Moheeb Zara
8bbe99d34f
- migration 028: drop global UNIQUE(forms.slug), add
UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
submits by formId (slug is no longer globally unambiguous) and the
sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)
build verified (Compiled successfully, exit 0; new route present). No deploy.
18 lines
972 B
SQL
18 lines
972 B
SQL
-- =============================================================================
|
|
-- 028: Form slug is unique PER SPACE, not globally
|
|
-- =============================================================================
|
|
-- The public form URL is moving from /f/[slug] to /f/[space]/[slug], so the
|
|
-- form slug only needs to be unique within a space (and global uniqueness was
|
|
-- a cross-tenant slug-squatting footgun). Drop the global UNIQUE(slug) and add
|
|
-- UNIQUE(space_id, slug).
|
|
--
|
|
-- `forms_slug_key` is the auto-generated name for the inline column UNIQUE in
|
|
-- migration 026 / schema.sql. Idempotent: DROP IF EXISTS the old and the new
|
|
-- constraint, then ADD.
|
|
-- =============================================================================
|
|
|
|
ALTER TABLE public.forms DROP CONSTRAINT IF EXISTS forms_slug_key;
|
|
ALTER TABLE public.forms DROP CONSTRAINT IF EXISTS forms_space_slug_key;
|
|
ALTER TABLE public.forms
|
|
ADD CONSTRAINT forms_space_slug_key UNIQUE (space_id, slug);
|