@actuate-media/cms-core 0.32.0 → 0.33.0

package/dist/api/handlers.js

@@ -28,6 +28,8 @@ import { listEntries as listEntriesService, getEntryWithSchema as getEntryWithSc
 import { processSubmission, buildPublicForm, SubmissionValidationError, } from '../forms/submission.js';
 import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FILE_BYTES, } from '../forms/files.js';
 import { resolveSubmissionFields } from '../forms/submission.js';
+import { createFormWebhook, listFormWebhooks, updateFormWebhook, deleteFormWebhook, testFormWebhook, FormWebhookError, } from '../forms/webhooks.js';
+import { sendFormNotifications } from '../forms/notify.js';
 import { checkForUpdates } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
@@ -290,6 +292,8 @@ function mapFormError(err) {
     if (err instanceof FormHasSubmissionsError) {
         return json({ error: err.message, code: 'FORM_HAS_SUBMISSIONS', submissionCount: err.submissionCount }, 409);
     }
+    if (err instanceof FormWebhookError)
+        return errorResponse(err.message, err.status);
     return null;
 }
 function parseFormsQuery(url) {
@@ -4720,6 +4724,147 @@ export function registerCMSRoutes(router) {
             return mapFormError(err) ?? internalError(err);
         }
     });
+    // ── Per-form webhooks (CRUD + test) ──────────────────────────────────────
+    router.get('/forms/:id/webhooks', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const form = await getFormByIdService(params.id);
+            if (!form)
+                return errorResponse('Form not found', 404);
+            const webhooks = await listFormWebhooks(params.id);
+            return json({ data: webhooks });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.post('/forms/:id/webhooks', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const form = await getFormByIdService(params.id);
+            if (!form)
+                return errorResponse('Form not found', 404);
+            const body = (await request.json().catch(() => ({})));
+            if (!body.url || typeof body.url !== 'string') {
+                return errorResponse('A webhook url is required', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const webhook = await createFormWebhook(ctx, params.id, body);
+            // The plaintext secret is returned exactly once here, on creation.
+            return json({ data: webhook }, 201);
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.patch('/forms/:id/webhooks/:webhookId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const webhook = await updateFormWebhook(ctx, params.webhookId, body);
+            return json({ data: webhook });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.delete('/forms/:id/webhooks/:webhookId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            await deleteFormWebhook(ctx, params.webhookId);
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.post('/forms/:id/webhooks/:webhookId/test', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            const result = await testFormWebhook(ctx, params.webhookId);
+            return json({ data: result });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    // ── Test notification email ──────────────────────────────────────────────
+    router.post('/forms/:id/notifications/test', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const form = await getFormByIdService(params.id);
+            if (!form)
+                return errorResponse('Form not found', 404);
+            const settings = await getFormNotificationSettingsService(params.id);
+            const primaryRecipient = (settings?.recipients ?? [])[0];
+            if (!settings?.enabled || !primaryRecipient) {
+                return errorResponse('Configure at least one recipient before sending a test', 400);
+            }
+            // Sample values so operators see a realistic email. The autoresponder is
+            // suppressed for tests so we never email an arbitrary sample address.
+            const fields = form.fields ?? [];
+            const sampleData = {};
+            for (const field of fields) {
+                if (field.type === 'honeypot' || field.type === 'divider' || field.type === 'richtext') {
+                    continue;
+                }
+                if (field.type === 'email')
+                    sampleData[field.key] = primaryRecipient;
+                else if (field.type === 'checkbox' || field.type === 'consent')
+                    sampleData[field.key] = true;
+                else
+                    sampleData[field.key] = `Sample ${field.label || field.key}`;
+            }
+            const ctx = {
+                formId: form.id,
+                formName: form.name,
+                entryNumber: null,
+                submittedAt: new Date().toISOString(),
+                fields,
+                data: sampleData,
+                senderName: 'Test Submission',
+                senderEmail: primaryRecipient,
+            };
+            const result = await sendFormNotifications({ ...settings, autoresponderEnabled: false }, ctx);
+            return json({ data: result });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
     // ---------------------------------------------------------------------------
     // Redirects routes
     // ---------------------------------------------------------------------------