@conduction/nextcloud-vue 2.79.0 → 2.81.0

package/dist/esm/components/CnFormPage/CnFormPage.vue2.js

@@ -9,7 +9,7 @@ import __sfc_main from '../CnFormErrorSummary/CnFormErrorSummary.vue.js';
 import __sfc_main$1 from '../CnFormField/CnFormField.vue.js';
 import __sfc_main$4 from '../CnStepper/CnStepper.vue.js';
 import { cnRenderFormField } from '../../composables/cnFormFieldRenderer.js';
-import { formDraftMixin, draftKey, draftIndicatorText, readDraft } from '../../composables/useFormDraft.js';
+import { formDraftMixin, draftKey, resolveDraftUserId, draftIndicatorText, clearAnonymousDrafts, readDraft } from '../../composables/useFormDraft.js';
 import { normalizeLook } from '../../composables/useLook.js';
 import { cnSelectAria } from '../../directives/cnSelectAria.js';
 import { loadCurrentUserProfile } from '../../utils/currentUserProfile.js';
@@ -141,7 +141,7 @@ var script = {
 			default: '',
 		},
 
-		/** Who is typing; part of the draft's storage key so a shared browser profile never leaks a draft between users. */
+		/** Who is typing; part of the draft's storage key so a shared browser profile never leaks a draft between users. Empty: the signed-in Nextcloud user. */
 		draftUserId: {
 			type: String,
 			default: '',
@@ -222,6 +222,17 @@ var script = {
 			default: '',
 		},
 
+		/**
+		 * Name of a honeypot field for a form anonymous visitors fill in.
+		 * The field is rendered out of sight and out of the tab order; when
+		 * it is filled, submit sends nothing and shows the normal success,
+		 * so a bot learns nothing. Empty (default): no honeypot.
+		 */
+		honeypot: {
+			type: String,
+			default: '',
+		},
+
 		/** HTTP method for endpoint mode. POST | PUT | PATCH. */
 		submitMethod: {
 			type: String,
@@ -360,6 +371,8 @@ var script = {
 			summaryKeys: [],
 			/** Per-field validation error messages, keyed by field.key. */
 			fieldErrors: {},
+			/** What a bot typed into the honeypot field; stays empty for a person. */
+			honeypotValue: '',
 			/**
 			 * Cache of resolved `endpoint`/`source` visibleWhen outcomes,
 			 * keyed by field.key. Resolved ONCE in `mounted()` — see the
@@ -561,7 +574,17 @@ var script = {
 			if (this.recoverDraft !== true) {
 				return ''
 			}
-			return draftKey({ appId: this.draftAppId, schema: this.draftScope, objectId: 'new', userId: this.draftUserId })
+			return draftKey({ appId: this.draftAppId, schema: this.draftScope, objectId: 'new', userId: this.draftUserOwner })
+		},
+
+		/**
+		 * Who the draft belongs to: `draftUserId`, else the signed-in user.
+		 *
+		 * @return {string} The user id, or '' when nobody is signed in.
+		 * @spec openspec/changes/form-draft-on-change-and-help-text-spacing/specs/form-draft-on-change-and-help-text-spacing/spec.md#requirement-a-draft-belongs-to-the-signed-in-user
+		 */
+		draftUserOwner() {
+			return resolveDraftUserId(this.draftUserId)
 		},
 
 		/**
@@ -609,6 +632,11 @@ var script = {
 		this.calcTimers = {};
 		// Offered, never applied: a form that fills itself is indistinguishable
 		// from one the server prefilled.
+		// A draft under `anonymous` may be somebody else's: removed once a
+		// signed-in user is known, never offered.
+		if (this.formDraftKey && this.draftUserOwner) {
+			clearAnonymousDrafts();
+		}
 		if (this.formDraftKey) {
 			this.draftOffer = readDraft(this.formDraftKey);
 		}
@@ -1380,6 +1408,11 @@ var script = {
 			}
 
 			this.lastError = null;
+			if (this.honeypot && this.honeypotValue !== '') {
+				// A bot filled the field no person sees: send nothing, look done.
+				this.submitted = true;
+				return
+			}
 			this.submitting = true;
 			try {
 				if (this.submitEndpoint) {
@@ -1405,6 +1438,9 @@ var script = {
 				// describes the transport ("Request failed with status code 400")
 				// and leaves the user to guess which field it meant.
 				this.lastError = serverErrorMessage(err);
+				// A refusal that names its fields (`findings[]`, as OpenRegister's
+				// form destination check answers 422) is marked on each field.
+				this.showServerFindings(err);
 				/**
 				 * Submit failure event. Payload is the thrown error / rejected reason.
 				 *
@@ -1417,6 +1453,45 @@ var script = {
 			}
 		},
 
+		/**
+		 * Put each finding of a refused submit on its field.
+		 *
+		 * Reads `response.data.findings[]`, each `{ field?, property, message }`,
+		 * and marks the field whose key is the finding's `field`, or else its
+		 * `property`. Findings on no field of this form stay in the general
+		 * error above the form. Nothing happens for an answer without findings.
+		 *
+		 * @param {object} err The rejected request.
+		 * @return {void}
+		 */
+		showServerFindings(err) {
+			const findings = err?.response?.data?.findings;
+			if (!Array.isArray(findings) || findings.length === 0) {
+				return
+			}
+			const keys = new Set(this.fields.map((f) => f && f.key));
+			const marked = [];
+			for (const finding of findings) {
+				const key = finding && (finding.field || finding.property);
+				if (!key || !keys.has(key) || this.fieldErrors[key]) {
+					continue
+				}
+				this.fieldErrors[key] = String(finding.message || translate('nextcloud-vue', 'This answer was refused.'));
+				marked.push(key);
+			}
+			if (marked.length === 0) {
+				return
+			}
+			this.summaryKeys = this.fields.map((f) => f.key).filter((key) => marked.includes(key));
+			if (this.hasSteps) {
+				const stepIndex = this.steps.findIndex((step) => this.stepFields(step).some((f) => f.key === this.summaryKeys[0]));
+				if (stepIndex >= 0) {
+					this.currentStepIndex = stepIndex;
+				}
+			}
+			this.focusFirstError(this.summaryKeys[0]);
+		},
+
 		async submitViaEndpoint() {
 			const method = (this.submitMethod || 'POST').toLowerCase();
 			const url = resolveParams(this.submitEndpoint, this.$route?.params || {});