Skip to content

Contact form on @profullstack/contact-form 0.1.0 - #14

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
contact-form-module
Oct 29, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
contact-form-module

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

Moves /contact and /api/contact onto @profullstack/contact-form@0.1.0 (pinned).

  • apps/web/src/lib/contact.ts: one createContactForm shared by page and route. Same questions, placeholders, length rules and error messages, binding icemap:contact, brand terms, token secret (FORM_GUARD_SECRET then SMTP_PASSWORD), SMTP relay via a module send (same SMTP_*/ADMIN_EMAIL env), subject line, and { success: true } even when SMTP fails (onSendError: 'ignore'), as before.
  • components/ContactForm.tsx wraps <ContactForm> from @profullstack/contact-form/react; contact_submit / contact_success still tracked. cf-* styled in globals.css; honeypot off-canvas.
  • Deleted lib/contact-guard.ts; dropped @profullstack/form-guard.
  • api/contact/route.test.ts: tokenless POST not delivered, valid one reaches the transport, old length rules hold.
  • Version 0.1.3.

Small behaviour changes: no contact_error event, no "Send Another Message" button, the live character counter is now a static "Up to 2000 characters" hint, and the notification email uses the module's layout.

🤖 Generated with Claude Code

/contact and /api/contact now share one createContactForm object
(apps/web/src/lib/contact.ts): the same questions (Name, Email, a
required Subject select with Bug Report / Question / Feedback / Other,
Message), placeholders, length rules and messages (name 2-100, message
10-2000), "icemap:contact" binding and brand terms, the same token
secret (FORM_GUARD_SECRET, else SMTP_PASSWORD), the same SMTP relay and
env (SMTP_*, ADMIN_EMAIL), the same "[icemap Contact] <Subject>: <first
50 chars>" subject, and the same { success: true } / { error } answers.
As before, a failed or unconfigured send is logged and the sender still
told it arrived.

The contact_submit and contact_success analytics events still fire;
contact_error no longer does (the module has no error callback yet).
The notification email is now the module's (labelled rows, provenance)
instead of the hand-built HTML, and escapes everything.

Removed the hand-rolled guard (lib/contact-guard.ts), the form state in
components/ContactForm.tsx and the direct @profullstack/form-guard
dependency. Version 0.1.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown
Contributor

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​contact-form@​0.1.07510010090100

View full report

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

3 finding(s)

HIGH/CRITICAL: 1 | LOW: 2

Severity Rule Location
HIGH js-ssrf-outbound-request apps/web/src/app/api/media/[...path]/route.ts:28
LOW secret-generic-credential packages/supabase/supabase/config.toml:271
LOW secret-generic-credential packages/supabase/supabase/config.toml:303

Snippets are redacted; ThreatCrush never prints matched credential material.

@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit 86b7b93 into master Oct 29, 2026
6 checks passed
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot deleted the contact-form-module branch October 29, 2026 01:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant