Moheeb Zara
03bb3a7466
- components/forms/form-renderer.tsx: one controlled renderer for all 8 field types, shared by the builder preview and the public page - components/forms/form-builder.tsx: easy builder — label-only field creation (keys auto-derived and de-duped at save), one-click type buttons, up/down reordering, inline options editor, live preview; edit mode adds publish/close/draft/delete and copy-public-link - /forms directory, /forms/new, /forms/[id]/edit, /forms/[id]/results (CSV download). Server-gated by lib/forms-guard.ts (forms.manage via the same RPC the RLS uses; RLS remains the real boundary) - public app/f/[slug] (outside the app group): getPublicForm serves only published public forms — members-only forms are never exposed there; waiver consent, anon email capture, signed-in gate for public_auth, thank-you state - sidebar "Forms & waivers" link; sonner toasts (codebase convention) - ARCHITECTURE + HANDOFF updated 285/285 tests, build clean, all four routes compiled. No deploy.
33 lines
1.1 KiB
TypeScript
33 lines
1.1 KiB
TypeScript
import { redirect } from 'next/navigation'
|
|
import { createClient } from '@/lib/supabase/server'
|
|
|
|
// Server-component guard for the /forms management pages. Mirrors the
|
|
// /settings server gate: resolve the member, check forms.manage via the
|
|
// same RPC the forms RLS uses, and redirect non-managers before any data
|
|
// is fetched. The forms RLS independently enforces this; the redirect is
|
|
// for UX, not the security boundary.
|
|
export async function requireFormsManagerPage() {
|
|
const supabase = await createClient()
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser()
|
|
if (!user) redirect('/login')
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members')
|
|
.select('id, space_id, role, user_id, display_name')
|
|
.eq('user_id', user.id)
|
|
.in('status', ['current', 'unverified', 'late'])
|
|
.single()
|
|
if (!member) redirect('/login')
|
|
|
|
const { data: allowed } = await supabase.rpc('user_has_permission', {
|
|
uid: user.id,
|
|
sid: member.space_id,
|
|
perm: 'forms.manage',
|
|
})
|
|
if (!allowed) redirect('/dashboard')
|
|
|
|
return { supabase, member }
|
|
}
|