form0-core 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "form0-core",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },
@@ -12,7 +12,7 @@
     "SECURITY.md"
   ],
   "scripts": {
-    "test": "node tests/form0-core.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/title-fields.test.js && node tests/builtin-metadata.test.js && node tests/calculation-expression-utils.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/form-authoring.test.js && node tests/security-test.js",
+    "test": "node tests/form0-core.test.js && node tests/conditions.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/title-fields.test.js && node tests/builtin-metadata.test.js && node tests/calculation-expression-utils.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/form-authoring.test.js && node tests/security-test.js",
     "format": "prettier --write \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
     "format:check": "prettier --check \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
     "lint:check": "eslint src tests",

package/src/builtins/docs/overview.mdx

@@ -181,11 +181,14 @@ IF(user.age >= 18, "Adult", "Minor")
 
 ## Security
 
-All builtins are designed to be safe for use in form contexts:
+Builtins provide defined interfaces for common form operations, and their arguments are validated
+where applicable. Event builtins such as `SETVALUE` and `ALERT` return operations for the host to
+apply instead of mutating application state directly.
 
-- **No side effects**: Builtins don't modify external state
-- **Sandboxed execution**: Cannot access system resources
-- **Input validation**: Arguments are validated before processing
+Using a builtin does not sandbox the JavaScript expression or event script that calls it. Schemas
+containing executable code must come from trusted authors. `SAFE` and `CUSTOM` modes provide
+validation and configuration controls, not isolation. See the project
+[security policy](../../../SECURITY.md) for the trust model and application responsibilities.
 
 ## Extending Builtins
 
@@ -252,4 +255,4 @@ SETRESULT(
 
 - Explore individual builtin documentation for detailed usage
 - Check out the [form0 examples](../examples.mdx) for real-world scenarios
-- Learn about [custom helpers](../custom-helpers.mdx) for extending functionality 
+- Learn about [custom helpers](../custom-helpers.mdx) for extending functionality

package/src/engine/conditions.js

@@ -1,8 +1,28 @@
 import { flattenFields } from '../utilities/field-helpers.js';
 
+const valuesEqual = (a, b) => {
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) {
+      return false;
+    }
+
+    const unmatched = [...b];
+    return a.every((value) => {
+      const matchIndex = unmatched.findIndex((candidate) => candidate === value);
+      if (matchIndex === -1) {
+        return false;
+      }
+      unmatched.splice(matchIndex, 1);
+      return true;
+    });
+  }
+
+  return a === b;
+};
+
 const OPERATORS = {
-  equal_to: (a, b) => a === b,
-  not_equal_to: (a, b) => a !== b,
+  equal_to: valuesEqual,
+  not_equal_to: (a, b) => !valuesEqual(a, b),
   greater_than: (a, b) => a > b,
   less_than: (a, b) => a < b,
   greater_or_equal_than: (a, b) => a >= b,
@@ -15,6 +35,52 @@ const OPERATORS = {
     !(a === null || a === undefined || a === '' || (Array.isArray(a) && a.length === 0)),
 };
 
+const hasValue = (entry, property) =>
+  entry &&
+  typeof entry === 'object' &&
+  Object.prototype.hasOwnProperty.call(entry, property) &&
+  entry[property] !== null &&
+  entry[property] !== undefined &&
+  entry[property] !== '';
+
+const getOtherValue = (entry) => {
+  if (hasValue(entry, 'value')) {
+    return entry.value;
+  }
+  if (hasValue(entry, 'label')) {
+    return entry.label;
+  }
+  return null;
+};
+
+function normalizeConditionValue(field, value) {
+  if (!field || !value || typeof value !== 'object' || Array.isArray(value)) {
+    return value;
+  }
+
+  if (field.type === 'SingleChoiceField' || field.type === 'BooleanField') {
+    const selectedChoice = Array.isArray(value.choice) ? value.choice[0] : null;
+    if (hasValue(selectedChoice, 'value')) {
+      return selectedChoice.value;
+    }
+
+    const otherEntry = Array.isArray(value.other) ? value.other[0] : null;
+    return getOtherValue(otherEntry);
+  }
+
+  if (field.type === 'MultiChoiceField') {
+    const selectedValues = Array.isArray(value.choices)
+      ? value.choices.filter((choice) => hasValue(choice, 'value')).map((choice) => choice.value)
+      : [];
+    const otherValues = Array.isArray(value.other)
+      ? value.other.map(getOtherValue).filter((otherValue) => otherValue !== null)
+      : [];
+    return [...selectedValues, ...otherValues];
+  }
+
+  return value;
+}
+
 export function evaluateConditions(conditions, values, allFields) {
   if (Array.isArray(conditions)) {
     return conditions.every((c) => evaluateConditions(c, values, allFields));
@@ -31,7 +97,7 @@ export function evaluateConditions(conditions, values, allFields) {
   // Map field_id (key) to data_name for value lookup
   const field = allFields ? allFields[conditions.field_id] : undefined;
   const dataName = field ? field.data_name : undefined;
-  const val = dataName ? values[dataName] : undefined;
+  const val = normalizeConditionValue(field, dataName ? values[dataName] : undefined);
   // Debug log: show what is being checked
   //console.log('[evaluateConditions] field_id:', conditions.field_id, 'data_name:', dataName, 'value in values:', val, 'expected:', conditions.value, 'operator:', conditions.operator);
   const fn = OPERATORS[conditions.operator];

package/src/engine/events.js

@@ -415,14 +415,16 @@ export class EventManager {
 
         // Consume any collected event operations
         const collectedOps = __consumeEventOperations();
+        const runtimeOps = collectedOps.filter(
+          (operation) => operation?.type !== 'EVENT_OPERATION'
+        );
 
         // Validate operations against context restrictions before adding them
-        const validOps = this.validateOperations(collectedOps, executionContext);
+        const validOps = this.validateOperations(runtimeOps, executionContext);
         operations.push(...validOps);
 
-        // Note: EVENT_OPERATION processing (ON/OFF) is handled only during initialization
-        // If event handlers contain ON/OFF calls, they will be in the operations array
-        // but won't be processed here to avoid duplicate registrations
+        // EVENT_OPERATION processing is initialization-only. ON/OFF calls inside a handler neither
+        // mutate the listener registry nor leak internal registration descriptors to the host.
 
         // For backward compatibility, still handle returned operations
         if (result && result.type === 'UI_OPERATION') {