Skip to content

feat: draft/publish separation, submission snapshots & full UI redesign (1.0.0-alpha.4)#58

Merged
devCluna merged 7 commits into
mainfrom
fix/security-and-bulk-actions
Jul 2, 2026
Merged

feat: draft/publish separation, submission snapshots & full UI redesign (1.0.0-alpha.4)#58
devCluna merged 7 commits into
mainfrom
fix/security-and-bulk-actions

Conversation

@devCluna

@devCluna devCluna commented Jul 2, 2026

Copy link
Copy Markdown
Owner

Redesigns the three admin screens to match the design mock and adds real draft/publish semantics plus historically-accurate submissions.

⚠️ Breaking

  • Public serving now requires the form to be published. The public page, embed schema and submit endpoint previously served the working record regardless of state; now an unpublished form 404s and rejects submissions. Forms published before this release keep working via a fallback — re-publish once after upgrading for the cleanest behavior.

Highlights

Backend

  • Publish freezes an immutable publishedData snapshot; Save draft no longer touches the live form. Public schema/page/submit serve & validate the published snapshot only.
  • Each submission stores a fields schema snapshot at submit time, so the detail view stays accurate after fields are added/removed/renamed.
  • Forms list API returns submissionCount.

Admin UI

  • Full restyle of forms list, builder and submissions.
  • Forms list: templates + first-run onboarding, search, submissions-count column, status column removed, eye/external-link row icons.
  • Builder: single status pill (Draft / Published / Unpublished changes), right-aligned View live link, Settings slide-over drawer (applies on Save), tabbed field settings (General / Validation), custom Preview & Embed modals (share link gated on public page).
  • Submissions: bulk read/archive/delete, search + status filter, right-side detail drawer with prev/next, per-form column picker (localStorage), detail renders stored data (never hides an answer).

Release

Verification

  • npm run test:ts:front, test:ts:back, npm run build pass; host Strapi boots and migrates the new columns cleanly. Authenticated end-to-end (submit / publish flows) to be confirmed in-app.

🤖 Generated with Claude Code

devCluna added 7 commits July 1, 2026 21:20
…ulk actions

Server:
- honeypot: plant the hidden _fc_hp field in the embed and strip it before persisting
- rate limit: enforce enableRateLimit/maxSubmissionsPerHour per form+IP (429)
- public page: escape title/description (stored XSS)
- CSV export: neutralize formula injection; drop broken xlsx path (CSV only)
- align settings defaults to English

Admin:
- unique field names derived from uuid (Date.now collided)
- unsaved-changes guard in the builder
- submissions: select-all/per-row checkboxes, bulk delete, Export CSV
- form list: select-all/per-row checkboxes, bulk delete
- README: click-to-add wording
…counts

- First-run onboarding + Create-form template picker (6 templates)
- Functional search over title/slug on the forms list
- Submissions count column (server find() returns submissionCount)
- Seed new forms from a chosen template via router state
- Open-live-form row action for published public forms
- Shared ui.ts theme (tokens, font, field categories/icons)
- Header: editable title, status pill, version chip, ghost/primary actions
- Palette: searchable, categorized 2-col chip grid with monochrome icons
- Canvas: card rows with drag dots, required star, width/deco pill, delete
- Field settings: General/Validation tabs, Required toggle, Width segmented
…dals

- Submissions: prototype header/stats/badges, bulk read/archive/delete,
  search + status filter menu, right-side detail drawer with prev/next
- Builder: Settings opens a right slide-over drawer (general, public access
  with live/pending URL, spam & limits, advanced); coerce description to string
- Preview: custom centered modal matching the public form, no device toggle/footer
- Embed: tabbed script/share-link modal with highlighted snippet; share link
  only when public page is enabled; locked state until published
…snapshots

- Publish freezes a publishedData snapshot; Save draft no longer touches it
- Public schema, page & submit serve/validate the published snapshot only
  (legacy published forms fall back to their current copy)
- Submissions store a fields snapshot at submit time so the record stays
  accurate after the form's fields are added, removed or renamed
…mn picker

- Builder header: single status pill (Draft/Published/Unpublished changes),
  plain right-aligned View live link, settings drawer edits a buffer applied
  on Save; unpublished-changes indicator compares saved copy vs published
- Forms list: remove Status column; submissions=eye, live=external-link icons
- Submissions: detail renders from stored data (never hides answers) using
  the submit-time field snapshot for labels; table columns are the union of
  current fields + stored keys; per-form column picker (localStorage);
  baseline-aligned data rows; Status tile removed from detail
@coderabbitai

coderabbitai Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@devCluna, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3c6f95f2-3529-4340-863c-997c51074508

📥 Commits

Reviewing files that changed from the base of the PR and between 5c1d039 and d375609.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (21)
  • CHANGELOG.md
  • README.md
  • admin/src/api.ts
  • admin/src/components/DropZone.tsx
  • admin/src/components/EmbedModal.tsx
  • admin/src/components/FieldPalette.tsx
  • admin/src/components/FieldSettingsPanel.tsx
  • admin/src/components/FormPreview.tsx
  • admin/src/pages/FormBuilderPage.tsx
  • admin/src/pages/FormListPage.tsx
  • admin/src/pages/SubmissionsPage.tsx
  • admin/src/templates.ts
  • admin/src/types.ts
  • admin/src/ui.ts
  • package.json
  • server/src/content-types/form-submission/schema.json
  • server/src/content-types/form/schema.json
  • server/src/controllers/form.ts
  • server/src/controllers/submission.ts
  • server/src/services/form.ts
  • server/src/services/submission.ts
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/security-and-bulk-actions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devCluna
devCluna merged commit d652108 into main Jul 2, 2026
3 checks passed
@devCluna
devCluna deleted the fix/security-and-bulk-actions branch July 2, 2026 18:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant