Add create-feedback-form node with public review page

Introduces a `create-feedback-form` logic node that emits a signed,
unlisted URL (`/feedback/:token`) displaying the execution's visible
node outputs alongside the workflow's evaluation criteria for
anonymous reviewers. Object reference outputs are exposed via 7-day
presigned R2 URLs and the node completes immediately without pausing
the workflow.

Form tokens now carry an HMAC-signed expiration and optional
organization ID (shared constant `UNLISTED_LINK_TTL_SECONDS` = 7
days). The `feedback.user_id` column becomes nullable to support
anonymous submissions (migration 0052). Renames `/f/:token` to
`/form/:token` for readability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bchapuis

apps/api/src/db/migrations/0052_make_feedback_user_id_optional.sql

@@ -0,0 +1,34 @@
+-- Make user_id nullable in feedback to allow anonymous submissions
+-- (e.g. via create-feedback-form node public page)
+CREATE TABLE `feedback_new` (
+	`id` text PRIMARY KEY NOT NULL,
+	`execution_id` text NOT NULL,
+	`criterion_id` text NOT NULL,
+	`workflow_id` text,
+	`organization_id` text NOT NULL,
+	`user_id` text,
+	`sentiment` text NOT NULL,
+	`comment` text,
+	`created_at` integer DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` integer DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`criterion_id`) REFERENCES `feedback_criteria`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`workflow_id`) REFERENCES `workflows`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`organization_id`) REFERENCES `organizations`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+INSERT INTO `feedback_new` (`id`, `execution_id`, `criterion_id`, `workflow_id`, `organization_id`, `user_id`, `sentiment`, `comment`, `created_at`, `updated_at`)
+	SELECT `id`, `execution_id`, `criterion_id`, `workflow_id`, `organization_id`, `user_id`, `sentiment`, `comment`, `created_at`, `updated_at` FROM `feedback`;
+--> statement-breakpoint
+DROP TABLE `feedback`;
+--> statement-breakpoint
+ALTER TABLE `feedback_new` RENAME TO `feedback`;
+--> statement-breakpoint
+CREATE INDEX `feedback_execution_id_idx` ON `feedback` (`execution_id`);--> statement-breakpoint
+CREATE INDEX `feedback_criterion_id_idx` ON `feedback` (`criterion_id`);--> statement-breakpoint
+CREATE INDEX `feedback_workflow_id_idx` ON `feedback` (`workflow_id`);--> statement-breakpoint
+CREATE INDEX `feedback_organization_id_idx` ON `feedback` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `feedback_user_id_idx` ON `feedback` (`user_id`);--> statement-breakpoint
+CREATE INDEX `feedback_sentiment_idx` ON `feedback` (`sentiment`);--> statement-breakpoint
+CREATE INDEX `feedback_created_at_idx` ON `feedback` (`created_at`);--> statement-breakpoint
+CREATE UNIQUE INDEX `feedback_execution_id_criterion_id_unique` ON `feedback` (`execution_id`, `criterion_id`);

apps/api/src/db/schema/index.ts

@@ -380,9 +380,9 @@ export const feedback = sqliteTable(
     organizationId: text("organization_id")
       .notNull()
       .references(() => organizations.id, { onDelete: "cascade" }),
-    userId: text("user_id")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => users.id, {
+      onDelete: "cascade",
+    }),
     sentiment: text("sentiment").$type<FeedbackSentimentType>().notNull(),
     comment: text("comment"),
     createdAt: createCreatedAt(),

apps/api/src/durable-objects/workflow-agent.ts

@@ -92,6 +92,7 @@ export class WorkflowAgent extends Agent<Bindings, WorkflowAgentState> {
   private static readonly STORAGE_KEY_DIRTY = "dirty:persist";
   private static readonly STORAGE_PREFIX_EXEC_BUFFER = "execbuf:";
   private static readonly STORAGE_PREFIX_FORM = "form:";
+  private static readonly STORAGE_PREFIX_FEEDBACK_FORM = "fform:";
 
   initialState: WorkflowAgentState = {};
 
@@ -532,27 +533,35 @@ export class WorkflowAgent extends Agent<Bindings, WorkflowAgentState> {
    * Scan node outputs for form schema data (`schema` + `token`) and
    * store them in DO transactional storage. This is how form nodes
    * register their field definitions without touching the main DB.
+   *
+   * Also picks up `feedbackFormConfig` from create-feedback-form nodes
+   * so the public feedback page can read title/description by token.
    */
   private async extractFormSchemas(
     execution: WorkflowExecution
   ): Promise<void> {
     for (const nodeExec of execution.nodeExecutions) {
-      if (
-        nodeExec.status === "completed" &&
-        nodeExec.outputs &&
-        typeof nodeExec.outputs.schema === "string" &&
-        typeof nodeExec.outputs.token === "string"
-      ) {
-        const key =
-          WorkflowAgent.STORAGE_PREFIX_FORM +
-          nodeExec.outputs.token +
-          ":schema";
-        // Only store if not already present (idempotent)
+      if (nodeExec.status !== "completed" || !nodeExec.outputs) continue;
+
+      const token = nodeExec.outputs.token;
+      if (typeof token !== "string") continue;
+
+      if (typeof nodeExec.outputs.schema === "string") {
+        const key = WorkflowAgent.STORAGE_PREFIX_FORM + token + ":schema";
         const existing = await this.storage.get(key);
         if (!existing) {
           await this.storage.put(key, nodeExec.outputs.schema);
         }
       }
+
+      if (typeof nodeExec.outputs.feedbackFormConfig === "string") {
+        const key =
+          WorkflowAgent.STORAGE_PREFIX_FEEDBACK_FORM + token + ":config";
+        const existing = await this.storage.get(key);
+        if (!existing) {
+          await this.storage.put(key, nodeExec.outputs.feedbackFormConfig);
+        }
+      }
     }
   }
 
@@ -659,6 +668,40 @@ export class WorkflowAgent extends Agent<Bindings, WorkflowAgentState> {
     }
   }
 
+  // ── Feedback form state ───────────────────────────────────────────────
+
+  async getFeedbackFormStatus(
+    token: string
+  ): Promise<{ submitted: boolean; config?: string }> {
+    const key = WorkflowAgent.STORAGE_PREFIX_FEEDBACK_FORM + token;
+    const [record, config] = await Promise.all([
+      this.storage.get<{ submitted: boolean }>(key),
+      this.storage.get<string>(key + ":config"),
+    ]);
+    return {
+      submitted: record?.submitted ?? false,
+      ...(config ? { config } : {}),
+    };
+  }
+
+  /**
+   * Unlike `checkAndSubmitForm`, this does not send any workflow event —
+   * feedback submission is decoupled from workflow execution.
+   */
+  async markFeedbackSubmitted(
+    token: string
+  ): Promise<{ success: boolean; error?: string }> {
+    const key = WorkflowAgent.STORAGE_PREFIX_FEEDBACK_FORM + token;
+    const existing = await this.storage.get<{ submitted: boolean }>(key);
+
+    if (existing?.submitted) {
+      return { success: false, error: "Feedback has already been submitted" };
+    }
+
+    await this.storage.put(key, { submitted: true, submittedAt: Date.now() });
+    return { success: true };
+  }
+
   // ── Persistence ───────────────────────────────────────────────────────
 
   /**

apps/api/src/index.ts

@@ -20,6 +20,7 @@ import endpointExecuteRoutes from "./routes/endpoint-execute";
 import endpointRoutes from "./routes/endpoints";
 import executionRoutes from "./routes/executions";
 import feedbackRoutes from "./routes/feedback";
+import feedbackFormRoutes from "./routes/feedback-forms";
 import formRoutes from "./routes/forms";
 import health from "./routes/health";
 import integrationRoutes from "./routes/integrations";
@@ -108,6 +109,7 @@ app.route("/replicate", replicateRoutes);
 
 // Public routes
 app.route("/forms", formRoutes);
+app.route("/feedback-forms", feedbackFormRoutes);
 app.route("/templates", templateRoutes);
 app.route("/types", typeRoutes);
 

apps/api/src/mocks/node-registry.ts

@@ -6,6 +6,7 @@ import {
 import { NumberInputNode } from "@dafthunk/runtime/nodes/input/number-input-node";
 import { ConditionalForkNode } from "@dafthunk/runtime/nodes/logic/conditional-fork-node";
 import { ConditionalJoinNode } from "@dafthunk/runtime/nodes/logic/conditional-join-node";
+import { CreateFeedbackFormNode } from "@dafthunk/runtime/nodes/logic/create-feedback-form-node";
 import { CreateFormNode } from "@dafthunk/runtime/nodes/logic/create-form-node";
 import { WaitForFormNode } from "@dafthunk/runtime/nodes/logic/wait-for-form-node";
 import { AdditionNode } from "@dafthunk/runtime/nodes/math/addition-node";
@@ -49,6 +50,7 @@ export class MockNodeRegistry extends BaseNodeRegistry<Bindings> {
     this.registerImplementation(ConditionalForkNode);
     this.registerImplementation(ConditionalJoinNode);
     this.registerImplementation(CreateFormNode);
+    this.registerImplementation(CreateFeedbackFormNode);
     this.registerImplementation(WaitForFormNode);
     this.registerImplementation(MultiStepAdditionNode);
     this.registerImplementation(FailingMultiStepNode);