payload-dynamic-forms 0.0.0-stage → 0.2.0

package/dist/delivery/webhook.d.ts

@@ -0,0 +1,41 @@
+export type WebhookSettings = {
+    /**
+     * Headers applied under the admin `headers` (e.g. resolved from the plugin config). A later
+     * header replaces an earlier one of the same name, in any case.
+     */
+    configHeaders?: null | Record<string, string>;
+    /** The webhook's own (admin) secret headers. */
+    headers?: Array<{
+        key?: null | string;
+        value?: null | string;
+    }> | null;
+    method?: 'PATCH' | 'POST' | 'PUT' | null;
+    retries?: null | number;
+    /** The secret to sign with, already resolved. Empty: the request is sent unsigned. */
+    signingSecret?: null | string;
+    timeoutMs?: null | number;
+    url?: null | string;
+    /**
+     * The Standard Webhooks `webhook-id`, the same on every try. Missing: `msg_` plus a random id
+     * made once per call. Characters outside `[A-Za-z0-9_]` become `_`.
+     */
+    webhookId?: null | string;
+};
+export type WebhookResult = {
+    error?: string;
+    ok: boolean;
+    status?: number;
+    tries: number;
+};
+/** Pauses between tries: 0.5 s, 1 s, 2 s. */
+export declare const RETRY_PAUSES_MS: number[];
+/** `X-Form-Signature` value: `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`. */
+export declare function signWebhookBody(secret: string, body: string, now?: number): Promise<string>;
+/** `msg_<submissionId>_<outputId>` when both exist, else `msg_` plus a random id; only `[A-Za-z0-9_]`. */
+export declare function webhookMessageId(submissionId?: null | number | string, outputId?: null | string): string;
+/**
+ * Sends one webhook: JSON body, config headers under the secret headers, an optional signature
+ * (given resolved), a timeout per try (default 8 s) and up to 3 retries with growing pauses. A
+ * non-2xx answer or a timeout is a failed try.
+ */
+export declare function sendWebhook(settings: WebhookSettings, body: unknown): Promise<WebhookResult>;

package/dist/delivery/webhook.js

@@ -0,0 +1,120 @@
+import { hmacSha256Base64, hmacSha256Hex, standardWebhooksKey } from '../security/crypto.js';
+/** Pauses between tries: 0.5 s, 1 s, 2 s. */ export const RETRY_PAUSES_MS = [
+    500,
+    1000,
+    2000
+];
+const sleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+/** `X-Form-Signature` value: `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`. */ export async function signWebhookBody(secret, body, now = Date.now()) {
+    const t = Math.floor(now / 1000);
+    return `t=${t},v1=${await hmacSha256Hex(secret, `${t}.${body}`)}`;
+}
+/** `msg_<submissionId>_<outputId>` when both exist, else `msg_` plus a random id; only `[A-Za-z0-9_]`. */ export function webhookMessageId(submissionId, outputId) {
+    const raw = submissionId !== undefined && submissionId !== null && submissionId !== '' && outputId ? `msg_${submissionId}_${outputId}` : `msg_${crypto.randomUUID().replace(/-/g, '')}`;
+    return raw.replace(/\W/g, '_');
+}
+/**
+ * Request headers in order, a later one replacing an earlier one whose name matches in any case:
+ * `Content-Type`, then each group in turn.
+ */ function mergeHeaders(...groups) {
+    const merged = new Map([
+        [
+            'content-type',
+            [
+                'Content-Type',
+                'application/json'
+            ]
+        ]
+    ]);
+    for (const group of groups){
+        for (const [key, value] of group){
+            merged.set(key.toLowerCase(), [
+                key,
+                value
+            ]);
+        }
+    }
+    return Object.fromEntries(merged.values());
+}
+/**
+ * Sends one webhook: JSON body, config headers under the secret headers, an optional signature
+ * (given resolved), a timeout per try (default 8 s) and up to 3 retries with growing pauses. A
+ * non-2xx answer or a timeout is a failed try.
+ */ export async function sendWebhook(settings, body) {
+    const json = JSON.stringify(body);
+    const timeoutMs = Math.min(30_000, Math.max(500, Number(settings.timeoutMs) || 8000));
+    const retries = Math.min(3, Math.max(0, Math.floor(Number(settings.retries) || 0)));
+    const configHeaders = Object.entries(settings.configHeaders || {}).filter((entry)=>Boolean(entry[0]) && typeof entry[1] === 'string');
+    const adminHeaders = (settings.headers || []).flatMap((header)=>header?.key && header.value ? [
+            [
+                header.key,
+                header.value
+            ]
+        ] : []);
+    const secret = settings.signingSecret || '';
+    const webhookId = settings.webhookId ? settings.webhookId.replace(/\W/g, '_') : webhookMessageId();
+    const key = secret ? standardWebhooksKey(secret) : null;
+    let lastError = '';
+    let lastStatus;
+    let tries = 0;
+    for(let attempt = 0; attempt <= retries; attempt += 1){
+        if (attempt > 0) {
+            await sleep(RETRY_PAUSES_MS[Math.min(attempt - 1, RETRY_PAUSES_MS.length - 1)]);
+        }
+        tries += 1;
+        // Signature headers come last: neither config nor admin headers can replace them.
+        const signature = [
+            [
+                'webhook-id',
+                webhookId
+            ]
+        ];
+        if (secret && key) {
+            const now = Date.now();
+            const t = Math.floor(now / 1000);
+            signature.push([
+                'X-Form-Signature',
+                await signWebhookBody(secret, json, now)
+            ], [
+                'webhook-timestamp',
+                String(t)
+            ], [
+                'webhook-signature',
+                `v1,${await hmacSha256Base64(key, `${webhookId}.${t}.${json}`)}`
+            ]);
+        }
+        const headers = mergeHeaders(configHeaders, adminHeaders, signature);
+        const controller = new AbortController();
+        const timer = setTimeout(()=>controller.abort(), timeoutMs);
+        try {
+            const response = await fetch(String(settings.url || ''), {
+                body: json,
+                headers,
+                method: settings.method || 'POST',
+                signal: controller.signal
+            });
+            lastStatus = response.status;
+            if (response.ok) {
+                return {
+                    ok: true,
+                    status: response.status,
+                    tries
+                };
+            }
+            lastError = `Webhook answered ${response.status}.`;
+        } catch (error) {
+            lastStatus = undefined;
+            lastError = controller.signal.aborted ? `Webhook timed out after ${timeoutMs} ms.` : error instanceof Error ? error.message : String(error);
+        } finally{
+            clearTimeout(timer);
+        }
+    }
+    return {
+        error: lastError,
+        ok: false,
+        status: lastStatus,
+        tries
+    };
+}
+
+//# sourceMappingURL=webhook.js.map

package/dist/delivery/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/delivery/webhook.ts"],"sourcesContent":["import { hmacSha256Base64, hmacSha256Hex, standardWebhooksKey } from '../security/crypto.js'\n\nexport type WebhookSettings = {\n  /**\n   * Headers applied under the admin `headers` (e.g. resolved from the plugin config). A later\n   * header replaces an earlier one of the same name, in any case.\n   */\n  configHeaders?: null | Record<string, string>\n  /** The webhook's own (admin) secret headers. */\n  headers?: Array<{ key?: null | string; value?: null | string }> | null\n  method?: 'PATCH' | 'POST' | 'PUT' | null\n  retries?: null | number\n  /** The secret to sign with, already resolved. Empty: the request is sent unsigned. */\n  signingSecret?: null | string\n  timeoutMs?: null | number\n  url?: null | string\n  /**\n   * The Standard Webhooks `webhook-id`, the same on every try. Missing: `msg_` plus a random id\n   * made once per call. Characters outside `[A-Za-z0-9_]` become `_`.\n   */\n  webhookId?: null | string\n}\n\nexport type WebhookResult = { error?: string; ok: boolean; status?: number; tries: number }\n\n/** Pauses between tries: 0.5 s, 1 s, 2 s. */\nexport const RETRY_PAUSES_MS = [500, 1000, 2000]\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms))\n\n/** `X-Form-Signature` value: `t=<unix seconds>,v1=<hex HMAC-SHA256 of \"<t>.<body>\">`. */\nexport async function signWebhookBody(secret: string, body: string, now = Date.now()): Promise<string> {\n  const t = Math.floor(now / 1000)\n  return `t=${t},v1=${await hmacSha256Hex(secret, `${t}.${body}`)}`\n}\n\n/** `msg_<submissionId>_<outputId>` when both exist, else `msg_` plus a random id; only `[A-Za-z0-9_]`. */\nexport function webhookMessageId(submissionId?: null | number | string, outputId?: null | string): string {\n  const raw =\n    submissionId !== undefined && submissionId !== null && submissionId !== '' && outputId\n      ? `msg_${submissionId}_${outputId}`\n      : `msg_${crypto.randomUUID().replace(/-/g, '')}`\n  return raw.replace(/\\W/g, '_')\n}\n\n/**\n * Request headers in order, a later one replacing an earlier one whose name matches in any case:\n * `Content-Type`, then each group in turn.\n */\nfunction mergeHeaders(...groups: Array<Array<[string, string]>>): Record<string, string> {\n  const merged = new Map<string, [string, string]>([['content-type', ['Content-Type', 'application/json']]])\n  for (const group of groups) {\n    for (const [key, value] of group) {\n      merged.set(key.toLowerCase(), [key, value])\n    }\n  }\n  return Object.fromEntries(merged.values())\n}\n\n/**\n * Sends one webhook: JSON body, config headers under the secret headers, an optional signature\n * (given resolved), a timeout per try (default 8 s) and up to 3 retries with growing pauses. A\n * non-2xx answer or a timeout is a failed try.\n */\nexport async function sendWebhook(settings: WebhookSettings, body: unknown): Promise<WebhookResult> {\n  const json = JSON.stringify(body)\n  const timeoutMs = Math.min(30_000, Math.max(500, Number(settings.timeoutMs) || 8000))\n  const retries = Math.min(3, Math.max(0, Math.floor(Number(settings.retries) || 0)))\n  const configHeaders = Object.entries(settings.configHeaders || {}).filter(\n    (entry): entry is [string, string] => Boolean(entry[0]) && typeof entry[1] === 'string',\n  )\n  const adminHeaders = (settings.headers || []).flatMap((header): Array<[string, string]> =>\n    header?.key && header.value ? [[header.key, header.value]] : [],\n  )\n  const secret = settings.signingSecret || ''\n  const webhookId = settings.webhookId ? settings.webhookId.replace(/\\W/g, '_') : webhookMessageId()\n  const key = secret ? standardWebhooksKey(secret) : null\n  let lastError = ''\n  let lastStatus: number | undefined\n  let tries = 0\n  for (let attempt = 0; attempt <= retries; attempt += 1) {\n    if (attempt > 0) {\n      await sleep(RETRY_PAUSES_MS[Math.min(attempt - 1, RETRY_PAUSES_MS.length - 1)])\n    }\n    tries += 1\n    // Signature headers come last: neither config nor admin headers can replace them.\n    const signature: Array<[string, string]> = [['webhook-id', webhookId]]\n    if (secret && key) {\n      const now = Date.now()\n      const t = Math.floor(now / 1000)\n      signature.push(\n        ['X-Form-Signature', await signWebhookBody(secret, json, now)],\n        ['webhook-timestamp', String(t)],\n        ['webhook-signature', `v1,${await hmacSha256Base64(key, `${webhookId}.${t}.${json}`)}`],\n      )\n    }\n    const headers = mergeHeaders(configHeaders, adminHeaders, signature)\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    try {\n      const response = await fetch(String(settings.url || ''), {\n        body: json,\n        headers,\n        method: settings.method || 'POST',\n        signal: controller.signal,\n      })\n      lastStatus = response.status\n      if (response.ok) {\n        return { ok: true, status: response.status, tries }\n      }\n      lastError = `Webhook answered ${response.status}.`\n    } catch (error) {\n      lastStatus = undefined\n      lastError = controller.signal.aborted\n        ? `Webhook timed out after ${timeoutMs} ms.`\n        : error instanceof Error\n          ? error.message\n          : String(error)\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n  return { error: lastError, ok: false, status: lastStatus, tries }\n}\n"],"names":["hmacSha256Base64","hmacSha256Hex","standardWebhooksKey","RETRY_PAUSES_MS","sleep","ms","Promise","resolve","setTimeout","signWebhookBody","secret","body","now","Date","t","Math","floor","webhookMessageId","submissionId","outputId","raw","undefined","crypto","randomUUID","replace","mergeHeaders","groups","merged","Map","group","key","value","set","toLowerCase","Object","fromEntries","values","sendWebhook","settings","json","JSON","stringify","timeoutMs","min","max","Number","retries","configHeaders","entries","filter","entry","Boolean","adminHeaders","headers","flatMap","header","signingSecret","webhookId","lastError","lastStatus","tries","attempt","length","signature","push","String","controller","AbortController","timer","abort","response","fetch","url","method","signal","status","ok","error","aborted","Error","message","clearTimeout"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,aAAa,EAAEC,mBAAmB,QAAQ,wBAAuB;AAyB5F,2CAA2C,GAC3C,OAAO,MAAMC,kBAAkB;IAAC;IAAK;IAAM;CAAK,CAAA;AAEhD,MAAMC,QAAQ,CAACC,KAAe,IAAIC,QAAc,CAACC,UAAYC,WAAWD,SAASF;AAEjF,uFAAuF,GACvF,OAAO,eAAeI,gBAAgBC,MAAc,EAAEC,IAAY,EAAEC,MAAMC,KAAKD,GAAG,EAAE;IAClF,MAAME,IAAIC,KAAKC,KAAK,CAACJ,MAAM;IAC3B,OAAO,CAAC,EAAE,EAAEE,EAAE,IAAI,EAAE,MAAMb,cAAcS,QAAQ,GAAGI,EAAE,CAAC,EAAEH,MAAM,GAAG;AACnE;AAEA,wGAAwG,GACxG,OAAO,SAASM,iBAAiBC,YAAqC,EAAEC,QAAwB;IAC9F,MAAMC,MACJF,iBAAiBG,aAAaH,iBAAiB,QAAQA,iBAAiB,MAAMC,WAC1E,CAAC,IAAI,EAAED,aAAa,CAAC,EAAEC,UAAU,GACjC,CAAC,IAAI,EAAEG,OAAOC,UAAU,GAAGC,OAAO,CAAC,MAAM,KAAK;IACpD,OAAOJ,IAAII,OAAO,CAAC,OAAO;AAC5B;AAEA;;;CAGC,GACD,SAASC,aAAa,GAAGC,MAAsC;IAC7D,MAAMC,SAAS,IAAIC,IAA8B;QAAC;YAAC;YAAgB;gBAAC;gBAAgB;aAAmB;SAAC;KAAC;IACzG,KAAK,MAAMC,SAASH,OAAQ;QAC1B,KAAK,MAAM,CAACI,KAAKC,MAAM,IAAIF,MAAO;YAChCF,OAAOK,GAAG,CAACF,IAAIG,WAAW,IAAI;gBAACH;gBAAKC;aAAM;QAC5C;IACF;IACA,OAAOG,OAAOC,WAAW,CAACR,OAAOS,MAAM;AACzC;AAEA;;;;CAIC,GACD,OAAO,eAAeC,YAAYC,QAAyB,EAAE3B,IAAa;IACxE,MAAM4B,OAAOC,KAAKC,SAAS,CAAC9B;IAC5B,MAAM+B,YAAY3B,KAAK4B,GAAG,CAAC,QAAQ5B,KAAK6B,GAAG,CAAC,KAAKC,OAAOP,SAASI,SAAS,KAAK;IAC/E,MAAMI,UAAU/B,KAAK4B,GAAG,CAAC,GAAG5B,KAAK6B,GAAG,CAAC,GAAG7B,KAAKC,KAAK,CAAC6B,OAAOP,SAASQ,OAAO,KAAK;IAC/E,MAAMC,gBAAgBb,OAAOc,OAAO,CAACV,SAASS,aAAa,IAAI,CAAC,GAAGE,MAAM,CACvE,CAACC,QAAqCC,QAAQD,KAAK,CAAC,EAAE,KAAK,OAAOA,KAAK,CAAC,EAAE,KAAK;IAEjF,MAAME,eAAe,AAACd,CAAAA,SAASe,OAAO,IAAI,EAAE,AAAD,EAAGC,OAAO,CAAC,CAACC,SACrDA,QAAQzB,OAAOyB,OAAOxB,KAAK,GAAG;YAAC;gBAACwB,OAAOzB,GAAG;gBAAEyB,OAAOxB,KAAK;aAAC;SAAC,GAAG,EAAE;IAEjE,MAAMrB,SAAS4B,SAASkB,aAAa,IAAI;IACzC,MAAMC,YAAYnB,SAASmB,SAAS,GAAGnB,SAASmB,SAAS,CAACjC,OAAO,CAAC,OAAO,OAAOP;IAChF,MAAMa,MAAMpB,SAASR,oBAAoBQ,UAAU;IACnD,IAAIgD,YAAY;IAChB,IAAIC;IACJ,IAAIC,QAAQ;IACZ,IAAK,IAAIC,UAAU,GAAGA,WAAWf,SAASe,WAAW,EAAG;QACtD,IAAIA,UAAU,GAAG;YACf,MAAMzD,MAAMD,eAAe,CAACY,KAAK4B,GAAG,CAACkB,UAAU,GAAG1D,gBAAgB2D,MAAM,GAAG,GAAG;QAChF;QACAF,SAAS;QACT,kFAAkF;QAClF,MAAMG,YAAqC;YAAC;gBAAC;gBAAcN;aAAU;SAAC;QACtE,IAAI/C,UAAUoB,KAAK;YACjB,MAAMlB,MAAMC,KAAKD,GAAG;YACpB,MAAME,IAAIC,KAAKC,KAAK,CAACJ,MAAM;YAC3BmD,UAAUC,IAAI,CACZ;gBAAC;gBAAoB,MAAMvD,gBAAgBC,QAAQ6B,MAAM3B;aAAK,EAC9D;gBAAC;gBAAqBqD,OAAOnD;aAAG,EAChC;gBAAC;gBAAqB,CAAC,GAAG,EAAE,MAAMd,iBAAiB8B,KAAK,GAAG2B,UAAU,CAAC,EAAE3C,EAAE,CAAC,EAAEyB,MAAM,GAAG;aAAC;QAE3F;QACA,MAAMc,UAAU5B,aAAasB,eAAeK,cAAcW;QAC1D,MAAMG,aAAa,IAAIC;QACvB,MAAMC,QAAQ5D,WAAW,IAAM0D,WAAWG,KAAK,IAAI3B;QACnD,IAAI;YACF,MAAM4B,WAAW,MAAMC,MAAMN,OAAO3B,SAASkC,GAAG,IAAI,KAAK;gBACvD7D,MAAM4B;gBACNc;gBACAoB,QAAQnC,SAASmC,MAAM,IAAI;gBAC3BC,QAAQR,WAAWQ,MAAM;YAC3B;YACAf,aAAaW,SAASK,MAAM;YAC5B,IAAIL,SAASM,EAAE,EAAE;gBACf,OAAO;oBAAEA,IAAI;oBAAMD,QAAQL,SAASK,MAAM;oBAAEf;gBAAM;YACpD;YACAF,YAAY,CAAC,iBAAiB,EAAEY,SAASK,MAAM,CAAC,CAAC,CAAC;QACpD,EAAE,OAAOE,OAAO;YACdlB,aAAatC;YACbqC,YAAYQ,WAAWQ,MAAM,CAACI,OAAO,GACjC,CAAC,wBAAwB,EAAEpC,UAAU,IAAI,CAAC,GAC1CmC,iBAAiBE,QACfF,MAAMG,OAAO,GACbf,OAAOY;QACf,SAAU;YACRI,aAAab;QACf;IACF;IACA,OAAO;QAAES,OAAOnB;QAAWkB,IAAI;QAAOD,QAAQhB;QAAYC;IAAM;AAClE"}

package/dist/endpoints/public.d.ts

@@ -0,0 +1,4 @@
+import type { Endpoint } from 'payload';
+import type { ResolvedOptions } from '../types.js';
+/** `GET /api/<forms>/public/:slug` — the published form, ready to render, without delivery settings. */
+export declare function publicFormEndpoint(options: ResolvedOptions): Endpoint;

package/dist/endpoints/public.js

@@ -0,0 +1,27 @@
+import { getPublicForm } from '../server/forms.js';
+/** `GET /api/<forms>/public/:slug` — the published form, ready to render, without delivery settings. */ export function publicFormEndpoint(options) {
+    return {
+        handler: async (req)=>{
+            const slug = String(req.routeParams?.slug || '');
+            const form = slug ? await getPublicForm(req.payload, slug, {
+                locale: req.locale || undefined,
+                req
+            }) : null;
+            if (!form) {
+                return Response.json({
+                    message: options.words.notFound,
+                    ok: false
+                }, {
+                    status: 404
+                });
+            }
+            return Response.json(form, {
+                status: 200
+            });
+        },
+        method: 'get',
+        path: '/public/:slug'
+    };
+}
+
+//# sourceMappingURL=public.js.map

package/dist/endpoints/public.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoints/public.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedOptions } from '../types.js'\n\nimport { getPublicForm } from '../server/forms.js'\n\n/** `GET /api/<forms>/public/:slug` — the published form, ready to render, without delivery settings. */\nexport function publicFormEndpoint(options: ResolvedOptions): Endpoint {\n  return {\n    handler: async (req) => {\n      const slug = String(req.routeParams?.slug || '')\n      const form = slug ? await getPublicForm(req.payload, slug, { locale: (req.locale || undefined) as never, req }) : null\n      if (!form) {\n        return Response.json({ message: options.words.notFound, ok: false }, { status: 404 })\n      }\n      return Response.json(form, { status: 200 })\n    },\n    method: 'get',\n    path: '/public/:slug',\n  }\n}\n"],"names":["getPublicForm","publicFormEndpoint","options","handler","req","slug","String","routeParams","form","payload","locale","undefined","Response","json","message","words","notFound","ok","status","method","path"],"mappings":"AAIA,SAASA,aAAa,QAAQ,qBAAoB;AAElD,sGAAsG,GACtG,OAAO,SAASC,mBAAmBC,OAAwB;IACzD,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,OAAOC,OAAOF,IAAIG,WAAW,EAAEF,QAAQ;YAC7C,MAAMG,OAAOH,OAAO,MAAML,cAAcI,IAAIK,OAAO,EAAEJ,MAAM;gBAAEK,QAASN,IAAIM,MAAM,IAAIC;gBAAqBP;YAAI,KAAK;YAClH,IAAI,CAACI,MAAM;gBACT,OAAOI,SAASC,IAAI,CAAC;oBAAEC,SAASZ,QAAQa,KAAK,CAACC,QAAQ;oBAAEC,IAAI;gBAAM,GAAG;oBAAEC,QAAQ;gBAAI;YACrF;YACA,OAAON,SAASC,IAAI,CAACL,MAAM;gBAAEU,QAAQ;YAAI;QAC3C;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/resend.d.ts

@@ -0,0 +1,4 @@
+import type { Endpoint } from 'payload';
+import type { ResolvedOptions } from '../types.js';
+/** `POST /api/<submissions>/:id/resend` — admins only: runs the failed outputs again. */
+export declare function resendEndpoint(options: ResolvedOptions): Endpoint;

package/dist/endpoints/resend.js

@@ -0,0 +1,58 @@
+import { RESEND_CONTEXT } from '../hooks/resendTick.js';
+import { resendFailedDeliveries } from '../server/resend.js';
+/** `POST /api/<submissions>/:id/resend` — admins only: runs the failed outputs again. */ export function resendEndpoint(options) {
+    return {
+        handler: async (req)=>{
+            if (!req.user || !options.isAdmin(req)) {
+                return Response.json({
+                    message: 'Forbidden',
+                    ok: false
+                }, {
+                    status: 403
+                });
+            }
+            const id = String(req.routeParams?.id || '');
+            let submission;
+            try {
+                submission = await req.payload.findByID({
+                    id,
+                    collection: options.slugs.submissions,
+                    depth: 0,
+                    overrideAccess: true
+                });
+            } catch  {
+                return Response.json({
+                    message: 'Not found',
+                    ok: false
+                }, {
+                    status: 404
+                });
+            }
+            const result = await resendFailedDeliveries(req.payload, submission, req);
+            if (result.added.length) {
+                await req.payload.update({
+                    id,
+                    collection: options.slugs.submissions,
+                    context: {
+                        [RESEND_CONTEXT]: true
+                    },
+                    data: {
+                        deliveryLog: result.log,
+                        status: result.status
+                    },
+                    overrideAccess: true
+                });
+            }
+            return Response.json({
+                deliveryLog: result.log,
+                ok: true,
+                resent: result.added.length,
+                status: result.status
+            });
+        },
+        method: 'post',
+        path: '/:id/resend'
+    };
+}
+
+//# sourceMappingURL=resend.js.map

package/dist/endpoints/resend.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoints/resend.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedOptions } from '../types.js'\n\nimport { RESEND_CONTEXT } from '../hooks/resendTick.js'\nimport { resendFailedDeliveries, type SubmissionDoc } from '../server/resend.js'\n\n/** `POST /api/<submissions>/:id/resend` — admins only: runs the failed outputs again. */\nexport function resendEndpoint(options: ResolvedOptions): Endpoint {\n  return {\n    handler: async (req) => {\n      if (!req.user || !options.isAdmin(req)) {\n        return Response.json({ message: 'Forbidden', ok: false }, { status: 403 })\n      }\n      const id = String(req.routeParams?.id || '')\n      let submission: SubmissionDoc\n      try {\n        submission = (await req.payload.findByID({\n          id,\n          collection: options.slugs.submissions as never,\n          depth: 0,\n          overrideAccess: true,\n        })) as unknown as SubmissionDoc\n      } catch {\n        return Response.json({ message: 'Not found', ok: false }, { status: 404 })\n      }\n      const result = await resendFailedDeliveries(req.payload, submission, req)\n      if (result.added.length) {\n        await req.payload.update({\n          id,\n          collection: options.slugs.submissions as never,\n          context: { [RESEND_CONTEXT]: true },\n          data: { deliveryLog: result.log, status: result.status } as never,\n          overrideAccess: true,\n        })\n      }\n      return Response.json({ deliveryLog: result.log, ok: true, resent: result.added.length, status: result.status })\n    },\n    method: 'post',\n    path: '/:id/resend',\n  }\n}\n"],"names":["RESEND_CONTEXT","resendFailedDeliveries","resendEndpoint","options","handler","req","user","isAdmin","Response","json","message","ok","status","id","String","routeParams","submission","payload","findByID","collection","slugs","submissions","depth","overrideAccess","result","added","length","update","context","data","deliveryLog","log","resent","method","path"],"mappings":"AAIA,SAASA,cAAc,QAAQ,yBAAwB;AACvD,SAASC,sBAAsB,QAA4B,sBAAqB;AAEhF,uFAAuF,GACvF,OAAO,SAASC,eAAeC,OAAwB;IACrD,OAAO;QACLC,SAAS,OAAOC;YACd,IAAI,CAACA,IAAIC,IAAI,IAAI,CAACH,QAAQI,OAAO,CAACF,MAAM;gBACtC,OAAOG,SAASC,IAAI,CAAC;oBAAEC,SAAS;oBAAaC,IAAI;gBAAM,GAAG;oBAAEC,QAAQ;gBAAI;YAC1E;YACA,MAAMC,KAAKC,OAAOT,IAAIU,WAAW,EAAEF,MAAM;YACzC,IAAIG;YACJ,IAAI;gBACFA,aAAc,MAAMX,IAAIY,OAAO,CAACC,QAAQ,CAAC;oBACvCL;oBACAM,YAAYhB,QAAQiB,KAAK,CAACC,WAAW;oBACrCC,OAAO;oBACPC,gBAAgB;gBAClB;YACF,EAAE,OAAM;gBACN,OAAOf,SAASC,IAAI,CAAC;oBAAEC,SAAS;oBAAaC,IAAI;gBAAM,GAAG;oBAAEC,QAAQ;gBAAI;YAC1E;YACA,MAAMY,SAAS,MAAMvB,uBAAuBI,IAAIY,OAAO,EAAED,YAAYX;YACrE,IAAImB,OAAOC,KAAK,CAACC,MAAM,EAAE;gBACvB,MAAMrB,IAAIY,OAAO,CAACU,MAAM,CAAC;oBACvBd;oBACAM,YAAYhB,QAAQiB,KAAK,CAACC,WAAW;oBACrCO,SAAS;wBAAE,CAAC5B,eAAe,EAAE;oBAAK;oBAClC6B,MAAM;wBAAEC,aAAaN,OAAOO,GAAG;wBAAEnB,QAAQY,OAAOZ,MAAM;oBAAC;oBACvDW,gBAAgB;gBAClB;YACF;YACA,OAAOf,SAASC,IAAI,CAAC;gBAAEqB,aAAaN,OAAOO,GAAG;gBAAEpB,IAAI;gBAAMqB,QAAQR,OAAOC,KAAK,CAACC,MAAM;gBAAEd,QAAQY,OAAOZ,MAAM;YAAC;QAC/G;QACAqB,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/submit.d.ts

@@ -0,0 +1,4 @@
+import type { Endpoint } from 'payload';
+import type { ResolvedOptions } from '../types.js';
+/** `POST /api/<forms>/submit/:slug` — every check runs here, whatever the browser did. */
+export declare function submitEndpoint(options: ResolvedOptions): Endpoint;

package/dist/endpoints/submit.js

@@ -0,0 +1,320 @@
+import { Buffer } from 'node:buffer';
+import { hasDeliveries, runDeliveries, statusFromLog } from '../delivery/run.js';
+import { checkRateLimit } from '../security/rateLimit.js';
+import { getRequestIP, isHoneypotFilled } from '../security/request.js';
+import { checkTurnstile } from '../security/turnstile.js';
+import { loadPublishedForm } from '../server/forms.js';
+import { buildSnapshot, checkAnswers } from '../shared/answers.js';
+import { getFieldLabel, getInputFields } from '../shared/rules.js';
+import { buildWhatsAppMessage, whatsappUrl } from '../shared/whatsapp.js';
+function respond(status, body) {
+    return Response.json(body, {
+        status
+    });
+}
+function isFile(value) {
+    return typeof value === 'object' && value !== null && typeof value.arrayBuffer === 'function' && 'name' in value;
+}
+async function parseBody(req) {
+    const type = req.headers.get('content-type') || '';
+    const raw = {};
+    const files = {};
+    if (type.includes('multipart/form-data') || type.includes('application/x-www-form-urlencoded')) {
+        const data = await req.formData();
+        for (const key of new Set(data.keys())){
+            const values = data.getAll(key);
+            const fileValues = values.filter(isFile).filter((f)=>f.size > 0);
+            if (fileValues.length) {
+                files[key] = fileValues;
+                continue;
+            }
+            const text = values.filter((v)=>typeof v === 'string');
+            raw[key] = text.length > 1 ? text : text[0];
+        }
+        return {
+            files,
+            raw
+        };
+    }
+    const json = await req.json();
+    if (json && typeof json === 'object' && !Array.isArray(json)) {
+        Object.assign(raw, json);
+    }
+    return {
+        files,
+        raw
+    };
+}
+/** `POST /api/<forms>/submit/:slug` — every check runs here, whatever the browser did. */ export function submitEndpoint(options) {
+    return {
+        handler: async (req)=>{
+            const payload = req.payload;
+            const slug = String(req.routeParams?.slug || '');
+            const locale = req.locale || undefined;
+            const loaded = slug ? await loadPublishedForm(payload, slug, {
+                locale,
+                req
+            }) : null;
+            if (!loaded) {
+                return respond(404, {
+                    message: options.words.notFound,
+                    ok: false
+                });
+            }
+            const { delivery, form } = loaded;
+            const words = form.wording;
+            if (form.intakeState === 'closed') {
+                return respond(409, {
+                    message: words.closed,
+                    ok: false
+                });
+            }
+            let body;
+            try {
+                body = await parseBody(req);
+            } catch  {
+                return respond(400, {
+                    message: words.genericError,
+                    ok: false
+                });
+            }
+            const { files, raw } = body;
+            const ip = getRequestIP(req.headers);
+            if (form.spamChecks) {
+                if (isHoneypotFilled(raw, options.honeypotField)) {
+                    return respond(400, {
+                        message: words.genericError,
+                        ok: false
+                    });
+                }
+                const human = await checkTurnstile({
+                    ip,
+                    logger: payload.logger,
+                    settings: options.turnstile,
+                    token: raw[options.turnstile.fieldName]
+                });
+                if (!human) {
+                    return respond(400, {
+                        message: words.securityCheckFailed,
+                        ok: false
+                    });
+                }
+                if (options.rateLimit) {
+                    const allowed = await checkRateLimit({
+                        formId: form.id,
+                        ip,
+                        max: options.rateLimit.max,
+                        payload,
+                        windowSeconds: options.rateLimit.windowSeconds
+                    });
+                    if (!allowed) {
+                        return respond(429, {
+                            message: words.tooManyTries,
+                            ok: false
+                        });
+                    }
+                }
+            }
+            const fileLikes = {};
+            for (const [key, list] of Object.entries(files)){
+                fileLikes[key] = list.map((f)=>({
+                        name: f.name,
+                        type: f.type,
+                        size: f.size
+                    }));
+            }
+            const checked = checkAnswers(form, raw, {
+                fieldTypes: options.fieldTypes,
+                files: fileLikes,
+                limits: options.attachments || undefined,
+                words
+            });
+            if (!checked.ok) {
+                return respond(400, {
+                    fieldErrors: checked.fieldErrors,
+                    message: words.errorPrefix,
+                    ok: false
+                });
+            }
+            const answers = checked.answers;
+            let waUrl;
+            if (delivery.whatsapp.enabled) {
+                const number = form.whatsapp?.number;
+                if (!number) {
+                    payload.logger.error(`payload-dynamic-forms: form "${form.slug}" has WhatsApp on but no number (form or whatsapp.number).`);
+                    return respond(500, {
+                        message: words.genericError,
+                        ok: false
+                    });
+                }
+                const message = buildWhatsAppMessage(form, answers, {
+                    fieldTypes: options.fieldTypes,
+                    rowTemplate: delivery.whatsapp.rowTemplate,
+                    template: delivery.whatsapp.messageTemplate
+                });
+                waUrl = whatsappUrl(number, message);
+            }
+            const inputs = new Map(getInputFields(form).map((entry)=>[
+                    entry.key,
+                    entry
+                ]));
+            const visibleUploads = checked.fileKeys.map((key)=>inputs.get(key)).filter(Boolean);
+            let submissionId;
+            let snapshot = buildSnapshot(form, answers, options.fieldTypes);
+            const created = [];
+            const outputs = hasDeliveries(delivery);
+            if (delivery.store) {
+                const attachmentSlug = options.attachments?.collection;
+                try {
+                    for (const { field, key } of visibleUploads){
+                        for (const file of files[key]){
+                            const doc = await payload.create({
+                                collection: attachmentSlug,
+                                data: {
+                                    fieldKey: key,
+                                    fieldLabel: getFieldLabel(field, key),
+                                    form: form.id
+                                },
+                                file: {
+                                    name: file.name || 'upload',
+                                    data: Buffer.from(await file.arrayBuffer()),
+                                    mimetype: file.type || 'application/octet-stream',
+                                    size: file.size
+                                },
+                                overrideAccess: true
+                            });
+                            const filename = String(doc.filename || file.name);
+                            created.push({
+                                id: doc.id,
+                                fieldKey: key,
+                                filename
+                            });
+                            const prev = answers[key];
+                            answers[key] = {
+                                attachmentIds: [
+                                    ...prev?.attachmentIds || [],
+                                    doc.id
+                                ],
+                                filenames: [
+                                    ...prev?.filenames || [],
+                                    filename
+                                ]
+                            };
+                        }
+                    }
+                    snapshot = buildSnapshot(form, answers, options.fieldTypes);
+                    const submission = await payload.create({
+                        collection: options.slugs.submissions,
+                        data: {
+                            answers,
+                            attachments: created.map((c)=>c.id),
+                            deliveryLog: [],
+                            form: form.id,
+                            metadata: {
+                                ip: options.metadata.ip ? ip || null : null,
+                                locale: req.locale || null,
+                                userAgent: options.metadata.userAgent ? req.headers.get('user-agent') || null : null
+                            },
+                            snapshot,
+                            status: outputs ? 'received' : 'processed'
+                        },
+                        overrideAccess: true
+                    });
+                    submissionId = submission.id;
+                    for (const file of created){
+                        await payload.update({
+                            id: file.id,
+                            collection: attachmentSlug,
+                            data: {
+                                submission: submissionId
+                            },
+                            overrideAccess: true
+                        });
+                    }
+                } catch (error) {
+                    payload.logger.error({
+                        err: error,
+                        msg: `payload-dynamic-forms: could not store a submission of "${form.slug}"`
+                    });
+                    for (const file of created){
+                        try {
+                            await payload.delete({
+                                id: file.id,
+                                collection: attachmentSlug,
+                                overrideAccess: true
+                            });
+                        } catch (deleteError) {
+                            payload.logger.error({
+                                err: deleteError,
+                                msg: 'payload-dynamic-forms: could not remove an attachment'
+                            });
+                        }
+                    }
+                    return respond(500, {
+                        message: words.genericError,
+                        ok: false
+                    });
+                }
+            }
+            if (outputs) {
+                const task = async ()=>{
+                    try {
+                        const entries = await runDeliveries({
+                            answers,
+                            attachments: created,
+                            delivery,
+                            form,
+                            options,
+                            payload,
+                            req,
+                            snapshot,
+                            submissionId
+                        });
+                        for (const entry of entries.filter((e)=>e.result === 'failed')){
+                            payload.logger.error(`payload-dynamic-forms: ${entry.kind} "${entry.label}" of "${form.slug}" failed: ${entry.error}`);
+                        }
+                        if (submissionId !== undefined) {
+                            await payload.update({
+                                id: submissionId,
+                                collection: options.slugs.submissions,
+                                data: {
+                                    deliveryLog: entries,
+                                    status: statusFromLog(entries)
+                                },
+                                overrideAccess: true
+                            });
+                        }
+                    } catch (error) {
+                        payload.logger.error({
+                            err: error,
+                            msg: `payload-dynamic-forms: delivery of "${form.slug}" failed`
+                        });
+                    }
+                };
+                if (options.delivery?.schedule) {
+                    options.delivery.schedule(task);
+                } else {
+                    await task();
+                }
+            }
+            const result = {
+                message: words.success,
+                ok: true
+            };
+            if (form.successType === 'redirect' && form.successRedirectURL) {
+                result.redirectURL = form.successRedirectURL;
+            }
+            if (submissionId !== undefined) {
+                result.submissionId = submissionId;
+            }
+            if (waUrl) {
+                result.whatsappUrl = waUrl;
+            }
+            return respond(200, result);
+        },
+        method: 'post',
+        path: '/submit/:slug'
+    };
+}
+
+//# sourceMappingURL=submit.js.map