@bygghammar/cms-platform 0.90.0-m7.5 → 0.90.0-m7.8

package/CHANGELOG.md

@@ -8,6 +8,38 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.90.0-m7.8
+
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.8`. `m7.6` and `m7.7` were
+  tagged and never published: two defects in the release workflow stopped them
+  after every gate had passed. The form-identity work they were meant to carry
+  is unchanged and ships here.
+- The release workflow gets both corrections, proven in lightweight-popup:
+  the redundant post-checkout `git fetch` is gone (checkout already brings
+  every branch, and its credentials are removed on the way out), and
+  `npm pack`'s destination is created before it is packed into, with the same
+  directory carried to the tarball verification rather than spelled twice.
+- `ops/verify-release-tag.mjs` checks `refs/remotes/origin/main` is present
+  before asking `merge-base` about it, so a checkout that fetched too little no
+  longer reports itself as a tag on an unmerged branch.
+
+## 0.90.0-m7.6
+
+- A form submitted from inside a popup now says so. `FormRenderer` and
+  `ManagedForm` take an opaque `context` that is merged into the submission,
+  and the popup module fills it with `{ popupKey }` — the form system keeps
+  knowing nothing about the features that use it. Without this the request was
+  indistinguishable from the same form filled on an ordinary page, so the
+  server stored an ordinary entry and every delivery configured on the popup
+  silently did nothing.
+- `HostSubmitFormInput` gains `popupKey?: string`, the only popup-shaped value
+  the browser sends. Destination, endpoint, signing secret and which fields may
+  leave are all read on the server from the popup's stored configuration.
+- Drafts and the builder preview carry no context, so a part-filled form and an
+  editor checking a layout cannot fire a campaign's webhook.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.6`, which is where the
+  identity comes from.
+
 ## 0.90.0-m7.5
 
 - `BackofficeHost.pages.fns.listPages` is declared. It was what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.90.0-m7.5",
+  "version": "0.90.0-m7.8",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -263,7 +263,7 @@
     "@dnd-kit/sortable": ">=3",
     "@dnd-kit/utilities": ">=3",
     "zod": ">=3",
-    "@bygghammar/lightweight-popup": ">=0.2.0-m7.5"
+    "@bygghammar/lightweight-popup": ">=0.2.0-m7.8"
   },
   "peerDependenciesMeta": {
     "@supabase/supabase-js": {
@@ -328,7 +328,7 @@
     "check": "bun run typecheck && bun run test && bun run verify:pack"
   },
   "devDependencies": {
-    "@bygghammar/lightweight-popup": "file:./vendor/bygghammar-lightweight-popup-0.2.0-m7.5.tgz",
+    "@bygghammar/lightweight-popup": "0.2.0-m7.8",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",

package/src/forms/FormRenderer.tsx

@@ -48,12 +48,25 @@ export function FormRenderer({
   dark = false,
   className,
   preview = false,
+  context,
   onSuccess,
 }: {
   form: PublicForm;
   dark?: boolean;
   className?: string;
   preview?: boolean;
+  /**
+   * Where this form is being rendered, for whoever is rendering it.
+   *
+   * Merged into the submission itself, so the server decides what a submission
+   * was from what it stored — not from anything the browser says afterwards.
+   * A feature that needs the server to treat its submissions differently sends
+   * that here, and names itself: this file deliberately does not know which
+   * features exist, and a test holds it to that.
+   *
+   * Absent for an ordinary page form, and that absence is the signal.
+   */
+  context?: Readonly<Record<string, string>>;
   /**
    * Called only for a submission the host actually stored. A honeypot
    * rejection — `{ ok: true, skipped: true }` — never reaches it, and neither
@@ -235,6 +248,11 @@ export function FormRenderer({
         elapsedMs: Date.now() - mountedAt.current,
         hp,
         clientToken: form.savePartials ? draftToken(form.key) : undefined,
+        // Spread rather than nested, and omitted entirely when there is none:
+        // the host reads a key's presence as the signal, so an always-present
+        // field holding an empty value is a different contract wearing the
+        // same name.
+        ...(context ?? {}),
         values: visible,
       });
 
@@ -438,11 +456,14 @@ export function ManagedForm({
   formKey,
   dark = false,
   className,
+  context,
   onSuccess,
 }: {
   formKey: string;
   dark?: boolean;
   className?: string;
+  /** Forwarded to `FormRenderer`; see its `context`. */
+  context?: Readonly<Record<string, string>>;
   /** Forwarded to `FormRenderer`; fires only for a stored submission. */
   onSuccess?: (event: FormSubmissionSuccess) => void;
 }) {
@@ -466,6 +487,7 @@ export function ManagedForm({
       form={form}
       dark={dark}
       className={className}
+      {...(context === undefined ? {} : { context })}
       {...(onSuccess === undefined ? {} : { onSuccess })}
     />
   );

package/src/host/index.tsx

@@ -174,6 +174,17 @@ export type HostSubmitFormInput = {
   elapsedMs?: number;
   hp?: string;
   clientToken?: string;
+  /**
+   * The popup this form was submitted from, when it was submitted from one.
+   *
+   * Absent for every ordinary page form, and that absence is meaningful: a
+   * host decides whether a submission is a campaign opt-in by whether this is
+   * here. It is the only popup-shaped value the browser sends — the
+   * destination, the endpoint, the signing secret and which fields may leave
+   * are all read on the server from the popup's stored configuration, because
+   * anything the browser could name it could also change.
+   */
+  popupKey?: string;
   values: HostFormValues;
 };
 

package/src/popups/admin.tsx

@@ -71,6 +71,10 @@ function PopupsScreen({
       forms: {
         // The builder preview renders the site's real form, so what an editor
         // checks is what a visitor will see.
+        //
+        // Without `popupKey`, deliberately. An editor filling the preview to
+        // see how it looks would otherwise store an opt-in and fire the
+        // popup's delivery — a real webhook, from somebody checking a layout.
         renderForm: ({ formKey }) => <ManagedForm formKey={formKey} />,
       },
     }),

package/src/popups/runtime.tsx

@@ -17,7 +17,10 @@ import {
   PopupRuntime,
   withExcludedBase,
 } from "@bygghammar/lightweight-popup/runtime";
-import type { RuntimeAdapters } from "@bygghammar/lightweight-popup/adapters";
+import type {
+  FormRenderPort,
+  RuntimeAdapters,
+} from "@bygghammar/lightweight-popup/adapters";
 
 import { ManagedForm } from "../forms/FormRenderer";
 import { onFormSubmissionSuccess } from "../forms/success-listeners";
@@ -28,14 +31,23 @@ import { popupPublicHost } from "./host";
 /**
  * Renders one of the site's own forms inside a popup.
  *
+ * `popupKey` goes into the submission itself, and that is the whole point of
+ * this component existing: without it the request is indistinguishable from
+ * the same form filled on an ordinary page, so the server stores an ordinary
+ * entry and every delivery configured on the popup quietly does nothing.
+ *
  * Success comes from the CMS form seam rather than from this component, which
  * is what makes a honeypot rejection impossible to miscount: the form runtime
- * only announces submissions the host actually stored.
+ * only announces submissions the host actually stored. That listener drives
+ * the popup's own flow and analytics — it is deliberately not a second way to
+ * deliver, because it would be delivering on the browser's word.
  */
 function PopupForm({
+  popupKey,
   formKey,
   onSuccess,
 }: {
+  popupKey: string;
   formKey: string;
   onSuccess: () => void;
 }): ReactNode {
@@ -50,7 +62,9 @@ function PopupForm({
     [formKey],
   );
 
-  return <ManagedForm formKey={formKey} />;
+  // The popup names itself here, in the popup module. The form renderer takes
+  // an opaque context and stays independent of the features that use it.
+  return <ManagedForm context={{ popupKey }} formKey={formKey} />;
 }
 
 /**
@@ -82,9 +96,12 @@ export function PopupModuleRuntime(): ReactNode {
   const path = useRouterState({ select: (state) => state.location.pathname });
   const host = popupPublicHost();
 
-  const renderForm = useCallback(
-    ({ formKey, onSuccess }: { formKey: string; onSuccess: () => void }) => (
-      <PopupForm formKey={formKey} onSuccess={onSuccess} />
+  // The argument type comes from the port, not a copy of it: a package that
+  // stopped supplying `popupKey` would fail to compile here rather than
+  // quietly go back to submitting forms with no identity.
+  const renderForm = useCallback<FormRenderPort["renderForm"]>(
+    ({ popupKey, formKey, onSuccess }) => (
+      <PopupForm popupKey={popupKey} formKey={formKey} onSuccess={onSuccess} />
     ),
     [],
   );