Repository navigation
Preview mode for the public form: try a form without storing answers - #266
Conversation
Creating a session with preview: true needs a member of the form's team and returns the token "preview" without storing a session. Submitting or uploading with that token checks the team again and stores, counts and sends nothing. Stored tokens have 32 characters, so they never match it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PhilReinking
left a comment
PhilReinking
left a comment
There was a problem hiding this comment.
OK at 2993fc9, CI green.
The new tests fail on main. Beyond that, a run with real login cookies: the app's own origin gets the preview, a cross-site request with the owner's cookie counts as a guest (403, 404 for a draft), and no CSRF token gives 419. An API token gets 403. Nothing is queued, mailed or written, a real token stores as before, and the rate limits still apply. One should inline: the changelog line.
| - The forms API (`GET /api/forms`) returns when each form last got a submission (`latest_submission_at`) and can sort by it, newest first. Sorting now works only by `name`, `created_at`, `updated_at` or `latest_submission_at`. Other sort values that worked before, like `published_at`, `id` or `uuid`, now give the default order. A dashboard link with an unknown filter or sort now shows your forms. Before, it showed no forms at all. (#242) | ||
| - Search your forms by name, also without accents ("muller" finds "Müller"), and press "/" to jump to the search. The form list has status tabs with counts and sorts by latest submission, last edit, newest or name. Your choice stays in the address, so Back undoes it and a link shows the same list. Dashboard links with the old `?filter=` show all forms. (#248) | ||
| - The form list shows when each form last got a submission, with a blue dot for the last 24 hours, and now opens sorted by latest submission. Its date column shows the date the list is sorted by. (#250) | ||
| - The form's team can try a form in preview mode, also while it's a draft. Answers in preview mode are never stored or counted and send no webhooks or emails. (#266) |
There was a problem hiding this comment.
The editor's Preview link still opens the real form, so answers there are stored and sent to webhooks until BITS-285 lands. A user who reads this line would expect the opposite. I'd name the API for now, like the other API lines here.
| - The form's team can try a form in preview mode, also while it's a draft. Answers in preview mode are never stored or counted and send no webhooks or emails. (#266) | |
| - The public form API has a preview mode for the form's team: start a session with `preview: true`, also for a draft. Answers in preview mode are never stored or counted and send no webhooks or emails. (#266) |
…-mode # Conflicts: # CHANGELOG.md
The editor's Preview link still opens the real form until BITS-285, so the line names the API that has the preview mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PhilReinking
left a comment
PhilReinking
left a comment
There was a problem hiding this comment.
OK at adeb430, CI green. The merges of main change only CHANGELOG.md by hand, and the PR's own diff against main is the reviewed one from 2993fc9. The reworded #266 line holds: POST /api/public/forms/{form}/session takes preview: true for the form's team only, also for a draft, and PreviewModeTest covers that nothing is stored, counted or sent.
1 participant
The coming editor's live preview runs the real form, also for a draft, but must store nothing. This adds a preview mode to the public form API, only for the form's team.
Fixes BITS-277
POST /api/public/forms/{form}/sessionwithpreview: true: needs a member of the form's team (else 403), stores no session and returns the tokenpreview.preview: team check again, then 204. No answers, files, counts, webhooks or emails.previewnever reaches a real session.Tested: full PHP suite on MariaDB and SQLite. The new tests fail on main (a preview stores a session, guests get in, the token gives 404). Scribe documents it.
Not tested: the public form app doesn't use it yet, see below.
What the public form app needs (frontend, live preview ticket)
callCreateFormSession: sendpreview: truein preview mode.initForm: take a start block uuid and setcurrentto it when it is inprocessedQueue.🤖 Generated with Claude Code