@orion-studios/payload-studio 0.6.0-beta.8 → 0.7.0

package/dist/forms/server.js

@@ -0,0 +1,442 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/forms/server.ts
+var server_exports = {};
+__export(server_exports, {
+  createFormSubmissionHandler: () => createFormSubmissionHandler,
+  createMemoryRateLimitStore: () => createMemoryRateLimitStore,
+  formatPhoneUS: () => formatPhoneUS,
+  inferFieldType: () => inferFieldType,
+  normalizeEmail: () => normalizeEmail,
+  normalizeFieldValue: () => normalizeFieldValue,
+  normalizePhone: () => normalizePhone,
+  normalizeUrl: () => normalizeUrl,
+  validateEmail: () => validateEmail,
+  validatePhoneUS: () => validatePhoneUS,
+  validateRequired: () => validateRequired,
+  validateUrl: () => validateUrl
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/forms/validation.ts
+var MAJOR_EMAIL_PROVIDERS = [
+  "gmail.com",
+  "yahoo.com",
+  "outlook.com",
+  "hotmail.com",
+  "icloud.com",
+  "live.com",
+  "protonmail.com"
+];
+var KNOWN_GOOD_DOMAINS = /* @__PURE__ */ new Set([
+  ...MAJOR_EMAIL_PROVIDERS,
+  "aol.com",
+  "gmx.com",
+  "googlemail.com",
+  "hey.com",
+  "mac.com",
+  "mail.com",
+  "me.com",
+  "msn.com",
+  "pm.me",
+  "proton.me",
+  "ymail.com",
+  "zoho.com"
+]);
+var EXPLICIT_TYPO_MAP = {
+  "gamil.com": "gmail.com",
+  "gmial.com": "gmail.com",
+  "gmai.com": "gmail.com",
+  "gmaill.com": "gmail.com",
+  "gmail.co": "gmail.com",
+  "gmail.con": "gmail.com",
+  "gmail.cmo": "gmail.com",
+  "hotmial.com": "hotmail.com",
+  "hotmall.com": "hotmail.com",
+  "hotmail.co": "hotmail.com",
+  "hotmail.con": "hotmail.com",
+  "iclod.com": "icloud.com",
+  "icloud.co": "icloud.com",
+  "icoud.com": "icloud.com",
+  "outlok.com": "outlook.com",
+  "outloook.com": "outlook.com",
+  "outlook.co": "outlook.com",
+  "outlook.con": "outlook.com",
+  "protonmail.co": "protonmail.com",
+  "yaho.com": "yahoo.com",
+  "yahooo.com": "yahoo.com",
+  "yahoo.co": "yahoo.com",
+  "yahoo.con": "yahoo.com"
+};
+var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  const dist = Array.from({ length: cols }, (_, j) => j);
+  for (let i = 1; i < rows; i += 1) {
+    let prevDiagonal = dist[0];
+    dist[0] = i;
+    for (let j = 1; j < cols; j += 1) {
+      const temp = dist[j];
+      dist[j] = Math.min(
+        dist[j] + 1,
+        dist[j - 1] + 1,
+        prevDiagonal + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+      prevDiagonal = temp;
+    }
+  }
+  return dist[cols - 1];
+}
+function normalizeEmail(value) {
+  return value.trim().toLowerCase();
+}
+function validateEmail(value, options = {}) {
+  const normalized = normalizeEmail(value);
+  if (normalized.length === 0) {
+    return { valid: false, normalized, message: "Email is required." };
+  }
+  if (!EMAIL_PATTERN.test(normalized)) {
+    return { valid: false, normalized, message: "Enter a valid email address." };
+  }
+  const [localPart, domain] = normalized.split("@");
+  const knownGood = options.knownGoodDomains ? /* @__PURE__ */ new Set([...KNOWN_GOOD_DOMAINS, ...options.knownGoodDomains.map((entry) => entry.toLowerCase())]) : KNOWN_GOOD_DOMAINS;
+  if (knownGood.has(domain)) {
+    return { valid: true, normalized };
+  }
+  const explicitCorrection = EXPLICIT_TYPO_MAP[domain];
+  if (explicitCorrection) {
+    const suggestion = `${localPart}@${explicitCorrection}`;
+    return {
+      valid: false,
+      normalized,
+      message: `Did you mean ${suggestion}?`,
+      suggestion
+    };
+  }
+  for (const provider of MAJOR_EMAIL_PROVIDERS) {
+    if (levenshtein(domain, provider) === 1) {
+      const suggestion = `${localPart}@${provider}`;
+      return {
+        valid: false,
+        normalized,
+        message: `Did you mean ${suggestion}?`,
+        suggestion
+      };
+    }
+  }
+  return { valid: true, normalized };
+}
+function normalizePhone(value) {
+  const digits = value.replace(/\D+/g, "");
+  if (digits.length === 11 && digits.startsWith("1")) {
+    return digits.slice(1);
+  }
+  return digits;
+}
+function formatPhoneUS(value) {
+  const digits = normalizePhone(value).slice(0, 10);
+  if (digits.length === 0) return "";
+  if (digits.length < 4) return `(${digits}`;
+  if (digits.length < 7) return `(${digits.slice(0, 3)}) ${digits.slice(3)}`;
+  return `(${digits.slice(0, 3)}) ${digits.slice(3, 6)}-${digits.slice(6)}`;
+}
+function validatePhoneUS(value) {
+  const digits = normalizePhone(value);
+  if (digits.length === 0) {
+    return { valid: false, normalized: "", message: "Phone number is required." };
+  }
+  if (digits.length !== 10) {
+    return { valid: false, normalized: digits, message: "Enter a 10-digit phone number." };
+  }
+  return { valid: true, normalized: digits };
+}
+function normalizeUrl(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return "";
+  if (/^https?:\/\//i.test(trimmed)) return trimmed;
+  return `https://${trimmed}`;
+}
+function validateUrl(value) {
+  const normalized = normalizeUrl(value);
+  if (normalized.length === 0) {
+    return { valid: false, normalized, message: "URL is required." };
+  }
+  try {
+    const parsed = new URL(normalized);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      return { valid: false, normalized, message: "Enter a valid web address." };
+    }
+    if (!parsed.hostname.includes(".")) {
+      return { valid: false, normalized, message: "Enter a valid web address." };
+    }
+    return { valid: true, normalized };
+  } catch {
+    return { valid: false, normalized, message: "Enter a valid web address." };
+  }
+}
+function validateRequired(value, label = "This field") {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  const present = typeof value === "string" ? normalized.length > 0 : Array.isArray(value) ? value.length > 0 : value !== null && value !== void 0 && value !== false;
+  if (!present) {
+    return { valid: false, normalized, message: `${label} is required.` };
+  }
+  return { valid: true, normalized: typeof value === "string" ? normalized : String(value) };
+}
+function normalizeFieldValue(value, fieldType) {
+  switch (fieldType) {
+    case "email":
+      return normalizeEmail(value);
+    case "phone":
+      return normalizePhone(value);
+    case "url":
+      return normalizeUrl(value);
+    default:
+      return value.trim();
+  }
+}
+function inferFieldType(field) {
+  const type = typeof field.type === "string" ? field.type.toLowerCase() : "";
+  if (type === "email" || type === "phone" || type === "tel" || type === "url") {
+    return type === "tel" ? "phone" : type;
+  }
+  const name = typeof field.name === "string" ? field.name.toLowerCase() : "";
+  if (name.includes("email")) return "email";
+  if (name.includes("phone") || name.includes("mobile")) return "phone";
+  if (name.includes("website") || name.endsWith("url")) return "url";
+  return "text";
+}
+
+// src/forms/submissionHandler.ts
+function createMemoryRateLimitStore(options) {
+  const max = options?.max ?? 5;
+  const windowMs = options?.windowMs ?? 6e4;
+  const hits = /* @__PURE__ */ new Map();
+  return {
+    isLimited(key, now) {
+      const windowStart = now - windowMs;
+      const entries = (hits.get(key) || []).filter((timestamp) => timestamp > windowStart);
+      entries.push(now);
+      hits.set(key, entries);
+      if (hits.size > 1e4) {
+        for (const [entryKey, timestamps] of hits) {
+          if (timestamps.every((timestamp) => timestamp <= windowStart)) {
+            hits.delete(entryKey);
+          }
+        }
+      }
+      return entries.length > max;
+    }
+  };
+}
+var json = (body, status) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+var getClientKey = (request) => {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    return forwarded.split(",")[0].trim();
+  }
+  return request.headers.get("x-real-ip") || "unknown";
+};
+var isOriginAllowed = (request, allowedOrigins) => {
+  const origin = request.headers.get("origin");
+  if (!origin) {
+    return true;
+  }
+  if (allowedOrigins && allowedOrigins.length > 0) {
+    return allowedOrigins.includes(origin);
+  }
+  const host = request.headers.get("x-forwarded-host") || request.headers.get("host");
+  if (!host) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+};
+var collectFormFieldDefinitions = (formDoc) => {
+  const steps = Array.isArray(formDoc.steps) ? formDoc.steps : [];
+  const definitions = [];
+  for (const step of steps) {
+    if (!step || typeof step !== "object") continue;
+    const fields = step.fields;
+    for (const field of Array.isArray(fields) ? fields : []) {
+      if (!field || typeof field !== "object") continue;
+      const record = field;
+      const name = typeof record.name === "string" ? record.name.trim() : "";
+      if (!name) continue;
+      definitions.push({
+        name,
+        type: inferFieldType(record),
+        required: record.required === true,
+        label: typeof record.label === "string" && record.label.length > 0 ? record.label : name
+      });
+    }
+  }
+  return definitions;
+};
+function createFormSubmissionHandler(options) {
+  const {
+    getPayloadClient,
+    formsCollectionSlug = "forms",
+    submissionsCollectionSlug = "form-submissions",
+    allowedOrigins,
+    honeypotFieldName = "website_url_confirm",
+    minFillTimeMs = 3e3,
+    knownGoodEmailDomains,
+    onSubmission
+  } = options;
+  const rateLimitStore = options.rateLimitStore === null ? null : options.rateLimitStore || createMemoryRateLimitStore();
+  return async function POST(request, context) {
+    if (!isOriginAllowed(request, allowedOrigins)) {
+      return json({ error: "Origin not allowed." }, 403);
+    }
+    const now = Date.now();
+    if (rateLimitStore && rateLimitStore.isLimited(getClientKey(request), now)) {
+      return json({ error: "Too many requests. Please try again shortly." }, 429);
+    }
+    const params = await context.params;
+    const slug = typeof params?.slug === "string" ? params.slug : "";
+    if (!slug) {
+      return json({ error: "Unknown form." }, 404);
+    }
+    let body;
+    try {
+      const parsed = await request.json();
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return json({ error: "Invalid submission body." }, 400);
+      }
+      body = parsed;
+    } catch {
+      return json({ error: "Invalid submission body." }, 400);
+    }
+    const data = body.data && typeof body.data === "object" && !Array.isArray(body.data) ? body.data : body;
+    const honeypotValue = data[honeypotFieldName];
+    if (typeof honeypotValue === "string" && honeypotValue.trim().length > 0) {
+      return json({ success: true }, 200);
+    }
+    if (minFillTimeMs > 0) {
+      const renderedAt = Number(data._renderedAt ?? body._renderedAt);
+      if (Number.isFinite(renderedAt) && renderedAt > 0 && now - renderedAt < minFillTimeMs) {
+        return json({ success: true }, 200);
+      }
+    }
+    const payload = await getPayloadClient();
+    const formResult = await payload.find({
+      collection: formsCollectionSlug,
+      depth: 0,
+      limit: 1,
+      overrideAccess: false,
+      where: { slug: { equals: slug } }
+    });
+    const formDoc = formResult.docs[0];
+    if (!formDoc) {
+      return json({ error: "Unknown form." }, 404);
+    }
+    const definitions = collectFormFieldDefinitions(formDoc);
+    const normalizedData = {};
+    const errors = {};
+    const knownNames = new Set(definitions.map((definition) => definition.name));
+    for (const definition of definitions) {
+      const rawValue = data[definition.name];
+      const isString = typeof rawValue === "string";
+      const normalized = isString ? normalizeFieldValue(rawValue, definition.type) : "";
+      const missing = rawValue === void 0 || rawValue === null || isString && normalized.length === 0 || Array.isArray(rawValue) && rawValue.length === 0;
+      if (definition.required && missing) {
+        errors[definition.name] = `${definition.label} is required.`;
+        continue;
+      }
+      if (normalized.length > 0) {
+        if (definition.type === "email") {
+          const result = validateEmail(normalized, { knownGoodDomains: knownGoodEmailDomains });
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid email address.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+        if (definition.type === "phone") {
+          const result = validatePhoneUS(normalized);
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid phone number.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+        if (definition.type === "url") {
+          const result = validateUrl(normalized);
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid web address.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+      }
+      if (rawValue !== void 0 && rawValue !== null) {
+        normalizedData[definition.name] = typeof rawValue === "string" ? normalized : rawValue;
+      }
+    }
+    for (const [key, value] of Object.entries(data)) {
+      if (knownNames.has(key) || key === honeypotFieldName || key.startsWith("_")) continue;
+      normalizedData[key] = typeof value === "string" ? value.trim() : value;
+    }
+    if (Object.keys(errors).length > 0) {
+      return json({ error: "Validation failed.", fieldErrors: errors }, 422);
+    }
+    const submission = await payload.create({
+      collection: submissionsCollectionSlug,
+      data: {
+        data: normalizedData,
+        form: formDoc.id,
+        submittedAt: new Date(now).toISOString()
+      },
+      overrideAccess: true
+    });
+    if (onSubmission) {
+      try {
+        await onSubmission({ formDoc, normalizedData, submissionID: submission.id });
+      } catch (error) {
+        payload.logger?.error?.({ err: error, msg: "Form submission onSubmission hook failed" });
+      }
+    }
+    return json({ success: true, id: submission.id }, 200);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createFormSubmissionHandler,
+  createMemoryRateLimitStore,
+  formatPhoneUS,
+  inferFieldType,
+  normalizeEmail,
+  normalizeFieldValue,
+  normalizePhone,
+  normalizeUrl,
+  validateEmail,
+  validatePhoneUS,
+  validateRequired,
+  validateUrl
+});

package/dist/forms/server.mjs

@@ -0,0 +1,228 @@
+import {
+  formatPhoneUS,
+  inferFieldType,
+  normalizeEmail,
+  normalizeFieldValue,
+  normalizePhone,
+  normalizeUrl,
+  validateEmail,
+  validatePhoneUS,
+  validateRequired,
+  validateUrl
+} from "../chunk-VA545CHJ.mjs";
+import "../chunk-6BWS3CLP.mjs";
+
+// src/forms/submissionHandler.ts
+function createMemoryRateLimitStore(options) {
+  const max = options?.max ?? 5;
+  const windowMs = options?.windowMs ?? 6e4;
+  const hits = /* @__PURE__ */ new Map();
+  return {
+    isLimited(key, now) {
+      const windowStart = now - windowMs;
+      const entries = (hits.get(key) || []).filter((timestamp) => timestamp > windowStart);
+      entries.push(now);
+      hits.set(key, entries);
+      if (hits.size > 1e4) {
+        for (const [entryKey, timestamps] of hits) {
+          if (timestamps.every((timestamp) => timestamp <= windowStart)) {
+            hits.delete(entryKey);
+          }
+        }
+      }
+      return entries.length > max;
+    }
+  };
+}
+var json = (body, status) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+var getClientKey = (request) => {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    return forwarded.split(",")[0].trim();
+  }
+  return request.headers.get("x-real-ip") || "unknown";
+};
+var isOriginAllowed = (request, allowedOrigins) => {
+  const origin = request.headers.get("origin");
+  if (!origin) {
+    return true;
+  }
+  if (allowedOrigins && allowedOrigins.length > 0) {
+    return allowedOrigins.includes(origin);
+  }
+  const host = request.headers.get("x-forwarded-host") || request.headers.get("host");
+  if (!host) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+};
+var collectFormFieldDefinitions = (formDoc) => {
+  const steps = Array.isArray(formDoc.steps) ? formDoc.steps : [];
+  const definitions = [];
+  for (const step of steps) {
+    if (!step || typeof step !== "object") continue;
+    const fields = step.fields;
+    for (const field of Array.isArray(fields) ? fields : []) {
+      if (!field || typeof field !== "object") continue;
+      const record = field;
+      const name = typeof record.name === "string" ? record.name.trim() : "";
+      if (!name) continue;
+      definitions.push({
+        name,
+        type: inferFieldType(record),
+        required: record.required === true,
+        label: typeof record.label === "string" && record.label.length > 0 ? record.label : name
+      });
+    }
+  }
+  return definitions;
+};
+function createFormSubmissionHandler(options) {
+  const {
+    getPayloadClient,
+    formsCollectionSlug = "forms",
+    submissionsCollectionSlug = "form-submissions",
+    allowedOrigins,
+    honeypotFieldName = "website_url_confirm",
+    minFillTimeMs = 3e3,
+    knownGoodEmailDomains,
+    onSubmission
+  } = options;
+  const rateLimitStore = options.rateLimitStore === null ? null : options.rateLimitStore || createMemoryRateLimitStore();
+  return async function POST(request, context) {
+    if (!isOriginAllowed(request, allowedOrigins)) {
+      return json({ error: "Origin not allowed." }, 403);
+    }
+    const now = Date.now();
+    if (rateLimitStore && rateLimitStore.isLimited(getClientKey(request), now)) {
+      return json({ error: "Too many requests. Please try again shortly." }, 429);
+    }
+    const params = await context.params;
+    const slug = typeof params?.slug === "string" ? params.slug : "";
+    if (!slug) {
+      return json({ error: "Unknown form." }, 404);
+    }
+    let body;
+    try {
+      const parsed = await request.json();
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return json({ error: "Invalid submission body." }, 400);
+      }
+      body = parsed;
+    } catch {
+      return json({ error: "Invalid submission body." }, 400);
+    }
+    const data = body.data && typeof body.data === "object" && !Array.isArray(body.data) ? body.data : body;
+    const honeypotValue = data[honeypotFieldName];
+    if (typeof honeypotValue === "string" && honeypotValue.trim().length > 0) {
+      return json({ success: true }, 200);
+    }
+    if (minFillTimeMs > 0) {
+      const renderedAt = Number(data._renderedAt ?? body._renderedAt);
+      if (Number.isFinite(renderedAt) && renderedAt > 0 && now - renderedAt < minFillTimeMs) {
+        return json({ success: true }, 200);
+      }
+    }
+    const payload = await getPayloadClient();
+    const formResult = await payload.find({
+      collection: formsCollectionSlug,
+      depth: 0,
+      limit: 1,
+      overrideAccess: false,
+      where: { slug: { equals: slug } }
+    });
+    const formDoc = formResult.docs[0];
+    if (!formDoc) {
+      return json({ error: "Unknown form." }, 404);
+    }
+    const definitions = collectFormFieldDefinitions(formDoc);
+    const normalizedData = {};
+    const errors = {};
+    const knownNames = new Set(definitions.map((definition) => definition.name));
+    for (const definition of definitions) {
+      const rawValue = data[definition.name];
+      const isString = typeof rawValue === "string";
+      const normalized = isString ? normalizeFieldValue(rawValue, definition.type) : "";
+      const missing = rawValue === void 0 || rawValue === null || isString && normalized.length === 0 || Array.isArray(rawValue) && rawValue.length === 0;
+      if (definition.required && missing) {
+        errors[definition.name] = `${definition.label} is required.`;
+        continue;
+      }
+      if (normalized.length > 0) {
+        if (definition.type === "email") {
+          const result = validateEmail(normalized, { knownGoodDomains: knownGoodEmailDomains });
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid email address.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+        if (definition.type === "phone") {
+          const result = validatePhoneUS(normalized);
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid phone number.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+        if (definition.type === "url") {
+          const result = validateUrl(normalized);
+          if (!result.valid) {
+            errors[definition.name] = result.message || "Enter a valid web address.";
+            continue;
+          }
+          normalizedData[definition.name] = result.normalized;
+          continue;
+        }
+      }
+      if (rawValue !== void 0 && rawValue !== null) {
+        normalizedData[definition.name] = typeof rawValue === "string" ? normalized : rawValue;
+      }
+    }
+    for (const [key, value] of Object.entries(data)) {
+      if (knownNames.has(key) || key === honeypotFieldName || key.startsWith("_")) continue;
+      normalizedData[key] = typeof value === "string" ? value.trim() : value;
+    }
+    if (Object.keys(errors).length > 0) {
+      return json({ error: "Validation failed.", fieldErrors: errors }, 422);
+    }
+    const submission = await payload.create({
+      collection: submissionsCollectionSlug,
+      data: {
+        data: normalizedData,
+        form: formDoc.id,
+        submittedAt: new Date(now).toISOString()
+      },
+      overrideAccess: true
+    });
+    if (onSubmission) {
+      try {
+        await onSubmission({ formDoc, normalizedData, submissionID: submission.id });
+      } catch (error) {
+        payload.logger?.error?.({ err: error, msg: "Form submission onSubmission hook failed" });
+      }
+    }
+    return json({ success: true, id: submission.id }, 200);
+  };
+}
+export {
+  createFormSubmissionHandler,
+  createMemoryRateLimitStore,
+  formatPhoneUS,
+  inferFieldType,
+  normalizeEmail,
+  normalizeFieldValue,
+  normalizePhone,
+  normalizeUrl,
+  validateEmail,
+  validatePhoneUS,
+  validateRequired,
+  validateUrl
+};