Skip to content

Corpus enquiry form on @profullstack/contact-form 0.2.0 - #258

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
mainfrom
contact-form-module
Oct 29, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
mainfrom
contact-form-module

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

Moves the corpus enquiry form (/sales, POST /api/sales/contact) onto @profullstack/contact-form@0.2.0 (pinned), keeping its questions.

  • apps/web/src/lib/salesContact.js: one createContactForm, built by a factory so tests can inject the store and transport. Same fields and limits (name 120, email 200 required, org 160, use case 10-4000 required with the old message), intro line as a section, the hint as help.
  • Kept: row stored in dataset_enquiries first (persist), mail best-effort (onSendError: 'ignore') through @rssamplifier/mail to SALES_EMAIL, subject Corpus enquiry: {org || email}, the DB-backed 3/hour/address limit (verify), 303 back to /sales#enquire for no-JS posts, useCase accepted from JSON callers (mapBody).
  • New: proof-of-render token (binding rssamplifier:sales, secret RESEND_API_KEY as set in prod); tokenless posts answered { ok: true } and neither stored nor mailed. JSON errors are { ok: false, error: message }. ?error= text is shown only when it is a message the form can produce.
  • Labels kept screen-reader-only and cf-* styled in globals.css so the box looks as before; honeypot hidden.
  • test/sales-contact.test.js (7 tests): tokenless not stored/sent, valid stored then mailed, useCase alias, short use case refused, DB limit, no-JS redirect.
  • Version 0.2.1.

Local run: 512 pass; the 6 failures are webhooks.test.js needing the CI Postgres. Build passes.

🤖 Generated with Claude Code

/sales and /api/sales/contact now share one createContactForm object
(apps/web/src/lib/salesContact.js) and keep their questions: name, email
(required), company or project, and the use case (required, at least ten
characters, same wording), the intro line and the hint under the box.

What stays the same: the enquiry is stored in dataset_enquiries before any
mail goes out and a failed mail never fails the request; the three per
hour per address limit is still read from the database; the notification
goes to SALES_EMAIL (default hello@rssamplifier.com) through
@rssamplifier/mail with Reply-To the sender and the same subject; a plain
form post (JavaScript off) still gets a 303 back to /sales#enquire; JSON
callers may still send useCase.

What is new: the form carries form-guard's proof-of-render token, so a
POST that never loaded the page is answered like success and not stored;
with JavaScript on it answers in place. JSON errors are now
{ ok: false, error: <message> } instead of an error code. A plain form
post's ?error= carries the message, and the page shows it only if it is
one the form can produce.

Version 0.2.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​contact-form@​0.2.07610010090100

View full report

@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit a022771 into main Oct 29, 2026
3 checks passed
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot deleted the contact-form-module branch October 29, 2026 01:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant