Forms (#875), continuing Polle's #1281

[michielbdejong]

Supersedes #1281. This is Polle's Forms work (@Polleps), brought up to date with develop and finished for a first Beta. Polle's 71 commits are kept as they are; the commits on top are listed below.

Closes #875

What Forms is

A form or survey you build in a drive and share as a link. Guests fill it in without an account, and each answer becomes a row in a Table.

• Create: New > Form (Beta), or "Create form from this table" (pick its columns).
• Builder: 21 question types, pages, drag-to-reorder, "Show when" rules on questions and pages, required fields and limits, Results (the table) and Summary (charts) tabs.
• Settings: public or invite-only (single-use links), open/close schedule, thank-you message (new here), appearance, custom CSS.
• Sharing: link, QR code, embed snippet.
• Guests: a small separate app (browser/form-app on browser/form-renderer) served at /form/{id}, with a self-hosted proof-of-work captcha (ALTCHA), a progress bar, and answers saved on the device until they submit.

Still to do from the #875 wishlist, as follow-up issues: password, requiring an account, redirect after submit, "submit another", seeing who submitted.

Commits on top of Polle's branch

1. Merge develop (241 commits, then two smaller catch-up merges). Every conflict and how it was resolved is in the merge commit message. The largest ones:
   • lib/src/db.rs: took develop's Db::from_kv().open() and added the fetch counters there.
   • resource.ts: DERIVED_BY_SERVER moved to server-managed-props.ts on develop; the form summary property is now added there.
   • urls.rs: a duplicate EMOJI constant that would not compile.
   • TableResource.tsx: the PR's remote-row rebase is dropped, because develop already shows rows added elsewhere without resetting the session.
   • .dagger/src/index.ts: develop's version, plus the form-app mounts.
   • Lockfiles and .po files: develop's versions, regenerated.
2. Left out, as unrelated to forms. These can come back as small separate PRs:
   • one machine's notes (AGENTS.local.md, CLAUDE.local.md; still gitignored);
   • the React-compiler agent hooks and their scripts and tests;
   • the pnpm 11 move;
   • doc edits: root CLAUDE.md, CONTRIBUTING port, the wuchale/OpenRouter note, READMEs, the sveltekit template, and two unrelated planning notes.
3. fix(lib): keep forms working on develop's store.
   • The forms vocabulary is now fetched from the host, like notifications. Its atomicdata.dev URLs 404 on the public catalog.
   • A real data-loss bug in the pending-deps recovery: clearing the save cursor let develop's initLoroSaveCursorIfFresh re-seat it past the unsent edit, so the retry sent nothing. The cursor is now rewound to the empty version instead.
4. fix(server): bare form ids resolve under develop's atomic: scheme (Emit atomic: identifiers and replace prefix checks with helpers #1585).
5. feat(forms): thank-you message setting in the builder. The runtime already displayed one.
6. fix(forms): keep a published form inside its own drive. Security; see below.
7. Changelog entries under UNRELEASED.
8. Fixes found by the e2e run:
   • Develop builds UI text from the wuchale catalogs, and strings missing from them render empty. The forms strings are extracted now; every entry added comes from the forms files.
   • "Form" is added to develop's new "Start blank" list (creationCatalog.ts).
   • Option tags under atomic: parents no longer get a path-based subject, which the server refused.
   • Tests follow develop's humanized column headers.
   • Missing imports in filePicker.spec.ts.

Security (commit 6), and why this design

Guests have no agent, so the server reads the definition and signs the row itself. Before this commit, anyone who could edit a Form could:

• point it at another drive's table, and get rows written there;
• list another drive's rows as options;
• serve another drive's private Files through /form/{id}/image.

forms::FormScope sets one rule for all three: a form writes only into its own drive, and shows guests only resources from that drive or ones that are public anyway. Why the drive rather than something narrower:

• "The table must be the form's parent" is too strict. The AI-assisted flow files a form in any folder next to an existing table.
• Checking the rights of whoever last edited the form is spoofable: an owner's later title edit would launder an attacker's earlier change.
• The drive is the boundary that rights and sync already use.

Also in that commit:

• Questions may not write parent, isA, drive, rights, lastCommit, createdBy or publicKey on the row.
• The submit rate limit keys on the socket peer (as helpers::peer_ip does), not on X-Forwarded-For, and forgets stale addresses.
• Minting a form's short slug is serialized, so two first visits can't lose a slug entry or mint two slugs.

Tests

• Rust: atomic_lib 287 passed. atomic-server --lib 353 passed, including new FormScope tests and a cross-drive submit in form_submission_flow. Clippy with -D warnings is clean.
• JS unit: @tomic/lib 1085, data-browser 1495, form-renderer 90, form-app 3; typecheck clean in every package.
• E2E, locally (pnpm test-e2e:local, 2 workers): forms, forms-submission (now also checks the custom thank-you message), forms-from-tables, tables, documents, filePicker and search: 33 of 33 passed. The full suite runs on CI.

Notes for review

• The forms strings are in the catalogs (English) but not yet translated into German, Spanish or French. Develop already carries about 2,400 untranslated strings, so that belongs in a translation pass of its own.
• New Rust dependencies: altcha (captcha) and lightningcss (sanitizes custom CSS; an alpha release).
• Only the TrekMeester merges this; it is ready for a batch once CI is green.

🤖 Generated with Claude Code

[michielbdejong]

Ready for the next TrekMeester batch: everything passes locally (listed in the description), and I'll post the CI result here once it's green. @joepio, for your trekmeester.

Posted by Claude on behalf of Michiel.

[michielbdejong]

Note from Michiel's coordination session: the German, Spanish and French translations for the new forms UI text still need to be generated. The project's translation flow (pnpm exec wuchale in browser/data-browser) needs OPENROUTER_API_KEY, which the agent that prepared this PR doesn't have. Michiel asked to leave that to @joepio / the trekmeester, who has the key: could you run it as part of batching this PR (or right after)? Until then the forms strings show in English in those languages.

[michielbdejong]

CI status (atomic-server worker, taking over from the Forms session):

Run 36717450608 (head 1853aa2):

• Downstream: green. It built atomic-saas 6901a3b (Deletion might not re-build index correctly #173), per the new atomic-saas <sha> line. The pick step shows no token warning.
• Main CI: red. The e2e server build's build.rs panicked with "Failed to spawn pnpm install".

Root cause: this PR mounts browser/form-app/dist into the Rust container at /code/browser/form-app/dist. That mount creates /code/browser, so build.rs no longer takes its "no browser folder, skip the JS build" path. It finds no data-browser/dist, but it does find its other watched sources (lib/src, wasm/src), so it tries to run pnpm, which that container doesn't have.

Fix, 3f91ebd: set ATOMICSERVER_SKIP_JS_BUILD=true on that container, as the integration and checks containers already do. The JS is built in the JS container and placed in assets_tmp. With the flag, build.rs keeps that copy and still refreshes form-assets/ from the mounted form-app/dist. The same container also builds the release binary, which gets the same fix.

Verified locally, with the branch laid out like that container (no browser/ except form-app/dist, a stub assets_tmp, no pnpm on PATH):

• cargo check -p atomic-server panics exactly as in CI;
• with the flag it passes and embeds the real form-app bundle, not the placeholder;
• the .dagger regression tests pass.

Main pipeline re-dispatched on claude/forms-875. atomic-saas#173 still merges only after this lands on develop.

---

Generated by Claude Code

[michielbdejong]

CI status for run 36751007165 (head 3f91ebd):

This failure is new, and it is not the build.rs problem. The previous fix held: the server build passed and the run reached the data-browser vitest suite. There, 196/196 files and 1500/1500 tests passed. Vitest still failed the step because of one unhandled rejection: ReferenceError: window is not defined in React's dispatchSetState. Vitest attributes it to src/components/forms/SearchBox/SearchBoxWindow.test.tsx. That means a state update arrived after jsdom had been torn down.

I don't think this PR causes it:

• This PR changes nothing in SearchBox/, @tomic/react hooks it uses, or the Store paths it touches. The lib changes are the pending-deps save-cursor recovery, the merge error guard and the forms vocabulary.
• The test file already carries develop's fix for this failure class (dacd78d, connect: false stores), so what is left is a timing race under CI load.
• Locally the file passes on every one of 3 runs.

So I changed no code and re-dispatched Main once: run 36788767633. If it fails the same way again, the next step is to make the test robust, for example by stubbing the store's resource fetches in SearchBoxWindow.test.tsx. That change should go in its own PR against develop, not this one.

---

Generated by Claude Code

[michielbdejong]

Re-run 36788767633 failed on something different from the vitest rejection in 36751007165, and this one is the PR's own test.

Failure. forms.spec.ts:227 (create a form, sync its properties, and persist across reload) failed all 3 attempts with Test timeout of 60000ms exceeded, each time at a different step:

• openSubject back to the Form;
• the option-label poll (it saw Option 3 because the poll was cut off, not because its 10s ran out);
• the third "Add option" (5 polls, then the test budget ran out).

None hit the step's own timeout. The walk does four full page boots plus ~10 sync waits, and forms.spec.ts took 498s on that shard. Also flaky but passed on retry: forms.spec.ts:539 (page transitions) and forks.spec.ts:142. The forks one is outside this PR's area.

Fix: 515595a marks the walk test.slow(), like the breadth test in the same file, and removes that test's stale comment saying the walk doesn't need it. e2e lint, format and typecheck pass. I could not reproduce in my container: Playwright's Chromium download is blocked and the preinstalled one couldn't open /app/dev-drive, so the new run is the real check.

New run: https://github.com/ontola/atomic-server/actions/runs/36809778568

---

Generated by Claude Code

[michielbdejong]

Ready for a batch. Main pipeline run 36809778568 on head 515595a is green: Mancave CI, Downstream (atomic-saas) and Main all passed. It includes the forms.spec.ts:227 timeout fix and the earlier build.rs/pnpm fix.

Merge order: ontola/atomic-saas#173 (the paired Cargo.lock) merges after this lands on develop.

---

Posted by Michiel's coordinator agent (Claude Code)

---

Generated by Claude Code

[joepio]

Trekmeester (for Joep): merged develop into this branch (db31cb7; a merge, no history rewritten). The PR is mergeable again.

Conflicts resolved:

• browser/react/src/useFileObjectUrl.ts: develop (Batch 2026-09-30: account menu, settings dialogs, share select, document images, onboarding recovery, table quick filter, view tabs, and fixes (13 PRs) #1915, document images) split it into useFileObjectUrl(resource) + useBlobObjectUrl(blobDid, fallbackUrl). This branch's SVG fix (b6441ab) now travels through it: useBlobObjectUrl takes an optional mimetype and types the Blob with it, and useFileObjectUrl reads server.properties.mimetype from the File and passes it on. Document images (ImagePicker) have no File, so they stay untyped as before.
• reconcile.test.ts: develop's Response-based mockFetch and setManagedDeviceToken(null), plus this branch's VITE_MANAGED_API_BASE stub.
• browser/CHANGELOG.md: both sides kept. The .po catalogs are re-extracted (2530 entries; de keeps its 12 translations).

Checked locally: data-browser tsc, pnpm run -r lint, and vitest for managed/RTE/FormBuilder (392/392).

Separate design point (Joep): sharing a form needs a server. In SaaS, shareBase comes from store.getServerUrl(), which can be the static app origin, so the link 404s. A workspace without a Cloud Server only gets a generic "Connect to a server" on the Publish toggle. The suggestion is to build the link from the node that hosts the drive, and to nudge toward Cloud Server when there is none.