@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/src/modules/forms/ui/public/types.ts

@@ -0,0 +1,228 @@
+/**
+ * Public renderer (FormRunner) shared types.
+ *
+ * These types describe the runtime API responses consumed by `useFormRunner`
+ * and the data passed into individual field renderers. They mirror the JSON
+ * payload returned by phase 1c routes (`GET /api/forms/by-key/:key/active`,
+ * `POST /api/forms/form-submissions`, `GET/PATCH /api/forms/form-submissions/:id`,
+ * `POST /api/forms/form-submissions/:id/submit`).
+ */
+
+export type RunnerLocaleMap = Record<string, string>
+
+export type RunnerOption = {
+  value: string
+  label: RunnerLocaleMap
+}
+
+export type RunnerFieldNode = {
+  type: string | string[]
+  'x-om-type'?: string
+  'x-om-label'?: RunnerLocaleMap
+  'x-om-help'?: RunnerLocaleMap
+  'x-om-options'?: RunnerOption[]
+  'x-om-min'?: number
+  'x-om-max'?: number
+  'x-om-sensitive'?: boolean
+  'x-om-editable-by'?: string[]
+  'x-om-visible-to'?: string[]
+  'x-om-widget'?: string
+  enum?: unknown[]
+  minLength?: number
+  maxLength?: number
+  pattern?: string
+  [key: string]: unknown
+}
+
+export type RunnerSection = {
+  key: string
+  title: RunnerLocaleMap
+  fieldKeys: string[]
+}
+
+export type RunnerSchema = {
+  type?: string
+  'x-om-roles'?: string[]
+  'x-om-default-actor-role'?: string
+  'x-om-sections'?: RunnerSection[]
+  properties?: Record<string, RunnerFieldNode>
+  required?: string[]
+  [key: string]: unknown
+}
+
+export type RunnerFieldDescriptor = {
+  key: string
+  type: string
+  sectionKey: string | null
+  sensitive: boolean
+  editableBy: string[]
+  visibleTo: string[]
+  required: boolean
+}
+
+export type RunnerActiveFormResponse = {
+  form: {
+    id: string
+    key: string
+    name: string
+    defaultLocale: string
+    supportedLocales: string[]
+  }
+  formVersion: {
+    id: string
+    versionNumber: number
+    schemaHash: string
+    registryVersion: string
+    roles: string[]
+  }
+  schema: RunnerSchema
+  uiSchema: Record<string, unknown>
+  fieldIndex: Record<string, RunnerFieldDescriptor>
+  callerRoles: string[]
+}
+
+export type RunnerSubmissionStatus = 'draft' | 'submitted' | 'reopened' | 'archived'
+
+export type RunnerSubmission = {
+  id: string
+  organizationId: string
+  tenantId: string
+  formVersionId: string
+  subjectType: string
+  subjectId: string
+  status: RunnerSubmissionStatus
+  currentRevisionId: string | null
+  startedBy: string
+  submittedBy: string | null
+  firstSavedAt: string | null
+  submittedAt: string | null
+  submitMetadata: Record<string, unknown> | null
+  pdfSnapshotAttachmentId: string | null
+  anonymizedAt: string | null
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export type RunnerRevision = {
+  id: string
+  submissionId: string
+  revisionNumber: number
+  encryptionKeyVersion: number | null
+  savedAt: string | null
+  savedBy: string
+  savedByRole: string | null
+  changeSource: string
+  changedFieldKeys: string[]
+  changeSummary: string | null
+  anonymizedAt: string | null
+}
+
+export type RunnerActor = {
+  id: string
+  submissionId: string
+  userId: string
+  role: string
+  assignedAt: string | null
+  revokedAt: string | null
+}
+
+export type RunnerSubmissionView = {
+  submission: RunnerSubmission
+  revision: RunnerRevision
+  decoded_data: Record<string, unknown>
+  actors: RunnerActor[]
+}
+
+export type RunnerSaveResult = {
+  revision: RunnerRevision
+  coalesced: boolean
+}
+
+export type RunnerSaveState =
+  | { status: 'idle' }
+  | { status: 'dirty' }
+  | { status: 'saving' }
+  | { status: 'saved'; savedAt: string }
+  | { status: 'conflict'; message: string }
+  | { status: 'error'; message: string }
+
+export type RunnerErrorCode =
+  | 'NETWORK'
+  | 'NOT_FOUND'
+  | 'NO_PUBLISHED_VERSION'
+  | 'UNAUTHORIZED'
+  | 'VALIDATION'
+  | 'CONFLICT'
+  | 'UNKNOWN'
+
+export type RunnerLoadError = {
+  code: RunnerErrorCode
+  message: string
+}
+
+/**
+ * Reference persisted in a `file`-field value. Mirrors
+ * `schema/file-field.ts#FileAttachmentRef`.
+ */
+export type RunnerFileAttachmentRef = {
+  id: string
+  filename: string
+  contentType: string
+  sizeBytes: number
+}
+
+/**
+ * Upload transport injected into the file renderer. Hides whether the active
+ * flow is authenticated (portal) or anonymous (access token) — the runtime
+ * client supplies the correct endpoint + auth header. `downloadUrl` returns a
+ * link the participant can open to preview their own upload.
+ */
+export type RunnerAttachmentUploader = {
+  upload(args: {
+    submissionId: string
+    fieldKey: string
+    file: File
+  }): Promise<RunnerFileAttachmentRef>
+  downloadUrl(submissionId: string, attachmentId: string): string
+}
+
+export type RunnerFieldRendererProps = {
+  field: RunnerFieldDescriptor
+  fieldNode: RunnerFieldNode
+  value: unknown
+  onChange: (next: unknown) => void
+  onBlur?: () => void
+  locale: string
+  defaultLocale: string
+  disabled?: boolean
+  error?: string | null
+  inputId?: string
+  /** Present when the field can upload (file type); supplied by the runtime. */
+  uploader?: RunnerAttachmentUploader
+  /** The current submission id — required for upload/download URLs. */
+  submissionId?: string
+}
+
+export function resolveLocaleString(
+  map: RunnerLocaleMap | undefined,
+  locale: string,
+  defaultLocale: string,
+  fallback: string,
+): string {
+  if (!map) return fallback
+  if (typeof map[locale] === 'string' && map[locale].length > 0) return map[locale]
+  if (typeof map[defaultLocale] === 'string' && map[defaultLocale].length > 0) return map[defaultLocale]
+  for (const key of Object.keys(map)) {
+    const value = map[key]
+    if (typeof value === 'string' && value.length > 0) return value
+  }
+  return fallback
+}
+
+export function resolveSectionTitle(
+  section: RunnerSection,
+  locale: string,
+  defaultLocale: string,
+): string {
+  return resolveLocaleString(section.title, locale, defaultLocale, section.key)
+}

package/src/modules/forms/widgets/injection/access-audit-panel/widget.tsx

@@ -0,0 +1,144 @@
+"use client"
+
+/**
+ * Phase 2b — AccessAuditPanel injection widget.
+ *
+ * Mounts into the submission drawer's `submission-drawer:access-audit` spot.
+ * Fetches the access-audit trail for the submission from
+ * `GET /api/forms/submissions/:submissionId/access-audit` and renders each row
+ * (actor / when / purpose / IP). Shows an empty state when no rows exist.
+ *
+ * Read-only — no mutation, so it does not need `useGuardedMutation`. Uses
+ * `apiCall` (never raw fetch). Feature-gated behind `forms.view` to match the
+ * server route. Re-fetches when the host drawer fires the shared refresh event
+ * (e.g. after anonymization changes the trail).
+ */
+
+import * as React from 'react'
+import { History } from 'lucide-react'
+import type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { Tag } from '@open-mercato/ui/primitives/tag'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import {
+  FORMS_DRAWER_REFRESH_EVENT,
+  type FormsDrawerWidgetContext,
+} from '../context'
+import {
+  formatAuditRows,
+  type AccessAuditApiRow,
+  type AccessAuditPurpose,
+  type FormattedAuditRow,
+} from '../audit-format'
+
+type AccessAuditPanelProps = {
+  context: FormsDrawerWidgetContext
+}
+
+const PURPOSE_VARIANT: Record<AccessAuditPurpose, 'info' | 'success' | 'warning' | 'error' | 'neutral'> = {
+  view: 'info',
+  export: 'success',
+  revert: 'warning',
+  reopen: 'warning',
+  anonymize: 'error',
+}
+
+export function AccessAuditPanelWidget({ context }: AccessAuditPanelProps) {
+  const t = useT()
+  const submissionId = typeof context?.submissionId === 'string' ? context.submissionId : null
+  const [rows, setRows] = React.useState<FormattedAuditRow[]>([])
+  const [isLoading, setIsLoading] = React.useState(true)
+
+  const load = React.useCallback(async () => {
+    if (!submissionId) {
+      setRows([])
+      setIsLoading(false)
+      return
+    }
+    setIsLoading(true)
+    const resp = await apiCall<{ items: AccessAuditApiRow[] }>(
+      `/api/forms/submissions/${encodeURIComponent(submissionId)}/access-audit`,
+    )
+    setRows(resp.ok && resp.result ? formatAuditRows(resp.result.items) : [])
+    setIsLoading(false)
+  }, [submissionId])
+
+  React.useEffect(() => {
+    void load()
+  }, [load])
+
+  React.useEffect(() => {
+    if (typeof window === 'undefined') return
+    const handler = () => {
+      void load()
+    }
+    window.addEventListener(FORMS_DRAWER_REFRESH_EVENT, handler)
+    return () => window.removeEventListener(FORMS_DRAWER_REFRESH_EVENT, handler)
+  }, [load])
+
+  if (!submissionId) return null
+
+  return (
+    <section
+      aria-label={t('forms.compliance.audit.title', { fallback: 'Access audit' })}
+      className="flex flex-col gap-2 rounded-md border border-border bg-card p-3"
+      data-forms-access-audit-panel=""
+    >
+      <header className="flex items-center gap-2">
+        <History className="h-4 w-4 text-muted-foreground" aria-hidden="true" />
+        <h3 className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+          {t('forms.compliance.audit.title', { fallback: 'Access audit' })}
+        </h3>
+      </header>
+      {isLoading ? (
+        <div className="flex items-center justify-center py-4">
+          <Spinner className="h-4 w-4" />
+        </div>
+      ) : rows.length === 0 ? (
+        <p className="rounded-md border border-dashed border-border p-3 text-xs text-muted-foreground">
+          {t('forms.compliance.audit.empty', { fallback: 'No access events recorded yet.' })}
+        </p>
+      ) : (
+        <ul className="flex flex-col gap-1">
+          {rows.map((row) => (
+            <li
+              key={row.id}
+              className="flex items-center justify-between gap-2 rounded-md border border-border px-2 py-1.5 text-xs"
+            >
+              <div className="flex min-w-0 flex-col">
+                <span className="truncate font-mono text-muted-foreground">{row.actorShort}</span>
+                {row.timestampMs != null ? (
+                  <time className="text-muted-foreground" dateTime={new Date(row.timestampMs).toISOString()}>
+                    {new Date(row.timestampMs).toLocaleString()}
+                  </time>
+                ) : null}
+              </div>
+              <div className="flex items-center gap-2">
+                {row.ip ? <span className="font-mono text-muted-foreground">{row.ip}</span> : null}
+                <Tag variant={PURPOSE_VARIANT[row.purpose]} dot>
+                  {t(row.purposeKey, { fallback: row.purpose })}
+                </Tag>
+              </div>
+            </li>
+          ))}
+        </ul>
+      )}
+    </section>
+  )
+}
+
+const widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {
+  metadata: {
+    id: 'forms.injection.access-audit-panel',
+    title: 'Forms Submission Access Audit Panel',
+    description:
+      'Lists the access-audit trail (who/when/purpose/IP) for a submission inside the drawer; reloads on the drawer refresh event.',
+    features: ['forms.view'],
+    priority: 100,
+    enabled: true,
+  },
+  Widget: AccessAuditPanelWidget,
+}
+
+export default widget

package/src/modules/forms/widgets/injection/anonymize-button/widget.tsx

@@ -0,0 +1,177 @@
+"use client"
+
+/**
+ * Phase 2b — AnonymizeButton injection widget.
+ *
+ * Mounts into the submission drawer's `submission-drawer:anonymize-action`
+ * spot. Renders a destructive "Anonymize" button that opens a typed-confirmation
+ * dialog (the operator types `DELETE`) and then POSTs to
+ * `/api/forms/submissions/:submissionId/anonymize` with `{ confirm: 'DELETE' }`.
+ *
+ * - Feature-gated behind `forms.submissions.anonymize` (declared in metadata;
+ *   the API route enforces it server-side too — fail-closed).
+ * - Hidden once the submission is already anonymized (irreversible; no re-run).
+ * - Writes go through `useGuardedMutation(...).runMutation(...)` per the
+ *   non-CrudForm mutation contract, with `apiCall` (never raw fetch).
+ * - On success flashes and asks the host drawer to refresh via a DOM event so
+ *   the drawer reloads the now-anonymized state.
+ */
+
+import * as React from 'react'
+import { Trash2 } from 'lucide-react'
+import type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { Input } from '@open-mercato/ui/primitives/input'
+import { FormField } from '@open-mercato/ui/primitives/form-field'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@open-mercato/ui/primitives/dialog'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import {
+  FORMS_DRAWER_REFRESH_EVENT,
+  type FormsDrawerWidgetContext,
+} from '../context'
+
+const CONFIRM_TOKEN = 'DELETE'
+
+type AnonymizeButtonProps = {
+  context: FormsDrawerWidgetContext
+}
+
+export function AnonymizeButtonWidget({ context }: AnonymizeButtonProps) {
+  const t = useT()
+  const submissionId = typeof context?.submissionId === 'string' ? context.submissionId : null
+  const isAnonymized = context?.isAnonymized === true
+  const [open, setOpen] = React.useState(false)
+  const [confirmText, setConfirmText] = React.useState('')
+  const [isLoading, setIsLoading] = React.useState(false)
+  const { runMutation } = useGuardedMutation({ contextId: 'forms.submission.anonymize' })
+
+  const canSubmit = confirmText === CONFIRM_TOKEN && !isLoading && !!submissionId
+
+  const handleSubmit = React.useCallback(async () => {
+    if (!submissionId || confirmText !== CONFIRM_TOKEN) return
+    setIsLoading(true)
+    try {
+      await runMutation({
+        operation: () =>
+          apiCall(`/api/forms/submissions/${encodeURIComponent(submissionId)}/anonymize`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ confirm: CONFIRM_TOKEN }),
+          }),
+        context: { submissionId },
+        mutationPayload: { confirm: CONFIRM_TOKEN },
+      }).then((resp) => {
+        if (!resp.ok) {
+          throw new Error('forms.compliance.anonymize.failed')
+        }
+      })
+      flash(t('forms.compliance.anonymize.success', { fallback: 'Submission anonymized.' }), 'success')
+      setOpen(false)
+      setConfirmText('')
+      if (typeof window !== 'undefined') {
+        window.dispatchEvent(new CustomEvent(FORMS_DRAWER_REFRESH_EVENT, { detail: { submissionId } }))
+      }
+    } catch {
+      flash(t('forms.compliance.anonymize.failed', { fallback: 'Failed to anonymize submission.' }), 'error')
+    } finally {
+      setIsLoading(false)
+    }
+  }, [confirmText, runMutation, submissionId, t])
+
+  const onKeyDown = React.useCallback(
+    (event: React.KeyboardEvent) => {
+      if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {
+        event.preventDefault()
+        if (canSubmit) void handleSubmit()
+      } else if (event.key === 'Escape') {
+        event.preventDefault()
+        setOpen(false)
+      }
+    },
+    [canSubmit, handleSubmit],
+  )
+
+  if (!submissionId || isAnonymized) return null
+
+  return (
+    <>
+      <Button
+        type="button"
+        variant="outline"
+        size="sm"
+        onClick={() => setOpen(true)}
+        data-forms-anonymize-trigger=""
+      >
+        <Trash2 className="mr-1 h-4 w-4 text-destructive" aria-hidden="true" />
+        {t('forms.compliance.anonymize.action', { fallback: 'Anonymize' })}
+      </Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent onKeyDown={onKeyDown} data-forms-anonymize-dialog="">
+          <DialogHeader>
+            <DialogTitle>
+              {t('forms.compliance.anonymize.title', { fallback: 'Anonymize submission' })}
+            </DialogTitle>
+            <DialogDescription>
+              {t('forms.compliance.anonymize.warning', {
+                fallback:
+                  'This is irreversible. All sensitive answers will be replaced with a tombstone token. Audit rows and actor assignments survive.',
+              })}
+            </DialogDescription>
+          </DialogHeader>
+          <FormField
+            label={t('forms.compliance.anonymize.typed_confirmation', { fallback: 'Type DELETE to confirm' })}
+            required
+          >
+            <Input
+              value={confirmText}
+              onChange={(event) => setConfirmText(event.target.value)}
+              placeholder={CONFIRM_TOKEN}
+              autoComplete="off"
+              data-forms-anonymize-confirm=""
+            />
+          </FormField>
+          <DialogFooter>
+            <Button type="button" variant="ghost" size="sm" onClick={() => setOpen(false)}>
+              {t('forms.actor.cancel', { fallback: 'Cancel' })}
+            </Button>
+            <Button
+              type="button"
+              variant="destructive"
+              size="sm"
+              disabled={!canSubmit}
+              onClick={handleSubmit}
+              data-forms-anonymize-submit=""
+            >
+              {t('forms.compliance.anonymize.action', { fallback: 'Anonymize' })}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
+
+const widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {
+  metadata: {
+    id: 'forms.injection.anonymize-button',
+    title: 'Forms Submission Anonymize Button',
+    description:
+      'Typed-confirmation anonymize action mounted in the submission drawer; POSTs to the anonymize endpoint and refreshes the drawer on success.',
+    features: ['forms.submissions.anonymize'],
+    priority: 100,
+    enabled: true,
+  },
+  Widget: AnonymizeButtonWidget,
+}
+
+export default widget

package/src/modules/forms/widgets/injection/audit-format.ts

@@ -0,0 +1,60 @@
+/**
+ * Phase 2b — pure formatting helpers for the AccessAuditPanel injection widget.
+ *
+ * Kept dependency-free (no React, no I/O) so the row-shaping logic is unit
+ * testable in isolation. The panel renders the access-audit trail returned by
+ * `GET /api/forms/submissions/:submissionId/access-audit`.
+ */
+
+export type AccessAuditPurpose = 'view' | 'export' | 'revert' | 'anonymize' | 'reopen'
+
+export type AccessAuditApiRow = {
+  id: string
+  accessedBy: string
+  accessedAt: string
+  accessPurpose: AccessAuditPurpose
+  ip: string | null
+  revisionId: string | null
+}
+
+export type FormattedAuditRow = {
+  id: string
+  actorShort: string
+  purpose: AccessAuditPurpose
+  purposeKey: string
+  timestampMs: number | null
+  ip: string | null
+}
+
+const PURPOSES: ReadonlySet<string> = new Set(['view', 'export', 'revert', 'anonymize', 'reopen'])
+
+function shortenActor(accessedBy: string): string {
+  if (typeof accessedBy !== 'string' || accessedBy.length === 0) return 'system'
+  return accessedBy.length > 8 ? `${accessedBy.slice(0, 8)}…` : accessedBy
+}
+
+function parseTimestamp(value: string): number | null {
+  const ms = Date.parse(value)
+  return Number.isNaN(ms) ? null : ms
+}
+
+export function isAccessAuditPurpose(value: unknown): value is AccessAuditPurpose {
+  return typeof value === 'string' && PURPOSES.has(value)
+}
+
+export function formatAuditRow(row: AccessAuditApiRow): FormattedAuditRow {
+  const purpose: AccessAuditPurpose = isAccessAuditPurpose(row.accessPurpose) ? row.accessPurpose : 'view'
+  return {
+    id: row.id,
+    actorShort: shortenActor(row.accessedBy),
+    purpose,
+    purposeKey: `forms.compliance.audit.purpose.${purpose}`,
+    timestampMs: typeof row.accessedAt === 'string' ? parseTimestamp(row.accessedAt) : null,
+    ip: typeof row.ip === 'string' && row.ip.length > 0 ? row.ip : null,
+  }
+}
+
+export function formatAuditRows(rows: AccessAuditApiRow[]): FormattedAuditRow[] {
+  if (!Array.isArray(rows)) return []
+  return rows.map(formatAuditRow)
+}

package/src/modules/forms/widgets/injection/context.ts

@@ -0,0 +1,24 @@
+/**
+ * Phase 2b — shared types + constants for the submission-drawer injection
+ * widgets (AnonymizeButton, AccessAuditPanel, SelfAuditFooter,
+ * PdfDownloadButton).
+ *
+ * The host drawer (`SubmissionDrawer.tsx`) passes a `DrawerInjectionContext`
+ * into every spot. The injection runtime additionally merges a `sharedState`
+ * bag into the context object, so widgets accept the host shape plus that
+ * optional field — never `any`.
+ */
+
+import type { DrawerInjectionContext } from '../../backend/forms/[id]/submissions/components/SubmissionDrawer'
+
+export type FormsDrawerWidgetContext = DrawerInjectionContext & {
+  sharedState?: Record<string, unknown>
+}
+
+/**
+ * DOM event the widgets fire after a successful mutation so the host drawer can
+ * reload. The drawer listens for it and re-fetches the submission detail. The
+ * canonical string lives on the drawer module (single source of truth); it is
+ * re-exported here so the widgets stay decoupled from the drawer's internals.
+ */
+export { FORMS_DRAWER_REFRESH_EVENT } from '../../backend/forms/[id]/submissions/components/SubmissionDrawer'