strapi-plugin-hubspot 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## Unreleased
+
+## 0.13.1 — 2026-09-21
+
+### Added
+- **GDPR proof on submissions.** `meta.consent` / `meta.consentedAt` sent by
+  the frontend are stored on the submission row and written on the HubSpot
+  timeline note. They are not CRM properties — an unknown HubSpot key would
+  fail the whole upsert. Rebuild HubSpot's native legal-consent block as a
+  required checkbox named `consent` (see README).
+
 ## 0.13.0 — 2026-08-31
 
 ### Added

package/README.md

@@ -66,6 +66,33 @@ Every submission is stored in **HubSpot form submissions** (Content Manager),
 synced or not, with the CRM ids when the sync succeeded — the source of truth
 lives in your database, not in HubSpot's availability.
 
+### GDPR consent
+
+HubSpot's native *legal consent* block is **not** a CRM field. Importing a
+HubSpot form skips it (you'll see "rebuild it as a field") because this
+builder maps answers onto Contact/Company properties, and an unknown property
+makes HubSpot reject the whole upsert.
+
+To connect consent so the CRM and Strapi both keep a proof:
+
+1. **In HubSpot** (Settings → Properties → Contact), create a checkbox
+   property, e.g. `rgpd_consent`. Optionally a datetime `rgpd_consented_at`.
+2. **In the form builder** (Admin → HubSpot Forms), last step: add a
+   **Checkbox**, name it `consent` (that name is what the site recognizes —
+   it will not inject a second box), mark it **required**.
+3. **Map it**: Object = Contact, property = `rgpd_consent`. The visitor's tick
+   then lands on the contact. Leave `consentedAt` unmapped; the frontend
+   sends it in `meta.consentedAt`, stored on the submission and on the
+   timeline note.
+4. **Publish** the form. The public submit pipeline already refuses a payload
+   without consent when the site is in front (Nuxt BFF). Direct calls to
+   `/api/hubspot/forms/:slug/submit` still accept a form that has no consent
+   field — add the checkbox so required-field validation covers them too.
+
+The newsletter block on the site is **not** a HubSpot form: it upserts the
+email as a contact and writes a timeline note with the consent timestamp.
+No form to create in the builder for that one.
+
 ### Browsing submissions
 
 The **Submissions** button on the forms list (also reachable from a form's

package/dist/server/index.js

@@ -1710,6 +1710,10 @@ function createFormsService(strapi, _opts = {}) {
       const path = opts.meta.originPath ? ` (${escapeHtml(String(opts.meta.originPath))})` : "";
       lines.push(`<strong>Sujet</strong> : ${escapeHtml(String(opts.meta.originLabel))}${path}`);
     }
+    if (opts.meta.consent === true) {
+      const when = typeof opts.meta.consentedAt === "string" && opts.meta.consentedAt ? ` (${escapeHtml(opts.meta.consentedAt)})` : "";
+      lines.push(`<strong>Consentement RGPD</strong> : oui${when}`);
+    }
     for (const record of opts.companies ?? []) {
       if (!record.name && !record.siret) continue;
       const bits = [record.name, record.siret ? `SIRET ${record.siret}` : ""].filter(Boolean);
@@ -2893,6 +2897,10 @@ const controllers = {
           const v = rawMeta[key];
           if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
         }
+        if (rawMeta.consent === true) meta.consent = true;
+        if (typeof rawMeta.consentedAt === "string" && rawMeta.consentedAt.trim()) {
+          meta.consentedAt = rawMeta.consentedAt.trim().slice(0, 40);
+        }
         const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
         if (!outcome.ok) {
           ctx.status = 422;

package/dist/server/index.mjs

@@ -1709,6 +1709,10 @@ function createFormsService(strapi, _opts = {}) {
       const path = opts.meta.originPath ? ` (${escapeHtml(String(opts.meta.originPath))})` : "";
       lines.push(`<strong>Sujet</strong> : ${escapeHtml(String(opts.meta.originLabel))}${path}`);
     }
+    if (opts.meta.consent === true) {
+      const when = typeof opts.meta.consentedAt === "string" && opts.meta.consentedAt ? ` (${escapeHtml(opts.meta.consentedAt)})` : "";
+      lines.push(`<strong>Consentement RGPD</strong> : oui${when}`);
+    }
     for (const record of opts.companies ?? []) {
       if (!record.name && !record.siret) continue;
       const bits = [record.name, record.siret ? `SIRET ${record.siret}` : ""].filter(Boolean);
@@ -2892,6 +2896,10 @@ const controllers = {
           const v = rawMeta[key];
           if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
         }
+        if (rawMeta.consent === true) meta.consent = true;
+        if (typeof rawMeta.consentedAt === "string" && rawMeta.consentedAt.trim()) {
+          meta.consentedAt = rawMeta.consentedAt.trim().slice(0, 40);
+        }
         const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
         if (!outcome.ok) {
           ctx.status = 422;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-hubspot",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "The form builder for HubSpot in Strapi — multi-step forms with conditional fields mapped to real CRM properties, a public submit pipeline with retries, and save-time mapping validation.",
   "keywords": [
     "strapi",