@odla-ai/chapter 0.10.1 → 0.12.0

package/dist/worker/index.cjs

@@ -184,15 +184,28 @@ async function createClerkUser(secretKey, input, fetchImpl = fetch) {
 }
 
 // src/member.ts
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(value) {
+  return typeof value === "string" && EMAIL_RE.test(value);
+}
+function clampArray(value, max) {
+  if (!Array.isArray(value)) return value;
+  return value.filter((x) => typeof x === "string" || typeof x === "number" || typeof x === "boolean").slice(0, max);
+}
+function hasDisclaimerAck(fields) {
+  return fields.disclaimerAck === true || fields.disclaimerAck === "true";
+}
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
+  const app = chapter.application;
+  const allowed = (f) => app.profileFields === null || app.profileFields.includes(f);
   const profile = {};
-  for (const f of [...chapter.application.required, ...chapter.application.optional]) {
-    if (IDENTITY_FIELDS.has(f)) continue;
+  for (const f of [...app.required, ...app.optional]) {
+    if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
     const v = fields[f];
     if (typeof v === "string" && v.trim() !== "") profile[f] = v.trim();
   }
-  if (fields.focus !== void 0) profile.focus = fields.focus;
+  if (fields.focus !== void 0 && allowed("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
   return Object.keys(profile).length > 0 ? profile : void 0;
 }
 async function submitApplication(db, chapter, fields, opts) {
@@ -206,19 +219,26 @@ async function submitApplication(db, chapter, fields, opts) {
     const cap = app.maxLen[f] ?? app.defaultMaxLen;
     if (typeof v === "string" && v.length > cap) return { ok: false, error: `${f} exceeds ${cap} characters` };
   }
+  if (app.validateEmail && typeof fields.email === "string" && !isValidEmail(fields.email)) {
+    return { ok: false, error: "email must be a valid email address" };
+  }
+  const acked = hasDisclaimerAck(fields);
+  if (app.requireDisclaimerAck && !acked) {
+    return { ok: false, error: "disclaimerAck is required" };
+  }
   const id = opts.newId();
   const row = { id, status: chapter.pipeline.initial, createdAt: opts.now };
   for (const f of [...app.required, ...app.optional]) {
     if (typeof fields[f] === "string") row[f] = fields[f].trim();
   }
-  if (fields.focus !== void 0) row.focus = fields.focus;
+  if (fields.focus !== void 0) row.focus = clampArray(fields.focus, app.maxArrayLen);
   if (opts.groupId) row.groupId = opts.groupId;
-  if (fields.disclaimerAck === true || fields.disclaimerAck === "true") row.disclaimerAckAt = opts.now;
+  if (acked) row.disclaimerAckAt = opts.now;
   const { duplicate } = await db.transact(
     [{ t: "update", ns: "applications", id, attrs: row }],
     opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
   );
-  return { ok: true, id, duplicate, status: chapter.pipeline.initial };
+  return { ok: true, id, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
 }
 function joinConfig(group, paymentsReady) {
   return {
@@ -264,7 +284,7 @@ async function projectSharedRecord(deps, person) {
   return upsertPerson(deps, { email: person.email, input: sharedPersonInput(person), mutationId: `share:${person.hubRecordId}` });
 }
 async function projectApplicant(deps, applicant) {
-  const input = sharedPersonInput({
+  const base = sharedPersonInput({
     email: applicant.email,
     firstName: applicant.firstName,
     lastName: applicant.lastName,
@@ -272,7 +292,14 @@ async function projectApplicant(deps, applicant) {
     linkedin: applicant.linkedin,
     hubRecordId: applicant.applicationId
   });
-  return upsertPerson(deps, { email: applicant.email, input, mutationId: `apply:${applicant.applicationId}` });
+  const mutationId = `apply:${applicant.applicationId}`;
+  const extra = applicant.extra ?? {};
+  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  try {
+    return await upsertPerson(deps, { email: applicant.email, input: { ...base, ...extra }, mutationId });
+  } catch {
+    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  }
 }
 
 // src/scheduling.ts
@@ -516,10 +543,14 @@ async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
   const s = (v) => typeof v === "string" ? v : void 0;
+  const extra = {};
+  for (const f of chapter.application.crmFields) {
+    if (fields[f] !== void 0) extra[f] = fields[f];
+  }
   try {
     await projectApplicant(
       { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      { applicationId, email, firstName: s(fields.firstName), lastName: s(fields.lastName), phone: s(fields.phone), linkedin: s(fields.linkedin) }
+      { applicationId, email, firstName: s(fields.firstName), lastName: s(fields.lastName), phone: s(fields.phone), linkedin: s(fields.linkedin), extra }
     );
   } catch {
   }
@@ -674,7 +705,14 @@ var handleMember = async (req, url, env, ctx) => {
       }
       await provisionApplicant(db, chapter, result.id, parsed);
     }
-    return json({ id: result.id, duplicate: result.duplicate, status: result.status });
+    return json({
+      id: result.id,
+      duplicate: result.duplicate,
+      status: result.status,
+      // Echoed so a site can see (and assert in an integration test) whether its
+      // join page actually posted the ack. Absent consent is otherwise invisible.
+      disclaimerAckAt: result.disclaimerAckAt
+    });
   }
   return null;
 };