\t\t\t\t\t\t\t\t\toptionLabels: sub.optionLabels,\n\t\t\t\t\t\t\t\t\tlocale,\n\t\t\t\t\t\t\t\t\tt,\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t: subRaw == null\n\t\t\t\t\t\t\t\t? ''\n\t\t\t\t\t\t\t\t: String(subRaw)\n\t\t\t\t\t\treturn { label: sub.label, value: formatted || '—' }\n\t\t\t\t\t}),\n\t\t\t\t})),\n\t\t\t})\n\t\t\tcontinue\n\t\t}\n\n\t\tconst def = registry.get(descriptor.fieldType)\n\t\tconst formatted = def?.format\n\t\t\t? def.format({ value: raw, config: {}, optionLabels: descriptor.optionLabels, locale, t })\n\t\t\t: raw == null\n\t\t\t\t? ''\n\t\t\t\t: String(raw)\n\n\t\tif (descriptor.fieldType === 'file') {\n\t\t\tconst ref =\n\t\t\t\traw && typeof raw === 'object' && 'url' in raw\n\t\t\t\t\t? (raw as { url?: string; filename?: string })\n\t\t\t\t\t: null\n\t\t\tconst url = typeof ref?.url === 'string' ? ref.url : undefined\n\t\t\tconst filename = typeof ref?.filename === 'string' ? ref.filename : (url ?? '')\n\t\t\tanswers.push({ field: descriptor.field, label: descriptor.label, value: filename, href: url })\n\t\t} else {\n\t\t\tanswers.push({\n\t\t\t\tfield: descriptor.field,\n\t\t\t\tlabel: descriptor.label,\n\t\t\t\tvalue: formatted || '—',\n\t\t\t\tmultiline: descriptor.fieldType === 'textarea',\n\t\t\t\t...(descriptor.width ? { width: descriptor.width } : {}),\n\t\t\t})\n\t\t}\n\t}\n\n\tconst consent: ConsentItem[] = rawConsent.map((entry) => ({\n\t\t...entry,\n\t\tat: formatDate(entry.at, locale),\n\t}))\n\n\tconst metaItems: MetaItem[] = [{ label: t(keys.submissionMetaLocale), value: locale }]\n\tif (meta) {\n\t\tif (meta.at)\n\t\t\tmetaItems.push({\n\t\t\t\tlabel: t(keys.submissionMetaReceivedAt),\n\t\t\t\tvalue: formatDate(meta.at, locale),\n\t\t\t})\n\t\tif (meta.ip) metaItems.push({ label: t(keys.submissionMetaIp), value: meta.ip })\n\t\tif (meta.ua) metaItems.push({ label: t(keys.submissionMetaUserAgent), value: String(meta.ua) })\n\t\tif (meta.spam) {\n\t\t\tconst captcha =\n\t\t\t\ttypeof meta.spam === 'object' && 'captcha' in meta.spam\n\t\t\t\t\t? String((meta.spam as MetaSpam).captcha)\n\t\t\t\t\t: '—'\n\t\t\tmetaItems.push({ label: t(keys.submissionMetaCaptcha), value: captcha })\n\t\t}\n\t}\n\n\tconst labels: SubmissionAnswersLabels = {\n\t\tanswers: t(keys.submissionAnswers),\n\t\tconsent: t(keys.submissionConsent),\n\t\tsubmissionDetails: t(keys.submissionDetails),\n\t\tagreed: t(keys.submissionConsentAgreed),\n\t\tdeclined: t(keys.submissionConsentDeclined),\n\t\trow: t(keys.repeaterRow),\n\t\tempty: t(keys.submissionNoAnswers),\n\t}\n\n\treturn (\n\t\t<SubmissionAnswersClient\n\t\t\tanswers={answers}\n\t\t\trepeaters={repeaters}\n\t\t\tconsent={consent}\n\t\t\tmeta={metaItems}\n\t\t\tlabels={labels}\n\t\t/>\n\t)\n}\n"],"mappings":";;;;;;;AAeA,MAAM,WAAW,cAAc,uBAAuB;AA+BtD,MAAM,cAAc,KAAa,WAA2B;CAC3D,IAAI;EACH,OAAO,IAAI,KAAK,eAAe,QAAQ;GAAE,WAAW;GAAU,WAAW;EAAQ,CAAC,EAAE,OACnF,IAAI,KAAK,GAAG,CACb;CACD,QAAQ;EACP,OAAO;CACR;AACD;;;;;AAMA,MAAa,qBAAqB,EAAE,MAAM,UAA8B;CACvE,MAAM,MAAO,QAAQ,CAAC;CACtB,MAAM,cAAc,IAAI,eAAe,CAAC;CACxC,MAAM,SAAS,IAAI,UAAU,CAAC;CAC9B,MAAM,SAAS,IAAI,UAAU,IAAI,UAAU;CAC3C,MAAM,IAAI,iBAAiB,IAAI,KAAK,CAAC;CACrC,MAAM,aAAa,IAAI,WAAW,CAAC;CACnC,MAAM,OAAO,IAAI;CAEjB,MAAM,eAAe,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,OAAO,MAAM,KAAK,CAAC,CAAC;CAE9E,MAAM,UAAwB,CAAC;CAC/B,MAAM,YAA4B,CAAC;CAEnC,KAAK,MAAM,cAAc,aAAa;EACrC,MAAM,MAAM,aAAa,IAAI,WAAW,KAAK;EAE7C,IAAI,WAAW,cAAc,YAAY;GACxC,MAAM,OAAO,MAAM,QAAQ,GAAG,IAAK,MAAyC,CAAC;GAC7E,MAAM,WAAW,WAAW,uBAAuB,CAAC;GACpD,UAAU,KAAK;IACd,OAAO,WAAW;IAClB,OAAO,WAAW;IAClB,MAAM,KAAK,KAAK,KAAK,cAAc;KAClC,IAAI,OAAO,QAAQ;KACnB,WAAW,SAAS,KAAK,QAAQ;MAChC,MAAM,SAAS,SAAS,IAAI,IAAI,SAAS;MACzC,MAAM,SAAS,IAAI,IAAI;MACvB,MAAM,YAAY,QAAQ,SACvB,OAAO,OAAO;OACd,OAAO;OACP,QAAQ,CAAC;OACT,cAAc,IAAI;OAClB;OACA;MACD,CAAC,IACA,UAAU,OACT,KACA,OAAO,MAAM;MACjB,OAAO;OAAE,OAAO,IAAI;OAAO,OAAO,aAAa;MAAI;KACpD,CAAC;IACF,EAAE;GACH,CAAC;GACD;EACD;EAEA,MAAM,MAAM,SAAS,IAAI,WAAW,SAAS;EAC7C,MAAM,YAAY,KAAK,SACpB,IAAI,OAAO;GAAE,OAAO;GAAK,QAAQ,CAAC;GAAG,cAAc,WAAW;GAAc;GAAQ;EAAE,CAAC,IACvF,OAAO,OACN,KACA,OAAO,GAAG;EAEd,IAAI,WAAW,cAAc,QAAQ;GACpC,MAAM,MACL,OAAO,OAAO,QAAQ,YAAY,SAAS,MACvC,MACD;GACJ,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM,KAAA;GACrD,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,IAAI,WAAY,OAAO;GAC5E,QAAQ,KAAK;IAAE,OAAO,WAAW;IAAO,OAAO,WAAW;IAAO,OAAO;IAAU,MAAM;GAAI,CAAC;EAC9F,OACC,QAAQ,KAAK;GACZ,OAAO,WAAW;GAClB,OAAO,WAAW;GAClB,OAAO,aAAa;GACpB,WAAW,WAAW,cAAc;GACpC,GAAI,WAAW,QAAQ,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;EACvD,CAAC;CAEH;CAEA,MAAM,UAAyB,WAAW,KAAK,WAAW;EACzD,GAAG;EACH,IAAI,WAAW,MAAM,IAAI,MAAM;CAChC,EAAE;CAEF,MAAM,YAAwB,CAAC;EAAE,OAAO,EAAE,KAAK,oBAAoB;EAAG,OAAO;CAAO,CAAC;CACrF,IAAI,MAAM;EACT,IAAI,KAAK,IACR,UAAU,KAAK;GACd,OAAO,EAAE,KAAK,wBAAwB;GACtC,OAAO,WAAW,KAAK,IAAI,MAAM;EAClC,CAAC;EACF,IAAI,KAAK,IAAI,UAAU,KAAK;GAAE,OAAO,EAAE,KAAK,gBAAgB;GAAG,OAAO,KAAK;EAAG,CAAC;EAC/E,IAAI,KAAK,IAAI,UAAU,KAAK;GAAE,OAAO,EAAE,KAAK,uBAAuB;GAAG,OAAO,OAAO,KAAK,EAAE;EAAE,CAAC;EAC9F,IAAI,KAAK,MAAM;GACd,MAAM,UACL,OAAO,KAAK,SAAS,YAAY,aAAa,KAAK,OAChD,OAAQ,KAAK,KAAkB,OAAO,IACtC;GACJ,UAAU,KAAK;IAAE,OAAO,EAAE,KAAK,qBAAqB;IAAG,OAAO;GAAQ,CAAC;EACxE;CACD;CAYA,OACC,oBAAC,yBAAD;EACU;EACE;EACF;EACT,MAAM;EACN,QAAQ;GAfT,SAAS,EAAE,KAAK,iBAAiB;GACjC,SAAS,EAAE,KAAK,iBAAiB;GACjC,mBAAmB,EAAE,KAAK,iBAAiB;GAC3C,QAAQ,EAAE,KAAK,uBAAuB;GACtC,UAAU,EAAE,KAAK,yBAAyB;GAC1C,KAAK,EAAE,KAAK,WAAW;GACvB,OAAO,EAAE,KAAK,mBAAmB;EASnB;CACb,CAAA;AAEH"}