S2c D2, D3, D4, D8 — the meat of the public API rewrite.
Draft / save / submit split (D4):
- POST /public/forms/{public_token}/submissions
Creates a draft. idempotency_key is now REQUIRED; second POST with
the same key returns the existing draft (HTTP 200 vs 201 for fresh).
UniqueConstraintViolationException caught for race-safe replay.
- PUT /public/forms/{public_token}/submissions/{submission_id}
Auto-save. Partial updates only — each PUT writes just the
slugs in the body. Status stays 'draft'; auto_save_count++.
- POST /public/forms/{public_token}/submissions/{submission_id}/submit
Final submission. Merges body values with already-saved values,
runs strict rule set against the merged map, then calls
FormSubmissionService::submit which fires the lifecycle events
(tag sync, identity match). Rate-limited per IP per token per hour.
Access rules: submission must belong to the resolved schema; status
must be 'draft' (409 SUBMISSION_ALREADY_SUBMITTED otherwise); schema
still accepting submissions.
Sub-endpoints (D2, D3):
- GET /public/forms/{public_token}/time-slots
Volunteer-only, festival-aware (parent + children). Reads straight
from TimeSlot model — no org-coupled service to extract from. Out:
{id, name, date, start_time, end_time, duration_hours, event_id,
event_name}.
- GET /public/forms/{public_token}/sections
show_in_registration=true, type=standard, deduplicated by name
across festival children.
Dynamic per-field validation (D8):
- FormFieldRuleBuilder builds Laravel rule arrays from form_fields.
strict() enforces is_required + in:options + type rules (email,
url, numeric, date, boolean, phone regex); relaxed() is the
auto-save variant that drops required-ness.
- StartPublicDraftRequest (required idempotency_key),
SavePublicDraftRequest (relaxed rules, values optional),
SubmitPublicSubmissionRequest (relaxed rules at body level — the
controller merges the body with saved values and runs the strict
validator on the full map so submit with an empty body still
passes when everything was auto-saved).
- FormValueService backs the request layer up with deeper enforcement
of validation_rules JSON (min/max/regex) + is_unique. Throws
FieldValidationException (422) which renders via the D6 envelope.
PublicFormTokenResolver centralises the grace-window logic; every
public endpoint resolves through it so the standardised exceptions
bubble uniformly.
Routes: 6 total under /public/forms/ (up from 2). Tests:
PublicFormApiTest's existing submit test retrofitted to the three-step
flow; 857 tests still green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
211 lines
6.7 KiB
PHP
211 lines
6.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Services\FormBuilder;
|
|
|
|
use App\Enums\FormBuilder\FormFieldType;
|
|
use App\Models\FormBuilder\FormField;
|
|
use App\Models\FormBuilder\FormSchema;
|
|
|
|
/**
|
|
* Build Laravel validation rules dynamically from a schema's form_fields.
|
|
*
|
|
* Two modes (S2c D8):
|
|
* - strict(): for the final submit pipeline. is_required fields are
|
|
* required; SELECT/RADIO values must be in options; multi-value
|
|
* types must be arrays; type rules (email/url/date/numeric/boolean)
|
|
* are enforced.
|
|
* - relaxed(): for auto-save drafts. Every rule becomes nullable;
|
|
* options lists still constrain (a SELECT can't silently accept
|
|
* garbage, even mid-draft), but required stays off.
|
|
*
|
|
* Rule shape returned targets `values.{slug}` and `values.{slug}.*` keys
|
|
* so FormRequests can merge this into their own `values` wrapper:
|
|
*
|
|
* return array_merge(['values' => ['required', 'array']], $ruleBuilder->strict($schema));
|
|
*/
|
|
final class FormFieldRuleBuilder
|
|
{
|
|
/**
|
|
* @return array<string, array<int, string>>
|
|
*/
|
|
public function strict(FormSchema $schema): array
|
|
{
|
|
return $this->build($schema, strict: true);
|
|
}
|
|
|
|
/**
|
|
* @return array<string, array<int, string>>
|
|
*/
|
|
public function relaxed(FormSchema $schema): array
|
|
{
|
|
return $this->build($schema, strict: false);
|
|
}
|
|
|
|
/**
|
|
* @return array<string, array<int, string>>
|
|
*/
|
|
private function build(FormSchema $schema, bool $strict): array
|
|
{
|
|
$fields = $schema->fields()->get();
|
|
$rules = [];
|
|
|
|
foreach ($fields as $field) {
|
|
if (! (bool) $field->is_portal_visible || (bool) $field->is_admin_only) {
|
|
continue;
|
|
}
|
|
|
|
if (in_array($field->field_type, [FormFieldType::HEADING->value, FormFieldType::PARAGRAPH->value], true)) {
|
|
continue;
|
|
}
|
|
|
|
$key = 'values.'.$field->slug;
|
|
$isMulti = $this->isMultiValue($field);
|
|
$primaryRules = [];
|
|
|
|
if ($strict && (bool) $field->is_required) {
|
|
$primaryRules[] = $isMulti ? 'present' : 'required';
|
|
} else {
|
|
$primaryRules[] = 'sometimes';
|
|
$primaryRules[] = 'nullable';
|
|
}
|
|
|
|
if ($isMulti) {
|
|
$primaryRules[] = 'array';
|
|
$rules[$key] = $primaryRules;
|
|
|
|
foreach ($this->itemRulesFor($field, $strict) as $itemRule) {
|
|
$rules[$key.'.*'][] = $itemRule;
|
|
}
|
|
continue;
|
|
}
|
|
|
|
foreach ($this->scalarTypeRules($field) as $r) {
|
|
$primaryRules[] = $r;
|
|
}
|
|
foreach ($this->validationRuleShortcuts($field) as $r) {
|
|
$primaryRules[] = $r;
|
|
}
|
|
|
|
$rules[$key] = $primaryRules;
|
|
}
|
|
|
|
return $rules;
|
|
}
|
|
|
|
private function isMultiValue(FormField $field): bool
|
|
{
|
|
return in_array($field->field_type, [
|
|
FormFieldType::MULTISELECT->value,
|
|
FormFieldType::CHECKBOX_LIST->value,
|
|
FormFieldType::TAG_PICKER->value,
|
|
FormFieldType::AVAILABILITY_PICKER->value,
|
|
FormFieldType::SECTION_PRIORITY->value,
|
|
FormFieldType::TABLE_ROWS->value,
|
|
], true);
|
|
}
|
|
|
|
/**
|
|
* @return array<int, string>
|
|
*/
|
|
private function scalarTypeRules(FormField $field): array
|
|
{
|
|
return match ($field->field_type) {
|
|
FormFieldType::EMAIL->value => ['email:rfc'],
|
|
FormFieldType::URL->value => ['url'],
|
|
FormFieldType::NUMBER->value => ['numeric'],
|
|
FormFieldType::DATE->value => ['date_format:Y-m-d'],
|
|
FormFieldType::DATETIME->value => ['date'],
|
|
FormFieldType::BOOLEAN->value => ['boolean'],
|
|
FormFieldType::PHONE->value => ['regex:/^[+]?[0-9\s\-()]{4,25}$/'],
|
|
FormFieldType::SELECT->value, FormFieldType::RADIO->value => $this->inOptionsRule($field),
|
|
default => ['string'],
|
|
};
|
|
}
|
|
|
|
/**
|
|
* @return array<int, string>
|
|
*/
|
|
private function itemRulesFor(FormField $field, bool $strict): array
|
|
{
|
|
$rules = [];
|
|
if ($strict && (bool) $field->is_required) {
|
|
$rules[] = 'required';
|
|
} else {
|
|
$rules[] = 'nullable';
|
|
}
|
|
|
|
return match ($field->field_type) {
|
|
FormFieldType::MULTISELECT->value, FormFieldType::CHECKBOX_LIST->value => array_merge($rules, $this->inOptionsRule($field)),
|
|
FormFieldType::TAG_PICKER->value => array_merge($rules, ['string', 'max:30']),
|
|
FormFieldType::AVAILABILITY_PICKER->value => array_merge($rules, ['string', 'max:30']),
|
|
FormFieldType::SECTION_PRIORITY->value => array_merge($rules, ['array:section_id,priority']),
|
|
FormFieldType::TABLE_ROWS->value => array_merge($rules, ['array']),
|
|
default => $rules,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* @return array<int, string>
|
|
*/
|
|
private function inOptionsRule(FormField $field): array
|
|
{
|
|
$options = $this->scalarOptions($field);
|
|
if ($options === []) {
|
|
return [];
|
|
}
|
|
|
|
return ['in:'.implode(',', $options)];
|
|
}
|
|
|
|
/**
|
|
* @return array<int, string>
|
|
*/
|
|
private function scalarOptions(FormField $field): array
|
|
{
|
|
$options = is_array($field->options) ? $field->options : [];
|
|
$out = [];
|
|
foreach ($options as $opt) {
|
|
if (is_scalar($opt)) {
|
|
$out[] = (string) $opt;
|
|
} elseif (is_array($opt) && isset($opt['value']) && is_scalar($opt['value'])) {
|
|
$out[] = (string) $opt['value'];
|
|
} elseif (is_array($opt) && isset($opt['label']) && is_scalar($opt['label'])) {
|
|
$out[] = (string) $opt['label'];
|
|
}
|
|
}
|
|
|
|
return $out;
|
|
}
|
|
|
|
/**
|
|
* Shortcuts picked up from form_fields.validation_rules JSON.
|
|
* Service-layer FormValueService does the deeper min/max/regex/unique
|
|
* enforcement — these are quick boundary checks surfaced at the
|
|
* Request layer when cheap.
|
|
*
|
|
* @return array<int, string>
|
|
*/
|
|
private function validationRuleShortcuts(FormField $field): array
|
|
{
|
|
$rules = [];
|
|
$v = $field->validation_rules ?? null;
|
|
if (! is_array($v)) {
|
|
return $rules;
|
|
}
|
|
|
|
if (isset($v['min']) && is_numeric($v['min'])) {
|
|
$rules[] = 'min:'.(string) $v['min'];
|
|
}
|
|
if (isset($v['max']) && is_numeric($v['max'])) {
|
|
$rules[] = 'max:'.(string) $v['max'];
|
|
}
|
|
if (isset($v['regex']) && is_string($v['regex'])) {
|
|
$rules[] = 'regex:'.$v['regex'];
|
|
}
|
|
|
|
return $rules;
|
|
}
|
|
}
|