efexen / formerer

Formerer

Formerer provides end points to send your forms to from your static sites.

Heavily WIP!

To start Formerer:

1. Install dependencies with mix deps.get
2. Create and migrate your database with mix ecto.create && mix ecto.migrate
3. Start Phoenix endpoint with mix phoenix.server

Now you can visit localhost:4000 from your browser.

Testing

Formerer uses hound for feature tests.

Please do make sure you have a webdriver server running before running the test suite.

The hound wiki has a great section that might be useful titled Starting a webdriver server

TODO

• More tests!
• Document usage
• Elixirify code
• Notifications & integrations (email, slack, chrome, drive etc)

formerer's Issues

Nice to have - navbar submission notification

Notification in the navbar to see when you received a new form submission, with link to the form

Challenges:

• Channels: needs access to all user forms channels
• Persist notifications. Eg. Hide them only on click, not on page refresh

Possible solutions:

• join all user forms channels as soon as the user signs in
  • or change the channels to be per user and not per form and broadcast all submissions for all forms in the same user channel
• for persist notifications, the last_seen_id submission can be persisted in the form, and on channel join and on new submissions to check against that

Add support for honeypot fields

We should add ability to have a specific field(s?) as a honeypot fields to act as a simple spam prevention system.

The idea is that user can specify a field of their choosing, if the submission contains a value for the given field the submission should be rejected.

The use of this would be that a user can setup a form with a standard field hidden by CSS, so if a real user is filling in the form they won't be setting a value for this field as it is hidden, if a crawler or a spam bot is filling the form they are unlikely to take CSS rules in to account and will fill this field with data.

The rejected submission should respond exactly the same as a successful submission so as to not give clues to automated systems.

Secure form channel for new submission

A new submission is broadcasted from the the submission_controller, like this: Formerer.Endpoint.broadcast("forms:#{form.id}", "new_submission", payload)

We need to make sure that only the current_user has access to the submissions broadcasted for its forms. (eg, current_user will have no way to see the submission for "forms:2" channel if form 2 belongs to another user).

In the channel join action we achieve this by filtering the forms only for the user id which is assigned to the channel in the connect action:
user = Repo.get(Formerer.User, socket.assigns.user_id)

But for the broadcast there is no socket available.

Possible options:

Would it be possible to find somehow the socket by the channel topic? something like:
%Phoenix.Socket{assigns: %{user_id: user_id}, topic: "forms:1"} = ALL_OPEN_SOCKETS?!

After that we could just see if user_id == submission.user_id, and broadcast if true

If that is not possible, what would be a best practice to do this, and to ensure only the current_user has access to their form submissions?