bert.hausmans
4b7e66b83f
Phase 4 of S2b. Nine resources that shape the universal form builder responses. FieldAccessService::filterVisibleFields gates every field array — the primary defence tested by FormResourceSecurityTest (§22.9). - FormSchemaResource: includes fields_count, submissions_count, has_submissions, is_locked (derived from edit_lock_*), public_form_url when public_token is set, and filtered fields collection. - FormSchemaSummaryResource: lean list-endpoint variant. - FormFieldResource: effective_label / help_text / options resolved via FormLocaleResolver + translations JSON, plus TAG_PICKER available_tags filtered by validation_rules.tag_categories. - FormSubmissionResource: values keyed by field slug with FieldAccessService filtering, section_statuses, active delegations, review_info, submitted_in_locale, submission_duration_seconds. - FormSubmissionSummaryResource: lean list variant. - FormTemplateResource, FormFieldLibraryResource. - PublicFormSchemaResource: strictly limited per §10 — only is_portal_visible=true AND is_admin_only=false fields, no PII hints, no role_restrictions, no submissions_count. - FormSchemaWebhookResource: url/secret never returned; only url_host + has_secret boolean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
99 lines
4.0 KiB
PHP
99 lines
4.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Resources\FormBuilder;
|
|
|
|
use App\Models\FormBuilder\FormSchema;
|
|
use App\Models\FormBuilder\FormSubmission;
|
|
use App\Services\FormBuilder\FieldAccessService;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Resources\Json\JsonResource;
|
|
|
|
/**
|
|
* @mixin FormSchema
|
|
*/
|
|
final class FormSchemaResource extends JsonResource
|
|
{
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function toArray(Request $request): array
|
|
{
|
|
$fieldsCollection = $this->relationLoaded('fields')
|
|
? $this->fields
|
|
: $this->fields()->get();
|
|
|
|
$visible = app(FieldAccessService::class)
|
|
->filterVisibleFields($request->user(), $fieldsCollection);
|
|
|
|
$submissionsCount = $this->whenCounted(
|
|
'submissions',
|
|
default: FormSubmission::query()->where('form_schema_id', $this->id)->count(),
|
|
);
|
|
|
|
return [
|
|
'id' => $this->id,
|
|
'organisation_id' => $this->organisation_id,
|
|
'owner_type' => $this->owner_type,
|
|
'owner_id' => $this->owner_id,
|
|
'name' => $this->name,
|
|
'slug' => $this->slug,
|
|
'purpose' => $this->purpose instanceof \BackedEnum ? $this->purpose->value : $this->purpose,
|
|
'custom_purpose_slug' => $this->custom_purpose_slug,
|
|
'description' => $this->description,
|
|
'is_published' => (bool) $this->is_published,
|
|
'submission_mode' => $this->submission_mode instanceof \BackedEnum ? $this->submission_mode->value : $this->submission_mode,
|
|
'locale' => $this->locale,
|
|
'settings' => $this->settings,
|
|
'snapshot_mode' => $this->snapshot_mode instanceof \BackedEnum ? $this->snapshot_mode->value : $this->snapshot_mode,
|
|
'freeze_on_submit' => (bool) $this->freeze_on_submit,
|
|
'retention_days' => $this->retention_days,
|
|
'consent_version' => $this->consent_version,
|
|
'section_level_submit' => (bool) $this->section_level_submit,
|
|
'auto_save_enabled' => (bool) $this->auto_save_enabled,
|
|
'max_submissions' => $this->max_submissions,
|
|
'version' => (int) $this->version,
|
|
'public_token' => $this->public_token,
|
|
'public_token_previous' => $this->public_token_previous,
|
|
'public_token_rotated_at' => optional($this->public_token_rotated_at)->toIso8601String(),
|
|
'submission_deadline' => optional($this->submission_deadline)->toIso8601String(),
|
|
'created_by_user_id' => $this->created_by_user_id,
|
|
'last_updated_by_user_id' => $this->last_updated_by_user_id,
|
|
'edit_lock_user_id' => $this->edit_lock_user_id,
|
|
'edit_lock_expires_at' => optional($this->edit_lock_expires_at)->toIso8601String(),
|
|
'is_locked' => $this->isLocked(),
|
|
'public_form_url' => $this->publicFormUrl(),
|
|
'fields_count' => $fieldsCollection->count(),
|
|
'submissions_count' => $submissionsCount,
|
|
'has_submissions' => is_int($submissionsCount) ? $submissionsCount > 0 : null,
|
|
'fields' => FormFieldResource::collection($visible),
|
|
'sections' => FormSchemaSectionResource::collection(
|
|
$this->relationLoaded('sections') ? $this->sections : $this->sections()->get(),
|
|
),
|
|
'created_at' => optional($this->created_at)->toIso8601String(),
|
|
'updated_at' => optional($this->updated_at)->toIso8601String(),
|
|
];
|
|
}
|
|
|
|
private function isLocked(): bool
|
|
{
|
|
if ($this->edit_lock_user_id === null || $this->edit_lock_expires_at === null) {
|
|
return false;
|
|
}
|
|
|
|
return $this->edit_lock_expires_at->isFuture();
|
|
}
|
|
|
|
private function publicFormUrl(): ?string
|
|
{
|
|
if (empty($this->public_token)) {
|
|
return null;
|
|
}
|
|
|
|
$base = rtrim((string) config('crewli.portal_url', config('app.url')), '/');
|
|
|
|
return $base.'/f/'.$this->public_token;
|
|
}
|
|
}
|