@10x-media/form-builder 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/submissions/verifyContext.js

@@ -0,0 +1,35 @@
+import { keys } from "../translations/keys.js";
+import { asTranslate } from "../translations/server.js";
+import { verifyFormContext } from "../context/formContext.js";
+import { CONTEXT_KEY } from "../spam/constants.js";
+import { APIError } from "payload";
+//#region src/submissions/verifyContext.ts
+/**
+* beforeValidate: pull the reserved signed-context entry out of the submitted values, verify it, and
+* stamp the verified `{ relationTo, value }` on the submission's separate `context` field. Runs
+* independently of the spam config (context must work with spam off) and before `validateSubmission`
+* stores the answers, so the token never reaches `values`, the answers view, or `{{*}}` output.
+*
+* A missing context is normal (the same form on an ordinary page carries none). An invalid one is
+* rejected loudly rather than dropped to absent, so a tampered reference cannot degrade into a send to
+* the statically configured recipients, which would hide the attack. The stored `value` is a string
+* for cross-adapter consistency; the id it references is already public.
+*/
+const verifyContext = () => async ({ data, operation, req }) => {
+	if (operation !== "create" || !data) return data;
+	const values = Array.isArray(data.values) ? data.values : [];
+	const token = values.find((entry) => entry.field === CONTEXT_KEY)?.value;
+	data.values = values.filter((entry) => entry.field !== CONTEXT_KEY);
+	if (typeof token !== "string" || token.length === 0) return data;
+	const verified = verifyFormContext(token, req.payload.secret);
+	if (!verified) throw new APIError(asTranslate(req.i18n.t)(keys.contextInvalid), 400);
+	data.context = {
+		relationTo: verified.relationTo,
+		value: String(verified.value)
+	};
+	return data;
+};
+//#endregion
+export { verifyContext };
+
+//# sourceMappingURL=verifyContext.js.map

package/dist/submissions/verifyContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyContext.js","names":[],"sources":["../../src/submissions/verifyContext.ts"],"sourcesContent":["import { APIError, type CollectionBeforeValidateHook } from 'payload'\nimport { verifyFormContext } from '../context/formContext'\nimport { CONTEXT_KEY } from '../spam/constants'\nimport { keys } from '../translations/keys'\nimport { asTranslate } from '../translations/server'\nimport type { SubmissionValue } from './types'\n\n/**\n * beforeValidate: pull the reserved signed-context entry out of the submitted values, verify it, and\n * stamp the verified `{ relationTo, value }` on the submission's separate `context` field. Runs\n * independently of the spam config (context must work with spam off) and before `validateSubmission`\n * stores the answers, so the token never reaches `values`, the answers view, or `{{*}}` output.\n *\n * A missing context is normal (the same form on an ordinary page carries none). An invalid one is\n * rejected loudly rather than dropped to absent, so a tampered reference cannot degrade into a send to\n * the statically configured recipients, which would hide the attack. The stored `value` is a string\n * for cross-adapter consistency; the id it references is already public.\n */\nexport const verifyContext =\n\t(): CollectionBeforeValidateHook =>\n\tasync ({ data, operation, req }) => {\n\t\tif (operation !== 'create' || !data) {\n\t\t\treturn data\n\t\t}\n\t\tconst values = Array.isArray(data.values) ? (data.values as SubmissionValue[]) : []\n\t\tconst token = values.find((entry) => entry.field === CONTEXT_KEY)?.value\n\t\t// Always strip the reserved entry, verified or not, so it can never land in the answers.\n\t\tdata.values = values.filter((entry) => entry.field !== CONTEXT_KEY)\n\t\tif (typeof token !== 'string' || token.length === 0) {\n\t\t\treturn data\n\t\t}\n\t\tconst verified = verifyFormContext(token, req.payload.secret)\n\t\tif (!verified) {\n\t\t\tthrow new APIError(asTranslate(req.i18n.t)(keys.contextInvalid), 400)\n\t\t}\n\t\tdata.context = { relationTo: verified.relationTo, value: String(verified.value) }\n\t\treturn data\n\t}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAEZ,OAAO,EAAE,MAAM,WAAW,UAAU;CACnC,IAAI,cAAc,YAAY,CAAC,MAC9B,OAAO;CAER,MAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,IAAK,KAAK,SAA+B,CAAC;CAClF,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,UAAU,WAAW,GAAG;CAEnE,KAAK,SAAS,OAAO,QAAQ,UAAU,MAAM,UAAU,WAAW;CAClE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,OAAO;CAER,MAAM,WAAW,kBAAkB,OAAO,IAAI,QAAQ,MAAM;CAC5D,IAAI,CAAC,UACJ,MAAM,IAAI,SAAS,YAAY,IAAI,KAAK,CAAC,EAAE,KAAK,cAAc,GAAG,GAAG;CAErE,KAAK,UAAU;EAAE,YAAY,SAAS;EAAY,OAAO,OAAO,SAAS,KAAK;CAAE;CAChF,OAAO;AACR"}

package/dist/submissions/voteChangeEndpoint.js

@@ -0,0 +1,105 @@
+import { keys } from "../translations/keys.js";
+import { asTranslate } from "../translations/server.js";
+import "../actions/dispatchContext.js";
+import { pollConfigOf } from "../form/pollState.js";
+import { formIdOf } from "./formIdOf.js";
+import { VOTE_CHANGE_CONTEXT_KEY, votedSubmissionIdFromCookie } from "./votedCookie.js";
+import { APIError, addDataAndFileToRequest, addLocalesToRequestFromData } from "payload";
+//#region src/submissions/voteChangeEndpoint.ts
+const FORM_SUBMISSIONS_SLUG = "form-submissions";
+const FORMS_SLUG = "forms";
+/** Marks the vote-submit endpoint in the sanitized endpoint list (`custom.formBuilder`). */
+const VOTE_SUBMIT_ENDPOINT_TAG = "vote-submit";
+const isComplete = (doc) => doc.status == null || doc.status === "complete";
+/**
+* The submission a cookie-identified re-vote should update, or null when the request must fall
+* through to a plain create. Guards run cheapest-first: no valid signed cookie for the posted form
+* means no form fetch at all, so the delegation overhead on ordinary submissions is one header
+* parse. A token is honored only when the form is an `allowChange` poll and it names a still
+* existing, complete submission of that same form; anything else (pruned row, cross-form replay,
+* legacy `1` marker, tampering) makes the caller a new voter rather than an error.
+*/
+const resolveVoteChangeTarget = async (args) => {
+	const { req, formId } = args;
+	if (formId == null) return null;
+	const submissionId = votedSubmissionIdFromCookie(req.headers?.get("cookie"), formId, req.payload.secret);
+	if (submissionId == null) return null;
+	const form = await req.payload.findByID({
+		collection: FORMS_SLUG,
+		id: formId,
+		depth: 0,
+		overrideAccess: true,
+		req
+	}).catch(() => null);
+	if (form?.pollEnabled !== true || pollConfigOf(form.poll)?.allowChange !== true) return null;
+	const submission = await req.payload.findByID({
+		collection: FORM_SUBMISSIONS_SLUG,
+		id: submissionId,
+		depth: 0,
+		overrideAccess: true,
+		req
+	}).catch(() => null);
+	if (submission == null) return null;
+	const stored = submission;
+	if (String(formIdOf(stored.form) ?? "") !== String(formId) || !isComplete(stored)) return null;
+	return { submissionId: submission.id };
+};
+/**
+* Custom root `POST /form-submissions` endpoint. Payload matches a collection's custom endpoints
+* ahead of its built-in REST routes, so this handler sees every REST create first: when the posted
+* form is an `allowChange` poll and the voted cookie identifies the caller's submission, it turns
+* the request into an in-place update (create-grade hooks opt in via the context flag); otherwise
+* it delegates to the stock create handler found in the same sanitized endpoint list, keeping the
+* default path semantics Payload's, not a reimplementation. The update runs `overrideAccess`
+* because the collection is deliberately update-closed to every API caller; the signed cookie is
+* the credential here, verified above rather than by collection access.
+*/
+const buildVoteSubmitEndpoint = () => {
+	const handler = async (req) => {
+		await addDataAndFileToRequest(req);
+		addLocalesToRequestFromData(req);
+		const data = req.data ?? {};
+		const target = await resolveVoteChangeTarget({
+			req,
+			formId: data.form
+		});
+		if (!target) {
+			const endpoints = req.payload.collections[FORM_SUBMISSIONS_SLUG]?.config.endpoints;
+			const stockCreate = (Array.isArray(endpoints) ? endpoints : []).find((endpoint) => endpoint.method === "post" && endpoint.path === "/" && endpoint.custom?.formBuilder !== "vote-submit");
+			if (!stockCreate) throw new APIError("form-builder: stock create endpoint not found", 500);
+			if (req.body) Object.defineProperty(req, "body", {
+				configurable: true,
+				value: null
+			});
+			const response = await stockCreate.handler(req);
+			if (req.context?.["formBuilderEssentialActionFailed"] === true && response.ok) return Response.json({ errors: [{ message: asTranslate(req.t)(keys.submissionActionFailed) }] }, { status: 502 });
+			return response;
+		}
+		req.context[VOTE_CHANGE_CONTEXT_KEY] = target.submissionId;
+		const doc = await req.payload.update.bind(req.payload)({
+			collection: FORM_SUBMISSIONS_SLUG,
+			id: target.submissionId,
+			data: {
+				form: data.form,
+				values: data.values
+			},
+			depth: 0,
+			overrideAccess: true,
+			req
+		});
+		return Response.json({
+			doc,
+			message: req.t("general:updatedSuccessfully")
+		}, { status: 200 });
+	};
+	return {
+		path: "/",
+		method: "post",
+		handler,
+		custom: { formBuilder: VOTE_SUBMIT_ENDPOINT_TAG }
+	};
+};
+//#endregion
+export { buildVoteSubmitEndpoint };
+
+//# sourceMappingURL=voteChangeEndpoint.js.map

package/dist/submissions/voteChangeEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voteChangeEndpoint.js","names":[],"sources":["../../src/submissions/voteChangeEndpoint.ts"],"sourcesContent":["import {\n\tAPIError,\n\taddDataAndFileToRequest,\n\taddLocalesToRequestFromData,\n\ttype Endpoint,\n\ttype PayloadRequest,\n} from 'payload'\nimport { ESSENTIAL_ACTION_FAILED_CONTEXT_KEY } from '../actions/dispatchContext'\nimport { pollConfigOf } from '../form/pollState'\nimport { keys } from '../translations/keys'\nimport { asTranslate } from '../translations/server'\nimport { formIdOf } from './formIdOf'\nimport { VOTE_CHANGE_CONTEXT_KEY, votedSubmissionIdFromCookie } from './votedCookie'\n\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\nconst FORMS_SLUG = 'forms'\n\n/** Marks the vote-submit endpoint in the sanitized endpoint list (`custom.formBuilder`). */\nexport const VOTE_SUBMIT_ENDPOINT_TAG = 'vote-submit'\n\nconst isComplete = (doc: { status?: unknown }): boolean =>\n\tdoc.status == null || doc.status === 'complete'\n\n/**\n * The submission a cookie-identified re-vote should update, or null when the request must fall\n * through to a plain create. Guards run cheapest-first: no valid signed cookie for the posted form\n * means no form fetch at all, so the delegation overhead on ordinary submissions is one header\n * parse. A token is honored only when the form is an `allowChange` poll and it names a still\n * existing, complete submission of that same form; anything else (pruned row, cross-form replay,\n * legacy `1` marker, tampering) makes the caller a new voter rather than an error.\n */\nexport const resolveVoteChangeTarget = async (args: {\n\treq: PayloadRequest\n\tformId: number | string | undefined | null\n}): Promise<{ submissionId: number | string } | null> => {\n\tconst { req, formId } = args\n\tif (formId == null) {\n\t\treturn null\n\t}\n\tconst submissionId = votedSubmissionIdFromCookie(\n\t\treq.headers?.get('cookie'),\n\t\tformId,\n\t\treq.payload.secret\n\t)\n\tif (submissionId == null) {\n\t\treturn null\n\t}\n\tconst form = await req.payload\n\t\t.findByID({ collection: FORMS_SLUG, id: formId, depth: 0, overrideAccess: true, req })\n\t\t.catch(() => null)\n\tif (form?.pollEnabled !== true || pollConfigOf(form.poll)?.allowChange !== true) {\n\t\treturn null\n\t}\n\tconst submission = await req.payload\n\t\t.findByID({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\tid: submissionId,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\t.catch(() => null)\n\tif (submission == null) {\n\t\treturn null\n\t}\n\tconst stored = submission as { form?: unknown; status?: unknown }\n\tif (String(formIdOf(stored.form) ?? '') !== String(formId) || !isComplete(stored)) {\n\t\treturn null\n\t}\n\treturn { submissionId: submission.id as number | string }\n}\n\n/**\n * Custom root `POST /form-submissions` endpoint. Payload matches a collection's custom endpoints\n * ahead of its built-in REST routes, so this handler sees every REST create first: when the posted\n * form is an `allowChange` poll and the voted cookie identifies the caller's submission, it turns\n * the request into an in-place update (create-grade hooks opt in via the context flag); otherwise\n * it delegates to the stock create handler found in the same sanitized endpoint list, keeping the\n * default path semantics Payload's, not a reimplementation. The update runs `overrideAccess`\n * because the collection is deliberately update-closed to every API caller; the signed cookie is\n * the credential here, verified above rather than by collection access.\n */\nexport const buildVoteSubmitEndpoint = (): Endpoint => {\n\tconst handler = async (req: PayloadRequest): Promise<Response> => {\n\t\tawait addDataAndFileToRequest(req)\n\t\taddLocalesToRequestFromData(req)\n\t\tconst data = (req.data ?? {}) as {\n\t\t\tform?: number | string\n\t\t\tvalues?: unknown\n\t\t}\n\t\tconst target = await resolveVoteChangeTarget({ req, formId: data.form })\n\t\tif (!target) {\n\t\t\tconst endpoints = req.payload.collections[FORM_SUBMISSIONS_SLUG]?.config.endpoints\n\t\t\tconst registered: Endpoint[] = Array.isArray(endpoints) ? endpoints : []\n\t\t\t// Next root-POST match excluding our own tag (never handler identity: a host-wrapped\n\t\t\t// handler would find itself and recurse). First-match mirrors handleEndpoints routing,\n\t\t\t// so another plugin's interceptor still wins exactly as it would without us.\n\t\t\tconst stockCreate = registered.find(\n\t\t\t\t(endpoint) =>\n\t\t\t\t\tendpoint.method === 'post' &&\n\t\t\t\t\tendpoint.path === '/' &&\n\t\t\t\t\tendpoint.custom?.formBuilder !== VOTE_SUBMIT_ENDPOINT_TAG\n\t\t\t)\n\t\t\tif (!stockCreate) {\n\t\t\t\tthrow new APIError('form-builder: stock create endpoint not found', 500)\n\t\t\t}\n\t\t\t// A consumed fetch body stays non-null, so Payload's addDataAndFileToRequest wrapper\n\t\t\t// would re-read it and 500; req.data/req.file are already populated, so hide the spent\n\t\t\t// stream (defineProperty: `body` is a getter-only prototype accessor).\n\t\t\tif (req.body) {\n\t\t\t\tObject.defineProperty(req, 'body', { configurable: true, value: null })\n\t\t\t}\n\t\t\tconst response = await stockCreate.handler(req)\n\t\t\t// An essential action's failure is the submission's failure: the row is committed and kept\n\t\t\t// (see dispatchActions), but the visitor must not be told it worked. 502 because the\n\t\t\t// upstream the submission exists for rejected or never confirmed it.\n\t\t\tif (req.context?.[ESSENTIAL_ACTION_FAILED_CONTEXT_KEY] === true && response.ok) {\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ errors: [{ message: asTranslate(req.t)(keys.submissionActionFailed) }] },\n\t\t\t\t\t{ status: 502 }\n\t\t\t\t)\n\t\t\t}\n\t\t\treturn response\n\t\t}\n\t\treq.context[VOTE_CHANGE_CONTEXT_KEY] = target.submissionId\n\t\t// Slug-agnostic cast (the `createSubmission` idiom): a host's generated types pin the\n\t\t// runtime-registered collection's `form` id flavor and `values` JSON shape, which this\n\t\t// framework-level write cannot know. Bound, because `update` is a prototype method.\n\t\tconst update = req.payload.update.bind(req.payload) as unknown as (options: {\n\t\t\tcollection: string\n\t\t\tid: number | string\n\t\t\tdata: { form?: number | string; values?: unknown }\n\t\t\tdepth?: number\n\t\t\toverrideAccess?: boolean\n\t\t\treq?: PayloadRequest\n\t\t}) => Promise<unknown>\n\t\tconst doc = await update({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\tid: target.submissionId,\n\t\t\tdata: { form: data.form, values: data.values },\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\treturn Response.json({ doc, message: req.t('general:updatedSuccessfully') }, { status: 200 })\n\t}\n\treturn { path: '/', method: 'post', handler, custom: { formBuilder: VOTE_SUBMIT_ENDPOINT_TAG } }\n}\n"],"mappings":";;;;;;;;AAcA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;;AAGnB,MAAa,2BAA2B;AAExC,MAAM,cAAc,QACnB,IAAI,UAAU,QAAQ,IAAI,WAAW;;;;;;;;;AAUtC,MAAa,0BAA0B,OAAO,SAGW;CACxD,MAAM,EAAE,KAAK,WAAW;CACxB,IAAI,UAAU,MACb,OAAO;CAER,MAAM,eAAe,4BACpB,IAAI,SAAS,IAAI,QAAQ,GACzB,QACA,IAAI,QAAQ,MACb;CACA,IAAI,gBAAgB,MACnB,OAAO;CAER,MAAM,OAAO,MAAM,IAAI,QACrB,SAAS;EAAE,YAAY;EAAY,IAAI;EAAQ,OAAO;EAAG,gBAAgB;EAAM;CAAI,CAAC,EACpF,YAAY,IAAI;CAClB,IAAI,MAAM,gBAAgB,QAAQ,aAAa,KAAK,IAAI,GAAG,gBAAgB,MAC1E,OAAO;CAER,MAAM,aAAa,MAAM,IAAI,QAC3B,SAAS;EACT,YAAY;EACZ,IAAI;EACJ,OAAO;EACP,gBAAgB;EAChB;CACD,CAAC,EACA,YAAY,IAAI;CAClB,IAAI,cAAc,MACjB,OAAO;CAER,MAAM,SAAS;CACf,IAAI,OAAO,SAAS,OAAO,IAAI,KAAK,EAAE,MAAM,OAAO,MAAM,KAAK,CAAC,WAAW,MAAM,GAC/E,OAAO;CAER,OAAO,EAAE,cAAc,WAAW,GAAsB;AACzD;;;;;;;;;;;AAYA,MAAa,gCAA0C;CACtD,MAAM,UAAU,OAAO,QAA2C;EACjE,MAAM,wBAAwB,GAAG;EACjC,4BAA4B,GAAG;EAC/B,MAAM,OAAQ,IAAI,QAAQ,CAAC;EAI3B,MAAM,SAAS,MAAM,wBAAwB;GAAE;GAAK,QAAQ,KAAK;EAAK,CAAC;EACvE,IAAI,CAAC,QAAQ;GACZ,MAAM,YAAY,IAAI,QAAQ,YAAY,wBAAwB,OAAO;GAKzE,MAAM,eAJyB,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC,GAIxC,MAC7B,aACA,SAAS,WAAW,UACpB,SAAS,SAAS,OAClB,SAAS,QAAQ,gBAAA,aACnB;GACA,IAAI,CAAC,aACJ,MAAM,IAAI,SAAS,iDAAiD,GAAG;GAKxE,IAAI,IAAI,MACP,OAAO,eAAe,KAAK,QAAQ;IAAE,cAAc;IAAM,OAAO;GAAK,CAAC;GAEvE,MAAM,WAAW,MAAM,YAAY,QAAQ,GAAG;GAI9C,IAAI,IAAI,UAAA,wCAAmD,QAAQ,SAAS,IAC3E,OAAO,SAAS,KACf,EAAE,QAAQ,CAAC,EAAE,SAAS,YAAY,IAAI,CAAC,EAAE,KAAK,sBAAsB,EAAE,CAAC,EAAE,GACzE,EAAE,QAAQ,IAAI,CACf;GAED,OAAO;EACR;EACA,IAAI,QAAQ,2BAA2B,OAAO;EAY9C,MAAM,MAAM,MARG,IAAI,QAAQ,OAAO,KAAK,IAAI,OAQpB,EAAE;GACxB,YAAY;GACZ,IAAI,OAAO;GACX,MAAM;IAAE,MAAM,KAAK;IAAM,QAAQ,KAAK;GAAO;GAC7C,OAAO;GACP,gBAAgB;GAChB;EACD,CAAC;EACD,OAAO,SAAS,KAAK;GAAE;GAAK,SAAS,IAAI,EAAE,6BAA6B;EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;CAC7F;CACA,OAAO;EAAE,MAAM;EAAK,QAAQ;EAAQ;EAAS,QAAQ,EAAE,aAAa,yBAAyB;CAAE;AAChG"}

package/dist/submissions/votedCookie.d.ts

@@ -0,0 +1,15 @@
+import { Payload } from "payload";
+
+//#region src/submissions/votedCookie.d.ts
+/** Name of the httpOnly voted cookie for a form: `fb-voted-{formId}`. */
+declare const votedCookieName: (formId: number | string) => string;
+/**
+ * Whether a request's `Cookie` header carries the voted marker for a form. For SSR hosts: read
+ * the header (e.g. Next's `(await headers()).get('cookie')`) and pass the result to `<Poll hasVoted>`.
+ * The cookie is httpOnly (set server-side when the plugin's `poll.votedCookie` option is on), so
+ * this server read is the only way to consume it.
+ */
+declare const hasVotedCookie: (cookieHeader: string | null | undefined, formId: number | string) => boolean;
+//#endregion
+export { hasVotedCookie, votedCookieName };
+//# sourceMappingURL=votedCookie.d.ts.map

package/dist/submissions/votedCookie.js

@@ -0,0 +1,74 @@
+import { signFormContext, verifyFormContext } from "../context/formContext.js";
+//#region src/submissions/votedCookie.ts
+/**
+* `req.context` key under which `validateSubmission` stashes the loaded form's poll state
+* (`{ pollEnabled, allowChange }`) so the voted-cookie `afterChange` hook can skip a second form
+* fetch on the same request.
+*/
+const POLL_CONTEXT_KEY = "formBuilderPollConfig";
+/**
+* `req.context` key the vote-submit endpoint sets to the id of the submission a cookie-identified
+* re-vote is updating. Its presence is what opts the update operation into the create-grade
+* pipeline: the spam guard, full validation in `validateSubmission`, the dedup rule's
+* self-exclusion, and the voted-cookie refresh all key off it, so an unflagged update (host
+* server code, admin tooling) keeps today's behavior exactly.
+*/
+const VOTE_CHANGE_CONTEXT_KEY = "formBuilderVoteChange";
+/** The change-target submission id a flagged request carries, or undefined. */
+const voteChangeTargetOf = (req) => {
+	const target = req.context?.[VOTE_CHANGE_CONTEXT_KEY];
+	return typeof target === "string" || typeof target === "number" ? target : void 0;
+};
+/** Redeclared to avoid a cycle: `collections/formSubmissions` imports from this module. */
+const FORM_SUBMISSIONS_SLUG = "form-submissions";
+/** One year, matching the voted cookie's `Max-Age` so the token never outlives the cookie by less. */
+const VOTED_COOKIE_MAX_AGE_SECONDS = 31536e3;
+/** Name of the httpOnly voted cookie for a form: `fb-voted-{formId}`. */
+const votedCookieName = (formId) => `fb-voted-${formId}`;
+/**
+* Whether a request's `Cookie` header carries the voted marker for a form. For SSR hosts: read
+* the header (e.g. Next's `(await headers()).get('cookie')`) and pass the result to `<Poll hasVoted>`.
+* The cookie is httpOnly (set server-side when the plugin's `poll.votedCookie` option is on), so
+* this server read is the only way to consume it.
+*/
+const hasVotedCookie = (cookieHeader, formId) => {
+	if (!cookieHeader) return false;
+	return votedCookieValue(cookieHeader, formId) != null;
+};
+const votedCookieValue = (cookieHeader, formId) => {
+	if (!cookieHeader) return null;
+	const name = votedCookieName(formId);
+	for (const pair of cookieHeader.split(";")) {
+		const eq = pair.indexOf("=");
+		if (eq !== -1 && pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim();
+	}
+	return null;
+};
+/**
+* Sign a submission id into the voted cookie's value for an `allowChange` poll. The token (same
+* HMAC format as `signFormContext`) is what lets a repeat submit update that submission in place;
+* signing means only ids the server issued are accepted, so a forged cookie cannot point a
+* re-vote at someone else's submission.
+*/
+const signVotedCookieValue = (payload, submissionId) => signFormContext({
+	payload,
+	relationTo: FORM_SUBMISSIONS_SLUG,
+	value: submissionId,
+	expiresIn: VOTED_COOKIE_MAX_AGE_SECONDS
+});
+/**
+* The submission id carried by a form's voted cookie, or null when the header has no cookie for
+* the form, the value is the legacy boolean marker (`1`), or the token fails verification
+* (tampered, wrong secret, expired). Null means "treat the caller as a new voter".
+*/
+const votedSubmissionIdFromCookie = (cookieHeader, formId, secret) => {
+	const value = votedCookieValue(cookieHeader, formId);
+	if (value == null || value.length === 0) return null;
+	const reference = verifyFormContext(value, secret);
+	if (reference == null || reference.relationTo !== FORM_SUBMISSIONS_SLUG) return null;
+	return String(reference.value);
+};
+//#endregion
+export { POLL_CONTEXT_KEY, VOTED_COOKIE_MAX_AGE_SECONDS, VOTE_CHANGE_CONTEXT_KEY, hasVotedCookie, signVotedCookieValue, voteChangeTargetOf, votedCookieName, votedSubmissionIdFromCookie };
+
+//# sourceMappingURL=votedCookie.js.map

package/dist/submissions/votedCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"votedCookie.js","names":[],"sources":["../../src/submissions/votedCookie.ts"],"sourcesContent":["import type { Payload } from 'payload'\nimport { signFormContext, verifyFormContext } from '../context/formContext'\n\n/**\n * `req.context` key under which `validateSubmission` stashes the loaded form's poll state\n * (`{ pollEnabled, allowChange }`) so the voted-cookie `afterChange` hook can skip a second form\n * fetch on the same request.\n */\nexport const POLL_CONTEXT_KEY = 'formBuilderPollConfig'\n\n/** The poll state `validateSubmission` stashes under {@link POLL_CONTEXT_KEY}. */\nexport type PollContextState = { pollEnabled: boolean; allowChange: boolean }\n\n/**\n * `req.context` key the vote-submit endpoint sets to the id of the submission a cookie-identified\n * re-vote is updating. Its presence is what opts the update operation into the create-grade\n * pipeline: the spam guard, full validation in `validateSubmission`, the dedup rule's\n * self-exclusion, and the voted-cookie refresh all key off it, so an unflagged update (host\n * server code, admin tooling) keeps today's behavior exactly.\n */\nexport const VOTE_CHANGE_CONTEXT_KEY = 'formBuilderVoteChange'\n\n/** The change-target submission id a flagged request carries, or undefined. */\nexport const voteChangeTargetOf = (req: {\n\tcontext?: Record<string, unknown>\n}): number | string | undefined => {\n\tconst target = req.context?.[VOTE_CHANGE_CONTEXT_KEY]\n\treturn typeof target === 'string' || typeof target === 'number' ? target : undefined\n}\n\n/** Redeclared to avoid a cycle: `collections/formSubmissions` imports from this module. */\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\n\n/** One year, matching the voted cookie's `Max-Age` so the token never outlives the cookie by less. */\nexport const VOTED_COOKIE_MAX_AGE_SECONDS = 31_536_000\n\n/** Name of the httpOnly voted cookie for a form: `fb-voted-{formId}`. */\nexport const votedCookieName = (formId: number | string): string => `fb-voted-${formId}`\n\n/**\n * Whether a request's `Cookie` header carries the voted marker for a form. For SSR hosts: read\n * the header (e.g. Next's `(await headers()).get('cookie')`) and pass the result to `<Poll hasVoted>`.\n * The cookie is httpOnly (set server-side when the plugin's `poll.votedCookie` option is on), so\n * this server read is the only way to consume it.\n */\nexport const hasVotedCookie = (\n\tcookieHeader: string | null | undefined,\n\tformId: number | string\n): boolean => {\n\tif (!cookieHeader) {\n\t\treturn false\n\t}\n\treturn votedCookieValue(cookieHeader, formId) != null\n}\n\nconst votedCookieValue = (\n\tcookieHeader: string | null | undefined,\n\tformId: number | string\n): string | null => {\n\tif (!cookieHeader) {\n\t\treturn null\n\t}\n\tconst name = votedCookieName(formId)\n\tfor (const pair of cookieHeader.split(';')) {\n\t\tconst eq = pair.indexOf('=')\n\t\tif (eq !== -1 && pair.slice(0, eq).trim() === name) {\n\t\t\treturn pair.slice(eq + 1).trim()\n\t\t}\n\t}\n\treturn null\n}\n\n/**\n * Sign a submission id into the voted cookie's value for an `allowChange` poll. The token (same\n * HMAC format as `signFormContext`) is what lets a repeat submit update that submission in place;\n * signing means only ids the server issued are accepted, so a forged cookie cannot point a\n * re-vote at someone else's submission.\n */\nexport const signVotedCookieValue = (payload: Payload, submissionId: number | string): string =>\n\tsignFormContext({\n\t\tpayload,\n\t\trelationTo: FORM_SUBMISSIONS_SLUG,\n\t\tvalue: submissionId,\n\t\texpiresIn: VOTED_COOKIE_MAX_AGE_SECONDS,\n\t})\n\n/**\n * The submission id carried by a form's voted cookie, or null when the header has no cookie for\n * the form, the value is the legacy boolean marker (`1`), or the token fails verification\n * (tampered, wrong secret, expired). Null means \"treat the caller as a new voter\".\n */\nexport const votedSubmissionIdFromCookie = (\n\tcookieHeader: string | null | undefined,\n\tformId: number | string,\n\tsecret: string\n): string | null => {\n\tconst value = votedCookieValue(cookieHeader, formId)\n\tif (value == null || value.length === 0) {\n\t\treturn null\n\t}\n\tconst reference = verifyFormContext(value, secret)\n\tif (reference == null || reference.relationTo !== FORM_SUBMISSIONS_SLUG) {\n\t\treturn null\n\t}\n\treturn String(reference.value)\n}\n"],"mappings":";;;;;;;AAQA,MAAa,mBAAmB;;;;;;;;AAYhC,MAAa,0BAA0B;;AAGvC,MAAa,sBAAsB,QAEA;CAClC,MAAM,SAAS,IAAI,UAAU;CAC7B,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,WAAW,SAAS,KAAA;AAC5E;;AAGA,MAAM,wBAAwB;;AAG9B,MAAa,+BAA+B;;AAG5C,MAAa,mBAAmB,WAAoC,YAAY;;;;;;;AAQhF,MAAa,kBACZ,cACA,WACa;CACb,IAAI,CAAC,cACJ,OAAO;CAER,OAAO,iBAAiB,cAAc,MAAM,KAAK;AAClD;AAEA,MAAM,oBACL,cACA,WACmB;CACnB,IAAI,CAAC,cACJ,OAAO;CAER,MAAM,OAAO,gBAAgB,MAAM;CACnC,KAAK,MAAM,QAAQ,aAAa,MAAM,GAAG,GAAG;EAC3C,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,MAAM,MAC7C,OAAO,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;CAEjC;CACA,OAAO;AACR;;;;;;;AAQA,MAAa,wBAAwB,SAAkB,iBACtD,gBAAgB;CACf;CACA,YAAY;CACZ,OAAO;CACP,WAAW;AACZ,CAAC;;;;;;AAOF,MAAa,+BACZ,cACA,QACA,WACmB;CACnB,MAAM,QAAQ,iBAAiB,cAAc,MAAM;CACnD,IAAI,SAAS,QAAQ,MAAM,WAAW,GACrC,OAAO;CAER,MAAM,YAAY,kBAAkB,OAAO,MAAM;CACjD,IAAI,aAAa,QAAQ,UAAU,eAAe,uBACjD,OAAO;CAER,OAAO,OAAO,UAAU,KAAK;AAC9B"}

package/dist/translations/clientRuntimeKeys.d.ts

@@ -0,0 +1,17 @@
+import { TranslationKey } from "./keys.js";
+
+//#region src/translations/clientRuntimeKeys.d.ts
+/**
+ * The typed keys the visitor-facing runtime (`<Form>`, `<Poll>`, `<FormResults>`, and the field
+ * renderers) resolves through `RendererTranslate`. A host bridging its own i18n can assert its mirror
+ * covers these in a unit test, the non-drifting form of a hand-written `dist/` diff. Kept in exact
+ * lockstep with `src/react/**` by `clientRuntimeKeys.test.ts`.
+ *
+ * For a complete, drift-proof fallback prefer `makeTranslate(locale)` (or
+ * `makeTranslate(bundles[locale] ?? en)`): a shipped bundle covers every key, including the
+ * client-side validation messages resolved outside these components, so no key can leak English.
+ */
+declare const clientRuntimeKeys: readonly TranslationKey[];
+//#endregion
+export { clientRuntimeKeys };
+//# sourceMappingURL=clientRuntimeKeys.d.ts.map

package/dist/translations/clientRuntimeKeys.js

@@ -0,0 +1,48 @@
+import { keys } from "./keys.js";
+//#region src/translations/clientRuntimeKeys.ts
+/**
+* The typed keys the visitor-facing runtime (`<Form>`, `<Poll>`, `<FormResults>`, and the field
+* renderers) resolves through `RendererTranslate`. A host bridging its own i18n can assert its mirror
+* covers these in a unit test, the non-drifting form of a hand-written `dist/` diff. Kept in exact
+* lockstep with `src/react/**` by `clientRuntimeKeys.test.ts`.
+*
+* For a complete, drift-proof fallback prefer `makeTranslate(locale)` (or
+* `makeTranslate(bundles[locale] ?? en)`): a shipped bundle covers every key, including the
+* client-side validation messages resolved outside these components, so no key can leak English.
+*/
+const clientRuntimeKeys = [
+	keys.formSubmit,
+	keys.formNext,
+	keys.formBack,
+	keys.formClose,
+	keys.formSuccess,
+	keys.formSubmitFailed,
+	keys.formStepStatus,
+	keys.formStepInvalid,
+	keys.flowStepFallbackTitle,
+	keys.repeaterAddRow,
+	keys.repeaterRemoveRow,
+	keys.repeaterRow,
+	keys.fileUploading,
+	keys.fileUploaded,
+	keys.fileRemove,
+	keys.fileTooLarge,
+	keys.fileUploadFailed,
+	keys.fileUploadMisconfigured,
+	keys.fileHintAccepted,
+	keys.fileHintMaxSize,
+	keys.pollChangeVote,
+	keys.pollClosed,
+	keys.pollFinalResult,
+	keys.pollResultsAfterClose,
+	keys.pollResultsError,
+	keys.resultsNoResponses,
+	keys.resultsResponses,
+	keys.resultsTruncated,
+	keys.resultsWinner,
+	keys.resultsYourVote
+];
+//#endregion
+export { clientRuntimeKeys };
+
+//# sourceMappingURL=clientRuntimeKeys.js.map

package/dist/translations/clientRuntimeKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientRuntimeKeys.js","names":[],"sources":["../../src/translations/clientRuntimeKeys.ts"],"sourcesContent":["import type { TranslationKey } from './keys'\nimport { keys } from './keys'\n\n/**\n * The typed keys the visitor-facing runtime (`<Form>`, `<Poll>`, `<FormResults>`, and the field\n * renderers) resolves through `RendererTranslate`. A host bridging its own i18n can assert its mirror\n * covers these in a unit test, the non-drifting form of a hand-written `dist/` diff. Kept in exact\n * lockstep with `src/react/**` by `clientRuntimeKeys.test.ts`.\n *\n * For a complete, drift-proof fallback prefer `makeTranslate(locale)` (or\n * `makeTranslate(bundles[locale] ?? en)`): a shipped bundle covers every key, including the\n * client-side validation messages resolved outside these components, so no key can leak English.\n */\nexport const clientRuntimeKeys: readonly TranslationKey[] = [\n\tkeys.formSubmit,\n\tkeys.formNext,\n\tkeys.formBack,\n\tkeys.formClose,\n\tkeys.formSuccess,\n\tkeys.formSubmitFailed,\n\tkeys.formStepStatus,\n\tkeys.formStepInvalid,\n\tkeys.flowStepFallbackTitle,\n\tkeys.repeaterAddRow,\n\tkeys.repeaterRemoveRow,\n\tkeys.repeaterRow,\n\tkeys.fileUploading,\n\tkeys.fileUploaded,\n\tkeys.fileRemove,\n\tkeys.fileTooLarge,\n\tkeys.fileUploadFailed,\n\tkeys.fileUploadMisconfigured,\n\tkeys.fileHintAccepted,\n\tkeys.fileHintMaxSize,\n\tkeys.pollChangeVote,\n\tkeys.pollClosed,\n\tkeys.pollFinalResult,\n\tkeys.pollResultsAfterClose,\n\tkeys.pollResultsError,\n\tkeys.resultsNoResponses,\n\tkeys.resultsResponses,\n\tkeys.resultsTruncated,\n\tkeys.resultsWinner,\n\tkeys.resultsYourVote,\n]\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,oBAA+C;CAC3D,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;AACN"}

package/dist/translations/de.d.ts

@@ -0,0 +1,12 @@
+import { TranslationKey } from "./keys.js";
+
+//#region src/translations/de.d.ts
+/**
+ * German values, keyed by the typed constants in `keys.ts` so the two stay in
+ * lockstep. The `Record<TranslationKey, string>` annotation makes a missing or
+ * unknown key a type error. `translations/index.ts` nests these for Payload.
+ */
+declare const de: Record<TranslationKey, string>;
+//#endregion
+export { de };
+//# sourceMappingURL=de.d.ts.map