@nextlyhq/plugin-form-builder 0.0.2-alpha.66 → 0.0.2-alpha.68

package/dist/index.js

@@ -30,8 +30,9 @@ import {
   parseRedirectReference,
   pickedDocumentField,
   pluralize,
-  toTitleCase
-} from "./chunk-VIGKSRSH.js";
+  toTitleCase,
+  warnIfWebhooksConfigured
+} from "./chunk-X5WLJLAR.js";
 
 // src/plugin.ts
 import { createRequire } from "module";
@@ -74,16 +75,13 @@ function applyRedirectPattern(pattern, document) {
 }
 
 // src/collections/access-defaults.ts
-var authenticated = ({ user }) => !!user;
-var administrative = ({ roles }) => roles.includes("admin") || roles.includes("super-admin");
+var permitted = ({ permissions, collection, operation }) => permissions.includes(`${collection}:${operation}`);
 function accessWithDefaults(overrides, defaults = {}) {
   return {
-    read: overrides?.read ?? defaults.read ?? authenticated,
-    create: overrides?.create ?? defaults.create ?? authenticated,
-    update: overrides?.update ?? authenticated,
-    // Deleting is administrative in both collections; the DB permission layer
-    // remains the backstop underneath it.
-    delete: overrides?.delete ?? administrative
+    read: overrides?.read ?? defaults.read ?? permitted,
+    create: overrides?.create ?? defaults.create ?? permitted,
+    update: overrides?.update ?? permitted,
+    delete: overrides?.delete ?? permitted
   };
 }
 
@@ -787,7 +785,8 @@ function submissionsCollection(pluginConfig) {
       ...overrides.admin
     },
     // Access control with sensible defaults
-    // Public can create (submit forms), but only authenticated users can read/update/delete
+    // Public can create (submit forms); reading, updating and deleting need the
+    // matching permission on the caller's role (`read-form-submissions`, ...).
     // `create: true` — a visitor submits without an account. Reading, updating
     // and deleting are the shared defaults.
     access: accessWithDefaults(accessOverrides, { create: true }),
@@ -2979,6 +2978,7 @@ function validateAccess(access, errors) {
 }
 function validateFormConfig(config) {
   const errors = [];
+  warnIfWebhooksConfigured(config);
   validateSlug(config.slug, errors);
   validateFields(config.fields, errors);
   validateSettings(config.settings, errors);
@@ -3057,184 +3057,6 @@ var hidden = (config) => ({
   type: "hidden"
 });
 
-// src/handlers/webhooks.ts
-import { safeFetch, ExternalUrlError } from "nextly";
-var WEBHOOK_TIMEOUT_MS = 1e4;
-var SIGNATURE_HEADER = "X-Webhook-Signature";
-var EVENT_HEADER = "X-Webhook-Event";
-var DELIVERY_ID_HEADER = "X-Webhook-Delivery-ID";
-async function generateSignature(payload, secret) {
-  const encoder = new TextEncoder();
-  const keyData = encoder.encode(secret);
-  const messageData = encoder.encode(payload);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
-  const hashArray = Array.from(new Uint8Array(signature));
-  const hashHex = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `sha256=${hashHex}`;
-}
-async function sendWebhook(webhook, payload) {
-  const startTime = Date.now();
-  const payloadString = JSON.stringify(payload);
-  try {
-    const headers = {
-      "Content-Type": "application/json",
-      [EVENT_HEADER]: payload.event,
-      [DELIVERY_ID_HEADER]: payload.submission.id,
-      ...webhook.headers
-    };
-    if (webhook.secret) {
-      headers[SIGNATURE_HEADER] = await generateSignature(
-        payloadString,
-        webhook.secret
-      );
-    }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), WEBHOOK_TIMEOUT_MS);
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: webhook.method || "POST",
-        headers,
-        body: payloadString,
-        signal: controller.signal,
-        allowLocalhost: process.env.NODE_ENV !== "production"
-      });
-      clearTimeout(timeoutId);
-      const durationMs = Date.now() - startTime;
-      if (response.ok) {
-        return {
-          url: webhook.url,
-          success: true,
-          statusCode: response.status,
-          durationMs
-        };
-      }
-      return {
-        url: webhook.url,
-        success: false,
-        statusCode: response.status,
-        error: `HTTP ${response.status}: ${response.statusText}`,
-        durationMs
-      };
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  } catch (error) {
-    const durationMs = Date.now() - startTime;
-    if (error instanceof Error && error.name === "AbortError") {
-      return {
-        url: webhook.url,
-        success: false,
-        error: `Timeout after ${WEBHOOK_TIMEOUT_MS}ms`,
-        durationMs
-      };
-    }
-    if (error instanceof ExternalUrlError) {
-      return {
-        url: webhook.url,
-        success: false,
-        error: `Webhook URL rejected for SSRF safety: ${error.message}`,
-        durationMs
-      };
-    }
-    return {
-      url: webhook.url,
-      success: false,
-      error: error instanceof Error ? error.message : String(error),
-      durationMs
-    };
-  }
-}
-async function triggerWebhooks(options) {
-  const { event, form, submission } = options;
-  const webhooks = form.webhooks || [];
-  const relevantWebhooks = webhooks.filter((w) => w.events.includes(event));
-  if (relevantWebhooks.length === 0) {
-    return {
-      triggered: 0,
-      successful: 0,
-      failed: 0,
-      results: []
-    };
-  }
-  const deliveryPromises = relevantWebhooks.map(async (webhook) => {
-    const payload = {
-      event,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      form: {
-        id: form.id,
-        slug: form.slug,
-        name: form.name
-      },
-      submission: webhook.includeData !== false ? submission : {
-        id: submission.id,
-        submittedAt: submission.submittedAt
-      }
-    };
-    return sendWebhook(webhook, payload);
-  });
-  const results = await Promise.all(deliveryPromises);
-  const successful = results.filter((r) => r.success).length;
-  const failed = results.filter((r) => !r.success).length;
-  return {
-    triggered: relevantWebhooks.length,
-    successful,
-    failed,
-    results
-  };
-}
-function fireWebhooks(options, logger) {
-  triggerWebhooks(options).then((result) => {
-    if (result.triggered > 0) {
-      if (result.failed > 0) {
-        logger?.warn?.("Some webhooks failed", {
-          event: options.event,
-          formSlug: options.form.slug,
-          submissionId: options.submission.id,
-          triggered: result.triggered,
-          successful: result.successful,
-          failed: result.failed,
-          errors: result.results.filter((r) => !r.success).map((r) => ({ url: r.url, error: r.error }))
-        });
-      } else {
-        logger?.info?.("Webhooks triggered successfully", {
-          event: options.event,
-          formSlug: options.form.slug,
-          submissionId: options.submission.id,
-          count: result.triggered
-        });
-      }
-    }
-  }).catch((error) => {
-    logger?.error?.("Unexpected error triggering webhooks", {
-      event: options.event,
-      formSlug: options.form.slug,
-      submissionId: options.submission.id,
-      error: error instanceof Error ? error.message : String(error)
-    });
-  });
-}
-function isValidWebhookUrl(url2) {
-  try {
-    const parsed = new URL(url2);
-    if (parsed.protocol !== "https:" && !parsed.hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
-      return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getSupportedWebhookEvents() {
-  return ["submission.created", "submission.updated", "submission.deleted"];
-}
-
 // src/index.ts
 var formBuilderPlugin = formBuilder().plugin;
 export {
@@ -3256,7 +3078,6 @@ export {
   exportToCSV,
   exportToJSON,
   file,
-  fireWebhooks,
   formBuilder,
   formBuilderPlugin,
   formatExportValue,
@@ -3266,7 +3087,6 @@ export {
   getFormBuilderConfig,
   getFormSubmissionStats,
   getSupportedComparisonOperators,
-  getSupportedWebhookEvents,
   getValidationErrors,
   hidden,
   isCheckboxFormField,
@@ -3279,7 +3099,6 @@ export {
   isSelectFormField,
   isTextFormField,
   isValidComparisonOperator,
-  isValidWebhookUrl,
   number,
   option,
   phone,
@@ -3293,7 +3112,6 @@ export {
   time,
   toTitleCase,
   transformFormData,
-  triggerWebhooks,
   url,
   validateFormConfig,
   validateFormData,