@actuate-media/cms-core 0.31.0 → 0.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/__tests__/api/public-forms.test.d.ts +2 -0
- package/dist/__tests__/api/public-forms.test.d.ts.map +1 -0
- package/dist/__tests__/api/public-forms.test.js +125 -0
- package/dist/__tests__/api/public-forms.test.js.map +1 -0
- package/dist/__tests__/forms/spam.test.d.ts +2 -0
- package/dist/__tests__/forms/spam.test.d.ts.map +1 -0
- package/dist/__tests__/forms/spam.test.js +115 -0
- package/dist/__tests__/forms/spam.test.js.map +1 -0
- package/dist/__tests__/forms/submission-files.test.d.ts +2 -0
- package/dist/__tests__/forms/submission-files.test.d.ts.map +1 -0
- package/dist/__tests__/forms/submission-files.test.js +65 -0
- package/dist/__tests__/forms/submission-files.test.js.map +1 -0
- package/dist/__tests__/forms/submission-pipeline.test.d.ts +2 -0
- package/dist/__tests__/forms/submission-pipeline.test.d.ts.map +1 -0
- package/dist/__tests__/forms/submission-pipeline.test.js +131 -0
- package/dist/__tests__/forms/submission-pipeline.test.js.map +1 -0
- package/dist/__tests__/forms/submission-validation.test.d.ts +2 -0
- package/dist/__tests__/forms/submission-validation.test.d.ts.map +1 -0
- package/dist/__tests__/forms/submission-validation.test.js +108 -0
- package/dist/__tests__/forms/submission-validation.test.js.map +1 -0
- package/dist/api/handler-factory.d.ts.map +1 -1
- package/dist/api/handler-factory.js +2 -2
- package/dist/api/handler-factory.js.map +1 -1
- package/dist/api/handlers.d.ts.map +1 -1
- package/dist/api/handlers.js +275 -56
- package/dist/api/handlers.js.map +1 -1
- package/dist/api/router.d.ts +2 -1
- package/dist/api/router.d.ts.map +1 -1
- package/dist/api/router.js +3 -0
- package/dist/api/router.js.map +1 -1
- package/dist/forms/files.d.ts +38 -0
- package/dist/forms/files.d.ts.map +1 -0
- package/dist/forms/files.js +134 -0
- package/dist/forms/files.js.map +1 -0
- package/dist/forms/index.d.ts +4 -0
- package/dist/forms/index.d.ts.map +1 -1
- package/dist/forms/index.js +4 -0
- package/dist/forms/index.js.map +1 -1
- package/dist/forms/spam.d.ts +33 -0
- package/dist/forms/spam.d.ts.map +1 -0
- package/dist/forms/spam.js +93 -0
- package/dist/forms/spam.js.map +1 -0
- package/dist/forms/submission.d.ts +95 -0
- package/dist/forms/submission.d.ts.map +1 -0
- package/dist/forms/submission.js +282 -0
- package/dist/forms/submission.js.map +1 -0
- package/dist/forms/validation.d.ts +19 -0
- package/dist/forms/validation.d.ts.map +1 -0
- package/dist/forms/validation.js +235 -0
- package/dist/forms/validation.js.map +1 -0
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/security/client-ip.d.ts +11 -21
- package/dist/security/client-ip.d.ts.map +1 -1
- package/dist/security/client-ip.js +38 -0
- package/dist/security/client-ip.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"submission-validation.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-validation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAA;AAG1E,SAAS,KAAK,CAAC,SAA6B;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,8BAA8B,CAC3C;YACE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACpC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC7C,KAAK,CAAC;gBACJ,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;oBAC1B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;iBAC3B;aACF,CAAC;SACH,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAChE,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EACjF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,EAAE,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAExB,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE;YACnF,KAAK,EAAE,cAAc;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE;YACvF,GAAG,EAAE,6CAA6C;SACnD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;YACtE,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,EACnF,EAAE,IAAI,EAAE,YAAY,EAAE,CACvB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAC7E,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAAG;YACb,KAAK,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,KAAK,CAAC;gBACJ,GAAG,EAAE,aAAa;gBAClB,QAAQ,EAAE,IAAI;gBACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;aAC3F,CAAC;SACH,CAAA;QACD,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,EAAE;YACpD,UAAU,EAAE,KAAK,CAAC,6BAA6B;SAChD,CAAC,CAAA;QACF,6DAA6D;QAC7D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE7B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3E,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;QAC7F,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAkFA,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5C;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,IAsFtC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmJnE"}
|
|
@@ -47,8 +47,8 @@ function isCsrfExemptPath(pathname) {
|
|
|
47
47
|
(p.endsWith('/') && pathname.startsWith(p)))) {
|
|
48
48
|
return true;
|
|
49
49
|
}
|
|
50
|
-
// Public form submission
|
|
51
|
-
return /^\/forms\/[^/]+\/submit$/.test(pathname);
|
|
50
|
+
// Public form submission endpoints (legacy by-id + slug-based public route).
|
|
51
|
+
return (/^\/forms\/[^/]+\/submit$/.test(pathname) || /^\/public\/forms\/[^/]+\/submit$/.test(pathname));
|
|
52
52
|
}
|
|
53
53
|
/**
|
|
54
54
|
* Detect requests authenticated with an Actuate API key (`act_sk_...`) so we
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"handler-factory.js","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,iBAAiB,GAA0B;IAC/C,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,sBAAsB;IACtB,cAAc;IACd,qBAAqB;IACrB,QAAQ;IACR,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,YAAY;CACb,CAAA;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IACE,iBAAiB,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,QAAQ,KAAK,CAAC;QACd,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC9C,EACD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,
|
|
1
|
+
{"version":3,"file":"handler-factory.js","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,iBAAiB,GAA0B;IAC/C,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,sBAAsB;IACtB,cAAc;IACd,qBAAqB;IACrB,QAAQ;IACR,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,YAAY;CACb,CAAA;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IACE,iBAAiB,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,QAAQ,KAAK,CAAC;QACd,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC9C,EACD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,6EAA6E;IAC7E,OAAO,CACL,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/F,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/C,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,oBAAoB,CAAwB,CAAA;AAQ3F,IAAI,aAAa,GAEN,IAAI,CAAA;AAEf,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IAEvC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,+CAA+C;QAC/C,gBAAgB,CAAC,OAAO,CAAC,MAAe,CAAC,CAAA;QAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAa,CAAA;QACpC,MAAM,KAAK,GAAU,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,CAAC;QAAC,MAAc,CAAC,YAAY,GAAG,KAAK,CAAA;QAErC,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAA;QAChD,IACE,eAAe;YACf,OAAO,eAAe,KAAK,QAAQ;YACnC,OAAQ,eAAuB,CAAC,MAAM,KAAK,UAAU,EACrD,CAAC;YACD,IAAI,CAAC;gBACH,iBAAiB,CAAC,eAAe,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,4DAA4D,EAAE,GAAG,CAAC,CAAA;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAEhC,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;IAE5E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACjC,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAA;QAC5D,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC9D;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAA;gBACzF,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;wBACnE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAEzB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,kEAAkE;QAClE,+DAA+D;QAC/D,kCAAkC;QAClC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAA;YACZ,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;QAC1C,+DAA+D;QAC/D,8DAA8D;QAC9D,gEAAgE;QAChE,IAAI,CAAC;YACH,gBAAgB,CAAC;gBACf,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;aAC1C,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IAED,KAAK,UAAU,UAAU,CAAC,OAAgB;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACvB,MAAM,MAAM,GACV,OAAO,CAAC,YAAY;oBACpB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBAC1E,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,CAAC,CAAA;oBACd,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAA;gBAChB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,OAAO,CAAC,YAAmD,CAAA;oBAC1E,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;wBACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAA;wBACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACvB,OAAO,CAAC,IAAI,CACV,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gCACtE,sEAAsE;gCACtE,+EAA+E,CAClF,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAA;YAEjC,IAAI,YAAY,KAAK,kBAAkB,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;gBACrC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE;wBACxE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;gBAC/B,MAAM,MAAM,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAA;gBAC5D,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;wBAClE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;yBAC9D;qBACF,CAAC,CAAA;gBACJ,CAAC;gBAED,IACE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC3D,CAAC,eAAe,CAAC,OAAO,CAAC,EACzB,CAAC;oBACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;oBACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAA;oBACzF,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;wBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;4BACnE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;gBACjC,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;wBACpE,aAAa,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;oBAC1D,CAAC;oBACD,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAA;YAC5B,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAChE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;gBACtD,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;gBAEhC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE;oBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,oEAAoE;oBACpE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAA;gBAEF,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1D,OAAO,CAAC,KAAK,CAAC,iDAAiD,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;YAEhF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;YACnD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,oBAAoB;gBAC3B,GAAG,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aACzC,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAk/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAkQD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAugUzD"}
|
package/dist/api/handlers.js
CHANGED
|
@@ -23,8 +23,11 @@ import { schedulingCronHandler } from '../scheduling/index.js';
|
|
|
23
23
|
import { isAuthorizedCronRequest, processCleanup, processSeoScan } from '../cron/index.js';
|
|
24
24
|
import { processContentHealthScan } from '../content-health/cron.js';
|
|
25
25
|
import { verifyCaptcha, getCaptchaConfig } from '../security/captcha.js';
|
|
26
|
-
import { listForms as listFormsService, getFormById as getFormByIdService, createForm as createFormService, updateForm as updateFormService, duplicateForm as duplicateFormService, deleteForm as deleteFormService, saveFormSchema as saveFormSchemaService, getFormSchema as getFormSchemaService, getNotificationSettings as getFormNotificationSettingsService, updateNotificationSettings as updateFormNotificationSettingsService, setNotifyEnabled as setFormNotifyEnabledService, getEmbedSettings as getFormEmbedSettingsService, updateEmbedSettings as updateFormEmbedSettingsService, getFormStats as getFormStatsService, getFormsSidebarCounts as getFormsSidebarCountsService, FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../forms/service.js';
|
|
26
|
+
import { listForms as listFormsService, getFormById as getFormByIdService, getFormBySlug as getFormBySlugService, createForm as createFormService, updateForm as updateFormService, duplicateForm as duplicateFormService, deleteForm as deleteFormService, saveFormSchema as saveFormSchemaService, getFormSchema as getFormSchemaService, getNotificationSettings as getFormNotificationSettingsService, updateNotificationSettings as updateFormNotificationSettingsService, setNotifyEnabled as setFormNotifyEnabledService, getEmbedSettings as getFormEmbedSettingsService, updateEmbedSettings as updateFormEmbedSettingsService, getFormStats as getFormStatsService, getFormsSidebarCounts as getFormsSidebarCountsService, FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../forms/service.js';
|
|
27
27
|
import { listEntries as listEntriesService, getEntryWithSchema as getEntryWithSchemaService, getEntryCounts as getEntryCountsService, updateEntry as updateEntryService, bulkUpdateEntries as bulkUpdateEntriesService, deleteEntry as deleteEntryService, } from '../forms/entries.js';
|
|
28
|
+
import { processSubmission, buildPublicForm, SubmissionValidationError, } from '../forms/submission.js';
|
|
29
|
+
import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FILE_BYTES, } from '../forms/files.js';
|
|
30
|
+
import { resolveSubmissionFields } from '../forms/submission.js';
|
|
28
31
|
import { checkForUpdates } from '../upgrade/version-check.js';
|
|
29
32
|
import { createUpgradePR } from '../upgrade/upgrade-pr.js';
|
|
30
33
|
import { encryptField, decryptField } from '../security/encrypted-fields.js';
|
|
@@ -332,6 +335,228 @@ function parseEntriesQuery(url) {
|
|
|
332
335
|
pageSize: sp.get('pageSize') ? Number(sp.get('pageSize')) : undefined,
|
|
333
336
|
};
|
|
334
337
|
}
|
|
338
|
+
// ─── Public form submission helpers ─────────────────────────────────────────
|
|
339
|
+
/**
|
|
340
|
+
* Build CORS headers for the public form endpoints. When the form has no
|
|
341
|
+
* embed allowlist we reflect the requesting origin (open embedding). When an
|
|
342
|
+
* allowlist is set we only echo the origin if it matches, so a disallowed site
|
|
343
|
+
* cannot read the response. Browser-level CORS is complemented by a hard
|
|
344
|
+
* server-side origin check in the submit handler.
|
|
345
|
+
*/
|
|
346
|
+
function formCorsHeaders(request, allowedDomains) {
|
|
347
|
+
const origin = request.headers.get('origin');
|
|
348
|
+
const headers = {
|
|
349
|
+
'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
|
|
350
|
+
'Access-Control-Allow-Headers': 'Content-Type, X-Requested-With',
|
|
351
|
+
'Access-Control-Max-Age': '600',
|
|
352
|
+
Vary: 'Origin',
|
|
353
|
+
};
|
|
354
|
+
if (!allowedDomains || allowedDomains.length === 0) {
|
|
355
|
+
headers['Access-Control-Allow-Origin'] = origin || '*';
|
|
356
|
+
}
|
|
357
|
+
else if (origin && isOriginAllowed(origin, allowedDomains)) {
|
|
358
|
+
headers['Access-Control-Allow-Origin'] = origin;
|
|
359
|
+
}
|
|
360
|
+
return headers;
|
|
361
|
+
}
|
|
362
|
+
function normalizeAllowedHost(domain) {
|
|
363
|
+
return domain
|
|
364
|
+
.trim()
|
|
365
|
+
.toLowerCase()
|
|
366
|
+
.replace(/^https?:\/\//, '')
|
|
367
|
+
.replace(/\/.*$/, '')
|
|
368
|
+
.replace(/^\*\./, '');
|
|
369
|
+
}
|
|
370
|
+
function isOriginAllowed(origin, allowedDomains) {
|
|
371
|
+
let host;
|
|
372
|
+
try {
|
|
373
|
+
host = new URL(origin).hostname.toLowerCase();
|
|
374
|
+
}
|
|
375
|
+
catch {
|
|
376
|
+
return false;
|
|
377
|
+
}
|
|
378
|
+
return allowedDomains
|
|
379
|
+
.map(normalizeAllowedHost)
|
|
380
|
+
.some((a) => a !== '' && (host === a || host.endsWith(`.${a}`)));
|
|
381
|
+
}
|
|
382
|
+
function jsonWithHeaders(data, status, extra) {
|
|
383
|
+
return new Response(JSON.stringify(data), {
|
|
384
|
+
status,
|
|
385
|
+
headers: { ...SECURITY_HEADERS, ...extra },
|
|
386
|
+
});
|
|
387
|
+
}
|
|
388
|
+
/**
|
|
389
|
+
* Parse a public submission request into field values, files, and metadata.
|
|
390
|
+
* Supports both `application/json` (no files) and `multipart/form-data`
|
|
391
|
+
* (files + fields). Unknown/oversized bodies are rejected by the caller's
|
|
392
|
+
* Content-Length gate before this runs.
|
|
393
|
+
*/
|
|
394
|
+
async function parseSubmissionRequest(request) {
|
|
395
|
+
const contentType = request.headers.get('content-type') ?? '';
|
|
396
|
+
if (contentType.includes('multipart/form-data')) {
|
|
397
|
+
const form = await request.formData();
|
|
398
|
+
const values = {};
|
|
399
|
+
const files = [];
|
|
400
|
+
let attribution = null;
|
|
401
|
+
let elapsedMs = null;
|
|
402
|
+
let pageUrl = null;
|
|
403
|
+
let captchaToken = '';
|
|
404
|
+
for (const [key, value] of form.entries()) {
|
|
405
|
+
if (typeof value === 'object' && value !== null && 'arrayBuffer' in value) {
|
|
406
|
+
const file = value;
|
|
407
|
+
if (file.size === 0 && !file.name)
|
|
408
|
+
continue;
|
|
409
|
+
const buffer = Buffer.from(await file.arrayBuffer());
|
|
410
|
+
files.push({
|
|
411
|
+
fieldKey: key,
|
|
412
|
+
fileName: file.name || 'file',
|
|
413
|
+
mimeType: file.type || 'application/octet-stream',
|
|
414
|
+
size: buffer.byteLength,
|
|
415
|
+
buffer,
|
|
416
|
+
});
|
|
417
|
+
continue;
|
|
418
|
+
}
|
|
419
|
+
const str = String(value);
|
|
420
|
+
if (key === '__attribution') {
|
|
421
|
+
attribution = safeJsonObject(str);
|
|
422
|
+
}
|
|
423
|
+
else if (key === '__elapsedMs') {
|
|
424
|
+
const n = Number(str);
|
|
425
|
+
elapsedMs = Number.isFinite(n) ? n : null;
|
|
426
|
+
}
|
|
427
|
+
else if (key === '__pageUrl') {
|
|
428
|
+
pageUrl = str || null;
|
|
429
|
+
}
|
|
430
|
+
else if (key === '__captchaToken' || key === 'captchaToken') {
|
|
431
|
+
captchaToken = str;
|
|
432
|
+
}
|
|
433
|
+
else if (Object.prototype.hasOwnProperty.call(values, key)) {
|
|
434
|
+
// Repeated keys (e.g. multi-checkbox) collapse into an array.
|
|
435
|
+
const existing = values[key];
|
|
436
|
+
values[key] = Array.isArray(existing) ? [...existing, str] : [existing, str];
|
|
437
|
+
}
|
|
438
|
+
else {
|
|
439
|
+
values[key] = str;
|
|
440
|
+
}
|
|
441
|
+
}
|
|
442
|
+
return { values, files, meta: { attribution, elapsedMs, pageUrl, captchaToken } };
|
|
443
|
+
}
|
|
444
|
+
// JSON body.
|
|
445
|
+
const body = (await request.json().catch(() => null));
|
|
446
|
+
if (!body)
|
|
447
|
+
return null;
|
|
448
|
+
const values = body.fields && typeof body.fields === 'object' && !Array.isArray(body.fields)
|
|
449
|
+
? body.fields
|
|
450
|
+
: null;
|
|
451
|
+
if (!values)
|
|
452
|
+
return null;
|
|
453
|
+
return {
|
|
454
|
+
values,
|
|
455
|
+
files: [],
|
|
456
|
+
meta: {
|
|
457
|
+
attribution: safeJsonObject(body.attribution),
|
|
458
|
+
elapsedMs: typeof body.elapsedMs === 'number' && Number.isFinite(body.elapsedMs)
|
|
459
|
+
? body.elapsedMs
|
|
460
|
+
: null,
|
|
461
|
+
pageUrl: typeof body.pageUrl === 'string' ? body.pageUrl : null,
|
|
462
|
+
captchaToken: typeof body.captchaToken === 'string' ? body.captchaToken : '',
|
|
463
|
+
},
|
|
464
|
+
};
|
|
465
|
+
}
|
|
466
|
+
function safeJsonObject(value) {
|
|
467
|
+
if (value && typeof value === 'object' && !Array.isArray(value)) {
|
|
468
|
+
return value;
|
|
469
|
+
}
|
|
470
|
+
if (typeof value === 'string' && value.trim()) {
|
|
471
|
+
try {
|
|
472
|
+
const parsed = JSON.parse(value);
|
|
473
|
+
if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
|
|
474
|
+
return parsed;
|
|
475
|
+
}
|
|
476
|
+
}
|
|
477
|
+
catch {
|
|
478
|
+
/* ignore malformed attribution blob */
|
|
479
|
+
}
|
|
480
|
+
}
|
|
481
|
+
return null;
|
|
482
|
+
}
|
|
483
|
+
/**
|
|
484
|
+
* Shared public-submission handler used by both the slug-based public route and
|
|
485
|
+
* the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
|
|
486
|
+
* allowlisting, optional CAPTCHA, file validation, then runs the core
|
|
487
|
+
* submission pipeline. Always responds with CORS headers so embedded forms can
|
|
488
|
+
* read the result.
|
|
489
|
+
*/
|
|
490
|
+
async function submitToForm(request, form) {
|
|
491
|
+
const allowedDomains = form.embedSettings?.allowedDomains;
|
|
492
|
+
const cors = formCorsHeaders(request, allowedDomains);
|
|
493
|
+
const ip = getClientIp(request);
|
|
494
|
+
const rlKey = isResolvedIp(ip) ? `formsubmit:${ip}:${form.id}` : `formsubmit:_unknown:${form.id}`;
|
|
495
|
+
if (!(await checkRateLimitAsync(formLimiterGlobal, rlKey))) {
|
|
496
|
+
return jsonWithHeaders({ error: 'Too many submissions. Please try again later.' }, 429, cors);
|
|
497
|
+
}
|
|
498
|
+
// Hard server-side origin check when an embed allowlist is configured —
|
|
499
|
+
// browser CORS alone does not prevent a non-browser client from posting.
|
|
500
|
+
if (allowedDomains && allowedDomains.length > 0) {
|
|
501
|
+
const origin = request.headers.get('origin');
|
|
502
|
+
if (origin && !isOriginAllowed(origin, allowedDomains)) {
|
|
503
|
+
return jsonWithHeaders({ error: 'This form cannot be submitted from this origin.' }, 403, cors);
|
|
504
|
+
}
|
|
505
|
+
}
|
|
506
|
+
const parsed = await parseSubmissionRequest(request);
|
|
507
|
+
if (!parsed) {
|
|
508
|
+
return jsonWithHeaders({ error: 'Invalid or missing submission body.' }, 400, cors);
|
|
509
|
+
}
|
|
510
|
+
const captchaConfig = getCaptchaConfig();
|
|
511
|
+
if (captchaConfig.provider !== 'none') {
|
|
512
|
+
const result = await verifyCaptcha(parsed.meta.captchaToken, captchaConfig, isResolvedIp(ip) ? ip : undefined);
|
|
513
|
+
if (!result.success) {
|
|
514
|
+
return jsonWithHeaders({ error: 'CAPTCHA verification failed. Please try again.' }, 403, cors);
|
|
515
|
+
}
|
|
516
|
+
}
|
|
517
|
+
if (parsed.files.length > 0) {
|
|
518
|
+
const fileCfg = getActuateConfig()?.forms?.fileUpload;
|
|
519
|
+
if (fileCfg?.enabled === false) {
|
|
520
|
+
return jsonWithHeaders({ error: 'File uploads are not enabled for this site.' }, 400, cors);
|
|
521
|
+
}
|
|
522
|
+
const { fields } = await resolveSubmissionFields(form);
|
|
523
|
+
const fileCheck = validateSubmissionFiles(fields, parsed.files, {
|
|
524
|
+
maxSizeBytes: fileCfg?.maxSizeMB ? fileCfg.maxSizeMB * 1024 * 1024 : DEFAULT_MAX_FILE_BYTES,
|
|
525
|
+
allowedMimeTypes: fileCfg?.allowedMimeTypes ?? FORM_UPLOAD_ALLOWED_MIME_TYPES,
|
|
526
|
+
});
|
|
527
|
+
if (!fileCheck.ok) {
|
|
528
|
+
return jsonWithHeaders({ error: 'File validation failed.', code: 'INVALID_FILES', details: fileCheck.errors }, 422, cors);
|
|
529
|
+
}
|
|
530
|
+
}
|
|
531
|
+
const ctx = {
|
|
532
|
+
values: parsed.values,
|
|
533
|
+
files: parsed.files,
|
|
534
|
+
ip,
|
|
535
|
+
userAgent: request.headers.get('user-agent'),
|
|
536
|
+
referrer: request.headers.get('referer'),
|
|
537
|
+
origin: request.headers.get('origin'),
|
|
538
|
+
pageUrl: parsed.meta.pageUrl,
|
|
539
|
+
attribution: parsed.meta.attribution,
|
|
540
|
+
elapsedMs: parsed.meta.elapsedMs,
|
|
541
|
+
};
|
|
542
|
+
try {
|
|
543
|
+
const result = await processSubmission(form, ctx);
|
|
544
|
+
return jsonWithHeaders({
|
|
545
|
+
data: {
|
|
546
|
+
success: true,
|
|
547
|
+
submissionId: result.submissionId,
|
|
548
|
+
entryNumber: result.entryNumber,
|
|
549
|
+
confirmation: result.confirmation,
|
|
550
|
+
},
|
|
551
|
+
}, 201, cors);
|
|
552
|
+
}
|
|
553
|
+
catch (err) {
|
|
554
|
+
if (err instanceof SubmissionValidationError) {
|
|
555
|
+
return jsonWithHeaders({ error: 'Validation failed.', code: 'VALIDATION_ERROR', details: err.fieldErrors }, 422, cors);
|
|
556
|
+
}
|
|
557
|
+
return internalError(err);
|
|
558
|
+
}
|
|
559
|
+
}
|
|
335
560
|
function normalizeRedirect(redirect) {
|
|
336
561
|
return {
|
|
337
562
|
...redirect,
|
|
@@ -4094,66 +4319,60 @@ export function registerCMSRoutes(router) {
|
|
|
4094
4319
|
return internalError(err);
|
|
4095
4320
|
}
|
|
4096
4321
|
});
|
|
4097
|
-
|
|
4322
|
+
// Public, unauthenticated form schema — what an embedded form needs to render.
|
|
4323
|
+
// CSRF-exempt and CORS-enabled (see handler-factory + formCorsHeaders).
|
|
4324
|
+
router.options('/public/forms/:slug', async (request, params) => {
|
|
4325
|
+
const form = await getFormBySlugService(params.slug).catch(() => null);
|
|
4326
|
+
return new Response(null, {
|
|
4327
|
+
status: 204,
|
|
4328
|
+
headers: formCorsHeaders(request, form?.embedSettings?.allowedDomains),
|
|
4329
|
+
});
|
|
4330
|
+
});
|
|
4331
|
+
router.get('/public/forms/:slug', async (request, params) => {
|
|
4098
4332
|
try {
|
|
4099
|
-
const
|
|
4100
|
-
if (!
|
|
4101
|
-
return
|
|
4333
|
+
const form = await getFormBySlugService(params.slug);
|
|
4334
|
+
if (!form || form.status !== 'active') {
|
|
4335
|
+
return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
|
|
4102
4336
|
}
|
|
4103
|
-
const
|
|
4104
|
-
const
|
|
4105
|
-
|
|
4337
|
+
const cors = formCorsHeaders(request, form.embedSettings?.allowedDomains);
|
|
4338
|
+
const { fields, versionId } = await resolveSubmissionFields(form);
|
|
4339
|
+
const captcha = getCaptchaConfig();
|
|
4340
|
+
const publicForm = buildPublicForm(form, fields, versionId, {
|
|
4341
|
+
captcha: { provider: captcha.provider, siteKey: captcha.siteKey },
|
|
4106
4342
|
});
|
|
4107
|
-
|
|
4108
|
-
|
|
4109
|
-
|
|
4110
|
-
|
|
4111
|
-
|
|
4112
|
-
|
|
4113
|
-
|
|
4343
|
+
return jsonWithHeaders({ data: publicForm }, 200, cors);
|
|
4344
|
+
}
|
|
4345
|
+
catch (err) {
|
|
4346
|
+
return internalError(err);
|
|
4347
|
+
}
|
|
4348
|
+
});
|
|
4349
|
+
router.options('/public/forms/:slug/submit', async (request, params) => {
|
|
4350
|
+
const form = await getFormBySlugService(params.slug).catch(() => null);
|
|
4351
|
+
return new Response(null, {
|
|
4352
|
+
status: 204,
|
|
4353
|
+
headers: formCorsHeaders(request, form?.embedSettings?.allowedDomains),
|
|
4354
|
+
});
|
|
4355
|
+
});
|
|
4356
|
+
router.post('/public/forms/:slug/submit', async (request, params) => {
|
|
4357
|
+
try {
|
|
4358
|
+
const form = await getFormBySlugService(params.slug);
|
|
4359
|
+
if (!form || form.status !== 'active') {
|
|
4360
|
+
return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
|
|
4114
4361
|
}
|
|
4115
|
-
|
|
4116
|
-
|
|
4117
|
-
|
|
4118
|
-
|
|
4119
|
-
|
|
4120
|
-
|
|
4121
|
-
|
|
4362
|
+
return submitToForm(request, form);
|
|
4363
|
+
}
|
|
4364
|
+
catch (err) {
|
|
4365
|
+
return internalError(err);
|
|
4366
|
+
}
|
|
4367
|
+
});
|
|
4368
|
+
// Legacy by-id submission endpoint — same pipeline, kept for existing embeds.
|
|
4369
|
+
router.post('/forms/:id/submit', async (request, params) => {
|
|
4370
|
+
try {
|
|
4371
|
+
const form = await getFormByIdService(params.id);
|
|
4372
|
+
if (!form || form.status !== 'active') {
|
|
4373
|
+
return jsonWithHeaders({ error: 'Form not found' }, 404, formCorsHeaders(request));
|
|
4122
4374
|
}
|
|
4123
|
-
|
|
4124
|
-
data: {
|
|
4125
|
-
formId,
|
|
4126
|
-
data: body.fields,
|
|
4127
|
-
attribution: body.attribution ?? null,
|
|
4128
|
-
submittedAt: new Date(),
|
|
4129
|
-
},
|
|
4130
|
-
});
|
|
4131
|
-
(async () => {
|
|
4132
|
-
try {
|
|
4133
|
-
const config = getActuateConfig();
|
|
4134
|
-
const hooks = (config?._pluginHooks ?? []);
|
|
4135
|
-
const formHooks = hooks.filter((h) => h?.event === 'afterCreate:form-submissions');
|
|
4136
|
-
for (const hook of formHooks) {
|
|
4137
|
-
await hook.handler({ formId, data: body.fields });
|
|
4138
|
-
}
|
|
4139
|
-
}
|
|
4140
|
-
catch (hookErr) {
|
|
4141
|
-
console.error('[cms] Form hook error:', hookErr);
|
|
4142
|
-
}
|
|
4143
|
-
})();
|
|
4144
|
-
const confirmation = formData.confirmation ?? {
|
|
4145
|
-
type: 'message',
|
|
4146
|
-
message: 'Thank you! Your submission has been received.',
|
|
4147
|
-
};
|
|
4148
|
-
const analytics = formData.analytics ?? null;
|
|
4149
|
-
return json({
|
|
4150
|
-
data: {
|
|
4151
|
-
success: true,
|
|
4152
|
-
submissionId: submission.id,
|
|
4153
|
-
confirmation,
|
|
4154
|
-
analytics,
|
|
4155
|
-
},
|
|
4156
|
-
}, 201);
|
|
4375
|
+
return submitToForm(request, form);
|
|
4157
4376
|
}
|
|
4158
4377
|
catch (err) {
|
|
4159
4378
|
return internalError(err);
|