@flusys/nestjs-form-builder 8.0.3 → 8.1.1

package/fesm/{262.js → 432.js}

@@ -4,16 +4,17 @@ import * as __rspack_external__flusys_nestjs_shared_classes_6076a329 from "@flus
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
 import * as __rspack_external__flusys_nestjs_shared_dtos_c4585026 from "@flusys/nestjs-shared/dtos";
 import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
+import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
 import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
 import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
 import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
 import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
 import * as __rspack_external_typeorm from "typeorm";
-import * as __rspack_external__flusys_nestjs_core_ff4ca4e2 from "@flusys/nestjs-core";
-import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
+import * as __rspack_external_crypto from "crypto";
 import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
-export const __rspack_esm_id = 262;
-export const __rspack_esm_ids = [262];
+import * as __rspack_external__flusys_nestjs_core_ff4ca4e2 from "@flusys/nestjs-core";
+export const __rspack_esm_id = 432;
+export const __rspack_esm_ids = [432];
 export const __webpack_modules__ = {
 769(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
@@ -58,7 +59,15 @@ const FORM_MESSAGES = {
     INVALID_ACCESS_TYPE: 'form.invalid.access.type',
     PERMISSION_CHECK_FAILED: 'form.permission.check.failed',
     GET_SUCCESS: 'form.get.success',
-    GET_ACCESS_INFO_SUCCESS: 'form.get.access.info.success'
+    GET_ACCESS_INFO_SUCCESS: 'form.get.access.info.success',
+    EMAIL_NOT_CONFIGURED: 'form.email.not.configured',
+    EMAIL_VERIFICATION_REQUIRED: 'form.email.verification.required',
+    OTP_SENT: 'form.email.otp.sent',
+    OTP_SEND_FAILED: 'form.email.otp.send.failed',
+    OTP_INVALID: 'form.email.otp.invalid',
+    OTP_EXPIRED: 'form.email.otp.expired',
+    OTP_TOO_MANY_ATTEMPTS: 'form.email.otp.too.many.attempts',
+    OTP_VERIFIED: 'form.email.otp.verified'
 };
 const FORM_RESULT_MESSAGES = {
     GET_ALL_SUCCESS: 'form.result.get.all.success',
@@ -67,7 +76,8 @@ const FORM_RESULT_MESSAGES = {
     HAS_NOT_SUBMITTED_SUCCESS: 'form.result.has.not.submitted.success',
     SUBMIT_SUCCESS: 'form.result.submit.success',
     DRAFT_GET_SUCCESS: 'form.result.draft.get.success',
-    DRAFT_UPDATE_SUCCESS: 'form.result.draft.update.success'
+    DRAFT_UPDATE_SUCCESS: 'form.result.draft.update.success',
+    ALREADY_SUBMITTED: 'form.result.already.submitted'
 };
 
 __webpack_require__.d(__webpack_exports__, {
@@ -109,6 +119,7 @@ class SubmitFormDto {
     formId;
     data;
     isDraft;
+    accessToken;
 }
 _ts_decorate([
     (0,_nestjs_swagger__rspack_import_1.ApiProperty)({
@@ -141,6 +152,15 @@ _ts_decorate([
     (0,class_validator__rspack_import_3.IsOptional)(),
     _ts_metadata("design:type", Boolean)
 ], SubmitFormDto.prototype, "isDraft", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_1.ApiProperty)({
+        description: 'Access token from email verification (only used for EMAIL_VERIFIED forms submitted anonymously)',
+        required: false
+    }),
+    (0,class_validator__rspack_import_3.IsString)(),
+    (0,class_validator__rspack_import_3.IsOptional)(),
+    _ts_metadata("design:type", String)
+], SubmitFormDto.prototype, "accessToken", void 0);
 class CreateFormResultDto extends SubmitFormDto {
     schemaVersionSnapshot;
     schemaVersion;
@@ -250,6 +270,7 @@ class FormResultResponseDto extends _flusys_nestjs_shared_dtos__rspack_import_0.
     schemaVersion;
     data;
     submittedById;
+    submitterEmail;
     submittedAt;
     isDraft;
 }
@@ -278,6 +299,11 @@ _ts_decorate([
     (0,_nestjs_swagger__rspack_import_1.ApiProperty)(),
     _ts_metadata("design:type", Object)
 ], FormResultResponseDto.prototype, "submittedById", void 0);
+_ts_decorate([
+    (0,class_transformer__rspack_import_2.Expose)(),
+    (0,_nestjs_swagger__rspack_import_1.ApiProperty)(),
+    _ts_metadata("design:type", Object)
+], FormResultResponseDto.prototype, "submitterEmail", void 0);
 _ts_decorate([
     (0,class_transformer__rspack_import_2.Expose)(),
     (0,_nestjs_swagger__rspack_import_1.ApiProperty)(),
@@ -301,7 +327,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-532(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+814(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -309,6 +335,7 @@ __webpack_require__.d(__webpack_exports__, {
   C7: () => (/* reexport */ Form),
   Xl: () => (/* binding */ FormCompanyEntities),
   t$: () => (/* binding */ FormCoreEntities),
+  Kr: () => (/* reexport */ FormEmailVerification),
   ez: () => (/* reexport */ FormResult),
   Wl: () => (/* reexport */ FormWithCompany),
   getFormBuilderEntitiesByConfig: () => (/* binding */ getFormBuilderEntitiesByConfig)
@@ -470,6 +497,7 @@ class FormResult extends Identity {
     schemaVersion;
     data;
     submittedById;
+    submitterEmail;
     submittedAt;
     isDraft;
 }
@@ -513,6 +541,15 @@ form_result_entity_ts_decorate([
     }),
     form_result_entity_ts_metadata("design:type", Object)
 ], FormResult.prototype, "submittedById", void 0);
+form_result_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: true,
+        name: 'submitter_email'
+    }),
+    form_result_entity_ts_metadata("design:type", Object)
+], FormResult.prototype, "submitterEmail", void 0);
 form_result_entity_ts_decorate([
     (0,external_typeorm_.Column)({
         type: 'timestamp',
@@ -532,9 +569,122 @@ form_result_entity_ts_decorate([
 FormResult = form_result_entity_ts_decorate([
     (0,external_typeorm_.Entity)({
         name: 'form_result'
-    })
+    }),
+    (0,external_typeorm_.Index)([
+        'formId',
+        'submitterEmail'
+    ])
 ], FormResult);
 
+;// CONCATENATED MODULE: ./projects/nestjs-form-builder/src/entities/form-email-verification.entity.ts
+function form_email_verification_entity_ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function form_email_verification_entity_ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+class FormEmailVerification extends Identity {
+    formId;
+    email;
+    otpHash;
+    otpExpiresAt;
+    otpAttempts;
+    verifiedAt;
+    accessTokenHash;
+    accessTokenExpiresAt;
+}
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'uuid',
+        nullable: false,
+        name: 'form_id'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", String)
+], FormEmailVerification.prototype, "formId", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: false
+    }),
+    form_email_verification_entity_ts_metadata("design:type", String)
+], FormEmailVerification.prototype, "email", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+        name: 'otp_hash'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Object)
+], FormEmailVerification.prototype, "otpHash", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'timestamp',
+        nullable: true,
+        name: 'otp_expires_at'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Object)
+], FormEmailVerification.prototype, "otpExpiresAt", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'int',
+        nullable: false,
+        default: 0,
+        name: 'otp_attempts'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Number)
+], FormEmailVerification.prototype, "otpAttempts", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'timestamp',
+        nullable: true,
+        name: 'verified_at'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Object)
+], FormEmailVerification.prototype, "verifiedAt", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Index)(),
+    (0,external_typeorm_.Column)({
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+        name: 'access_token_hash'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Object)
+], FormEmailVerification.prototype, "accessTokenHash", void 0);
+form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Column)({
+        type: 'timestamp',
+        nullable: true,
+        name: 'access_token_expires_at'
+    }),
+    form_email_verification_entity_ts_metadata("design:type", Object)
+], FormEmailVerification.prototype, "accessTokenExpiresAt", void 0);
+FormEmailVerification = form_email_verification_entity_ts_decorate([
+    (0,external_typeorm_.Entity)({
+        name: 'form_email_verification'
+    }),
+    (0,external_typeorm_.Unique)([
+        'formId',
+        'email'
+    ])
+], FormEmailVerification);
+
 ;// CONCATENATED MODULE: ./projects/nestjs-form-builder/src/entities/form-with-company.entity.ts
 function form_with_company_entity_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -590,20 +740,24 @@ FormWithCompany = form_with_company_entity_ts_decorate([
 // Entities without company feature
 
 
+
 // Entities with company feature
 
 
 
 
+
 // Core entities (no company feature)
 const FormCoreEntities = [
     Form,
-    FormResult
+    FormResult,
+    FormEmailVerification
 ];
 // Company-specific entities
 const FormCompanyEntities = [
     FormWithCompany,
-    FormResult
+    FormResult,
+    FormEmailVerification
 ];
 function getFormBuilderEntitiesByConfig(enableCompanyFeature) {
     return enableCompanyFeature ? FormCompanyEntities : FormCoreEntities;
@@ -621,6 +775,7 @@ function getFormBuilderEntitiesByConfig(enableCompanyFeature) {
     /** No authentication required - anyone can submit */ FormAccessType["PUBLIC"] = "public";
     /** Any authenticated user can submit */ FormAccessType["AUTHENTICATED"] = "authenticated";
     /** Only users with specific action permissions can submit */ FormAccessType["ACTION_GROUP"] = "action_group";
+    /** Anonymous visitors verify a one-time email code before submitting (already-logged-in users are auto-identified by their account email) */ FormAccessType["EMAIL_VERIFIED"] = "email_verified";
     return FormAccessType;
 }({});
 
@@ -629,6 +784,20 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+341(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Provider Interface for sending form-submission verification emails.
+ * Implemented at the app level (composition root) using the email module,
+ * so nestjs-form-builder never depends on nestjs-email directly.
+ */ const FORM_BUILDER_EMAIL_PROVIDER = 'FORM_BUILDER_EMAIL_PROVIDER';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  Q: FORM_BUILDER_EMAIL_PROVIDER
+});
+
+
 },
 781(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
@@ -758,7 +927,7 @@ class FormBuilderDataSourceProvider extends modules_.MultiTenantDataSourceServic
     }
     async getFormBuilderEntities(enableCompanyFeature) {
         const enable = enableCompanyFeature ?? this.configService.isCompanyFeatureEnabled();
-        const { getFormBuilderEntitiesByConfig } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 532));
+        const { getFormBuilderEntitiesByConfig } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 814));
         return getFormBuilderEntitiesByConfig(enable);
     }
     async createDataSourceFromConfig(config) {
@@ -782,6 +951,219 @@ FormBuilderDataSourceProvider = _ts_decorate([
 ], FormBuilderDataSourceProvider);
 
 
+},
+474(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  w: () => (/* binding */ FormEmailAuthService)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(216);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+;// CONCATENATED MODULE: external "crypto"
+
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/config/message-keys.ts
+var message_keys = __webpack_require__(137);
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/entities/index.ts + 6 modules
+var entities = __webpack_require__(814);
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/interfaces/form-builder-email-provider.interface.ts
+var form_builder_email_provider_interface = __webpack_require__(341);
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/services/form-builder-datasource.provider.ts + 1 modules
+var form_builder_datasource_provider = __webpack_require__(593);
+;// CONCATENATED MODULE: ./projects/nestjs-form-builder/src/services/form-email-auth.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+class FormEmailAuthService {
+    dataSourceProvider;
+    emailProvider;
+    OTP_EXPIRY_MS = 10 * 60 * 1000;
+    ACCESS_TOKEN_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
+    MAX_OTP_ATTEMPTS = 5;
+    repository = null;
+    constructor(dataSourceProvider, emailProvider){
+        this.dataSourceProvider = dataSourceProvider;
+        this.emailProvider = emailProvider;
+    }
+    async ensureRepository() {
+        if (!this.repository) {
+            this.repository = await this.dataSourceProvider.getRepository(entities/* .FormEmailVerification */.Kr);
+        }
+        return this.repository;
+    }
+    generateOtp() {
+        return __rspack_external_crypto.randomInt(100000, 1000000).toString();
+    }
+    generateAccessToken() {
+        return (0,utils_.generateSecureToken)();
+    }
+    hashValue(value) {
+        return (0,utils_.hashToken)(value);
+    }
+    normalizeEmail(email) {
+        return email.trim().toLowerCase();
+    }
+    assertEmailEnabled() {
+        if (!this.emailProvider) {
+            throw new common_.BadRequestException({
+                message: 'Email service is not configured for this form',
+                messageKey: message_keys/* .FORM_MESSAGES.EMAIL_NOT_CONFIGURED */.Q.EMAIL_NOT_CONFIGURED
+            });
+        }
+    }
+    async requestOtp(formId, email, formTitle) {
+        this.assertEmailEnabled();
+        const repository = await this.ensureRepository();
+        email = this.normalizeEmail(email);
+        const otp = this.generateOtp();
+        const record = await repository.findOne({
+            where: {
+                formId,
+                email
+            }
+        }) ?? repository.create({
+            formId,
+            email
+        });
+        Object.assign(record, {
+            otpHash: this.hashValue(otp),
+            otpExpiresAt: new Date(Date.now() + this.OTP_EXPIRY_MS),
+            otpAttempts: 0
+        });
+        await repository.save(record);
+        try {
+            await this.emailProvider.sendOtpEmail(email, otp, formTitle, this.OTP_EXPIRY_MS / 60000);
+        } catch  {
+            throw new common_.BadRequestException({
+                message: 'Failed to send verification code. Please try again.',
+                messageKey: message_keys/* .FORM_MESSAGES.OTP_SEND_FAILED */.Q.OTP_SEND_FAILED
+            });
+        }
+        return {
+            success: true,
+            message: 'Verification code sent to your email',
+            messageKey: message_keys/* .FORM_MESSAGES.OTP_SENT */.Q.OTP_SENT
+        };
+    }
+    async verifyOtp(formId, email, code) {
+        const repository = await this.ensureRepository();
+        email = this.normalizeEmail(email);
+        const record = await repository.findOne({
+            where: {
+                formId,
+                email
+            }
+        });
+        if (!record?.otpHash || !record.otpExpiresAt) {
+            throw new common_.BadRequestException({
+                message: 'Invalid or expired verification code',
+                messageKey: message_keys/* .FORM_MESSAGES.OTP_INVALID */.Q.OTP_INVALID
+            });
+        }
+        if (record.otpAttempts >= this.MAX_OTP_ATTEMPTS) {
+            throw new common_.BadRequestException({
+                message: 'Too many incorrect attempts. Please request a new code.',
+                messageKey: message_keys/* .FORM_MESSAGES.OTP_TOO_MANY_ATTEMPTS */.Q.OTP_TOO_MANY_ATTEMPTS
+            });
+        }
+        if ((0,utils_.isExpired)(record.otpExpiresAt)) {
+            throw new common_.BadRequestException({
+                message: 'Verification code has expired. Please request a new one.',
+                messageKey: message_keys/* .FORM_MESSAGES.OTP_EXPIRED */.Q.OTP_EXPIRED
+            });
+        }
+        if (record.otpHash !== this.hashValue(code)) {
+            record.otpAttempts += 1;
+            await repository.save(record);
+            throw new common_.BadRequestException({
+                message: 'Invalid verification code',
+                messageKey: message_keys/* .FORM_MESSAGES.OTP_INVALID */.Q.OTP_INVALID
+            });
+        }
+        const accessToken = this.generateAccessToken();
+        const accessTokenExpiresAt = new Date(Date.now() + this.ACCESS_TOKEN_EXPIRY_MS);
+        Object.assign(record, {
+            verifiedAt: record.verifiedAt ?? new Date(),
+            accessTokenHash: this.hashValue(accessToken),
+            accessTokenExpiresAt,
+            otpHash: null,
+            otpExpiresAt: null,
+            otpAttempts: 0
+        });
+        await repository.save(record);
+        return {
+            accessToken,
+            expiresAt: accessTokenExpiresAt
+        };
+    }
+    // Slides the token's expiry forward on every use so an active repeat-filler
+    // on a 'multiple' response-mode form never needs to re-verify.
+    async resolveAccessToken(formId, accessToken) {
+        if (!accessToken) return null;
+        const repository = await this.ensureRepository();
+        const record = await repository.findOne({
+            where: {
+                formId,
+                accessTokenHash: this.hashValue(accessToken)
+            }
+        });
+        if (!record?.accessTokenExpiresAt || (0,utils_.isExpired)(record.accessTokenExpiresAt)) {
+            return null;
+        }
+        record.accessTokenExpiresAt = new Date(Date.now() + this.ACCESS_TOKEN_EXPIRY_MS);
+        await repository.save(record);
+        return record.email;
+    }
+    async resolveSubmitterEmail(formId, user, accessToken) {
+        if (user?.email) return this.normalizeEmail(user.email);
+        return this.resolveAccessToken(formId, accessToken);
+    }
+}
+FormEmailAuthService = _ts_decorate([
+    (0,common_.Injectable)({
+        scope: common_.Scope.REQUEST
+    }),
+    _ts_param(0, (0,common_.Inject)(form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(1, (0,common_.Optional)()),
+    _ts_param(1, (0,common_.Inject)(form_builder_email_provider_interface/* .FORM_BUILDER_EMAIL_PROVIDER */.Q)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._,
+        typeof IFormBuilderEmailProvider === "undefined" ? Object : IFormBuilderEmailProvider
+    ])
+], FormEmailAuthService);
+
+
 },
 160(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
@@ -789,15 +1171,16 @@ FormBuilderDataSourceProvider = _ts_decorate([
 /* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(236);
 /* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
 /* import */ var typeorm__rspack_import_4 = __webpack_require__(158);
-/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(769);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(137);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(769);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(137);
 /* import */ var _dtos_form_result_dto_js__rspack_import_5 = __webpack_require__(788);
-/* import */ var _entities_index_js__rspack_import_6 = __webpack_require__(532);
-/* import */ var _enums_form_access_type_enum_js__rspack_import_12 = __webpack_require__(376);
-/* import */ var _utils_computed_field_utils_js__rspack_import_13 = __webpack_require__(801);
+/* import */ var _entities_index_js__rspack_import_6 = __webpack_require__(814);
+/* import */ var _enums_form_access_type_enum_js__rspack_import_13 = __webpack_require__(376);
+/* import */ var _utils_computed_field_utils_js__rspack_import_14 = __webpack_require__(801);
 /* import */ var _utils_permission_utils_js__rspack_import_7 = __webpack_require__(988);
 /* import */ var _form_builder_config_service_js__rspack_import_8 = __webpack_require__(781);
 /* import */ var _form_builder_datasource_provider_js__rspack_import_9 = __webpack_require__(593);
+/* import */ var _form_email_auth_service_js__rspack_import_10 = __webpack_require__(474);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -834,14 +1217,22 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     formBuilderConfig;
     dataSourceProvider;
+    formEmailAuthService;
     formRepository = null;
-    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider){
-        super(_config_index_js__rspack_import_10/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_10/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_6/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider;
+    // Serializes the single-response check-then-insert per (formId, email) within
+    // this process, so a double-click/two-tab submission can't both pass the check
+    // before either has saved. Static because the service is REQUEST-scoped - a
+    // per-instance lock would never be shared between the two racing requests.
+    // Does not span multiple app instances; see withSubmissionLock().
+    static submissionLocks = new Map();
+    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, formEmailAuthService){
+        super(_config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_6/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider, this.formEmailAuthService = formEmailAuthService;
     }
     async ensureFormRepositoryInitialized() {
         if (!this.formRepository) {
@@ -850,6 +1241,23 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             this.formRepository = await this.dataSourceProvider.getRepository(formEntity);
         }
     }
+    async withSubmissionLock(key, fn) {
+        const prior = FormResultService.submissionLocks.get(key) ?? Promise.resolve();
+        let release;
+        const current = new Promise((resolve)=>{
+            release = resolve;
+        });
+        FormResultService.submissionLocks.set(key, current);
+        await prior;
+        try {
+            return await fn();
+        } finally{
+            release();
+            if (FormResultService.submissionLocks.get(key) === current) {
+                FormResultService.submissionLocks.delete(key);
+            }
+        }
+    }
     async getActiveForm(formId) {
         await this.ensureFormRepositoryInitialized();
         const form = await this.formRepository.findOne({
@@ -862,7 +1270,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         if (!form) {
             throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: 'Form not found or inactive',
-                messageKey: _config_index_js__rspack_import_11/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
             });
         }
         return form;
@@ -874,35 +1282,85 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             });
         }
     }
+    static PUBLICLY_SUBMITTABLE_ACCESS_TYPES = new Set([
+        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC,
+        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED
+    ]);
     async validateSubmissionAccess(form, user, isPublic) {
         if (isPublic) {
-            if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_12/* .FormAccessType.PUBLIC */.h.PUBLIC) {
+            if (!FormResultService.PUBLICLY_SUBMITTABLE_ACCESS_TYPES.has(form.accessType)) {
                 throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                     message: 'This form is not available for public submission',
-                    messageKey: _config_index_js__rspack_import_11/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
+                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
                 });
             }
             return;
         }
-        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_12/* .FormAccessType.PUBLIC */.h.PUBLIC) return;
+        switch(form.accessType){
+            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC:
+                return;
+            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED:
+                throw new _nestjs_common__rspack_import_3.BadRequestException({
+                    message: 'Email-verified forms must be submitted through the public endpoint',
+                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                });
+            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP:
+            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED:
+                break;
+            default:
+                throw new _nestjs_common__rspack_import_3.BadRequestException({
+                    message: 'Invalid form access type',
+                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                });
+        }
         if (!user) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: 'Authentication required to submit this form',
-                messageKey: _config_index_js__rspack_import_11/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
+                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
             });
         }
-        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_12/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
+        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
             const hasPermission = await (0,_utils_permission_utils_js__rspack_import_7/* .validateUserPermissions */.i)(user, form.actionGroups, this.cacheManager, this.formBuilderConfig.isCompanyFeatureEnabled());
             if (!hasPermission) {
                 throw new _nestjs_common__rspack_import_3.ForbiddenException({
                     message: 'You do not have permission to submit this form',
-                    messageKey: _config_index_js__rspack_import_11/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
+                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
                 });
             }
-        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_12/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
+        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
             throw new _nestjs_common__rspack_import_3.BadRequestException({
                 message: 'Invalid form access type',
-                messageKey: _config_index_js__rspack_import_11/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+            });
+        }
+    }
+    async resolveEmailVerifiedSubmitter(form, user, accessToken) {
+        if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) return null;
+        const email = await this.formEmailAuthService.resolveSubmitterEmail(form.id, user ?? undefined, accessToken);
+        if (!email) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: 'Email verification required to submit this form',
+                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.EMAIL_VERIFICATION_REQUIRED */.Q.EMAIL_VERIFICATION_REQUIRED
+            });
+        }
+        return email;
+    }
+    async assertSingleResponseNotExceeded(form, submitterEmail) {
+        if (!submitterEmail) return;
+        const settings = form.schema?.settings;
+        if (settings?.responseMode !== 'single') return;
+        const count = await this.repository.count({
+            where: {
+                formId: form.id,
+                submitterEmail,
+                isDraft: false,
+                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+            }
+        });
+        if (count > 0) {
+            throw new _nestjs_common__rspack_import_3.ConflictException({
+                message: 'You have already submitted a response to this form',
+                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.ALREADY_SUBMITTED */.y.ALREADY_SUBMITTED
             });
         }
     }
@@ -924,6 +1382,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 'schemaVersion',
                 'data',
                 'submittedById',
+                'submitterEmail',
                 'submittedAt',
                 'isDraft',
                 'createdAt',
@@ -952,7 +1411,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         if (!computedFields || computedFields.length === 0) {
             return data;
         }
-        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_13/* .calculateComputedFields */.X)(data, computedFields);
+        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_14/* .calculateComputedFields */.X)(data, computedFields);
         return {
             ...data,
             _computed: computedValues
@@ -966,6 +1425,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             schemaVersion: entity.schemaVersion,
             data: entity.data,
             submittedById: entity.submittedById,
+            submitterEmail: entity.submitterEmail,
             submittedAt: entity.submittedAt,
             isDraft: entity.isDraft,
             createdAt: entity.createdAt,
@@ -981,7 +1441,21 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         await this.ensureDataSourceRepository();
         const form = await this.getActiveForm(dto.formId);
         await this.validateSubmissionAccess(form, user, isPublic);
+        const submitterEmail = await this.resolveEmailVerifiedSubmitter(form, user, dto.accessToken);
         const isDraft = dto.isDraft ?? false;
+        const persist = ()=>this.persistSubmission(form, dto, user, submitterEmail, isDraft);
+        // Only a non-draft submission is subject to the single-response check, so
+        // only that path needs serializing against a concurrent duplicate for the
+        // same form + email (see withSubmissionLock()).
+        if (!isDraft && submitterEmail) {
+            return this.withSubmissionLock(`${form.id}:${submitterEmail}`, persist);
+        }
+        return persist();
+    }
+    async persistSubmission(form, dto, user, submitterEmail, isDraft) {
+        if (!isDraft) {
+            await this.assertSingleResponseNotExceeded(form, submitterEmail);
+        }
         const staleResults = [];
         // Handle existing draft for authenticated users
         if (user?.id) {
@@ -1013,6 +1487,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             schemaVersion: form.schemaVersion,
             data: this.applyComputedFields(dto.data, form, isDraft),
             submittedById: user?.id ?? null,
+            submitterEmail,
             submittedAt: new Date(),
             isDraft
         });
@@ -1045,7 +1520,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         if (!draft) {
             throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: 'Draft not found',
-                messageKey: _config_index_js__rspack_import_11/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
             });
         }
         const form = await this.getActiveForm(dto.formId);
@@ -1065,7 +1540,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         return this.convertEntityToResponseDto(saved, false);
     }
     async publishSubmissionEvent(result, formId, isDraft, user) {
-        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_10/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_10/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
+        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
             ids: [
                 result.id
             ],
@@ -1111,6 +1586,20 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         });
         return count > 0;
     }
+    // Anonymous-path counterpart to hasUserSubmitted, keyed by a resolved
+    // EMAIL_VERIFIED submitter email instead of a user id.
+    async hasSubmittedByEmail(formId, email) {
+        await this.ensureDataSourceRepository();
+        const count = await this.repository.count({
+            where: {
+                formId,
+                submitterEmail: email,
+                isDraft: false,
+                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+            }
+        });
+        return count > 0;
+    }
 }
 _ts_decorate([
     (0,_flusys_nestjs_shared_decorators__rspack_import_1.LogAction)({
@@ -1146,12 +1635,14 @@ FormResultService = _ts_decorate([
     _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j)),
     _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
         typeof _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j === "undefined" ? Object : _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j,
-        typeof _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._
+        typeof _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._,
+        typeof _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w === "undefined" ? Object : _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w
     ])
 ], FormResultService);
 
@@ -1161,7 +1652,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-148(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+134(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1174,8 +1665,8 @@ __webpack_require__.d(__webpack_exports__, {
 var classes_ = __webpack_require__(937);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
 var modules_ = __webpack_require__(236);
-;// CONCATENATED MODULE: external "@flusys/nestjs-shared/utils"
-
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(216);
 // EXTERNAL MODULE: external "@nestjs/common"
 var common_ = __webpack_require__(157);
 // EXTERNAL MODULE: external "typeorm"
@@ -1184,8 +1675,8 @@ var external_typeorm_ = __webpack_require__(158);
 var event_actions = __webpack_require__(769);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/config/message-keys.ts
 var message_keys = __webpack_require__(137);
-// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/entities/index.ts + 5 modules
-var entities = __webpack_require__(532);
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/entities/index.ts + 6 modules
+var entities = __webpack_require__(814);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/enums/form-access-type.enum.ts
 var form_access_type_enum = __webpack_require__(376);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/utils/permission.utils.ts
@@ -1348,7 +1839,7 @@ class FormService extends classes_.ApiService {
     async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
         // Apply company filter using shared utility
-        (0,__rspack_external__flusys_nestjs_shared_utils_9125c1f1.applyCompanyFilter)(query, {
+        (0,utils_.applyCompanyFilter)(query, {
             isCompanyFeatureEnabled: this.formBuilderConfig.isCompanyFeatureEnabled(),
             entityAlias: 'form'
         }, user);
@@ -1494,6 +1985,33 @@ class FormService extends classes_.ApiService {
             isActive: form.isActive
         };
     }
+    async getEmailVerifiedFormEntity(formId) {
+        await this.ensureDataSourceRepository();
+        const form = await this.repository.findOne({
+            where: {
+                id: formId,
+                isActive: true,
+                deletedAt: (0,external_typeorm_.IsNull)()
+            }
+        });
+        if (!form) {
+            throw new common_.NotFoundException({
+                message: 'Form not found or inactive',
+                messageKey: message_keys/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
+            });
+        }
+        if (form.accessType !== form_access_type_enum/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) {
+            throw new common_.BadRequestException({
+                message: 'This form does not use email verification',
+                messageKey: message_keys/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+            });
+        }
+        return form;
+    }
+    async getEmailVerifiedForm(formId) {
+        const form = await this.getEmailVerifiedFormEntity(formId);
+        return this.toPublicForm(form);
+    }
     async getAuthenticatedForm(formId, user) {
         const form = await this.getFormForSubmission(formId, user);
         // For action_group access, check permissions from cache
@@ -1806,6 +2324,12 @@ module.exports = __rspack_external__flusys_nestjs_shared_dtos_c4585026;
 module.exports = __rspack_external__flusys_nestjs_shared_modules_24702bee;
 
 
+},
+216(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
+
+
 },
 157(module) {