@formancy/server 0.10.0 → 0.12.0

package/dist/{completers-CQQDS4qr.mjs → completers-DWLA1A-r.mjs}

@@ -1,12 +1,12 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { AUDIT_ACTIONS, auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, completeBuilderRequest, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, formToFill, formVersion, healthOf, keepExamples, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, readExamples, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
+import { AUDIT_ACTIONS, auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, completeBuilderRequest, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, formToFill, formVersion, healthOf, keepExamples, listForms, listSubmissionPage, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, readExamples, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, summariseResponses, verifySolution } from "@formancy/server-core";
 import { MODEL_REQUEST_KINDS } from "@formancy/builder-core";
 import Fastify, { LogController } from "fastify";
 import rateLimit from "@fastify/rate-limit";
 import { hash, verify } from "@node-rs/argon2";
 import { SignJWT, jwtVerify } from "jose";
 import { METHODS, STATUS_CODES, validateHeaderName, validateHeaderValue } from "node:http";
-import { and, desc, eq, inArray, isNull, lt, lte, max, ne, or } from "drizzle-orm";
+import { and, desc, eq, inArray, isNull, lt, lte, max, ne, or, sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
 import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
 import postgres from "postgres";
@@ -267,17 +267,18 @@ async function accessRoutes(app, { deps, requires, audit }) {
 			error: "invalid_access",
 			message: "allowedOrigins must be an array of strings, or absent for no allowlist."
 		});
+		const allowed = origins;
 		if (!(await setFormAccess(deps, {
 			path,
 			submit,
-			...origins === void 0 ? {} : { allowedOrigins: origins }
+			...allowed === void 0 ? {} : { allowedOrigins: allowed }
 		})).ok) return reply.code(404).send({ error: "unknown_form" });
 		await audit(request, {
 			action: "form.access.changed",
 			subject: path,
 			detail: {
 				submit,
-				allowedOrigins: origins === void 0 ? "unchanged" : origins.join(" ")
+				allowedOrigins: allowed === void 0 ? "unchanged" : allowed.join(" ")
 			}
 		});
 		return reply.code(204).send();
@@ -508,7 +509,7 @@ async function submissionRoutes(app, { deps, challengeSecret, limit, actorOf })
 		if (challengeSecret === void 0) return reply.code(404).send({ error: "challenge_not_enabled" });
 		const { path } = request.params;
 		if (await deps.storage.getFormByPath(path) === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send(await mintChallenge({
+		return reply.send(mintChallenge({
 			secret: challengeSecret,
 			nowSeconds: Math.floor(new Date(deps.nowIso()).getTime() / 1e3)
 		}));
@@ -587,7 +588,7 @@ async function checkChallenge(deps, challengeSecret, request) {
 		message: "The challenge header is not base64 JSON."
 	};
 	const nowSeconds = Math.floor(new Date(deps.nowIso()).getTime() / 1e3);
-	const verified = await verifySolution(challengeSecret, solution, nowSeconds);
+	const verified = verifySolution(challengeSecret, solution, nowSeconds);
 	if (!verified.ok) return {
 		error: `challenge_${verified.reason}`,
 		message: "The challenge was not solved. Ask for a new one and try again."
@@ -1193,6 +1194,26 @@ async function createApp(storage, options) {
 	});
 	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
 		const { path } = request.params;
+		const query = request.query ?? {};
+		if (query.limit !== void 0 || query.after !== void 0) {
+			const asked = typeof query.limit === "string" ? Number.parseInt(query.limit, 10) : 100;
+			const after = query.after === void 0 ? void 0 : typeof query.after === "string" ? query.after : "";
+			const page = await listSubmissionPage(deps, path, {
+				limit: Number.isFinite(asked) ? asked : 100,
+				after
+			});
+			if (page === void 0) return reply.code(404).send({ error: "unknown_form" });
+			if (page.kind === "bad_cursor") return reply.code(400).send({ error: "bad_cursor" });
+			await audit(request, {
+				action: "submission.read",
+				subject: path,
+				detail: { count: page.submissions.length }
+			});
+			return reply.send({
+				submissions: page.submissions,
+				next: page.next
+			});
+		}
 		const listed = await listSubmissions(deps, path);
 		if (listed === void 0) return reply.code(404).send({ error: "unknown_form" });
 		await audit(request, {
@@ -1202,6 +1223,21 @@ async function createApp(storage, options) {
 		});
 		return reply.send({ submissions: listed });
 	});
+	app.get("/f/:path/summary", { preHandler: requires("submission.read") }, async (request, reply) => {
+		const { path } = request.params;
+		const versions = await summariseResponses(deps, path);
+		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const count = versions.reduce((total, version) => total + version.responses, 0);
+		await audit(request, {
+			action: "submission.read",
+			subject: path,
+			detail: {
+				count,
+				summary: true
+			}
+		});
+		return reply.send({ versions });
+	});
 	app.get("/f/:path/submissions/export.csv", { preHandler: requires("submission.export") }, async (request, reply) => {
 		const { path } = request.params;
 		const csv = await exportCsv(deps, path);
@@ -1387,6 +1423,7 @@ async function bootstrapSchema(sql) {
       data jsonb NOT NULL,
       submitted_at timestamptz NOT NULL
     )`;
+	await sql`CREATE INDEX IF NOT EXISTS submissions_by_form ON submissions (form_id, submitted_at DESC, id DESC)`;
 	await sql`
     CREATE TABLE IF NOT EXISTS webhooks (
       id uuid PRIMARY KEY,
@@ -1638,8 +1675,8 @@ function toApiKeyRecord(row) {
 }
 //#endregion
 //#region src/postgres-storage.ts
-function createPostgresStorage(sql) {
-	const db = drizzle(sql);
+function createPostgresStorage(sql$1) {
+	const db = drizzle(sql$1);
 	return {
 		...examplesStorage(db),
 		...identitiesStorage(db),
@@ -1873,6 +1910,9 @@ function createPostgresStorage(sql) {
 		async listSubmissionsByForm(formId) {
 			return (await db.select().from(submissions).where(eq(submissions.formId, formId)).orderBy(desc(submissions.submittedAt), desc(submissions.id))).map(toSubmissionRecord);
 		},
+		async pageSubmissionsByForm(formId, limit, before) {
+			return (await db.select().from(submissions).where(and(eq(submissions.formId, formId), before === void 0 ? void 0 : sql`(${submissions.submittedAt}, ${submissions.id}) < (${before.submittedAt}::timestamptz, ${before.id}::uuid)`)).orderBy(desc(submissions.submittedAt), desc(submissions.id)).limit(limit)).map(toSubmissionRecord);
+		},
 		async listVersionsByForm(formId) {
 			return (await db.select().from(formVersions).where(eq(formVersions.formId, formId)).orderBy(desc(formVersions.version))).map((row) => ({
 				id: row.id,
@@ -2380,4 +2420,4 @@ function createCompleter(settings, fetch) {
 //#endregion
 export { SUBMISSION_TOKEN_HEADER as _, createLocalFileStore as a, createPostgresStorage as c, LOG_LEVELS as d, createServerLog as f, SCHEMA_HASH_HEADER as g, maxFileBytesFrom as h, startFileCollector as i, bootstrapSchema as l, workerLog as m, MODEL_PROVIDERS as n, sha256 as o, databaseNotices as p, modelSettings as r, createPostgresRateLimitStore as s, createCompleter as t, createApp as u };
 
-//# sourceMappingURL=completers-CQQDS4qr.mjs.map
+//# sourceMappingURL=completers-DWLA1A-r.mjs.map