fix

Author: os-zhuang

examples/app-crm/dist/objectstack.json

@@ -138,6 +138,13 @@ export const Account = ObjectSchema.create({
       group: 'branding',
     }),
 
+    // Company logo (uploaded image)
+    logo: Field.image({
+      label: 'Company Logo',
+      group: 'branding',
+      crop: true,
+    }),
+
     // Date field
     last_activity_date: Field.date({
       label: 'Last Activity Date',

examples/app-crm/src/objects/account.object.ts

@@ -27,6 +27,23 @@ const caseValidation: Hook = {
   description: 'Apply SLA defaults for critical cases.',
   handler: async (ctx: HookContext) => {
     const { input } = ctx;
+
+    // Web-to-Case: stamp safe defaults for anonymous submissions and strip
+    // any client-supplied fields that should be controlled server-side.
+    // Guests are unauthenticated, identified by the absence of ctx.user.id.
+    // Only applies on INSERT (no `ctx.previous`).
+    const isGuestSubmission = !ctx.previous && !ctx.user?.id;
+    if (isGuestSubmission) {
+      if (!input.origin)   input.origin   = 'web';
+      if (!input.status)   input.status   = 'new';
+      if (!input.priority) input.priority = 'medium';
+      delete (input as Record<string, unknown>).owner;
+      delete (input as Record<string, unknown>).is_escalated;
+      delete (input as Record<string, unknown>).is_closed;
+      delete (input as Record<string, unknown>).internal_notes;
+      delete (input as Record<string, unknown>).resolution;
+    }
+
     const priority =
       (typeof input.priority === 'string' && input.priority) ||
       (typeof ctx.previous?.priority === 'string' && (ctx.previous.priority as string)) ||

examples/app-crm/src/objects/case.hook.ts

@@ -76,6 +76,25 @@ const leadHook: Hook = {
     }
 
     if (event === 'beforeInsert') {
+      // Web-to-Lead: anonymous submissions from the public form get
+      // sensible defaults stamped server-side so they cannot be spoofed
+      // by the client. Guests are unauthenticated, so we identify them
+      // by the absence of `ctx.user?.id`. (The `guest_portal` profile
+      // already restricts them to INSERT-only on `lead`.)
+      const isGuestSubmission = !ctx.user?.id;
+      if (isGuestSubmission) {
+        if (!input.lead_source) input.lead_source = 'web';
+        if (!input.status)      input.status      = 'new';
+        // Never trust client-supplied conversion / ownership fields on
+        // a public form — strip them defensively.
+        delete (input as Record<string, unknown>).is_converted;
+        delete (input as Record<string, unknown>).converted_account;
+        delete (input as Record<string, unknown>).converted_contact;
+        delete (input as Record<string, unknown>).converted_opportunity;
+        delete (input as Record<string, unknown>).converted_date;
+        delete (input as Record<string, unknown>).owner;
+      }
+
       if (typeof input.rating !== 'number') {
         input.rating = computeRating(input);
       }

examples/app-crm/src/objects/lead.hook.ts

@@ -112,12 +112,14 @@ export const Product = ObjectSchema.create({
     }),
 
     // Images and Assets
-    image_url: Field.url({
+    image: Field.image({
       label: 'Product Image',
+      crop: true,
     }),
-    
-    datasheet_url: Field.url({
-      label: 'Datasheet URL',
+
+    datasheet: Field.file({
+      label: 'Datasheet',
+      accept: ['application/pdf', '.pdf'],
     }),
 
     // Tax & billing

examples/app-crm/src/objects/product.object.ts

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Guest Portal Profile
+ *
+ * Permission set applied to anonymous (unauthenticated) visitors who submit
+ * the public Web-to-Lead and Web-to-Case forms.
+ *
+ * IRON-CLAD RULE: guests must NEVER be able to read existing CRM data.
+ * The only thing they can do is INSERT a new `lead` or `case` row through
+ * the form views whose `sharing.allowAnonymous = true`.
+ *
+ * Any new object added to the CRM stack is implicitly DENIED for guests —
+ * profile permissions are explicit-allow only.
+ */
+export const GuestPortalProfile = {
+  name: 'guest_portal',
+  label: 'Guest (Public Forms)',
+  isProfile: true,
+  description:
+    'Anonymous visitors submitting public Web-to-Lead / Web-to-Case forms. ' +
+    'INSERT-only on lead and case; no read/edit/delete on any object.',
+  objects: {
+    lead: {
+      allowCreate: true,
+      allowRead: false,
+      allowEdit: false,
+      allowDelete: false,
+      viewAllRecords: false,
+      modifyAllRecords: false,
+    },
+    case: {
+      allowCreate: true,
+      allowRead: false,
+      allowEdit: false,
+      allowDelete: false,
+      viewAllRecords: false,
+      modifyAllRecords: false,
+    },
+  },
+};

examples/app-crm/src/profiles/guest-portal.profile.ts

@@ -3,6 +3,7 @@
 /**
  * Profile Definitions Barrel
  */
+export { GuestPortalProfile } from './guest-portal.profile';
 export { MarketingUserProfile } from './marketing-user.profile';
 export { SalesManagerProfile } from './sales-manager.profile';
 export { SalesRepProfile } from './sales-rep.profile';

examples/app-crm/src/profiles/index.ts

@@ -39,6 +39,7 @@ export const en: TranslationData = {
         is_active: { label: 'Active' },
         last_activity_date: { label: 'Last Activity Date' },
         brand_color: { label: 'Brand Color' },
+        logo: { label: 'Company Logo' },
         tier: {
           label: 'Customer Tier',
           options: { strategic: 'Strategic', enterprise: 'Enterprise', mid_market: 'Mid-Market', smb: 'SMB' },
@@ -380,6 +381,8 @@ export const en: TranslationData = {
         product_manager: { label: 'Product Manager' },
         image_url: { label: 'Product Image' },
         datasheet_url: { label: 'Datasheet URL' },
+        image: { label: 'Product Image' },
+        datasheet: { label: 'Datasheet' },
       },
       _views: {
         all_products: { label: 'All Products' },

examples/app-crm/src/translations/en.ts

@@ -38,6 +38,7 @@ export const esES: TranslationData = {
         is_active: { label: 'Activo' },
         last_activity_date: { label: 'Fecha de Última Actividad' },
         brand_color: { label: 'Color de Marca' },
+        logo: { label: 'Logo de la Empresa' },
       },
       _views: {
         all_accounts: { label: 'Todas las Cuentas', description: 'Lista maestra de cuentas con ingresos e industria' },
@@ -344,6 +345,8 @@ export const esES: TranslationData = {
         product_manager: { label: 'Gerente de Producto' },
         image_url: { label: 'Imagen de Producto' },
         datasheet_url: { label: 'URL de Ficha Técnica' },
+        image: { label: 'Imagen de Producto' },
+        datasheet: { label: 'Ficha Técnica' },
       },
       _views: {
         all_products: { label: 'Todos los Productos' },

examples/app-crm/src/translations/es-ES.ts

@@ -38,6 +38,7 @@ export const jaJP: TranslationData = {
         is_active: { label: '有効' },
         last_activity_date: { label: '最終活動日' },
         brand_color: { label: 'ブランドカラー' },
+        logo: { label: '会社ロゴ' },
       },
       _views: {
         all_accounts: { label: '全取引先', description: '売上と業種を含む取引先の一覧' },
@@ -344,6 +345,8 @@ export const jaJP: TranslationData = {
         product_manager: { label: 'プロダクトマネージャー' },
         image_url: { label: '製品画像' },
         datasheet_url: { label: 'データシートURL' },
+        image: { label: '製品画像' },
+        datasheet: { label: 'データシート' },
       },
       _views: {
         all_products: { label: '全製品' },