3 Commits

Include renames

Author	SHA1	Message	Date
Moheeb Zara	40d4cdad98	feat(forms): verified-email retro-link of anonymous submissions (Phase 5) ... - claimMyAnonymousSubmissions(): exported but safe — no trusted params, resolves member + email from the caller's session, gated on email_confirmed_at, idempotent. Links the caller's own prior anonymous submissions to their member row - hooked best-effort from joinSpace (member insert now returns id; links prior anon submissions for the verified email) and finishOnboarding - addMember/importMembers deliberately NOT auto-linked: those emails are admin-asserted, not verified; the locked decision forbids auto-link there, so the forms.manage linkSubmissionsForMember stays the admin manual-link path - also repairs a build break committed in 295d220: finishOnboarding declared `const admin` twice (Phase 4 added a second). The probe and the completion update now share one admin client - docs: API_REFERENCE / ARCHITECTURE / HANDOFF 287/287 tests, build compiles clean (verified Compiled successfully). No deploy.	2026-05-16 16:29:32 -07:00
Moheeb Zara	03bb3a7466	feat(forms): builder UI, management pages, and public fill page (Phase 3) ... - components/forms/form-renderer.tsx: one controlled renderer for all 8 field types, shared by the builder preview and the public page - components/forms/form-builder.tsx: easy builder — label-only field creation (keys auto-derived and de-duped at save), one-click type buttons, up/down reordering, inline options editor, live preview; edit mode adds publish/close/draft/delete and copy-public-link - /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via the same RPC the RLS uses; RLS remains the real boundary) - public app/f/[slug] (outside the app group): getPublicForm serves only published public forms — members-only forms are never exposed there; waiver consent, anon email capture, signed-in gate for public_auth, thank-you state - sidebar "Forms & waivers" link; sonner toasts (codebase convention) - ARCHITECTURE + HANDOFF updated 285/285 tests, build clean, all four routes compiled. No deploy.	2026-05-16 15:03:48 -07:00
Moheeb Zara	897fa30ec1	feat(forms): server actions, Zod schemas, and dynamic answer validation (Phase 2) ... - lib/validations.ts: form field/array schemas (8 field types, duplicate-key and select-options refinements) and create/update/ status/submit/link envelope schemas; slug immutable on update - lib/forms-schema.ts: pure parseFormSchema + validateAnswers; unknown answer keys are discarded so a caller cannot inject arbitrary jsonb - lib/actions/forms.ts: create/update/setStatus/delete/list/results/ CSV export (forms.manage via user_has_permission + RLS), submitForm (service-client read+write, visibility + waiver consent enforced, schema/legal/version snapshot, IP/UA capture), and linkSubmissionsForMember (manual admin link; auto path is Phase 5) - updateForm bumps a published waiver's version on legal/schema change (non-blocking; existing submissions stay valid against their snapshot) - deleteForm refuses when submissions exist (immutable records) - types/database.ts: type user_has_permission/user_effective_roles (stale since migration 023) - __tests__/forms.test.ts (14); API_REFERENCE + HANDOFF updated 285/285 tests, build clean. No deploy.	2026-05-16 14:51:20 -07:00