@actuate-media/cms-core 0.30.0 → 0.32.0

package/dist/api/handlers.js

@@ -23,6 +23,11 @@ import { schedulingCronHandler } from '../scheduling/index.js';
 import { isAuthorizedCronRequest, processCleanup, processSeoScan } from '../cron/index.js';
 import { processContentHealthScan } from '../content-health/cron.js';
 import { verifyCaptcha, getCaptchaConfig } from '../security/captcha.js';
+import { listForms as listFormsService, getFormById as getFormByIdService, getFormBySlug as getFormBySlugService, createForm as createFormService, updateForm as updateFormService, duplicateForm as duplicateFormService, deleteForm as deleteFormService, saveFormSchema as saveFormSchemaService, getFormSchema as getFormSchemaService, getNotificationSettings as getFormNotificationSettingsService, updateNotificationSettings as updateFormNotificationSettingsService, setNotifyEnabled as setFormNotifyEnabledService, getEmbedSettings as getFormEmbedSettingsService, updateEmbedSettings as updateFormEmbedSettingsService, getFormStats as getFormStatsService, getFormsSidebarCounts as getFormsSidebarCountsService, FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../forms/service.js';
+import { listEntries as listEntriesService, getEntryWithSchema as getEntryWithSchemaService, getEntryCounts as getEntryCountsService, updateEntry as updateEntryService, bulkUpdateEntries as bulkUpdateEntriesService, deleteEntry as deleteEntryService, } from '../forms/entries.js';
+import { processSubmission, buildPublicForm, SubmissionValidationError, } from '../forms/submission.js';
+import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FILE_BYTES, } from '../forms/files.js';
+import { resolveSubmissionFields } from '../forms/submission.js';
 import { checkForUpdates } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
@@ -246,17 +251,6 @@ function asRecord(value) {
         ? value
         : {};
 }
-function normalizeFormDocument(form, submissions = 0) {
-    const data = asRecord(form.data);
-    const fields = Array.isArray(data.fields) ? data.fields.length : Number(data.fields ?? 0);
-    return {
-        ...form,
-        name: data.name ?? form.name ?? form.title ?? 'Untitled form',
-        description: data.description ?? form.description ?? '',
-        fields,
-        submissions,
-    };
-}
 function normalizeSubmission(submission) {
     const data = asRecord(submission.data);
     const attribution = asRecord(submission.attribution);
@@ -281,6 +275,288 @@ function normalizeSubmission(submission) {
         },
     };
 }
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+function mapFormError(err) {
+    if (err instanceof FormNotFoundError)
+        return errorResponse(err.message, 404);
+    if (err instanceof FormValidationError) {
+        return json({ error: err.message, code: 'INVALID_SCHEMA', details: err.errors }, 400);
+    }
+    if (err instanceof FormConflictError)
+        return errorResponse(err.message, 409);
+    if (err instanceof FormHasSubmissionsError) {
+        return json({ error: err.message, code: 'FORM_HAS_SUBMISSIONS', submissionCount: err.submissionCount }, 409);
+    }
+    return null;
+}
+function parseFormsQuery(url) {
+    const sp = url.searchParams;
+    const status = sp.get('status');
+    const notify = sp.get('notifyEnabled');
+    return {
+        search: sp.get('search') ?? undefined,
+        status: status === 'active' || status === 'draft' || status === 'archived' ? status : undefined,
+        notifyEnabled: notify == null ? undefined : notify === 'true',
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc'
+            ? 'asc'
+            : sp.get('sortDirection') === 'desc'
+                ? 'desc'
+                : undefined,
+        page: sp.get('page') ? Number(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? Number(sp.get('pageSize')) : undefined,
+    };
+}
+function parseEntriesQuery(url) {
+    const sp = url.searchParams;
+    const spam = sp.get('spamStatus');
+    const boolParam = (key) => {
+        const v = sp.get(key);
+        return v == null ? undefined : v === 'true';
+    };
+    return {
+        search: sp.get('search') ?? undefined,
+        formId: sp.get('formId') ?? sp.get('form') ?? undefined,
+        unread: boolParam('unread'),
+        starred: boolParam('starred'),
+        archived: boolParam('archived'),
+        spamStatus: spam === 'clean' || spam === 'suspected' || spam === 'spam'
+            ? spam
+            : undefined,
+        dateFrom: sp.get('dateFrom') ?? undefined,
+        dateTo: sp.get('dateTo') ?? undefined,
+        thisWeek: boolParam('thisWeek'),
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc' ? 'asc' : undefined,
+        page: sp.get('page') ? Number(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? Number(sp.get('pageSize')) : undefined,
+    };
+}
+// ─── Public form submission helpers ─────────────────────────────────────────
+/**
+ * Build CORS headers for the public form endpoints. When the form has no
+ * embed allowlist we reflect the requesting origin (open embedding). When an
+ * allowlist is set we only echo the origin if it matches, so a disallowed site
+ * cannot read the response. Browser-level CORS is complemented by a hard
+ * server-side origin check in the submit handler.
+ */
+function formCorsHeaders(request, allowedDomains) {
+    const origin = request.headers.get('origin');
+    const headers = {
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type, X-Requested-With',
+        'Access-Control-Max-Age': '600',
+        Vary: 'Origin',
+    };
+    if (!allowedDomains || allowedDomains.length === 0) {
+        headers['Access-Control-Allow-Origin'] = origin || '*';
+    }
+    else if (origin && isOriginAllowed(origin, allowedDomains)) {
+        headers['Access-Control-Allow-Origin'] = origin;
+    }
+    return headers;
+}
+function normalizeAllowedHost(domain) {
+    return domain
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, '')
+        .replace(/\/.*$/, '')
+        .replace(/^\*\./, '');
+}
+function isOriginAllowed(origin, allowedDomains) {
+    let host;
+    try {
+        host = new URL(origin).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return allowedDomains
+        .map(normalizeAllowedHost)
+        .some((a) => a !== '' && (host === a || host.endsWith(`.${a}`)));
+}
+function jsonWithHeaders(data, status, extra) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { ...SECURITY_HEADERS, ...extra },
+    });
+}
+/**
+ * Parse a public submission request into field values, files, and metadata.
+ * Supports both `application/json` (no files) and `multipart/form-data`
+ * (files + fields). Unknown/oversized bodies are rejected by the caller's
+ * Content-Length gate before this runs.
+ */
+async function parseSubmissionRequest(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('multipart/form-data')) {
+        const form = await request.formData();
+        const values = {};
+        const files = [];
+        let attribution = null;
+        let elapsedMs = null;
+        let pageUrl = null;
+        let captchaToken = '';
+        for (const [key, value] of form.entries()) {
+            if (typeof value === 'object' && value !== null && 'arrayBuffer' in value) {
+                const file = value;
+                if (file.size === 0 && !file.name)
+                    continue;
+                const buffer = Buffer.from(await file.arrayBuffer());
+                files.push({
+                    fieldKey: key,
+                    fileName: file.name || 'file',
+                    mimeType: file.type || 'application/octet-stream',
+                    size: buffer.byteLength,
+                    buffer,
+                });
+                continue;
+            }
+            const str = String(value);
+            if (key === '__attribution') {
+                attribution = safeJsonObject(str);
+            }
+            else if (key === '__elapsedMs') {
+                const n = Number(str);
+                elapsedMs = Number.isFinite(n) ? n : null;
+            }
+            else if (key === '__pageUrl') {
+                pageUrl = str || null;
+            }
+            else if (key === '__captchaToken' || key === 'captchaToken') {
+                captchaToken = str;
+            }
+            else if (Object.prototype.hasOwnProperty.call(values, key)) {
+                // Repeated keys (e.g. multi-checkbox) collapse into an array.
+                const existing = values[key];
+                values[key] = Array.isArray(existing) ? [...existing, str] : [existing, str];
+            }
+            else {
+                values[key] = str;
+            }
+        }
+        return { values, files, meta: { attribution, elapsedMs, pageUrl, captchaToken } };
+    }
+    // JSON body.
+    const body = (await request.json().catch(() => null));
+    if (!body)
+        return null;
+    const values = body.fields && typeof body.fields === 'object' && !Array.isArray(body.fields)
+        ? body.fields
+        : null;
+    if (!values)
+        return null;
+    return {
+        values,
+        files: [],
+        meta: {
+            attribution: safeJsonObject(body.attribution),
+            elapsedMs: typeof body.elapsedMs === 'number' && Number.isFinite(body.elapsedMs)
+                ? body.elapsedMs
+                : null,
+            pageUrl: typeof body.pageUrl === 'string' ? body.pageUrl : null,
+            captchaToken: typeof body.captchaToken === 'string' ? body.captchaToken : '',
+        },
+    };
+}
+function safeJsonObject(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        try {
+            const parsed = JSON.parse(value);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            /* ignore malformed attribution blob */
+        }
+    }
+    return null;
+}
+/**
+ * Shared public-submission handler used by both the slug-based public route and
+ * the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
+ * allowlisting, optional CAPTCHA, file validation, then runs the core
+ * submission pipeline. Always responds with CORS headers so embedded forms can
+ * read the result.
+ */
+async function submitToForm(request, form) {
+    const allowedDomains = form.embedSettings?.allowedDomains;
+    const cors = formCorsHeaders(request, allowedDomains);
+    const ip = getClientIp(request);
+    const rlKey = isResolvedIp(ip) ? `formsubmit:${ip}:${form.id}` : `formsubmit:_unknown:${form.id}`;
+    if (!(await checkRateLimitAsync(formLimiterGlobal, rlKey))) {
+        return jsonWithHeaders({ error: 'Too many submissions. Please try again later.' }, 429, cors);
+    }
+    // Hard server-side origin check when an embed allowlist is configured —
+    // browser CORS alone does not prevent a non-browser client from posting.
+    if (allowedDomains && allowedDomains.length > 0) {
+        const origin = request.headers.get('origin');
+        if (origin && !isOriginAllowed(origin, allowedDomains)) {
+            return jsonWithHeaders({ error: 'This form cannot be submitted from this origin.' }, 403, cors);
+        }
+    }
+    const parsed = await parseSubmissionRequest(request);
+    if (!parsed) {
+        return jsonWithHeaders({ error: 'Invalid or missing submission body.' }, 400, cors);
+    }
+    const captchaConfig = getCaptchaConfig();
+    if (captchaConfig.provider !== 'none') {
+        const result = await verifyCaptcha(parsed.meta.captchaToken, captchaConfig, isResolvedIp(ip) ? ip : undefined);
+        if (!result.success) {
+            return jsonWithHeaders({ error: 'CAPTCHA verification failed. Please try again.' }, 403, cors);
+        }
+    }
+    if (parsed.files.length > 0) {
+        const fileCfg = getActuateConfig()?.forms?.fileUpload;
+        if (fileCfg?.enabled === false) {
+            return jsonWithHeaders({ error: 'File uploads are not enabled for this site.' }, 400, cors);
+        }
+        const { fields } = await resolveSubmissionFields(form);
+        const fileCheck = validateSubmissionFiles(fields, parsed.files, {
+            maxSizeBytes: fileCfg?.maxSizeMB ? fileCfg.maxSizeMB * 1024 * 1024 : DEFAULT_MAX_FILE_BYTES,
+            allowedMimeTypes: fileCfg?.allowedMimeTypes ?? FORM_UPLOAD_ALLOWED_MIME_TYPES,
+        });
+        if (!fileCheck.ok) {
+            return jsonWithHeaders({ error: 'File validation failed.', code: 'INVALID_FILES', details: fileCheck.errors }, 422, cors);
+        }
+    }
+    const ctx = {
+        values: parsed.values,
+        files: parsed.files,
+        ip,
+        userAgent: request.headers.get('user-agent'),
+        referrer: request.headers.get('referer'),
+        origin: request.headers.get('origin'),
+        pageUrl: parsed.meta.pageUrl,
+        attribution: parsed.meta.attribution,
+        elapsedMs: parsed.meta.elapsedMs,
+    };
+    try {
+        const result = await processSubmission(form, ctx);
+        return jsonWithHeaders({
+            data: {
+                success: true,
+                submissionId: result.submissionId,
+                entryNumber: result.entryNumber,
+                confirmation: result.confirmation,
+            },
+        }, 201, cors);
+    }
+    catch (err) {
+        if (err instanceof SubmissionValidationError) {
+            return jsonWithHeaders({ error: 'Validation failed.', code: 'VALIDATION_ERROR', details: err.fieldErrors }, 422, cors);
+        }
+        return internalError(err);
+    }
+}
 function normalizeRedirect(redirect) {
     return {
         ...redirect,
@@ -3992,35 +4268,17 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const d = db();
-            const forms = await d.document.findMany({
-                where: { collection: 'forms', deletedAt: null },
-                orderBy: { createdAt: 'desc' },
-            });
-            // Single grouped count is far cheaper than N+1 count() per form once
-            // the dashboard grows past a handful of forms. Fall back to per-form
-            // .count() when the consumer's Prisma client doesn't expose groupBy
-            // (older schemas, custom adapters).
-            let submissionCounts = new Map();
-            if (hasModel(d, 'formSubmission') && forms.length > 0) {
-                const ids = forms.map((f) => f.id);
-                if (typeof d.formSubmission.groupBy === 'function') {
-                    const grouped = await d.formSubmission.groupBy({
-                        by: ['formId'],
-                        where: { formId: { in: ids } },
-                        _count: { _all: true },
-                    });
-                    submissionCounts = new Map(grouped.map((g) => [g.formId, g._count._all]));
-                }
-                else {
-                    for (const id of ids) {
-                        const count = await d.formSubmission.count({ where: { formId: id } });
-                        submissionCounts.set(id, count);
-                    }
-                }
-            }
-            const normalized = forms.map((form) => normalizeFormDocument(form, submissionCounts.get(form.id) ?? 0));
-            return json({ data: normalized });
+            const url = new URL(request.url);
+            const { forms, total, page, pageSize } = await listFormsService(parseFormsQuery(url));
+            // Response is a superset of the typed FormDefinition with legacy aliases
+            // (`submissions`, `fieldCount`) so older admin views keep working while
+            // PR3 migrates them to the typed shape.
+            const data = forms.map((f) => ({
+                ...f,
+                fieldCount: f.fields?.length ?? 0,
+                submissions: f.totalEntries ?? 0,
+            }));
+            return json({ data, total, page, pageSize });
         }
         catch (err) {
             return internalError(err);
@@ -4061,71 +4319,407 @@ export function registerCMSRoutes(router) {
             return internalError(err);
         }
     });
-    router.post('/forms/:id/submit', async (request, params) => {
+    // Public, unauthenticated form schema — what an embedded form needs to render.
+    // CSRF-exempt and CORS-enabled (see handler-factory + formCorsHeaders).
+    router.options('/public/forms/:slug', async (request, params) => {
+        const form = await getFormBySlugService(params.slug).catch(() => null);
+        return new Response(null, {
+            status: 204,
+            headers: formCorsHeaders(request, form?.embedSettings?.allowedDomains),
+        });
+    });
+    router.get('/public/forms/:slug', async (request, params) => {
         try {
-            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
-            if (!(await checkRateLimitAsync(formLimiterGlobal, `form:${clientIp}`))) {
-                return errorResponse('Too many submissions. Please try again later.', 429);
+            const form = await getFormBySlugService(params.slug);
+            if (!form || form.status !== 'active') {
+                return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
             }
-            const formId = params.id;
-            const form = await db().document.findFirst({
-                where: { id: formId, collection: 'forms', deletedAt: null },
+            const cors = formCorsHeaders(request, form.embedSettings?.allowedDomains);
+            const { fields, versionId } = await resolveSubmissionFields(form);
+            const captcha = getCaptchaConfig();
+            const publicForm = buildPublicForm(form, fields, versionId, {
+                captcha: { provider: captcha.provider, siteKey: captcha.siteKey },
             });
-            if (!form) {
-                return errorResponse('Form not found', 404);
+            return jsonWithHeaders({ data: publicForm }, 200, cors);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.options('/public/forms/:slug/submit', async (request, params) => {
+        const form = await getFormBySlugService(params.slug).catch(() => null);
+        return new Response(null, {
+            status: 204,
+            headers: formCorsHeaders(request, form?.embedSettings?.allowedDomains),
+        });
+    });
+    router.post('/public/forms/:slug/submit', async (request, params) => {
+        try {
+            const form = await getFormBySlugService(params.slug);
+            if (!form || form.status !== 'active') {
+                return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
             }
-            const formData = (form.data ?? {});
-            const body = (await request.json());
-            if (!body.fields || typeof body.fields !== 'object') {
-                return errorResponse('Missing or invalid "fields" in request body', 400);
+            return submitToForm(request, form);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // Legacy by-id submission endpoint — same pipeline, kept for existing embeds.
+    router.post('/forms/:id/submit', async (request, params) => {
+        try {
+            const form = await getFormByIdService(params.id);
+            if (!form || form.status !== 'active') {
+                return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
             }
-            const captchaConfig = getCaptchaConfig();
-            if (captchaConfig.provider !== 'none') {
-                const ip = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
-                const captchaResult = await verifyCaptcha(body.captchaToken ?? '', captchaConfig, ip);
-                if (!captchaResult.success) {
-                    return errorResponse('CAPTCHA verification failed. Please try again.', 403);
-                }
+            return submitToForm(request, form);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Forms management routes (admin) — services in ../forms/*.
+    //
+    // Route order matters: the router matches the first registered pattern, and
+    // `:id` is a greedy `[^/]+`. All static `/forms/<word>` GETs are registered
+    // before `/forms/:id` so e.g. `/forms/entries` is not captured as an id.
+    // ---------------------------------------------------------------------------
+    router.get('/forms/stats', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            return json({ data: await getFormStatsService() });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/sidebar-counts', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            return json({ data: await getFormsSidebarCountsService() });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries/counts', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const counts = await getEntryCountsService(parseEntriesQuery(new URL(request.url)));
+            return json({ data: counts });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const result = await getEntryWithSchemaService(params.entryId);
+            if (!result)
+                return errorResponse('Entry not found', 404);
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.patch('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const updated = await updateEntryService(ctx, params.entryId, body);
+            if (!updated)
+                return errorResponse('Entry not found', 404);
+            return json({ data: updated });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            await deleteEntryService(ctx, params.entryId);
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/forms/entries/bulk', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            if (!Array.isArray(body.ids) || body.ids.length === 0) {
+                return errorResponse('"ids" must be a non-empty array', 400);
             }
-            const submission = await db().formSubmission.create({
-                data: {
-                    formId,
-                    data: body.fields,
-                    attribution: body.attribution ?? null,
-                    submittedAt: new Date(),
-                },
-            });
-            (async () => {
-                try {
-                    const config = getActuateConfig();
-                    const hooks = (config?._pluginHooks ?? []);
-                    const formHooks = hooks.filter((h) => h?.event === 'afterCreate:form-submissions');
-                    for (const hook of formHooks) {
-                        await hook.handler({ formId, data: body.fields });
-                    }
-                }
-                catch (hookErr) {
-                    console.error('[cms] Form hook error:', hookErr);
-                }
-            })();
-            const confirmation = formData.confirmation ?? {
-                type: 'message',
-                message: 'Thank you! Your submission has been received.',
-            };
-            const analytics = formData.analytics ?? null;
-            return json({
-                data: {
-                    success: true,
-                    submissionId: submission.id,
-                    confirmation,
-                    analytics,
-                },
-            }, 201);
+            const ctx = buildActionContext(auth.session, db());
+            const count = await bulkUpdateEntriesService(ctx, body.ids, body.patch ?? {});
+            return json({ data: { updated: count } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const result = await listEntriesService(parseEntriesQuery(new URL(request.url)));
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/forms', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body.name !== 'string' || !body.name.trim()) {
+                return errorResponse('"name" is required', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const form = await createFormService(ctx, body);
+            return json({ data: form }, 201);
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const form = await getFormByIdService(params.id);
+            if (!form)
+                return errorResponse('Form not found', 404);
+            return json({ data: form });
         }
         catch (err) {
             return internalError(err);
         }
     });
+    router.patch('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const form = await updateFormService(ctx, params.id, body);
+            return json({ data: form });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.delete('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const url = new URL(request.url);
+            const force = url.searchParams.get('force') === 'true';
+            const ctx = buildActionContext(auth.session, db());
+            await deleteFormService(ctx, params.id, { force });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.post('/forms/:id/duplicate', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            const form = await duplicateFormService(ctx, params.id);
+            return json({ data: form }, 201);
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/schema', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const schema = await getFormSchemaService(params.id);
+            return json({ data: schema });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/schema', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            if (!Array.isArray(body.fields)) {
+                return errorResponse('"fields" must be an array', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const result = await saveFormSchemaService(ctx, params.id, body.fields, body.notes);
+            return json({ data: result });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/notifications', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const settings = await getFormNotificationSettingsService(params.id);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/notifications', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await updateFormNotificationSettingsService(ctx, params.id, body);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    // Lightweight notify toggle used by the forms table switch.
+    router.put('/forms/:id/notify', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await setFormNotifyEnabledService(ctx, params.id, Boolean(body.enabled));
+            return json({ data: { notifyEnabled: settings.enabled } });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/embed', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const settings = await getFormEmbedSettingsService(params.id);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/embed', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await updateFormEmbedSettingsService(ctx, params.id, body);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
     // ---------------------------------------------------------------------------
     // Redirects routes
     // ---------------------------------------------------------------------------
@@ -4438,8 +5032,10 @@ export function registerCMSRoutes(router) {
             }
             const { suggestRedirectTarget } = await import('../redirects/suggest.js');
             // Candidate set: published page/post URLs.
-            const { gatherAuditEntities } = await import('../seo/audit-runner.js');
-            const entities = await gatherAuditEntities(db());
+            const { gatherAuditEntities, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const entities = await gatherAuditEntities(db(), {
+                collectionTypes: frontEndContentCollectionTypes(getActuateConfig()),
+            });
             const candidates = entities.map((e) => ({ url: e.url, title: e.title }));
             const unresolved = await db().redirect404Hit.findMany({ where: { resolvedAt: null } });
             let created = 0;
@@ -5046,60 +5642,13 @@ export function registerCMSRoutes(router) {
             if (!(await checkRateLimitAsync(seoAuditLimiter, scanKey))) {
                 return errorResponse('Too many scans. Please try again later.', 429);
             }
-            const documents = await db().document.findMany({
-                where: { status: 'PUBLISHED', deletedAt: null },
-                select: {
-                    id: true,
-                    title: true,
-                    slug: true,
-                    collection: true,
-                    data: true,
-                    plainText: true,
-                },
-                orderBy: { updatedAt: 'desc' },
-                take: 5000,
-            });
-            const issues = [];
-            for (const doc of documents) {
-                const data = (doc.data ?? {});
-                const problems = [];
-                if (!data.metaTitle && !data.seoTitle)
-                    problems.push('Missing meta title');
-                if (!data.metaDescription && !data.seoDescription)
-                    problems.push('Missing meta description');
-                if (!data.canonical)
-                    problems.push('No canonical URL set');
-                if (!data.schemaType)
-                    problems.push('No Schema.org type');
-                const plainText = (doc.plainText ?? '');
-                if (plainText.length > 0 && plainText.length < 300)
-                    problems.push('Content is too short (< 300 characters)');
-                const content = typeof data.body === 'string'
-                    ? data.body
-                    : typeof data.content === 'string'
-                        ? data.content
-                        : '';
-                if (content) {
-                    const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
-                    const missingAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
-                    if (missingAlt > 0)
-                        problems.push(`${missingAlt} image(s) missing alt text`);
-                    if (!content.includes('<h1') && !content.includes('<h1>'))
-                        problems.push('No H1 heading found in content');
-                }
-                if (problems.length > 0) {
-                    issues.push({
-                        documentId: doc.id,
-                        title: doc.title ?? 'Untitled',
-                        slug: doc.slug ?? '',
-                        problems,
-                    });
-                }
-            }
-            const total = documents.length;
-            const pagesWithIssues = issues.length;
-            const totalProblems = issues.reduce((sum, i) => sum + i.problems.length, 0);
-            return json({ data: { total, pagesWithIssues, totalProblems, issues } });
+            // Scope the scan to configured front-end content collections so structural
+            // (navigation/footer) and benchmark documents are never reported. Shares
+            // the exact scan logic with the cron path via processSeoScan.
+            const { frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const allowedCollections = Object.keys(frontEndContentCollectionTypes(getActuateConfig()));
+            const result = await processSeoScan(db(), { allowedCollections, maxDocuments: 5000 });
+            return json({ data: result });
         }
         catch (err) {
             return internalError(err);
@@ -5152,9 +5701,10 @@ export function registerCMSRoutes(router) {
         };
     }
     async function buildSeoContentRecords() {
-        const { gatherAuditEntities } = await import('../seo/audit-runner.js');
+        const { gatherAuditEntities, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
         const { calculatePageSeoScore } = await import('../seo/score.js');
-        const entities = await gatherAuditEntities(db());
+        const collectionTypes = frontEndContentCollectionTypes(getActuateConfig());
+        const entities = await gatherAuditEntities(db(), { collectionTypes });
         return entities.map((e) => {
             const score = calculatePageSeoScore(e);
             return {
@@ -5232,8 +5782,12 @@ export function registerCMSRoutes(router) {
             }
             const body = (await request.json().catch(() => ({})));
             const scope = body?.scope ?? 'full';
-            const { runAndPersistAudit } = await import('../seo/audit-runner.js');
-            const run = await runAndPersistAudit(db(), { scope, startedById: auth.session.userId });
+            const { runAndPersistAudit, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const run = await runAndPersistAudit(db(), {
+                scope,
+                startedById: auth.session.userId,
+                collectionTypes: frontEndContentCollectionTypes(getActuateConfig()),
+            });
             try {
                 await logEvent({
                     event: 'settings_changed',
@@ -5827,6 +6381,13 @@ export function registerCMSRoutes(router) {
         const excluded = new Set(resolved.seo?.sitemap?.excludeCollections ?? []);
         const out = [];
         for (const [slug, col] of Object.entries(resolved.collections ?? {})) {
+            // Only publicly-rendered content types belong in the sitemap. Structural
+            // / utility collections (navigation menus, footers, tags, templates) have
+            // no `type` and must never produce indexable sitemap URLs.
+            if (col.type !== 'page' && col.type !== 'post')
+                continue;
+            if (col.admin?.hidden)
+                continue;
             if (excluded.has(slug))
                 continue;
             if (col.seo?.excludeFromSitemap)
@@ -5907,6 +6468,12 @@ export function registerCMSRoutes(router) {
             const collection = cfg?.collections?.[rawSlug];
             if (!collection)
                 return errorResponse('Collection not found', 404);
+            // Only publicly-rendered page/post collections are sitemap-eligible —
+            // structural/utility collections (menus, tags, templates) are not.
+            if (collection.type !== 'page' && collection.type !== 'post')
+                return errorResponse('Collection excluded from sitemap', 404);
+            if (collection.admin?.hidden)
+                return errorResponse('Collection excluded from sitemap', 404);
             if (collection.seo?.excludeFromSitemap)
                 return errorResponse('Collection excluded from sitemap', 404);
             const base = siteUrlFromRequest(request, cfg);
@@ -8023,7 +8590,9 @@ export function registerCMSRoutes(router) {
             if (!isAuthorizedCronRequest(request.headers.get('authorization'))) {
                 return errorResponse('Unauthorized', 401);
             }
-            const result = await processSeoScan(db());
+            const { frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const allowedCollections = Object.keys(frontEndContentCollectionTypes(getActuateConfig()));
+            const result = await processSeoScan(db(), { allowedCollections });
             return json({ data: result });
         }
         catch (err) {