public-forms.controller.ts

public-forms.controller.tsapps/api/src/modules/forms/public-forms.controller.tsraw ← forms2,166 B← Back to the app
1/**
2 * TASK-0107/0108 — the PUBLIC form routes (no auth — the global AuthGuard
3 * whitelists `/api/v1/public/forms/*`):
4 *
5 *   GET  /public/forms/:slug          the spec's public payload
6 *   POST /public/forms/:slug/submit   the submission pipeline
7 *
8 * The submit path is 201 on success (with an `X-Submission-Id` header for
9 * client dedupe logging); the 429's `Retry-After` header is set on the
10 * response by the service before the exception filter writes the body.
11 */
12import {
13  Body,
14  Controller,
15  Get,
16  HttpCode,
17  HttpStatus,
18  Inject,
19  Param,
20  Post,
21  Req,
22  UseGuards
23} from "@nestjs/common";
24import type { Request } from "express";
25import { z } from "zod";
26import { PublicFormsService } from "./public-forms.service.js";
27import { ZodValidate } from "../../common/pipes/zod-validation.pipe.js";
28import { loadEnv } from "../../config/env.js";
29import { verifyToken, TokenError } from "../../lib/jwt.js";
30import type { AuthContext } from "../../common/types.js";
31import { OptionalAuthGuard } from "./optional-auth.guard.js";
32 
33/** The submit body (spec: answers + optional recaptchaToken + honeypot). */
34const SubmitBody = z
35  .object({
36    answers: z.record(z.unknown()).default({}),
37    recaptchaToken: z.string().max(4_096).optional(),
38    website: z.string().max(500).optional(), // honeypot (hidden)
39    hp: z.string().max(500).optional() // honeypot (hidden)
40  })
41  .strict();
42type SubmitInput = z.infer<typeof SubmitBody>;
43 
44@Controller()
45export class PublicFormsController {
46  constructor(@Inject(PublicFormsService) private readonly publicForms: PublicFormsService) {}
47 
48  @Get("public/forms/:slug")
49  get(@Param("slug") slug: string) {
50    return this.publicForms.getPublic(slug);
51  }
52 
53  // Optional auth: a valid user JWT attributes the submission (submittedBy);
54  // a missing/invalid token is NOT a 401 — the public path never demands it.
55  @UseGuards(OptionalAuthGuard)
56  @HttpCode(HttpStatus.CREATED)
57  @Post("public/forms/:slug/submit")
58  submit(
59    @Param("slug") slug: string,
60    @Body(ZodValidate(SubmitBody)) body: SubmitInput,
61    @Req() req: Request
62  ) {
63    return this.publicForms.submitPublic(slug, body, req);
64  }
65}
66 
67 
68