diff --git a/‎.changeset/21331-public-form-withdrawal.md‎
Lines changed: 9 additions & 0 deletions b/‎.changeset/21331-public-form-withdrawal.md‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎packages/qa/dogfood/test/showcase-public-form-withdrawal.dogfood.test.ts‎
Lines changed: 133 additions & 0 deletions b/‎packages/qa/dogfood/test/showcase-public-form-withdrawal.dogfood.test.ts‎
Lines changed: 133 additions & 0 deletions
diff --git a/‎packages/rest/src/public-form-withdrawal.test.ts‎
Lines changed: 197 additions & 0 deletions b/‎packages/rest/src/public-form-withdrawal.test.ts‎
Lines changed: 197 additions & 0 deletions
@@ -0,0 +1,9 @@
+---
+'@objectstack/rest': patch
+---
+
+Withdrawing a public form from anonymous intake now takes effect on every intake door
+
+Clause-②: no
+
+When an administrator withdraws a public form, both anonymous form routes (`GET /forms/:slug` and `POST /forms/:slug/submit`) now answer `404 FORM_NOT_FOUND` and no record is created. Republishing the form restores both routes. If a service the routes need to resolve the form is registered but cannot be reached, both routes refuse the request instead of serving the form.
@@ -0,0 +1,133 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#21331] Withdrawing a public form from anonymous intake takes effect on
+// every intake door, on a real showcase boot.
+//
+// The showcase ships `showcase_inquiry.contact`, a FormView with
+// `sharing.allowAnonymous: true` at `/forms/contact-us`
+// (`showcase-public-form.dogfood.test.ts` pins that it serves). An
+// administrator withdraws it the way the editor does, with `PUT /meta/view/...`
+// at their own session, once env-wide (no active organization) and once in
+// their organization (`orgContext: true` gives the admin one). After either
+// withdrawal both anonymous doors must refuse, and nothing may land:
+//
+//   - `GET /forms/contact-us` and `POST /forms/contact-us/submit` both answer
+//     `404 FORM_NOT_FOUND`;
+//   - no `showcase_inquiry` row is written by the refused submit.
+//
+// Both sides are pinned: republishing at the same scope restores both doors,
+// and after the organization republish the row lands in that organization.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plugin-security';
+
+const VIEW = '/meta/view/showcase_inquiry.contact';
+const SYS = { isSystem: true } as const;
+
+interface Probe {
+  get: number;
+  getCode: unknown;
+  submit: number;
+  submitCode: unknown;
+  landed: Array<{ organization_id?: unknown }>;
+}
+
+describe('showcase: withdrawing the public contact form closes every intake door', () => {
+  let stack: VerifyStack;
+  let admin: string;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let ql: any;
+  let published: Record<string, any>;
+  let probeSeq = 0;
+
+  /** Both anonymous doors, plus the rows a submit with a unique marker left. */
+  const probe = async (): Promise<Probe> => {
+    const marker = `withdrawal_probe_${++probeSeq}`;
+    const get = await stack.api('/forms/contact-us');
+    const getBody = (await get.json()) as { code?: unknown };
+    const submit = await stack.api('/forms/contact-us/submit', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ name: marker, email: 'probe@example.com', message: 'probe' }),
+    });
+    const submitBody = (await submit.json()) as { code?: unknown };
+    const landed = await ql.find('showcase_inquiry', { where: { name: marker }, context: SYS });
+    return { get: get.status, getCode: getBody.code, submit: submit.status, submitCode: submitBody.code, landed };
+  };
+
+  /** Save the form with `allowAnonymous` set, at the admin's current session scope. */
+  const save = async (allowAnonymous: boolean): Promise<string> => {
+    const body = structuredClone(published);
+    body.config.sharing.allowAnonymous = allowAnonymous;
+    const res = await stack.apiAs(admin, 'PUT', VIEW, body);
+    const json = (await res.json()) as { message?: string };
+    expect(res.status, JSON.stringify(json)).toBe(200);
+    return String(json.message ?? '');
+  };
+
+  beforeAll(async () => {
+    stack = await bootStack(showcaseStack, {
+      orgContext: true,
+      security: new SecurityPlugin({ defaultPermissionSets: [...securityDefaultPermissionSets] }),
+    });
+    admin = await stack.signIn();
+    ql = await stack.kernel.getServiceAsync('objectql');
+    const res = await stack.apiAs(admin, 'GET', VIEW);
+    expect(res.status).toBe(200);
+    const json = (await res.json()) as { item?: Record<string, any> };
+    const item = (json.item ?? json) as Record<string, any>;
+    // The editor's PUT body: the effective item without its read decorations.
+    published = Object.fromEntries(Object.entries(item).filter(([k]) => !k.startsWith('_')));
+    expect(published.config?.sharing?.allowAnonymous).toBe(true);
+  }, 120_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+  });
+
+  it('PRECONDITION: the published form accepts anonymous intake', async () => {
+    const p = await probe();
+    expect(p.get).toBe(200);
+    expect(p.submit).toBe(201);
+    expect(p.landed).toHaveLength(1);
+  });
+
+  it('withdrawn env-wide: both doors answer 404 FORM_NOT_FOUND and nothing lands; republishing restores them', async () => {
+    const off = await stack.apiAs(admin, 'POST', '/auth/organization/set-active', { organizationId: null });
+    expect(off.status).toBe(200);
+    expect(await save(false)).toMatch(/env-wide/);
+    const closed = await probe();
+    expect([closed.get, closed.getCode, closed.submit, closed.submitCode])
+      .toEqual([404, 'FORM_NOT_FOUND', 404, 'FORM_NOT_FOUND']);
+    expect(closed.landed).toHaveLength(0);
+
+    expect(await save(true)).toMatch(/env-wide/);
+    const open = await probe();
+    expect([open.get, open.submit]).toEqual([200, 201]);
+    expect(open.landed).toHaveLength(1);
+  });
+
+  it('withdrawn in the admin\'s organization: both doors answer 404 FORM_NOT_FOUND and nothing lands', async () => {
+    const orgs = await ql.find('sys_organization', { fields: ['id'], limit: 2, context: SYS });
+    expect(orgs, 'the showcase boot holds exactly one organization').toHaveLength(1);
+    const on = await stack.apiAs(admin, 'POST', '/auth/organization/set-active', { organizationId: orgs[0].id });
+    expect(on.status).toBe(200);
+
+    expect(await save(false), 'the save is an organization overlay').toContain(`org=${orgs[0].id}`);
+    const p = await probe();
+    expect([p.get, p.getCode, p.submit, p.submitCode]).toEqual([404, 'FORM_NOT_FOUND', 404, 'FORM_NOT_FOUND']);
+    expect(p.landed).toHaveLength(0);
+  });
+
+  it('republished in the same organization (control): both doors accept and the row lands in that organization', async () => {
+    const message = await save(true);
+    const org = /org=(\S+?),/.exec(message)?.[1];
+    expect(org, message).toBeTruthy();
+    const p = await probe();
+    expect([p.get, p.submit]).toEqual([200, 201]);
+    expect(p.landed).toHaveLength(1);
+    expect(p.landed[0].organization_id).toBe(org);
+  });
+});
@@ -0,0 +1,197 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#21331] Withdrawing a public form from anonymous intake takes effect on
+// every intake door. Both doors (`GET /forms/:slug` and
+// `POST /forms/:slug/submit`) read the form in the organization the request
+// belongs to: the tenancy service's `defaultOrgId()`. That is the same
+// organization whose overlay the administrator's editor shows. A withdrawal
+// saved in that organization therefore closes both doors, and nothing is
+// written.
+//
+// Pinned both sides:
+//   - withdrawn in the organization: both doors answer 404 FORM_NOT_FOUND and
+//     `createData` is never called;
+//   - published in the organization (the control): both doors accept, and
+//     every metadata read the doors make names that organization;
+//   - withdrawn env-wide with no organization to resolve: both doors refuse;
+//   - tenancy never registered: the env-wide read, unchanged;
+//   - tenancy registered but unreachable: both doors refuse (fail closed).
+
+import { describe, it, expect, vi } from 'vitest';
+import { RestServer } from './rest-server';
+
+// [#10126] Pay the first transform of these dist-resolved workspace deps at
+// MODULE LOAD rather than inside a clocked `it()` body.
+import '@objectstack/spec/ui';
+
+const ORG = 'org_alpha';
+
+function mockServer() {
+  return {
+    get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(),
+    use: vi.fn(), listen: vi.fn().mockResolvedValue(undefined), close: vi.fn().mockResolvedValue(undefined),
+  };
+}
+
+function mockRes() {
+  const res: any = { statusCode: 200, body: undefined };
+  res.status = vi.fn((c: number) => { res.statusCode = c; return res; });
+  res.json = vi.fn((b: any) => { res.body = b; return res; });
+  res.header = vi.fn(() => res);
+  res.end = vi.fn(() => res);
+  return res;
+}
+
+function formView(allowAnonymous: boolean) {
+  return {
+    name: 'contact',
+    object: 'inquiry',
+    viewKind: 'form',
+    config: {
+      data: { object: 'inquiry' },
+      sections: [{ fields: ['name', 'email'] }],
+      sharing: { allowAnonymous, publicLink: '/forms/contact-us' },
+    },
+  };
+}
+
+const inquiryObject = {
+  name: 'inquiry',
+  label: 'Inquiry',
+  fields: {
+    name: { type: 'text', label: 'Name' },
+    email: { type: 'text', label: 'Email' },
+  },
+};
+
+/** Reproduces the registry's own "never registered" rejection. */
+function notRegistered(): Error {
+  return Object.assign(new Error("Service 'tenancy' not found"), {
+    __objectstackServiceNotRegistered: true,
+    code: 'SERVICE_NOT_REGISTERED',
+    serviceName: 'tenancy',
+  });
+}
+
+interface Setup {
+  /** What the env-wide (organization-less) read answers. */
+  envWide: boolean;
+  /** What the organization read answers; `undefined` = no overlay there. */
+  inOrg?: boolean;
+  /** The tenancy provider's behaviour. */
+  tenancy: 'org' | 'no-org' | 'not-registered' | 'unreachable';
+}
+
+function build(setup: Setup) {
+  const createData = vi.fn().mockResolvedValue({ object: 'inquiry', id: 'rec_1', record: {} });
+  const getMetaItems = vi.fn(async (req: { type: string; organizationId?: string }) => {
+    if (req.type === 'view') {
+      const effective = req.organizationId === ORG && setup.inOrg !== undefined ? setup.inOrg : setup.envWide;
+      return [formView(effective)];
+    }
+    if (req.type === 'object') return [inquiryObject];
+    return [];
+  });
+  const protocol: any = {
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
+    getMetaTypes: vi.fn().mockResolvedValue([]),
+    getMetaItems,
+    createData,
+  };
+  const tenancyServiceProvider = async () => {
+    switch (setup.tenancy) {
+      case 'org': return { posture: 'single', defaultOrgId: async () => ORG };
+      case 'no-org': return { posture: 'single', defaultOrgId: async () => null };
+      case 'not-registered': throw notRegistered();
+      case 'unreachable': throw new Error('tenancy service failed to construct');
+    }
+  };
+  const rest = new RestServer(
+    mockServer() as any, protocol, { api: { requireAuth: false } } as any,
+    undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined,
+    undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined,
+    tenancyServiceProvider,
+  );
+  rest.registerRoutes();
+  const find = (method: string, suffix: string) =>
+    rest.getRoutes().find((r) => r.method === method && r.path.endsWith(suffix))!;
+  const resolve = find('GET', '/forms/:slug');
+  const submit = find('POST', '/forms/:slug/submit');
+  return {
+    createData,
+    getMetaItems,
+    async get() {
+      const res = mockRes();
+      await resolve.handler({ params: { slug: 'contact-us' }, query: {}, headers: {} } as any, res);
+      return res;
+    },
+    async post() {
+      const res = mockRes();
+      await submit.handler(
+        { params: { slug: 'contact-us' }, query: {}, headers: {}, body: { name: 'x', email: 'x@example.com' } } as any,
+        res,
+      );
+      return res;
+    },
+  };
+}
+
+describe('[#21331] public form withdrawal reaches every intake door', () => {
+  it('withdrawn in the organization: both doors answer FORM_NOT_FOUND and nothing is written', async () => {
+    const s = build({ envWide: true, inOrg: false, tenancy: 'org' });
+    const get = await s.get();
+    expect(get.statusCode).toBe(404);
+    expect(get.body.code).toBe('FORM_NOT_FOUND');
+    const post = await s.post();
+    expect(post.statusCode).toBe(404);
+    expect(post.body.code).toBe('FORM_NOT_FOUND');
+    expect(s.createData).not.toHaveBeenCalled();
+  });
+
+  it('published in the organization (control): both doors accept, every read names the organization', async () => {
+    const s = build({ envWide: true, inOrg: true, tenancy: 'org' });
+    const get = await s.get();
+    expect(get.statusCode).toBe(200);
+    expect(get.body.object).toBe('inquiry');
+    expect(Object.keys(get.body.objectSchema.fields).sort()).toEqual(['email', 'name']);
+    const post = await s.post();
+    expect(post.statusCode).toBe(201);
+    expect(s.createData).toHaveBeenCalledTimes(1);
+    const reads = s.getMetaItems.mock.calls.map(([r]) => [r.type, r.organizationId]);
+    expect(reads.length).toBeGreaterThan(0);
+    for (const [, organizationId] of reads) expect(organizationId).toBe(ORG);
+  });
+
+  it('an organization overlay that publishes a form the package withdrew is honoured too', async () => {
+    const s = build({ envWide: false, inOrg: true, tenancy: 'org' });
+    expect((await s.get()).statusCode).toBe(200);
+    expect((await s.post()).statusCode).toBe(201);
+  });
+
+  it('withdrawn env-wide with no organization to resolve: both doors refuse', async () => {
+    const s = build({ envWide: false, tenancy: 'no-org' });
+    expect((await s.get()).body.code).toBe('FORM_NOT_FOUND');
+    expect((await s.post()).body.code).toBe('FORM_NOT_FOUND');
+    expect(s.createData).not.toHaveBeenCalled();
+    for (const [r] of s.getMetaItems.mock.calls) expect(r.organizationId).toBeUndefined();
+  });
+
+  it('tenancy never registered: the env-wide read, unchanged', async () => {
+    const s = build({ envWide: true, inOrg: false, tenancy: 'not-registered' });
+    expect((await s.get()).statusCode).toBe(200);
+    expect((await s.post()).statusCode).toBe(201);
+    for (const [r] of s.getMetaItems.mock.calls) expect(r.organizationId).toBeUndefined();
+  });
+
+  it('tenancy registered but unreachable: both doors refuse instead of reading env-wide (fail closed)', async () => {
+    const s = build({ envWide: true, tenancy: 'unreachable' });
+    const get = await s.get();
+    expect(get.statusCode).toBe(500);
+    expect(get.body.code).toBe('FORM_RESOLVE_FAILED');
+    const post = await s.post();
+    expect(post.statusCode).toBe(503);
+    expect(post.body.code).toBe('SERVICE_UNAVAILABLE');
+    expect(s.createData).not.toHaveBeenCalled();
+    expect(s.getMetaItems).not.toHaveBeenCalledWith(expect.objectContaining({ type: 'view' }));
+  });
+});