@frigear-nu/forms 0.0.5 → 0.0.7

package/dist/runtime/server/routes/admin/form-password.delete.js

@@ -0,0 +1,8 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  await db.delete(schema.formAccess).where(eq(schema.formAccess.formId, form.id));
+  return { set: false };
+});

package/dist/runtime/server/routes/admin/form-password.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-password.get.js

@@ -0,0 +1,8 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const [row] = await db.select({ formId: schema.formAccess.formId }).from(schema.formAccess).where(eq(schema.formAccess.formId, form.id)).limit(1);
+  return { set: !!row };
+});

package/dist/runtime/server/routes/admin/form-password.put.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-password.put.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { db, schema } from "@nuxthub/db";
+const input = z.object({ password: z.string().min(6).max(200) });
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const { password } = await readValidatedBody(event, input.parse);
+  const passwordHash = await hashPassword(password);
+  await db.insert(schema.formAccess).values({ formId: form.id, passwordHash }).onConflictDoUpdate({
+    target: schema.formAccess.formId,
+    set: { passwordHash, updatedAt: /* @__PURE__ */ new Date() }
+  });
+  return { set: true };
+});

package/dist/runtime/server/routes/admin/form-secret.delete.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-secret.delete.js

@@ -0,0 +1,8 @@
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const key = getRouterParam(event, "key");
+  if (!isFormSecretKey(key)) throw createError({ statusCode: 400, statusMessage: "Unknown secret key." });
+  await deleteFormSecret(form.id, key);
+  return describeFormSecrets(event, form.id);
+});

package/dist/runtime/server/routes/admin/form-secrets.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-secrets.get.js

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  return describeFormSecrets(event, form.id);
+});

package/dist/runtime/server/routes/admin/form-secrets.put.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-secrets.put.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+const input = z.object({
+  key: z.string().refine(isFormSecretKey, "Unknown secret key."),
+  value: z.string().trim().min(1).max(2e3)
+});
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const { key, value } = await readValidatedBody(event, input.parse);
+  await setFormSecret(form.id, key, value);
+  return describeFormSecrets(event, form.id);
+});

package/dist/runtime/server/routes/admin/form-token.delete.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-token.delete.js

@@ -0,0 +1,12 @@
+import { and, eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const [row] = await db.update(schema.formAccessTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and(
+    eq(schema.formAccessTokens.id, getRouterParam(event, "tokenId")),
+    eq(schema.formAccessTokens.formId, form.id)
+  )).returning();
+  if (!row) throw createError({ statusCode: 404, statusMessage: "Token not found." });
+  return toTokenDto(row);
+});

package/dist/runtime/server/routes/admin/form-tokens.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-tokens.get.js

@@ -0,0 +1,8 @@
+import { desc, eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const rows = await db.select().from(schema.formAccessTokens).where(eq(schema.formAccessTokens.formId, form.id)).orderBy(desc(schema.formAccessTokens.createdAt));
+  return rows.map(toTokenDto);
+});

package/dist/runtime/server/routes/admin/form-tokens.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/form-tokens.post.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { db, schema } from "@nuxthub/db";
+const input = z.object({ name: z.string().trim().min(1).max(100) });
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const { name } = await readValidatedBody(event, input.parse);
+  const { id, token, tokenHash, prefix } = await generateToken();
+  const [row] = await db.insert(schema.formAccessTokens).values({ id, formId: form.id, name, tokenHash, prefix }).returning();
+  setResponseStatus(event, 201);
+  return { ...toTokenDto(row), token };
+});

package/dist/runtime/server/routes/admin/form.get.js

@@ -1,4 +1,8 @@
+import { count, eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
 export default defineEventHandler(async (event) => {
   await requireFormsManager(event);
-  return toAdminForm(await findFormById(getRouterParam(event, "id")));
+  const row = await findFormById(getRouterParam(event, "id"));
+  const [totals] = await db.select({ total: count() }).from(schema.formSubmissions).where(eq(schema.formSubmissions.formId, row.id));
+  return { ...toAdminForm(row), submissionCount: totals?.total ?? 0 };
 });

package/dist/runtime/server/routes/admin/form.patch.js

@@ -1,17 +1,8 @@
-import { eq } from "drizzle-orm";
-import { db, schema } from "@nuxthub/db";
 import { formPatch } from "../../utils/admin-schemas.js";
 export default defineEventHandler(async (event) => {
   await requireFormsManager(event);
-  const current = await findFormById(getRouterParam(event, "id"));
+  const id = getRouterParam(event, "id");
+  await findFormById(id);
   const input = await readValidatedBody(event, formPatch.parse);
-  if (input.slug && input.slug !== current.slug && await findFormBySlug(input.slug)) {
-    throw createError({ statusCode: 409, statusMessage: "A form with this slug already exists." });
-  }
-  const definitionChanged = input.definition !== void 0 && JSON.stringify(input.definition) !== JSON.stringify(current.definition);
-  const [row] = await db.update(schema.forms).set({
-    ...input,
-    version: definitionChanged ? current.version + 1 : current.version
-  }).where(eq(schema.forms.id, current.id)).returning();
-  return toAdminForm(row);
+  return toAdminForm(await patchForm(id, input));
 });

package/dist/runtime/server/routes/admin/forms.post.js

@@ -1,13 +1,8 @@
-import { db, schema } from "@nuxthub/db";
-import { newId } from "../../../utils/index.js";
 import { formInput } from "../../utils/admin-schemas.js";
 export default defineEventHandler(async (event) => {
   await requireFormsManager(event);
   const input = await readValidatedBody(event, formInput.parse);
-  if (await findFormBySlug(input.slug)) {
-    throw createError({ statusCode: 409, statusMessage: "A form with this slug already exists." });
-  }
-  const [row] = await db.insert(schema.forms).values({ id: newId("frm"), ...input }).returning();
+  const row = await createForm(input);
   setResponseStatus(event, 201);
   return toAdminForm(row);
 });

package/dist/runtime/server/routes/public/access.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/public/access.get.js

@@ -0,0 +1,3 @@
+export default defineEventHandler(async (event) => {
+  return describeFormAccess(event, await findPublishedForm(getRouterParam(event, "slug")));
+});

package/dist/runtime/server/routes/public/form.get.js

@@ -1,3 +1,5 @@
 export default defineEventHandler(async (event) => {
-  return toPublicForm(await findPublishedForm(getRouterParam(event, "slug")));
+  const form = await findPublishedForm(getRouterParam(event, "slug"));
+  await authorizeFormAccess(event, form);
+  return toPublicForm(form);
 });

package/dist/runtime/server/routes/public/submit.post.js

@@ -2,6 +2,6 @@ export default defineEventHandler(async (event) => {
   const slug = getRouterParam(event, "slug");
   await enforceRateLimit(event, slug);
   const form = await findPublishedForm(slug);
-  const session = await getUserSession(event);
-  return processSubmission(event, form, session.user?.id ?? null);
+  const { userId } = await authorizeFormAccess(event, form);
+  return processSubmission(event, form, userId);
 });

package/dist/runtime/server/utils/access.d.ts

@@ -0,0 +1,27 @@
+import type { H3Event } from 'h3';
+import { schema } from '@nuxthub/db';
+import type { FormAccessInfoDto } from '../../../types.js';
+type FormRow = typeof schema.forms.$inferSelect;
+export declare const TOKEN_HEADER = "x-form-token";
+export declare const PASSWORD_HEADER = "x-form-password";
+export declare function hashToken(token: string): Promise<string>;
+/** A new random token (shown once), its hash and its display prefix. */
+export declare function generateToken(): Promise<{
+    id: string;
+    token: string;
+    tokenHash: string;
+    prefix: string;
+}>;
+/** `Authorization: Bearer <token>` or `x-form-token: <token>`. */
+export declare function readToken(event: H3Event): string | undefined;
+/**
+ * The single access gate of the public routes (definition and submit). Resolves the submitter's user id
+ * (when signed in) and throws 401 unless the form's `access.auth` is satisfied. API-only forms are
+ * still served here: `availability` only removes the public page.
+ */
+export declare function authorizeFormAccess(event: H3Event, form: FormRow): Promise<{
+    userId: number | null;
+}>;
+/** Public facts the page needs to pick between the form, a gate and "not found". */
+export declare function describeFormAccess(event: H3Event, form: FormRow): Promise<FormAccessInfoDto>;
+export {};

package/dist/runtime/server/utils/access.js

@@ -0,0 +1,63 @@
+import { and, eq, isNull } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { isFormOpen, newId, nextFormOpening, resolveAccess } from "../../utils/index.js";
+export const TOKEN_HEADER = "x-form-token";
+export const PASSWORD_HEADER = "x-form-password";
+const TOKEN_PREFIX = "ffk_";
+const toHex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+export async function hashToken(token) {
+  return toHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token)));
+}
+export async function generateToken() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  const token = `${TOKEN_PREFIX}${btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "")}`;
+  return { id: newId("fat"), token, tokenHash: await hashToken(token), prefix: token.slice(0, 8) };
+}
+export function readToken(event) {
+  const authorization = getRequestHeader(event, "authorization")?.trim() ?? "";
+  const bearer = authorization.slice(0, 7).toLowerCase() === "bearer " ? authorization.slice(7).trim() : "";
+  return bearer || getRequestHeader(event, TOKEN_HEADER)?.trim() || void 0;
+}
+const unauthorized = (event, message, scheme) => {
+  if (scheme) setResponseHeader(event, "www-authenticate", scheme);
+  return createError({ statusCode: 401, statusMessage: message, data: { access: true } });
+};
+async function verifyToken(event, form) {
+  const token = readToken(event);
+  if (!token) throw unauthorized(event, "A form token is required.", "Bearer");
+  const [row] = await db.select({ id: schema.formAccessTokens.id }).from(schema.formAccessTokens).where(and(
+    eq(schema.formAccessTokens.formId, form.id),
+    eq(schema.formAccessTokens.tokenHash, await hashToken(token)),
+    isNull(schema.formAccessTokens.revokedAt)
+  )).limit(1);
+  if (!row) throw unauthorized(event, "Invalid or revoked form token.", "Bearer");
+  await db.update(schema.formAccessTokens).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq(schema.formAccessTokens.id, row.id));
+}
+async function verifyFormPassword(event, form) {
+  const password = getRequestHeader(event, PASSWORD_HEADER);
+  if (!password) throw unauthorized(event, "A form password is required.");
+  await assertPasswordAttemptsLeft(event, form.slug);
+  const [row] = await db.select().from(schema.formAccess).where(eq(schema.formAccess.formId, form.id)).limit(1);
+  if (!row || !await verifyPassword(row.passwordHash, password)) {
+    await recordPasswordFailure(event, form.slug);
+    throw unauthorized(event, "Wrong form password.");
+  }
+}
+export async function authorizeFormAccess(event, form) {
+  const { auth, schedule } = resolveAccess(form.definition);
+  if (!isFormOpen(schedule)) {
+    const opensAt = nextFormOpening(schedule);
+    throw createError({ statusCode: 403, statusMessage: "This form is closed.", data: { closed: true, opensAt: opensAt?.toISOString() ?? null } });
+  }
+  const user = await getUser(event, { scopes: ["forms:submit"] });
+  if (auth === "user" && !user) throw unauthorized(event, "Sign in to use this form.");
+  if (auth === "token") await verifyToken(event, form);
+  if (auth === "password") await verifyFormPassword(event, form);
+  return { userId: user?.id ?? null };
+}
+export async function describeFormAccess(event, form) {
+  const user = await getUser(event, { scopes: ["forms:submit"] });
+  const access = resolveAccess(form.definition);
+  const open = isFormOpen(access.schedule);
+  return { slug: form.slug, name: form.name, access, signedIn: !!user, open, opensAt: open ? null : nextFormOpening(access.schedule)?.toISOString() ?? null };
+}