@oneuptime/common 14.0.10 → 14.0.11

package/build/dist/Types/Incident/IncidentFormPublic.js

@@ -0,0 +1,678 @@
+import { parseCustomFieldDropdownOptions } from "../CustomField/CustomFieldDropdownOption";
+import CustomFieldType from "../CustomField/CustomFieldType";
+import { isCustomFieldValueEmpty } from "../CustomField/CustomFieldValueMapping";
+import { validateCustomFieldValues, } from "../CustomField/CustomFieldValueValidator";
+import ColumnLength from "../Database/ColumnLength";
+import Email from "../Email";
+/*
+ * The public half of incident forms: what the page anyone with a form's link
+ * opens is told about the form, what it sends back, and the one set of rules
+ * a submission is held to.
+ *
+ * A form is filled in by people with no OneUptime account, so nothing on the
+ * way in is trusted. The server builds the incident only from what
+ * validateIncidentFormSubmission hands back - a value assembled field by
+ * field from the answers the form actually asks for. Anything else in the
+ * request (a projectId, a state, isPrivate, an answer to a field the form
+ * does not ask) never reaches it. Every text is trimmed and capped so it fits
+ * the column it lands in, and every custom field answer is checked with the
+ * same rules as an API write (validateCustomFieldValues) plus the form's own
+ * Required.
+ *
+ * Pure, with no database or React imports: the server enforces these rules,
+ * and the public page can show the same limits before anything is sent.
+ */
+/*
+ * How the form treats one of its built-in questions. Only the description
+ * has a setting today: Title is always asked and always required.
+ */
+export var IncidentFormFieldSetting;
+(function (IncidentFormFieldSetting) {
+    IncidentFormFieldSetting["Required"] = "Required";
+    IncidentFormFieldSetting["Optional"] = "Optional";
+    IncidentFormFieldSetting["Hidden"] = "Hidden";
+})(IncidentFormFieldSetting || (IncidentFormFieldSetting = {}));
+// Every setting, in the order a picker lists them.
+export const INCIDENT_FORM_FIELD_SETTINGS = [
+    IncidentFormFieldSetting.Required,
+    IncidentFormFieldSetting.Optional,
+    IncidentFormFieldSetting.Hidden,
+];
+// What a form asks for the description when nobody chose otherwise.
+export const DEFAULT_INCIDENT_FORM_DESCRIPTION_SETTING = IncidentFormFieldSetting.Optional;
+/** Whether a value is one of the settings, spelled exactly as stored. */
+export const isIncidentFormFieldSetting = (value) => {
+    return (typeof value === "string" &&
+        INCIDENT_FORM_FIELD_SETTINGS.includes(value));
+};
+/*
+ * The longest answers a form takes. Each is at most the column the answer is
+ * stored in, so a submission that passes here cannot then fail to save:
+ *
+ *   - the title becomes Incident.title, a varchar(500);
+ *   - the description becomes Incident.description (text) - capped anyway,
+ *     since the request body may be up to 50 MB and an incident description
+ *     is read in emails, Slack and on status pages;
+ *   - each custom field text answer is stored in Incident.customFields;
+ *   - the reporter's name and email are stored on IncidentFormSubmission, in
+ *     a varchar(100) each (an email longer than that is not one anybody can
+ *     sign up to OneUptime with either).
+ */
+export const INCIDENT_FORM_TITLE_MAX_LENGTH = ColumnLength.LongText;
+export const INCIDENT_FORM_DESCRIPTION_MAX_LENGTH = 20000;
+export const INCIDENT_FORM_CUSTOM_FIELD_TEXT_MAX_LENGTH = 10000;
+export const INCIDENT_FORM_REPORTER_NAME_MAX_LENGTH = ColumnLength.ShortText;
+export const INCIDENT_FORM_REPORTER_EMAIL_MAX_LENGTH = ColumnLength.Email;
+/*
+ * The most entries a multi-select answer may have: this many, or the
+ * field's number of options when it has more. The page sends each option
+ * at most once, so a real answer never comes near it; what it bounds is a
+ * request that sends a million entries, each of which would otherwise be
+ * cleaned, sorted and quoted back in the refusal (or, for a field nobody
+ * gave options to, stored on the incident).
+ */
+export const INCIDENT_FORM_MULTI_SELECT_MAX_CHOICES = 100;
+export const INCIDENT_FORM_QUESTION_LABELS = {
+    title: "Title",
+    description: "Description",
+    severity: "Severity",
+    reporterName: "Your Name",
+    reporterEmail: "Your Email",
+};
+/*
+ * The message templates, worded as the form's own client-side checks word
+ * them (Forms/Validation and CUSTOM_FIELD_MUST_BE_CHECKED_MESSAGE), so an
+ * answer refused by the server reads like one refused in the browser.
+ */
+const REQUIRED_MESSAGE = "{{field}} is required.";
+const TOO_LONG_MESSAGE = "{{field}} cannot be more than {{maxLength}} characters.";
+const MUST_BE_CHECKED_MESSAGE = "{{field}} must be checked.";
+const TOO_MANY_CHOICES_MESSAGE = "{{field}} cannot have more than {{maxLength}} choices.";
+const NOT_A_LIST_MESSAGE = "{{field}} takes one answer, not a list.";
+const NESTED_CHOICE_MESSAGE = "{{field}} takes a list of its options, not lists or objects within it.";
+const OBJECT_ANSWER_MESSAGE = "{{field}} takes one answer, not an object.";
+const OBJECT_CHOICES_MESSAGE = "{{field}} takes a list of its options, not an object.";
+/*
+ * Replacer functions, not replacement strings: a field named "Cost ($)" or
+ * "$& total" must come out as typed, and a replacement string would read its
+ * "$" patterns.
+ */
+const fillMessage = (template, values) => {
+    return template
+        .replace("{{field}}", () => {
+        return values.field;
+    })
+        .replace("{{maxLength}}", () => {
+        var _a;
+        return String((_a = values.maxLength) !== null && _a !== void 0 ? _a : "");
+    });
+};
+/*
+ * A header the public page's own script adds to every request it makes, and
+ * the value it gives it. Reading a form needs it: another site's page can
+ * have a visitor's browser send that GET - an <img>, a link, a no-cors
+ * fetch - carrying neither of the headers that say where a request came
+ * from (over plain HTTP a browser sends neither on such a request), but it
+ * cannot add a header of its own to one. A request that adds one is
+ * preflighted first, and then carries the Origin that gives it away
+ * (SameOriginRequest). The name is in lower case, as the server reads
+ * header names.
+ */
+export const INCIDENT_FORM_PAGE_HEADER = "x-oneuptime-incident-form";
+export const INCIDENT_FORM_PAGE_HEADER_VALUE = "1";
+const isPlainObject = (value) => {
+    return (value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        !(value instanceof Date));
+};
+const hasOwn = (target, key) => {
+    return Object.prototype.hasOwnProperty.call(target, key);
+};
+/*
+ * Postgres cannot store a NUL character in a text column, nor in a jsonb
+ * string, so one pasted into an answer would fail the insert - after the
+ * checks here had passed. Nobody means to type one. no-control-regex is
+ * disabled for these two on purpose: matching control characters is exactly
+ * what they are for.
+ */
+// eslint-disable-next-line no-control-regex
+const NUL_CHARACTERS = /\u0000/g;
+// Control characters, line breaks and tabs included.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTER_RUNS = /[\u0000-\u001F\u007F]+/g;
+/*
+ * A one-line answer (the title, the reporter's name): line breaks, tabs and
+ * other control characters become spaces - a title is shown on one line in
+ * lists, emails and chat messages - runs of spaces become one, and the ends
+ * are trimmed.
+ */
+const cleanSingleLine = (value) => {
+    return value
+        .replace(CONTROL_CHARACTER_RUNS, " ")
+        .replace(/ {2,}/g, " ")
+        .trim();
+};
+/*
+ * A Markdown or multi-line answer. Blank lines before the text and
+ * whitespace after it are dropped, but the first line keeps its own
+ * indentation: four spaces there start a code block, and trimming them would
+ * turn the reporter's pasted log into a paragraph.
+ */
+const cleanMultiLine = (value) => {
+    return value
+        .replace(NUL_CHARACTERS, "")
+        .replace(/^\s*\n/, "")
+        .trimEnd();
+};
+// A dropdown option, a number or a date typed as text.
+const cleanScalarText = (value) => {
+    return value.replace(NUL_CHARACTERS, "").trim();
+};
+const KNOWN_CUSTOM_FIELD_TYPES = Object.values(CustomFieldType);
+const DROPDOWN_TYPES = [
+    CustomFieldType.Dropdown,
+    CustomFieldType.MultiSelectDropdown,
+];
+/*
+ * One asked definition as the public page sees it and as its answers are
+ * checked. A field with no type - rows from before types were required - or
+ * a type this version does not know is asked and checked as Text: the admin
+ * put it on the form, and text is what an untyped field has always held.
+ */
+const toPublicField = (definition) => {
+    if (!definition ||
+        typeof definition.name !== "string" ||
+        definition.name.length === 0) {
+        return null;
+    }
+    const customFieldType = typeof definition.customFieldType === "string" &&
+        KNOWN_CUSTOM_FIELD_TYPES.includes(definition.customFieldType)
+        ? definition.customFieldType
+        : CustomFieldType.Text;
+    const field = {
+        name: definition.name,
+        customFieldType: customFieldType,
+        isRequired: definition.isRequiredOnCreate === true,
+    };
+    if (typeof definition.description === "string" &&
+        definition.description.trim().length > 0) {
+        field.description = definition.description;
+    }
+    if (DROPDOWN_TYPES.includes(customFieldType) &&
+        typeof definition.dropdownOptions === "string" &&
+        definition.dropdownOptions.trim().length > 0) {
+        field.dropdownOptions = definition.dropdownOptions;
+    }
+    return field;
+};
+/**
+ * The custom fields the public page shows, in the order given (pass the
+ * result of getIncidentFormAskedDefinitions). A definition without a name is
+ * left out, and so is a second one with a name already listed - answers are
+ * keyed by name, so it could not be told apart.
+ */
+export const getPublicIncidentFormFields = (askedDefinitions) => {
+    const fields = [];
+    const seenNames = new Set();
+    for (const definition of askedDefinitions || []) {
+        const field = toPublicField(definition);
+        if (!field || seenNames.has(field.name)) {
+            continue;
+        }
+        seenNames.add(field.name);
+        fields.push(field);
+    }
+    return fields;
+};
+// A stored setting, or the column's default for anything else.
+const readDescriptionSetting = (value) => {
+    return isIncidentFormFieldSetting(value)
+        ? value
+        : DEFAULT_INCIDENT_FORM_DESCRIPTION_SETTING;
+};
+/**
+ * What the public page is told about a form, built field by field so that
+ * nothing else about the form - its share key, its template, its IP
+ * allowlist, its project - is ever sent. The project's severities are only
+ * listed when the reporter may choose one.
+ */
+export const getPublicIncidentForm = (data) => {
+    const publicForm = {
+        name: typeof data.form.name === "string" ? data.form.name : "",
+        descriptionSetting: readDescriptionSetting(data.form.descriptionSetting),
+        isReporterDetailsRequired: data.form.isReporterDetailsRequired !== false,
+        customFields: getPublicIncidentFormFields(data.askedDefinitions),
+        isCaptchaRequired: data.isCaptchaRequired === true,
+    };
+    if (typeof data.form.description === "string" &&
+        data.form.description.trim().length > 0) {
+        publicForm.description = data.form.description;
+    }
+    if (data.form.allowReporterToChooseSeverity === true) {
+        const severities = [];
+        // Only the three properties the page draws, whatever the caller passed.
+        for (const severity of data.severities || []) {
+            if (!severity || typeof severity._id !== "string" || !severity._id) {
+                continue;
+            }
+            const listed = {
+                _id: severity._id,
+                name: typeof severity.name === "string" ? severity.name : "",
+            };
+            if (typeof severity.color === "string" && severity.color) {
+                listed.color = severity.color;
+            }
+            severities.push(listed);
+        }
+        publicForm.severities = severities;
+        const formSeverityId = data.form.incidentSeverityId
+            ? data.form.incidentSeverityId.toString().toLowerCase()
+            : "";
+        const formSeverity = severities.find((severity) => {
+            return severity._id.toLowerCase() === formSeverityId;
+        });
+        if (formSeverity) {
+            publicForm.defaultIncidentSeverityId = formSeverity._id;
+        }
+    }
+    return publicForm;
+};
+/*
+ * An answer as it is checked and stored: text cleaned as its field shows
+ * it, "true" / "false" as the booleans the dashboard's own checkbox stores,
+ * and a multi-select as a list with each option once. Anything else is left
+ * for the checks to judge.
+ */
+const cleanAnswer = (field, value) => {
+    if (typeof value === "string") {
+        switch (field.customFieldType) {
+            case CustomFieldType.Text:
+                return cleanSingleLine(value);
+            case CustomFieldType.LongText:
+            case CustomFieldType.Markdown:
+                return cleanMultiLine(value);
+            case CustomFieldType.Boolean: {
+                const text = cleanScalarText(value);
+                if (text === "true") {
+                    return true;
+                }
+                if (text === "false") {
+                    return false;
+                }
+                return text;
+            }
+            case CustomFieldType.MultiSelectDropdown: {
+                const text = cleanScalarText(value);
+                return text.length > 0 ? [text] : [];
+            }
+            default:
+                return cleanScalarText(value);
+        }
+    }
+    if (Array.isArray(value) &&
+        field.customFieldType === CustomFieldType.MultiSelectDropdown) {
+        const entries = [];
+        const seen = new Set();
+        for (const entry of value) {
+            const cleaned = typeof entry === "string" ? cleanScalarText(entry) : entry;
+            if (cleaned === "") {
+                continue;
+            }
+            const key = `${typeof cleaned}:${String(cleaned)}`;
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            entries.push(cleaned);
+        }
+        return entries;
+    }
+    return value;
+};
+// A text answer, or any text entry of a list, longer than the cap.
+const isTooLong = (value, maxLength) => {
+    if (typeof value === "string") {
+        return value.length > maxLength;
+    }
+    if (Array.isArray(value)) {
+        return value.some((entry) => {
+            return typeof entry === "string" && entry.length > maxLength;
+        });
+    }
+    return false;
+};
+// See INCIDENT_FORM_MULTI_SELECT_MAX_CHOICES.
+const getMaxChoices = (field) => {
+    return Math.max(INCIDENT_FORM_MULTI_SELECT_MAX_CHOICES, parseCustomFieldDropdownOptions(field.dropdownOptions).length);
+};
+/*
+ * The custom field answers a submission may store. Only the fields the form
+ * asks for are read; an answer keyed by any other name is dropped unread.
+ */
+const validateAnswers = (data) => {
+    const accepted = {};
+    for (const field of data.fields) {
+        const answer = hasOwn(data.answers, field.name)
+            ? data.answers[field.name]
+            : undefined;
+        /*
+         * An answer is one value - text, a number, a yes/no - or, for a
+         * multi-select, a list of them; nothing the form's page sends is an
+         * object. So an object is refused here, unread: checking it against
+         * its field (validateCustomFieldValues) would turn all of it into text
+         * twice before refusing it, and the request may carry millions of keys
+         * or a nesting millions deep, whose conversion alone blocks the server
+         * for seconds - a minute, at the body's 50 MB.
+         */
+        if (answer !== null &&
+            typeof answer === "object" &&
+            !Array.isArray(answer)) {
+            data.errors.push(fillMessage(field.customFieldType === CustomFieldType.MultiSelectDropdown
+                ? OBJECT_CHOICES_MESSAGE
+                : OBJECT_ANSWER_MESSAGE, { field: field.name }));
+            continue;
+        }
+        /*
+         * A list is bounded before anything reads its entries: cleaning,
+         * de-duplicating and checking them, and quoting the ones that are not
+         * options back in the refusal, all cost as much as the list is long,
+         * and the request may carry millions. Only a multi-select takes a list
+         * at all, and only as many entries as it could have choices.
+         */
+        if (Array.isArray(answer) && answer.length > 0) {
+            if (field.customFieldType !== CustomFieldType.MultiSelectDropdown) {
+                data.errors.push(fillMessage(NOT_A_LIST_MESSAGE, { field: field.name }));
+                continue;
+            }
+            const maxChoices = getMaxChoices(field);
+            if (answer.length > maxChoices) {
+                data.errors.push(fillMessage(TOO_MANY_CHOICES_MESSAGE, {
+                    field: field.name,
+                    maxLength: maxChoices,
+                }));
+                continue;
+            }
+            /*
+             * Each choice is one option, so a list or an object inside the list
+             * is refused here, unread: turning a list nested thousands deep into
+             * text, as cleaning and checking the entries would, overflows the
+             * stack - a refusal must never become a thrown error.
+             */
+            if (answer.some((entry) => {
+                return entry !== null && typeof entry === "object";
+            })) {
+                data.errors.push(fillMessage(NESTED_CHOICE_MESSAGE, { field: field.name }));
+                continue;
+            }
+        }
+        const value = cleanAnswer(field, answer);
+        if (isCustomFieldValueEmpty(value)) {
+            if (field.isRequired) {
+                data.errors.push(fillMessage(field.customFieldType === CustomFieldType.Boolean
+                    ? MUST_BE_CHECKED_MESSAGE
+                    : REQUIRED_MESSAGE, { field: field.name }));
+            }
+            continue;
+        }
+        if (isTooLong(value, INCIDENT_FORM_CUSTOM_FIELD_TEXT_MAX_LENGTH)) {
+            data.errors.push(fillMessage(TOO_LONG_MESSAGE, {
+                field: field.name,
+                maxLength: INCIDENT_FORM_CUSTOM_FIELD_TEXT_MAX_LENGTH,
+            }));
+            continue;
+        }
+        const typeErrors = validateCustomFieldValues({
+            definitions: [
+                {
+                    name: field.name,
+                    customFieldType: field.customFieldType,
+                    dropdownOptions: field.dropdownOptions,
+                },
+            ],
+            customFields: { [field.name]: value },
+            storedCustomFields: {},
+        });
+        if (typeErrors.length > 0) {
+            data.errors.push(...typeErrors.map((error) => {
+                return error.message;
+            }));
+            continue;
+        }
+        /*
+         * A required yes/no question is an acknowledgement: only a tick answers
+         * it, as on the dashboard (CUSTOM_FIELD_MUST_BE_CHECKED_MESSAGE).
+         */
+        if (field.isRequired &&
+            field.customFieldType === CustomFieldType.Boolean &&
+            value !== true) {
+            data.errors.push(fillMessage(MUST_BE_CHECKED_MESSAGE, { field: field.name }));
+            continue;
+        }
+        /*
+         * Defined, not assigned: a field may be named "__proto__", and assigning
+         * that name would set the object's prototype instead of storing the
+         * answer.
+         */
+        Object.defineProperty(accepted, field.name, {
+            value: value,
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
+    return accepted;
+};
+/*
+ * Email alone finds an address anywhere in a text - "Jane <jane@x.test>"
+ * passes it - so the whole answer must also be one ordinary address: the
+ * dot-atom half of Email's own pattern, anchored at both ends.
+ */
+export const WHOLE_EMAIL_ADDRESS = /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i;
+/*
+ * One of the built-in text questions: "" when it was not answered, the
+ * cleaned text when it was, and null - with the problem recorded - when the
+ * answer is not text at all, so the caller does not also call it missing.
+ */
+const readTextAnswer = (data) => {
+    if (data.value === undefined || data.value === null) {
+        return "";
+    }
+    if (typeof data.value !== "string") {
+        data.errors.push(`${data.label} must be text.`);
+        return null;
+    }
+    return data.clean(data.value);
+};
+// Required and too-long checks for a built-in text question.
+const checkLength = (data) => {
+    if (data.text.length === 0) {
+        if (data.isRequired) {
+            data.errors.push(fillMessage(REQUIRED_MESSAGE, { field: data.label }));
+        }
+        return;
+    }
+    if (data.text.length > data.maxLength) {
+        data.errors.push(fillMessage(TOO_LONG_MESSAGE, {
+            field: data.label,
+            maxLength: data.maxLength,
+        }));
+    }
+};
+/**
+ * Checks a submission against its form and returns either every problem
+ * with it, or the answers the incident may be built from. Never throws on a
+ * parsed JSON body, whatever it holds.
+ *
+ * - Title: always required, one line, at most 500 characters.
+ * - Description: ignored when the form hides it; required or optional
+ *   otherwise, at most 20000 characters.
+ * - Severity: only read when the form lets the reporter choose, and then it
+ *   must be one of the project's severities. Leaving it out means the
+ *   form's own severity.
+ * - Name and email: required unless the form says otherwise; when given,
+ *   the name is at most 100 characters and the email one valid address of
+ *   at most 100.
+ * - Custom fields: only those the form asks, each checked as an API write
+ *   would be, required ones filled in (a required yes/no ticked), text at
+ *   most 10000 characters, never an object, a list only for a multi-select
+ *   and then with at most 100 choices (or as many as it has options), none
+ *   of them a list or an object. Answers to anything else are dropped.
+ *
+ * No check costs more for a larger body: text is measured, a list is
+ * counted and an object refused before anything reads what they hold.
+ */
+export const validateIncidentFormSubmission = (data) => {
+    if (!isPlainObject(data.data)) {
+        return {
+            isValid: false,
+            errors: [
+                "The submission must be an object holding the form's answers.",
+            ],
+        };
+    }
+    const input = data.data;
+    const form = data.form || {};
+    const labels = INCIDENT_FORM_QUESTION_LABELS;
+    const errors = [];
+    // Title: always asked, always required.
+    const title = readTextAnswer({
+        value: input["title"],
+        label: labels.title,
+        clean: cleanSingleLine,
+        errors: errors,
+    });
+    if (title !== null) {
+        checkLength({
+            text: title,
+            label: labels.title,
+            isRequired: true,
+            maxLength: INCIDENT_FORM_TITLE_MAX_LENGTH,
+            errors: errors,
+        });
+    }
+    // Description: not even read when the form hides it.
+    const descriptionSetting = readDescriptionSetting(form.descriptionSetting);
+    let description = "";
+    if (descriptionSetting !== IncidentFormFieldSetting.Hidden) {
+        description = readTextAnswer({
+            value: input["description"],
+            label: labels.description,
+            clean: cleanMultiLine,
+            errors: errors,
+        });
+        if (description !== null) {
+            checkLength({
+                text: description,
+                label: labels.description,
+                isRequired: descriptionSetting === IncidentFormFieldSetting.Required,
+                maxLength: INCIDENT_FORM_DESCRIPTION_MAX_LENGTH,
+                errors: errors,
+            });
+        }
+    }
+    // Severity: only a choice the form offers, and only when it offers one.
+    let incidentSeverityId = undefined;
+    if (form.allowReporterToChooseSeverity === true) {
+        const requested = input["incidentSeverityId"];
+        const isUnanswered = requested === undefined ||
+            requested === null ||
+            (typeof requested === "string" && requested.trim().length === 0);
+        if (!isUnanswered) {
+            const requestedId = typeof requested === "string" ? requested.trim().toLowerCase() : "";
+            const listed = requestedId
+                ? (data.severities || []).find((severity) => {
+                    return (typeof (severity === null || severity === void 0 ? void 0 : severity._id) === "string" &&
+                        severity._id.toLowerCase() === requestedId);
+                })
+                : undefined;
+            if (listed) {
+                incidentSeverityId = listed._id;
+            }
+            else {
+                errors.push(`${labels.severity} must be one of the severities this form lists.`);
+            }
+        }
+    }
+    // The reporter: required unless the form says otherwise.
+    const detailsRequired = form.isReporterDetailsRequired !== false;
+    const reporterName = readTextAnswer({
+        value: input["reporterName"],
+        label: labels.reporterName,
+        clean: cleanSingleLine,
+        errors: errors,
+    });
+    if (reporterName !== null) {
+        checkLength({
+            text: reporterName,
+            label: labels.reporterName,
+            isRequired: detailsRequired,
+            maxLength: INCIDENT_FORM_REPORTER_NAME_MAX_LENGTH,
+            errors: errors,
+        });
+    }
+    let reporterEmail = readTextAnswer({
+        value: input["reporterEmail"],
+        label: labels.reporterEmail,
+        clean: cleanScalarText,
+        errors: errors,
+    });
+    if (reporterEmail !== null) {
+        const errorCount = errors.length;
+        checkLength({
+            text: reporterEmail,
+            label: labels.reporterEmail,
+            isRequired: detailsRequired,
+            maxLength: INCIDENT_FORM_REPORTER_EMAIL_MAX_LENGTH,
+            errors: errors,
+        });
+        if (reporterEmail.length > 0 && errors.length === errorCount) {
+            if (WHOLE_EMAIL_ADDRESS.test(reporterEmail) &&
+                Email.isValid(reporterEmail)) {
+                reporterEmail = new Email(reporterEmail).toString();
+            }
+            else {
+                errors.push(`${labels.reporterEmail} is not a valid email address.`);
+            }
+        }
+    }
+    // Custom fields: only the ones the form asks for are read.
+    const rawAnswers = input["customFields"];
+    let answers = {};
+    if (isPlainObject(rawAnswers)) {
+        answers = rawAnswers;
+    }
+    else if (rawAnswers !== undefined && rawAnswers !== null) {
+        errors.push("The custom field answers must be an object keyed by field name.");
+    }
+    const customFields = validateAnswers({
+        fields: getPublicIncidentFormFields(data.askedDefinitions || []),
+        answers: answers,
+        errors: errors,
+    });
+    if (errors.length > 0) {
+        return { isValid: false, errors: errors };
+    }
+    const value = {
+        title: title || "",
+        customFields: customFields,
+    };
+    if (description) {
+        value.description = description;
+    }
+    if (incidentSeverityId) {
+        value.incidentSeverityId = incidentSeverityId;
+    }
+    if (reporterName) {
+        value.reporterName = reporterName;
+    }
+    if (reporterEmail) {
+        value.reporterEmail = reporterEmail;
+    }
+    return { isValid: true, value: value };
+};
+/** Every problem as one message, for an API error response. */
+export const formatIncidentFormSubmissionErrors = (errors) => {
+    return errors.join(" ");
+};
+//# sourceMappingURL=IncidentFormPublic.js.map