@actuate-media/cms-core 0.31.0 → 0.33.0

package/dist/__tests__/forms/submission-files.test.js

@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest';
+import { validateSubmissionFiles } from '../../forms/files.js';
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d]);
+const PDF = Buffer.from('%PDF-1.4\n%âãÏÓ\n', 'latin1');
+function fileField(overrides) {
+    return {
+        id: 'f',
+        label: 'Attachment',
+        key: 'attachment',
+        type: 'file',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+function incoming(overrides) {
+    return {
+        fieldKey: 'attachment',
+        fileName: 'photo.png',
+        mimeType: 'image/png',
+        size: PNG.byteLength,
+        buffer: PNG,
+        ...overrides,
+    };
+}
+describe('validateSubmissionFiles', () => {
+    it('accepts a valid PNG against a file field', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({})]);
+        expect(result.ok).toBe(true);
+        expect(result.errors).toHaveLength(0);
+    });
+    it('rejects files larger than the size cap', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({ size: 999_999_999 })], {
+            maxSizeBytes: 1024,
+        });
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.fieldKey).toBe('attachment');
+    });
+    it('rejects disallowed MIME types', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({ mimeType: 'application/zip', fileName: 'x.zip', buffer: PNG })]);
+        expect(result.ok).toBe(false);
+    });
+    it('rejects content that does not match the declared MIME (magic-byte sniff)', () => {
+        const result = validateSubmissionFiles([fileField({})], [
+            incoming({
+                mimeType: 'image/png',
+                fileName: 'fake.png',
+                buffer: PDF,
+                size: PDF.byteLength,
+            }),
+        ]);
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.message).toMatch(/do not match/i);
+    });
+    it('rejects a file uploaded to a non-file field', () => {
+        const result = validateSubmissionFiles([{ id: 't', label: 'Name', key: 'name', type: 'text', required: false, sortOrder: 0 }], [incoming({ fieldKey: 'name' })]);
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.message).toMatch(/unexpected/i);
+    });
+    it('honours per-field fileTypes to narrow the allowlist', () => {
+        const result = validateSubmissionFiles([fileField({ validationRules: { fileTypes: ['application/pdf'] } })], [incoming({})]);
+        expect(result.ok).toBe(false);
+    });
+});
+//# sourceMappingURL=submission-files.test.js.map

package/dist/__tests__/forms/submission-files.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-files.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-files.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,uBAAuB,EAAqB,MAAM,sBAAsB,CAAA;AAGjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAA;AAEtD,SAAS,SAAS,CAAC,SAA6B;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,YAAY;QACnB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAAgC;IAChD,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG;QACX,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE;YACzF,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EACf,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAC5E,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EACf;YACE,QAAQ,CAAC;gBACP,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,GAAG,CAAC,UAAU;aACrB,CAAC;SACH,CACF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EACtF,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CACjC,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC,EACpE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CACf,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/submission-pipeline.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=submission-pipeline.test.d.ts.map

package/dist/__tests__/forms/submission-pipeline.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-pipeline.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-pipeline.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/submission-pipeline.test.js

@@ -0,0 +1,131 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+const dbHolder = { current: {} };
+vi.mock('../../db.js', () => ({ getDB: () => dbHolder.current }));
+vi.mock('../../security/audit.js', () => ({ logEvent: vi.fn(async () => { }) }));
+vi.mock('../../config/runtime.js', () => ({
+    getActuateConfig: () => ({ forms: { defaultSuccessMessage: 'Thanks!' } }),
+}));
+import { processSubmission, buildPublicForm, SubmissionValidationError, } from '../../forms/submission.js';
+function field(overrides) {
+    return {
+        id: 'f',
+        label: 'Label',
+        key: 'key',
+        type: 'text',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+function form(overrides = {}) {
+    return {
+        id: 'form_1',
+        name: 'Contact Us',
+        slug: 'contact-us',
+        status: 'active',
+        activeSchemaVersionId: null,
+        fields: [
+            field({ key: 'name', type: 'text', required: true }),
+            field({ key: 'email', type: 'email', required: true }),
+            field({ key: 'message', type: 'textarea' }),
+        ],
+        successMessage: 'Got it!',
+        ...overrides,
+    };
+}
+function fakeDb() {
+    const created = [];
+    return {
+        created,
+        $transaction: async (fn) => fn({
+            formSubmission: {
+                aggregate: async () => ({ _max: { entryNumber: 4 } }),
+                create: async ({ data }) => {
+                    created.push(data);
+                    return { id: 'sub_1', entryNumber: data.entryNumber };
+                },
+            },
+        }),
+    };
+}
+describe('processSubmission', () => {
+    beforeEach(() => {
+        dbHolder.current = fakeDb();
+    });
+    it('persists a clean submission with the next entry number and derived sender', async () => {
+        const result = await processSubmission(form(), {
+            values: { name: 'Ada Lovelace', email: 'ada@calc.io', message: 'Hello there' },
+            ip: '203.0.113.5',
+            userAgent: 'jest',
+            attribution: { source: 'google', medium: 'cpc', campaign: 'spring' },
+        });
+        expect(result.spamStatus).toBe('clean');
+        expect(result.entryNumber).toBe(5);
+        expect(result.confirmation).toEqual({ type: 'message', message: 'Got it!' });
+        const row = dbHolder.current.created[0];
+        expect(row.senderName).toBe('Ada Lovelace');
+        expect(row.senderEmail).toBe('ada@calc.io');
+        expect(row.spamStatus).toBe('clean');
+        expect(row.utmSource).toBe('google');
+        expect(row.utmCampaign).toBe('spring');
+        // IP is hashed, never stored raw.
+        expect(row.ipAddressHash).toBeTruthy();
+        expect(row.ipAddressHash).not.toContain('203.0.113.5');
+    });
+    it('marks a honeypot-tripped submission as spam but still persists it', async () => {
+        const result = await processSubmission(form({ fields: [...form().fields, field({ key: 'company', type: 'honeypot' })] }), {
+            values: { name: 'Bot', email: 'bot@spam.io', company: 'filled-by-bot' },
+        });
+        expect(result.spamStatus).toBe('spam');
+        expect(dbHolder.current.created[0].spamStatus).toBe('spam');
+    });
+    it('throws SubmissionValidationError on invalid input', async () => {
+        await expect(processSubmission(form(), { values: { name: '', email: 'nope' } })).rejects.toBeInstanceOf(SubmissionValidationError);
+    });
+    it('builds a redirect confirmation when the form has a redirect URL', async () => {
+        const result = await processSubmission(form({ redirectUrl: 'https://site.com/thanks' }), {
+            values: { name: 'Ada', email: 'ada@calc.io' },
+        });
+        expect(result.confirmation).toEqual({
+            type: 'redirect',
+            redirectUrl: 'https://site.com/thanks',
+        });
+    });
+});
+describe('buildPublicForm', () => {
+    it('projects a safe, embeddable schema', () => {
+        const f = form({
+            fields: [
+                field({
+                    key: 'name',
+                    type: 'text',
+                    validationRules: { required: true, customValidator: 'secretHook' },
+                }),
+                field({ key: 'hp', type: 'honeypot' }),
+            ],
+            spamSettings: { honeypotFieldKey: 'hp', minSubmitSeconds: 3, blockedEmails: ['x@y.com'] },
+        });
+        const publicForm = buildPublicForm(f, f.fields, null, {
+            captcha: { provider: 'turnstile', siteKey: 'site-123' },
+        });
+        // Honeypot field is never exposed.
+        expect(publicForm.fields.find((field) => field.key === 'hp')).toBeUndefined();
+        // Server-only validator name is stripped.
+        expect(publicForm.fields[0]?.validationRules).not.toHaveProperty('customValidator');
+        // Spam internals limited to render-time hints; blocklist never leaks.
+        expect(publicForm.spam.honeypotFieldKey).toBe('hp');
+        expect(publicForm.spam.minSubmitSeconds).toBe(3);
+        expect(JSON.stringify(publicForm)).not.toContain('x@y.com');
+        // Submit path + captcha hint exposed.
+        expect(publicForm.submitPath).toBe('/api/cms/public/forms/contact-us/submit');
+        expect(publicForm.captcha).toEqual({ provider: 'turnstile', siteKey: 'site-123' });
+    });
+    it('omits the captcha hint when no provider is configured', () => {
+        const f = form();
+        const publicForm = buildPublicForm(f, f.fields, null, {
+            captcha: { provider: 'none', siteKey: '' },
+        });
+        expect(publicForm.captcha).toBeUndefined();
+    });
+});
+//# sourceMappingURL=submission-pipeline.test.js.map

package/dist/__tests__/forms/submission-pipeline.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-pipeline.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-pipeline.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,MAAM,QAAQ,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACjE,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/E,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,EAAE,CAAC;CAC1E,CAAC,CAAC,CAAA;AAEH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAGlC,SAAS,KAAK,CAAC,SAA6B;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CAAC,YAAqC,EAAE;IACnD,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,qBAAqB,EAAE,IAAI;QAC3B,MAAM,EAAE;YACN,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpD,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACtD,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SAC5C;QACD,cAAc,EAAE,SAAS;QACzB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAU,EAAE,CAAA;IACzB,OAAO;QACL,OAAO;QACP,YAAY,EAAE,KAAK,EAAE,EAAO,EAAE,EAAE,CAC9B,EAAE,CAAC;YACD,cAAc,EAAE;gBACd,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;oBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAClB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;gBACvD,CAAC;aACF;SACF,CAAC;KACL,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,CAAC,OAAO,GAAG,MAAM,EAAE,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE;YAC9E,EAAE,EAAE,aAAa;YACjB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,kCAAkC;QAClC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EACjF;YACE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE;SACxE,CACF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,MAAM,CACV,iBAAiB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EAAE;YACvF,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YAClC,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,yBAAyB;SACvC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC;YACb,MAAM,EAAE;gBACN,KAAK,CAAC;oBACJ,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,MAAM;oBACZ,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE;iBACnE,CAAC;gBACF,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aACvC;YACD,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE;SAC1F,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE;YACpD,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;SACxD,CAAC,CAAA;QAEF,mCAAmC;QACnC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC7E,0CAA0C;QAC1C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;QACnF,sEAAsE;QACtE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC3D,sCAAsC;QACtC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC7E,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;QAChB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE;YACpD,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;SAC3C,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/submission-validation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=submission-validation.test.d.ts.map

package/dist/__tests__/forms/submission-validation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-validation.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-validation.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/submission-validation.test.js

@@ -0,0 +1,108 @@
+import { describe, expect, it } from 'vitest';
+import { validateAndNormalizeSubmission } from '../../forms/validation.js';
+function field(overrides) {
+    return {
+        id: 'f',
+        label: 'Label',
+        key: 'key',
+        type: 'text',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+describe('validateAndNormalizeSubmission', () => {
+    it('accepts a valid payload and coerces types', () => {
+        const result = validateAndNormalizeSubmission([
+            field({ key: 'name', type: 'text' }),
+            field({ key: 'age', type: 'number' }),
+            field({ key: 'subscribe', type: 'checkbox' }),
+            field({
+                key: 'topics',
+                type: 'multiselect',
+                options: [
+                    { label: 'A', value: 'a' },
+                    { label: 'B', value: 'b' },
+                ],
+            }),
+        ], { name: 'Ada', age: '42', subscribe: 'on', topics: ['a', 'b'] });
+        expect(result.ok).toBe(true);
+        expect(result.normalized.age).toBe(42);
+        expect(result.normalized.subscribe).toBe(true);
+        expect(result.normalized.topics).toEqual(['a', 'b']);
+        expect(result.data.name).toBe('Ada');
+    });
+    it('flags required fields that are missing or blank', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'name', required: true }), field({ key: 'note', required: false })], { name: '   ' });
+        expect(result.ok).toBe(false);
+        expect(result.errors.some((e) => e.key === 'name')).toBe(true);
+    });
+    it('validates email format for email-typed fields', () => {
+        const ok = validateAndNormalizeSubmission([field({ key: 'email', type: 'email' })], {
+            email: 'a@b.co',
+        });
+        expect(ok.ok).toBe(true);
+        const bad = validateAndNormalizeSubmission([field({ key: 'email', type: 'email' })], {
+            email: 'not-an-email',
+        });
+        expect(bad.ok).toBe(false);
+        expect(bad.errors[0]?.key).toBe('email');
+    });
+    it('strips HTML from string values to prevent stored XSS', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'msg', type: 'textarea' })], {
+            msg: '<script>alert(1)</script>Hello <b>there</b>',
+        });
+        expect(result.ok).toBe(true);
+        const stored = String(result.data.msg);
+        expect(stored).not.toContain('<script');
+        expect(stored).not.toContain('alert(1)');
+        expect(stored).toContain('Hello');
+    });
+    it('drops keys that are not part of the schema', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'name' })], {
+            name: 'Ada',
+            injected: 'evil',
+        });
+        expect(result.data).toHaveProperty('name');
+        expect(result.data).not.toHaveProperty('injected');
+    });
+    it('rejects select values outside the option set', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'plan', type: 'select', options: [{ label: 'Pro', value: 'pro' }] })], { plan: 'enterprise' });
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.key).toBe('plan');
+    });
+    it('enforces number min/max', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'qty', type: 'number', validationRules: { min: 1, max: 10 } })], { qty: '20' });
+        expect(result.ok).toBe(false);
+    });
+    it('requires consent fields to be accepted', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'terms', type: 'consent', required: true })], { terms: 'false' });
+        expect(result.ok).toBe(false);
+    });
+    it('skips fields hidden by conditional logic (not required, not stored)', () => {
+        const fields = [
+            field({ key: 'hasCompany', type: 'select', options: [{ label: 'Yes', value: 'yes' }] }),
+            field({
+                key: 'companyName',
+                required: true,
+                conditionalLogic: { show: [{ fieldKey: 'hasCompany', operator: 'equals', value: 'yes' }] },
+            }),
+        ];
+        const hidden = validateAndNormalizeSubmission(fields, {
+            hasCompany: 'yes' /* companyName not visible */,
+        });
+        // hasCompany=yes makes companyName visible -> required error
+        expect(hidden.ok).toBe(false);
+        const notShown = validateAndNormalizeSubmission(fields, { hasCompany: '' });
+        expect(notShown.ok).toBe(true);
+        expect(notShown.data).not.toHaveProperty('companyName');
+    });
+    it('requires a file field only when no file is attached', () => {
+        const fields = [field({ key: 'resume', type: 'file', required: true })];
+        const missing = validateAndNormalizeSubmission(fields, {});
+        expect(missing.ok).toBe(false);
+        const present = validateAndNormalizeSubmission(fields, {}, { fileKeys: new Set(['resume']) });
+        expect(present.ok).toBe(true);
+    });
+});
+//# sourceMappingURL=submission-validation.test.js.map

package/dist/__tests__/forms/submission-validation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-validation.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-validation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAA;AAG1E,SAAS,KAAK,CAAC,SAA6B;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,8BAA8B,CAC3C;YACE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACpC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC7C,KAAK,CAAC;gBACJ,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;oBAC1B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;iBAC3B;aACF,CAAC;SACH,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAChE,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EACjF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,EAAE,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAExB,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE;YACnF,KAAK,EAAE,cAAc;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE;YACvF,GAAG,EAAE,6CAA6C;SACnD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;YACtE,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,EACnF,EAAE,IAAI,EAAE,YAAY,EAAE,CACvB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAC7E,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAAG;YACb,KAAK,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvF,KAAK,CAAC;gBACJ,GAAG,EAAE,aAAa;gBAClB,QAAQ,EAAE,IAAI;gBACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;aAC3F,CAAC;SACH,CAAA;QACD,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,EAAE;YACpD,UAAU,EAAE,KAAK,CAAC,6BAA6B;SAChD,CAAC,CAAA;QACF,6DAA6D;QAC7D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE7B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3E,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE9B,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;QAC7F,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/webhooks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhooks.test.d.ts.map

package/dist/__tests__/forms/webhooks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/webhooks.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/webhooks.test.js

@@ -0,0 +1,203 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+const dbHolder = { current: {} };
+vi.mock('../../db.js', () => ({ getDB: () => dbHolder.current }));
+vi.mock('../../security/audit.js', () => ({ logEvent: vi.fn(async () => { }) }));
+// Identity secret storage so the "encrypted" value equals the plaintext in tests.
+vi.mock('../../security/secret-storage.js', () => ({
+    encryptSecret: async (s) => s,
+    decryptSecret: async (s) => s,
+}));
+const { SsrfBlockedError, safeFetchMock } = vi.hoisted(() => {
+    class SsrfBlockedError extends Error {
+    }
+    return { SsrfBlockedError, safeFetchMock: vi.fn() };
+});
+vi.mock('../../security/safe-fetch.js', () => ({
+    safeFetch: (...args) => safeFetchMock(...args),
+    SsrfBlockedError,
+}));
+import { createFormWebhook, listFormWebhooks, updateFormWebhook, deleteFormWebhook, dispatchFormWebhooks, testFormWebhook, FormWebhookError, } from '../../forms/webhooks.js';
+import { signPayload } from '../../webhooks/index.js';
+const ctx = { userId: 'u1', role: 'admin', locale: 'en', db: {} };
+function fakeDb() {
+    const rows = [];
+    return {
+        rows,
+        formWebhook: {
+            create: async ({ data }) => {
+                const row = {
+                    id: `wh_${rows.length + 1}`,
+                    createdAt: new Date(),
+                    updatedAt: new Date(),
+                    lastDeliveryAt: null,
+                    lastDeliveryStatus: null,
+                    ...data,
+                };
+                rows.push(row);
+                return row;
+            },
+            findMany: async ({ where }) => rows.filter((r) => r.formId === where.formId &&
+                (where.enabled === undefined || r.enabled === where.enabled)),
+            findUnique: async ({ where }) => rows.find((r) => r.id === where.id) ?? null,
+            update: async ({ where, data }) => {
+                const r = rows.find((x) => x.id === where.id);
+                Object.assign(r, data);
+                return r;
+            },
+            delete: async ({ where }) => {
+                const i = rows.findIndex((x) => x.id === where.id);
+                rows.splice(i, 1);
+                return {};
+            },
+        },
+    };
+}
+function httpResponse(status) {
+    return { ok: status >= 200 && status < 300, status, text: async () => '' };
+}
+beforeEach(() => {
+    dbHolder.current = fakeDb();
+    safeFetchMock.mockReset();
+});
+describe('form webhook CRUD', () => {
+    it('creates a webhook, auto-generates a signing secret, and returns it once', async () => {
+        const wh = await createFormWebhook(ctx, 'form_1', { url: 'https://hooks.example.com/x' });
+        expect(wh.secret).toMatch(/^whsec_/);
+        expect(wh.events).toEqual(['form.submitted']);
+        expect(wh.enabled).toBe(true);
+    });
+    it('masks the secret in list responses', async () => {
+        await createFormWebhook(ctx, 'form_1', { url: 'https://hooks.example.com/x', secret: 's3cret' });
+        const list = await listFormWebhooks('form_1');
+        expect(list).toHaveLength(1);
+        expect(list[0].secret).toBeUndefined();
+    });
+    it('rejects SSRF / private webhook URLs', async () => {
+        await expect(createFormWebhook(ctx, 'form_1', { url: 'http://localhost:3000/hook' })).rejects.toBeInstanceOf(FormWebhookError);
+        await expect(createFormWebhook(ctx, 'form_1', { url: 'http://169.254.169.254/latest' })).rejects.toBeInstanceOf(FormWebhookError);
+    });
+    it('clamps retryCount and normalizes events on update', async () => {
+        const wh = await createFormWebhook(ctx, 'form_1', { url: 'https://hooks.example.com/x' });
+        const updated = await updateFormWebhook(ctx, wh.id, {
+            retryCount: 99,
+            events: ['form.submitted', 'bogus'],
+        });
+        expect(updated.retryCount).toBe(10);
+        expect(updated.events).toEqual(['form.submitted']);
+    });
+    it('deletes a webhook', async () => {
+        const wh = await createFormWebhook(ctx, 'form_1', { url: 'https://hooks.example.com/x' });
+        await deleteFormWebhook(ctx, wh.id);
+        expect(await listFormWebhooks('form_1')).toHaveLength(0);
+    });
+});
+describe('dispatchFormWebhooks', () => {
+    it('delivers a signed payload to matching enabled webhooks', async () => {
+        safeFetchMock.mockResolvedValue(httpResponse(200));
+        await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            secret: 'shh',
+            events: ['form.submitted'],
+        });
+        const res = await dispatchFormWebhooks('form_1', {
+            event: 'form.submitted',
+            formId: 'form_1',
+            submissionId: 'sub_1',
+            data: { name: 'Ada' },
+        });
+        expect(res).toEqual({ matched: 1, delivered: 1 });
+        expect(safeFetchMock).toHaveBeenCalledTimes(1);
+        const [url, opts] = safeFetchMock.mock.calls[0];
+        expect(url).toBe('https://hooks.example.com/x');
+        const expectedSig = await signPayload(opts.body, 'shh');
+        expect(opts.headers['X-Actuate-Signature']).toBe(expectedSig);
+        expect(opts.headers['X-Actuate-Event']).toBe('form.submitted');
+        expect(dbHolder.current.rows[0].lastDeliveryStatus).toBe('success');
+    });
+    it('ignores webhooks not subscribed to the event', async () => {
+        safeFetchMock.mockResolvedValue(httpResponse(200));
+        await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            events: ['form.entry.starred'],
+        });
+        const res = await dispatchFormWebhooks('form_1', {
+            event: 'form.submitted',
+            formId: 'form_1',
+        });
+        expect(res.matched).toBe(0);
+        expect(safeFetchMock).not.toHaveBeenCalled();
+    });
+    it('does not deliver to disabled webhooks', async () => {
+        safeFetchMock.mockResolvedValue(httpResponse(200));
+        await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            enabled: false,
+        });
+        const res = await dispatchFormWebhooks('form_1', { event: 'form.submitted', formId: 'form_1' });
+        expect(res.matched).toBe(0);
+    });
+    it('stops retrying on a 4xx response', async () => {
+        safeFetchMock.mockResolvedValue(httpResponse(400));
+        await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            retryCount: 3,
+        });
+        const res = await dispatchFormWebhooks('form_1', { event: 'form.submitted', formId: 'form_1' });
+        expect(res.delivered).toBe(0);
+        expect(safeFetchMock).toHaveBeenCalledTimes(1);
+        expect(dbHolder.current.rows[0].lastDeliveryStatus).toContain('failed');
+    });
+    it('retries on a 5xx response and succeeds with backoff', async () => {
+        // Fire backoff timers immediately so the test doesn't wait real seconds.
+        const timeoutSpy = vi.spyOn(global, 'setTimeout').mockImplementation(((fn) => {
+            fn();
+            return 0;
+        }));
+        try {
+            safeFetchMock
+                .mockResolvedValueOnce(httpResponse(503))
+                .mockResolvedValueOnce(httpResponse(200));
+            await createFormWebhook(ctx, 'form_1', {
+                url: 'https://hooks.example.com/x',
+                retryCount: 2,
+            });
+            const res = await dispatchFormWebhooks('form_1', {
+                event: 'form.submitted',
+                formId: 'form_1',
+            });
+            expect(res.delivered).toBe(1);
+            expect(safeFetchMock).toHaveBeenCalledTimes(2);
+        }
+        finally {
+            timeoutSpy.mockRestore();
+        }
+    });
+    it('treats an SSRF block as a permanent failure (no retry)', async () => {
+        safeFetchMock.mockRejectedValue(new SsrfBlockedError('blocked'));
+        await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            retryCount: 3,
+        });
+        const res = await dispatchFormWebhooks('form_1', { event: 'form.submitted', formId: 'form_1' });
+        expect(res.delivered).toBe(0);
+        expect(safeFetchMock).toHaveBeenCalledTimes(1);
+    });
+});
+describe('testFormWebhook', () => {
+    it('sends a single sample delivery and records the result', async () => {
+        safeFetchMock.mockResolvedValue(httpResponse(200));
+        const wh = await createFormWebhook(ctx, 'form_1', {
+            url: 'https://hooks.example.com/x',
+            secret: 'shh',
+        });
+        const result = await testFormWebhook(ctx, wh.id);
+        expect(result.ok).toBe(true);
+        expect(result.attempts).toBe(1);
+        const [, opts] = safeFetchMock.mock.calls[0];
+        expect(JSON.parse(opts.body).data._test).toBe(true);
+    });
+    it('throws a 404 FormWebhookError for an unknown webhook', async () => {
+        await expect(testFormWebhook(ctx, 'missing')).rejects.toMatchObject({ status: 404 });
+    });
+});
+//# sourceMappingURL=webhooks.test.js.map

package/dist/__tests__/forms/webhooks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/webhooks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,MAAM,QAAQ,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACjE,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/E,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,aAAa,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC;IACrC,aAAa,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC,CAAA;AAEH,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,gBAAiB,SAAQ,KAAK;KAAG;IACvC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;AACrD,CAAC,CAAC,CAAA;AACF,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,SAAS,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACrD,gBAAgB;CACjB,CAAC,CAAC,CAAA;AAEH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAGrD,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAS,EAAE,CAAA;AAEvF,SAAS,MAAM;IACb,MAAM,IAAI,GAAU,EAAE,CAAA;IACtB,OAAO;QACL,IAAI;QACJ,WAAW,EAAE;YACX,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,GAAG,GAAG;oBACV,EAAE,EAAE,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,cAAc,EAAE,IAAI;oBACpB,kBAAkB,EAAE,IAAI;oBACxB,GAAG,IAAI;iBACR,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACd,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CACjC,IAAI,CAAC,MAAM,CACT,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBACzB,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAC/D;YACH,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI;YACjF,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBACtB,OAAO,CAAC,CAAA;YACV,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjB,OAAO,EAAE,CAAA;YACX,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAA;AAC5E,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,CAAC,OAAO,GAAG,MAAM,EAAE,CAAA;IAC3B,aAAa,CAAC,SAAS,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACzF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChG,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,CACV,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,CAAC,CACxE,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAC1C,MAAM,MAAM,CACV,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACzF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,CAAC,gBAAgB,EAAE,OAAc,CAAC;SAC3C,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACzF,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YACrC,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC,gBAAgB,CAAC;SAC3B,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE;YAC/C,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,OAAO;YACrB,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAE9C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC9D,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YACrC,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,CAAC,oBAAoB,CAAC;SAC/B,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE;YAC/C,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YACrC,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,KAAK;SACf,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC/F,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YACrC,GAAG,EAAE,6BAA6B;YAClC,UAAU,EAAE,CAAC;SACd,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC/F,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC9C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,yEAAyE;QACzE,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAc,EAAE,EAAE;YACvF,EAAE,EAAE,CAAA;YACJ,OAAO,CAA6C,CAAA;QACtD,CAAC,CAAsB,CAAC,CAAA;QACxB,IAAI,CAAC;YACH,aAAa;iBACV,qBAAqB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;iBACxC,qBAAqB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;YAC3C,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;gBACrC,GAAG,EAAE,6BAA6B;gBAClC,UAAU,EAAE,CAAC;aACd,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE;gBAC/C,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;YACF,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC7B,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAChD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,WAAW,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,aAAa,CAAC,iBAAiB,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;QAChE,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YACrC,GAAG,EAAE,6BAA6B;YAClC,UAAU,EAAE,CAAC;SACd,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC/F,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE;YAChD,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handler-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAgFA,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5C;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,IAsFtC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmJnE"}
+{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAkFA,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5C;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,IAsFtC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmJnE"}

package/dist/api/handler-factory.js

@@ -47,8 +47,8 @@ function isCsrfExemptPath(pathname) {
         (p.endsWith('/') && pathname.startsWith(p)))) {
         return true;
     }
-    // Public form submission endpoint.
-    return /^\/forms\/[^/]+\/submit$/.test(pathname);
+    // Public form submission endpoints (legacy by-id + slug-based public route).
+    return (/^\/forms\/[^/]+\/submit$/.test(pathname) || /^\/public\/forms\/[^/]+\/submit$/.test(pathname));
 }
 /**
  * Detect requests authenticated with an Actuate API key (`act_sk_...`) so we