@vicacha-devs/strapi-plugin-inbox 1.0.0 → 1.1.1

package/dist/server/index.js

@@ -45,15 +45,122 @@ const DEFAULT_INBOX_SETTINGS = {
   defaultNotifyEmails: [],
   outboundWebhookUrl: ""
 };
+const SUPPORTED_INTL_CALENDARS = Object.freeze([
+  { id: "gregory", intlCalendar: "gregory", defaultLabel: "Gregorian" },
+  { id: "iso8601", intlCalendar: "iso8601", defaultLabel: "ISO 8601" },
+  {
+    id: "islamic-umalqura",
+    intlCalendar: "islamic-umalqura",
+    defaultLabel: "Hijri (Umm al-Qura)"
+  },
+  {
+    id: "islamic-civil",
+    intlCalendar: "islamic-civil",
+    defaultLabel: "Hijri (Civil)"
+  },
+  {
+    id: "islamic-tbla",
+    intlCalendar: "islamic-tbla",
+    defaultLabel: "Hijri (Tabular)"
+  },
+  { id: "hebrew", intlCalendar: "hebrew", defaultLabel: "Hebrew" },
+  {
+    id: "persian",
+    intlCalendar: "persian",
+    defaultLabel: "Persian (Solar Hijri)"
+  },
+  { id: "buddhist", intlCalendar: "buddhist", defaultLabel: "Buddhist" },
+  { id: "japanese", intlCalendar: "japanese", defaultLabel: "Japanese" },
+  { id: "chinese", intlCalendar: "chinese", defaultLabel: "Chinese Lunar" },
+  { id: "indian", intlCalendar: "indian", defaultLabel: "Indian National" },
+  { id: "coptic", intlCalendar: "coptic", defaultLabel: "Coptic" },
+  { id: "ethiopic", intlCalendar: "ethiopic", defaultLabel: "Ethiopic" }
+]);
+Object.freeze([
+  "none",
+  ...SUPPORTED_INTL_CALENDARS.map((item) => item.id)
+]);
+const BASE_BCP47_REGEX = /^[a-zA-Z]{2,3}(?:-[a-zA-Z0-9]{2,8})*$/;
+function sanitizeCalendarBaseLocale(locale, fallbackLocale = "es") {
+  if (typeof locale !== "string" || !locale.trim()) {
+    return fallbackLocale;
+  }
+  const trimmed = locale.trim();
+  const uIdx = trimmed.toLowerCase().indexOf("-u-");
+  let stripped = uIdx >= 0 ? trimmed.slice(0, uIdx) : trimmed;
+  while (stripped.endsWith("-")) {
+    stripped = stripped.slice(0, -1);
+  }
+  if (!stripped || stripped.length > 35 || !BASE_BCP47_REGEX.test(stripped)) {
+    return fallbackLocale;
+  }
+  return stripped;
+}
+function formatSecondaryDate(isoDateString, calendar = "islamic-umalqura", locale = "es") {
+  if (!isoDateString || calendar === "none") {
+    return { calendar, formatted: "" };
+  }
+  const date = new Date(isoDateString);
+  if (Number.isNaN(date.getTime())) {
+    return { calendar, formatted: isoDateString };
+  }
+  try {
+    const baseLocale = sanitizeCalendarBaseLocale(locale);
+    const formatter = new Intl.DateTimeFormat(`${baseLocale}-u-ca-${calendar}`, {
+      year: "numeric",
+      month: "short",
+      day: "numeric"
+    });
+    const parts = formatter.formatToParts(date);
+    const year = Number(parts.find((p) => p.type === "year")?.value) || void 0;
+    const month = Number(parts.find((p) => p.type === "month")?.value) || void 0;
+    const day = Number(parts.find((p) => p.type === "day")?.value) || void 0;
+    return {
+      calendar,
+      formatted: formatter.format(date),
+      year,
+      month,
+      day
+    };
+  } catch {
+    return {
+      calendar,
+      formatted: date.toISOString().slice(0, 10)
+    };
+  }
+}
 function isValidEmail(value) {
-  if (/\s/.test(value))
+  if (typeof value !== "string" || value.length < 3 || value.length > 254) {
+    return false;
+  }
+  if (/[\u0000-\u0020\u007f]/.test(value) || /\s/.test(value))
     return false;
   const at = value.indexOf("@");
-  if (at < 1 || at !== value.lastIndexOf("@"))
+  if (at < 1 || at > 64 || at !== value.lastIndexOf("@"))
+    return false;
+  const local = value.slice(0, at);
+  if (local.startsWith(".") || local.endsWith(".") || local.includes("..")) {
     return false;
+  }
   const domain = value.slice(at + 1);
-  const dot = domain.indexOf(".");
-  return dot > 0 && dot < domain.length - 1;
+  if (domain.startsWith(".") || domain.endsWith(".") || domain.includes("..")) {
+    return false;
+  }
+  const labels = domain.split(".");
+  if (labels.length < 2)
+    return false;
+  return labels.every((label) => label.length > 0 && label.length <= 63 && !label.startsWith("-") && !label.endsWith("-"));
+}
+const CSV_FORMULA_PREFIX_RE = /^[\s\u0085\u2028\u2029]*[=+\-@|]|^[\t\r\n]/;
+function escapeCsvCell(value) {
+  if (value === null || value === void 0)
+    return "";
+  const raw = typeof value === "object" ? JSON.stringify(value) : String(value);
+  const sanitized = raw.length > 0 && CSV_FORMULA_PREFIX_RE.test(raw) ? `'${raw}` : raw;
+  if (sanitized.includes('"') || sanitized.includes(",") || sanitized.includes("\n") || sanitized.includes("\r")) {
+    return `"${sanitized.replace(/"/g, '""')}"`;
+  }
+  return sanitized;
 }
 function freezeOptions(items) {
   return Object.freeze(items.map((item) => Object.freeze({ ...item })));
@@ -85,6 +192,54 @@ freezeOptions([
   { value: "persian", label: "persian (Solar Hijri)" },
   { value: "none", label: "none (Gregorian Only)" }
 ]);
+class SlidingWindowRateLimiter {
+  hits = /* @__PURE__ */ new Map();
+  maxTrackedKeys;
+  defaultWindowMs;
+  constructor(options2) {
+    this.maxTrackedKeys = options2?.maxTrackedKeys ?? 1e4;
+    this.defaultWindowMs = options2?.defaultWindowMs ?? 60 * 60 * 1e3;
+  }
+  check(ip, bucketKey, limitPerWindow, nowMs = Date.now(), windowMs = this.defaultWindowMs) {
+    if (limitPerWindow <= 0) {
+      return { allowed: true, remaining: 999, retryAfterSeconds: 0 };
+    }
+    if (this.hits.size > this.maxTrackedKeys) {
+      const oldestKey = this.hits.keys().next().value;
+      if (oldestKey !== void 0) {
+        this.hits.delete(oldestKey);
+      }
+    }
+    const key = `${bucketKey}::${ip || "unknown"}`;
+    const cutoff = nowMs - windowMs;
+    const previous = (this.hits.get(key) || []).filter((ts) => ts > cutoff);
+    if (previous.length >= limitPerWindow) {
+      const oldest = previous[0] ?? nowMs;
+      const retryAfterSeconds = Math.max(1, Math.ceil((oldest + windowMs - nowMs) / 1e3));
+      this.hits.set(key, previous);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterSeconds
+      };
+    }
+    previous.push(nowMs);
+    this.hits.set(key, previous);
+    return {
+      allowed: true,
+      remaining: Math.max(0, limitPerWindow - previous.length),
+      retryAfterSeconds: 0
+    };
+  }
+  reset() {
+    this.hits.clear();
+  }
+}
+const FORBIDDEN_OBJECT_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
 const LOCALIZED_REQUIRED_FALLBACK = {
   es: (label) => `${label} es obligatorio`,
   en: (label) => `${label} is required`,
@@ -182,12 +337,23 @@ function checkNumericBoundRule(rule, limit, rawValue, fieldLabel, locale) {
   }
   return null;
 }
+function hasNestedQuantifier(pattern) {
+  return /[+*?}]\s*\)\s*[+*?{]/.test(pattern.replaceAll(/\\./g, ""));
+}
 function checkLengthOrNumberRule(rule, rawValue, strVal, fieldLabel, locale) {
-  if (typeof rule.value !== "number") return null;
-  return checkLengthRule(rule, rule.value, strVal, fieldLabel, locale) ?? checkNumericBoundRule(rule, rule.value, rawValue, fieldLabel, locale);
+  const numRuleVal = typeof rule.value === "number" ? rule.value : typeof rule.value === "string" && rule.value.trim() !== "" ? Number(rule.value) : Number.NaN;
+  if (!Number.isFinite(numRuleVal)) return null;
+  return checkLengthRule(rule, numRuleVal, strVal, fieldLabel, locale) ?? checkNumericBoundRule(rule, numRuleVal, rawValue, fieldLabel, locale);
 }
 function checkPatternOrEmailRule(rule, fieldType, strVal, fieldLabel, locale) {
   if (rule.type === "pattern" && typeof rule.value === "string") {
+    if (strVal.length > 4096 || rule.value.length > 512 || hasNestedQuantifier(rule.value)) {
+      return resolveRuleMessage(
+        rule,
+        locale,
+        `${fieldLabel} format is invalid`
+      );
+    }
     try {
       const regex = new RegExp(rule.value);
       if (!regex.test(strVal)) {
@@ -207,6 +373,13 @@ function checkPatternOrEmailRule(rule, fieldType, strVal, fieldLabel, locale) {
       `${fieldLabel} must be a valid email address`
     );
   }
+  if (rule.type === "url" && fieldType !== "url" && !isValidHttpUrl(strVal)) {
+    return resolveRuleMessage(
+      rule,
+      locale,
+      `${fieldLabel} must be a valid URL`
+    );
+  }
   return null;
 }
 function evaluateCustomRules(field, rawValue, strVal, fieldLabel, locale, rules) {
@@ -241,7 +414,7 @@ function buildRequiredError(rules, locale, fieldLabel) {
   return resolveRuleMessage(reqRule, locale, fallbackFn(fieldLabel));
 }
 function validateSingleField(field, data, locale) {
-  const rawValue = data[field.name] ?? field.defaultValue;
+  const rawValue = Object.hasOwn(data, field.name) ? data[field.name] : field.defaultValue;
   const fieldLabel = resolveFieldLabel(field, locale);
   const rules = field.validation || [];
   if (field.required && isValueEmpty(rawValue)) {
@@ -274,7 +447,9 @@ function validateFormSubmission(fields, data, locale = "en") {
   const errors = {};
   const cleanedData = {};
   for (const field of fields) {
-    if (DECORATIVE_FIELD_TYPES.includes(field.type)) continue;
+    if (DECORATIVE_FIELD_TYPES.includes(field.type) || FORBIDDEN_OBJECT_KEYS.has(field.name)) {
+      continue;
+    }
     const { fieldErrors, cleanedValue } = validateSingleField(
       field,
       data,
@@ -293,45 +468,10 @@ function validateFormSubmission(fields, data, locale = "en") {
   };
 }
 function isHoneypotTriggered(payload, honeypotField = "_website_url") {
-  if (!honeypotField) return false;
+  if (!honeypotField || !Object.hasOwn(payload, honeypotField)) return false;
   const val = payload[honeypotField];
   return typeof val === "string" && val.trim().length > 0;
 }
-class SlidingWindowRateLimiter {
-  hits = /* @__PURE__ */ new Map();
-  check(ip, bucketKey, limitPerHour, nowMs = Date.now()) {
-    if (limitPerHour <= 0) {
-      return { allowed: true, remaining: 999, retryAfterSeconds: 0 };
-    }
-    const windowMs = 60 * 60 * 1e3;
-    const key = `${bucketKey}::${ip || "unknown"}`;
-    const cutoff = nowMs - windowMs;
-    const previous = (this.hits.get(key) || []).filter((ts) => ts > cutoff);
-    if (previous.length >= limitPerHour) {
-      const oldest = previous[0] ?? nowMs;
-      const retryAfterSeconds = Math.max(
-        1,
-        Math.ceil((oldest + windowMs - nowMs) / 1e3)
-      );
-      this.hits.set(key, previous);
-      return {
-        allowed: false,
-        remaining: 0,
-        retryAfterSeconds
-      };
-    }
-    previous.push(nowMs);
-    this.hits.set(key, previous);
-    return {
-      allowed: true,
-      remaining: Math.max(0, limitPerHour - previous.length),
-      retryAfterSeconds: 0
-    };
-  }
-  reset() {
-    this.hits.clear();
-  }
-}
 const defaultRateLimiter = new SlidingWindowRateLimiter();
 function resolveFetchRunner(fetchImpl) {
   return fetchImpl ?? globalThis.fetch;
@@ -690,16 +830,6 @@ function localizeFormForLocale(form, locale) {
     }
   };
 }
-const FORMULA_PREFIXES = ["=", "+", "-", "@", "	", "\r"];
-function escapeCsvCell(value) {
-  if (value === null || value === void 0) return "";
-  const raw = typeof value === "object" ? JSON.stringify(value) : String(value);
-  const sanitized = raw.length > 0 && FORMULA_PREFIXES.includes(raw[0]) ? `'${raw}` : raw;
-  if (sanitized.includes('"') || sanitized.includes(",") || sanitized.includes("\n") || sanitized.includes("\r")) {
-    return `"${sanitized.replace(/"/g, '""')}"`;
-  }
-  return sanitized;
-}
 function collectDataFieldNames(submissions, fields) {
   const dataFieldNames = [];
   const seen = /* @__PURE__ */ new Set();
@@ -763,36 +893,7 @@ function submissionsToCsv(submissions, fields = []) {
   return rows.join("\n");
 }
 function convertIsoDateToCalendar(isoDateString, calendar = "islamic-umalqura", locale = "en") {
-  if (!isoDateString) {
-    return { calendar, formatted: "" };
-  }
-  const date = new Date(isoDateString);
-  if (Number.isNaN(date.getTime())) {
-    return { calendar, formatted: isoDateString };
-  }
-  try {
-    const formatter = new Intl.DateTimeFormat(`${locale}-u-ca-${calendar}`, {
-      year: "numeric",
-      month: "short",
-      day: "numeric"
-    });
-    const parts = formatter.formatToParts(date);
-    const year = Number(parts.find((p) => p.type === "year")?.value) || void 0;
-    const month = Number(parts.find((p) => p.type === "month")?.value) || void 0;
-    const day = Number(parts.find((p) => p.type === "day")?.value) || void 0;
-    return {
-      calendar,
-      formatted: formatter.format(date),
-      year,
-      month,
-      day
-    };
-  } catch {
-    return {
-      calendar,
-      formatted: date.toISOString().slice(0, 10)
-    };
-  }
+  return formatSecondaryDate(isoDateString, calendar, locale);
 }
 let mirroringToFormBuilderCms = false;
 function generateReferenceCode(now = /* @__PURE__ */ new Date()) {
@@ -1265,8 +1366,14 @@ function extractLifecycleFormId(event) {
   const fromResult = resultForm !== void 0 ? resolveCmsSubmissionFormRef({ form: resultForm }).formId : null;
   return fromResult ?? void 0;
 }
+const subscribedStrapiInstances = /* @__PURE__ */ new WeakSet();
+function clearSubscribedStrapiInstance(strapi) {
+  subscribedStrapiInstances.delete(strapi);
+}
 function subscribeFormBuilderLifecycles(strapi, formService2, submissionService2) {
   if (!strapi.db?.lifecycles?.subscribe) return;
+  if (subscribedStrapiInstances.has(strapi)) return;
+  subscribedStrapiInstances.add(strapi);
   if (strapi.contentTypes?.[FORM_BUILDER_CMS_FORM_UID]) {
     strapi.db.lifecycles.subscribe({
       models: [FORM_BUILDER_CMS_FORM_UID],
@@ -1505,8 +1612,16 @@ function normalizeSubmitPayload(rawBody) {
   return nestedData ? { ...rawBody, ...nestedData } : rawBody;
 }
 function resolveClientIp(ctx) {
+  const directIp = ctx.ip || ctx.request.ip;
+  if (directIp && directIp.trim()) return directIp.trim();
   const forwarded = ctx.request.headers?.["x-forwarded-for"]?.split(",")[0]?.trim();
-  return forwarded || ctx.request.ip || "127.0.0.1";
+  return forwarded || "127.0.0.1";
+}
+function isAuthenticatedAdminContext(ctx) {
+  const state = ctx.state;
+  return Boolean(
+    state?.user || state?.isAuthenticatedAdmin || state?.route?.info?.type === "admin"
+  );
 }
 const ERROR_STATUS_MAP = {
   NotFoundError: 404,
@@ -1541,11 +1656,12 @@ const createFormHandlers = (strapi) => ({
   },
   async listForms(ctx) {
     const svc = strapi.plugin(PLUGIN_ID).service("formService");
+    const isAdmin = isAuthenticatedAdminContext(ctx);
     const data = await svc.listForms({
       category: ctx.query?.category,
-      activeOnly: ctx.query?.activeOnly !== "false",
+      activeOnly: isAdmin ? ctx.query?.activeOnly !== "false" : true,
       locale: ctx.query?.locale,
-      publicSafe: ctx.query?.admin !== "true"
+      publicSafe: isAdmin ? ctx.query?.admin !== "true" : true
     });
     ctx.body = { data };
   },
@@ -1587,8 +1703,14 @@ const createFormHandlers = (strapi) => ({
         locale: rawBody.locale || ctx.query?.locale,
         captchaToken: rawBody.captchaToken || payload.captchaToken
       });
+      const {
+        ipAddress: _ipAddress,
+        userAgent: _userAgent,
+        staffNotes: _staffNotes,
+        ...publicData
+      } = data;
       ctx.status = 201;
-      ctx.body = { data };
+      ctx.body = { data: publicData };
     } catch (err) {
       const error = err;
       ctx.status = ERROR_STATUS_MAP[error.name] ?? 400;
@@ -1608,6 +1730,7 @@ const controllers = {
   inboxController
 };
 const destroy = ({ strapi }) => {
+  clearSubscribedStrapiInstance(strapi);
   strapi.log.debug("[@vicacha-devs/strapi-plugin-inbox] Destroyed");
 };
 const register = ({ strapi }) => {
@@ -1615,6 +1738,17 @@ const register = ({ strapi }) => {
     "[@vicacha-devs/strapi-plugin-inbox] Registered inbox & form builder plugin"
   );
 };
+const withPerm = (action) => [
+  "admin::isAuthenticatedAdmin",
+  {
+    name: "admin::hasPermissions",
+    config: { actions: [`plugin::inbox.${action}`] }
+  }
+];
+const FORMS_POLICIES = withPerm("forms.manage");
+const SUBMISSIONS_POLICIES = withPerm("submissions.manage");
+const SUBSCRIBERS_POLICIES = withPerm("subscribers.manage");
+const SETTINGS_POLICIES = withPerm("settings.manage");
 const admin = {
   type: "admin",
   routes: [
@@ -1622,103 +1756,103 @@ const admin = {
       method: "GET",
       path: "/settings",
       handler: "inboxController.getSettings",
-      config: { policies: [] }
+      config: { policies: SETTINGS_POLICIES }
     },
     {
       method: "PUT",
       path: "/settings",
       handler: "inboxController.updateSettings",
-      config: { policies: [] }
+      config: { policies: SETTINGS_POLICIES }
     },
     {
       method: "GET",
       path: "/templates",
       handler: "inboxController.listTemplates",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "GET",
       path: "/form-builder-forms",
       handler: "inboxController.listFormBuilderForms",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "POST",
       path: "/forms/sync-builder",
       handler: "inboxController.syncFormBuilder",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "GET",
       path: "/forms",
       handler: "inboxController.listForms",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "POST",
       path: "/forms",
       handler: "inboxController.saveForm",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "POST",
       path: "/forms/from-template",
       handler: "inboxController.createFromTemplate",
-      config: { policies: [] }
+      config: { policies: FORMS_POLICIES }
     },
     {
       method: "GET",
       path: "/submissions",
       handler: "inboxController.listSubmissions",
-      config: { policies: [] }
+      config: { policies: SUBMISSIONS_POLICIES }
     },
     {
       method: "PUT",
       path: "/submissions/:documentId/casework",
       handler: "inboxController.updateCasework",
-      config: { policies: [] }
+      config: { policies: SUBMISSIONS_POLICIES }
     },
     {
       method: "POST",
       path: "/submissions/:documentId/schedule-booking",
       handler: "inboxController.scheduleBooking",
-      config: { policies: [] }
+      config: { policies: SUBMISSIONS_POLICIES }
     },
     {
       method: "POST",
       path: "/submissions/:documentId/issue-certificate",
       handler: "inboxController.issueCertificate",
-      config: { policies: [] }
+      config: { policies: SUBMISSIONS_POLICIES }
     },
     {
       method: "GET",
       path: "/submissions/export-csv",
       handler: "inboxController.exportCsv",
-      config: { policies: [] }
+      config: { policies: SUBMISSIONS_POLICIES }
     },
     {
       method: "POST",
       path: "/captcha/test",
       handler: "inboxController.testCaptcha",
-      config: { policies: [] }
+      config: { policies: SETTINGS_POLICIES }
     },
     {
       method: "GET",
       path: "/subscribers",
       handler: "inboxController.listSubscribers",
-      config: { policies: [] }
+      config: { policies: SUBSCRIBERS_POLICIES }
     },
     {
       method: "GET",
       path: "/alerts",
       handler: "inboxController.getActiveAlerts",
-      config: { policies: [] }
+      config: { policies: SUBSCRIBERS_POLICIES }
     },
     {
       method: "POST",
       path: "/alerts",
       handler: "inboxController.upsertAlertBanner",
-      config: { policies: [] }
+      config: { policies: SUBSCRIBERS_POLICIES }
     }
   ]
 };
@@ -1779,6 +1913,15 @@ const contentApi = {
         auth: false
       }
     },
+    {
+      method: "GET",
+      path: "/public/unsubscribe",
+      handler: "inboxController.unsubscribe",
+      config: {
+        policies: [],
+        auth: false
+      }
+    },
     {
       method: "GET",
       path: "/alerts",
@@ -1797,6 +1940,15 @@ const routes = {
 function getDocuments(strapi, uid) {
   return strapi.documents(uid);
 }
+function sanitizeSafeCtaUrl(raw) {
+  if (typeof raw !== "string") return "";
+  const trimmed = raw.trim();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("https://") || trimmed.startsWith("http://") || trimmed.startsWith("/") && !trimmed.startsWith("//")) {
+    return trimmed;
+  }
+  return "";
+}
 function buildAlertBannerPayload(input) {
   return {
     code: input.code,
@@ -1804,7 +1956,7 @@ function buildAlertBannerPayload(input) {
     message: input.message,
     severity: input.severity ?? "info",
     ctaLabel: input.ctaLabel ?? "",
-    ctaUrl: input.ctaUrl ?? "",
+    ctaUrl: sanitizeSafeCtaUrl(input.ctaUrl),
     dismissible: input.dismissible ?? true,
     active: input.active ?? true,
     priority: input.priority ?? 10,
@@ -1818,7 +1970,8 @@ const alertService = ({ strapi }) => ({
     const settingsService = strapi.plugin(PLUGIN_ID).service("settings");
     const settings2 = await settingsService.getSettings();
     const locale = params?.locale || settings2.defaultLocale || "es";
-    const nowMs = new Date(params?.nowIso || Date.now()).getTime();
+    const parsedNowMs = new Date(params?.nowIso || Date.now()).getTime();
+    const nowMs = Number.isNaN(parsedNowMs) ? Date.now() : parsedNowMs;
     const docs = await getDocuments(strapi, ALERT_BANNER_UID).findMany({
       filters: { active: true },
       limit: 50
@@ -1850,7 +2003,7 @@ const alertService = ({ strapi }) => ({
         title: tr?.title || banner.title,
         message: tr?.message || banner.message,
         ctaLabel: tr?.ctaLabel || banner.ctaLabel,
-        ctaUrl: tr?.ctaUrl || banner.ctaUrl,
+        ctaUrl: sanitizeSafeCtaUrl(tr?.ctaUrl || banner.ctaUrl),
         secondaryDateLabel: secondaryDate.formatted
       };
     });
@@ -1864,17 +2017,23 @@ const alertService = ({ strapi }) => ({
     );
     const existing = existingDocs[0] || null;
     const payload = buildAlertBannerPayload(input);
+    let saved;
     if (existing?.documentId) {
       const updated = await getDocuments(strapi, ALERT_BANNER_UID).update({
         documentId: existing.documentId,
         data: payload
       });
-      return updated;
+      saved = updated;
+    } else {
+      const created = await getDocuments(strapi, ALERT_BANNER_UID).create({
+        data: payload
+      });
+      saved = created;
     }
-    const created = await getDocuments(strapi, ALERT_BANNER_UID).create({
-      data: payload
-    });
-    return created;
+    if (saved.active) {
+      strapi.eventHub?.emit("inbox.alert.published", { entry: saved });
+    }
+    return saved;
   }
 });
 function sanitizePublicForm(form, locale) {
@@ -2673,18 +2832,20 @@ function assertRequiredChecklistVerified(existing, requireVerified) {
 async function tryIssuePluginCertificate(strapi, existing, certInput, fallbackCertNumber) {
   try {
     const certsPlugin = strapi.plugin("certificates");
-    const certSvc = certsPlugin?.service("certificateService");
+    const certSvc = certsPlugin?.service("issuance") ?? certsPlugin?.service("certificateService");
     if (!certSvc?.issueCertificate) return fallbackCertNumber;
+    const recipientFullName = certInput?.recipientName || existing.applicantName || "Applicant";
     const issued = await certSvc.issueCertificate({
       templateSlug: certInput?.templateSlug || "official-service-certificate",
-      recipientName: certInput?.recipientName || existing.applicantName || "Applicant",
+      recipientName: recipientFullName,
+      recipientFullName,
       recipientEmail: existing.applicantEmail,
       metadata: {
         submissionReference: existing.referenceCode,
         formSlug: existing.formSlug
       }
     });
-    return issued?.certificateNumber || fallbackCertNumber;
+    return issued?.serialNumber || issued?.certificateNumber || fallbackCertNumber;
   } catch {
     return fallbackCertNumber;
   }
@@ -2965,7 +3126,8 @@ function pickSubscriberStr(...values) {
 function buildSubscriberPayload(email, input, existing, settings2) {
   const doubleOptIn = settings2.enableDoubleOptIn !== false;
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-  const status = doubleOptIn ? "pending" : "confirmed";
+  const alreadyConfirmed = existing?.status === "confirmed";
+  const status = alreadyConfirmed || !doubleOptIn ? "confirmed" : "pending";
   return {
     email,
     fullName: pickSubscriberStr(input.fullName, existing?.fullName),
@@ -2973,12 +3135,12 @@ function buildSubscriberPayload(email, input, existing, settings2) {
     locale: pickSubscriberStr(input.locale, settings2.defaultLocale, "es"),
     topics: normalizeSubscriberTopics(input.topics),
     status,
-    confirmToken: doubleOptIn ? node_crypto.randomBytes(20).toString("hex") : null,
+    confirmToken: alreadyConfirmed || !doubleOptIn ? null : node_crypto.randomBytes(20).toString("hex"),
     unsubscribeToken: pickSubscriberStr(
       existing?.unsubscribeToken,
       node_crypto.randomBytes(20).toString("hex")
     ),
-    confirmedAt: doubleOptIn ? null : nowIso,
+    confirmedAt: alreadyConfirmed ? existing.confirmedAt || nowIso : doubleOptIn ? null : nowIso,
     unsubscribedAt: null,
     sourceFormSlug: pickSubscriberStr(
       input.sourceFormSlug,