): FormAIframeConfig => ({
+ enabled: false,
+ reason,
+ route: options.route,
+ locale: options.locale,
+ });
+ const config = resolveFormMode(options.rawMode, options.liveApproved);
+ if (config.mode !== 'isolated-test') return disabled('mode-not-isolated-test');
+ if (!isTrue(options.isolatedTestApproved)) return disabled('isolated-test-not-approved');
+ if (options.environmentRole?.trim().toLowerCase() !== isolatedTestEnvironmentRole) return disabled('invalid-environment-role');
+ if (isTrue(options.allowIndexing)) return disabled('indexing-enabled');
+
+ const placement = formAIframePlacements.find((candidate) => candidate.route === options.route);
+ if (!placement) return disabled('route-not-authorized');
+ if (options.locale !== placement.locale) return disabled('locale-not-authorized');
+
+ return {
+ enabled: true,
+ reason: 'enabled',
+ route: options.route,
+ locale: placement.locale,
+ context: placement.context,
+ url: buildFormAIframeUrl(placement.locale, placement.context),
+ ...formAIframeCopy(placement.locale),
+ };
+}
+
/**
* The Form A meeting preview is deliberately narrower than the general mock
* mode: it is available only for an explicitly requested, non-indexing mock
@@ -55,11 +185,11 @@ export const formRouteMapping: ReadonlyArray<{
{ route: '/aba-therapy', logicalForm: 'service', kind: 'native-instance' },
{ route: '/autism-evaluations', logicalForm: 'service', kind: 'native-instance' },
{ route: '/learner-social-club', logicalForm: 'service', kind: 'native-instance' },
- { route: '/lp/aba-therapy', logicalForm: 'service', kind: 'landing-journey' },
- { route: '/lp/aba-insurance', logicalForm: 'service', kind: 'landing-journey' },
- { route: '/lp/aba-ahcccs', logicalForm: 'service', kind: 'landing-journey' },
- { route: '/lp/aba-private-pay', logicalForm: 'service', kind: 'landing-journey' },
- { route: '/lp/early-intervention', logicalForm: 'service', kind: 'landing-journey' },
+ { route: '/lp/aba-therapy', logicalForm: 'general', kind: 'landing-journey' },
+ { route: '/lp/aba-insurance', logicalForm: 'general', kind: 'landing-journey' },
+ { route: '/lp/aba-ahcccs', logicalForm: 'general', kind: 'landing-journey' },
+ { route: '/lp/aba-private-pay', logicalForm: 'general', kind: 'landing-journey' },
+ { route: '/lp/early-intervention', logicalForm: 'general', kind: 'landing-journey' },
];
export function logicalFormForRoute(route: string): LogicalForm | undefined {
diff --git a/www/tools/campaign.test.mjs b/www/tools/campaign.test.mjs
index 39eff30..a98346e 100644
--- a/www/tools/campaign.test.mjs
+++ b/www/tools/campaign.test.mjs
@@ -150,8 +150,11 @@ test('early-intervention preserves its own publication identity and source secti
assert.equal($('.qr-benefit-card').length, 3);
assert.equal($('.qr-process-step').length, 3);
assert.equal($('form, input[type="hidden"], script[src]').length, 0);
+ assert.equal($('#consultation-heading').text(), 'Contact AIA about early intervention');
assert.equal($('#consultation input').length, 3);
assert.equal($('#consultation input:disabled').length, 3);
+ assert.equal($('#consultation').attr('data-forms-mode'), 'off');
+ assert.equal($('#consultation [data-jotform-form-a]').length, 0);
assert.equal($('#consultation button').attr('type'), 'button');
assert.ok($('.qr-call-card a[href="tel:+14806877099"]').length);
assert.equal($('#consultation-unavailable, [data-form-status-notice]').length, 0);
diff --git a/www/tools/jotform-form-a-browser.mjs b/www/tools/jotform-form-a-browser.mjs
new file mode 100644
index 0000000..5a10075
--- /dev/null
+++ b/www/tools/jotform-form-a-browser.mjs
@@ -0,0 +1,193 @@
+/**
+ * Deterministic Form A adapter check. Build the requested mode first, then
+ * run this against a loopback-only Astro preview. Every external request is
+ * intercepted and aborted before it can leave the browser.
+ *
+ * FORM_A_IFRAME_BROWSER_MODE=isolated-test \
+ * PLAYWRIGHT_MODULE=/path/to/playwright/index.mjs \
+ * CHROMIUM_EXECUTABLE=/path/to/chromium node tools/jotform-form-a-browser.mjs
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import http from 'node:http';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const moduleName = process.env.PLAYWRIGHT_MODULE ? pathToFileURL(path.resolve(process.env.PLAYWRIGHT_MODULE)).href : 'playwright';
+const mode = process.env.FORM_A_IFRAME_BROWSER_MODE ?? 'off';
+if (!['off', 'mock', 'isolated-test'].includes(mode)) throw new Error(`Unsupported Form A browser mode: ${mode}`);
+
+const expectedIframe = mode === 'isolated-test';
+const routes = [
+ { route: '/contact', locale: 'en', context: 'contact', screenshot: 'contact' },
+ { route: '/es/contact', locale: 'es', context: 'contact', screenshot: 'es-contact' },
+ { route: '/lp/aba-therapy', locale: 'en', context: 'landing', screenshot: 'aba-therapy' },
+ { route: '/lp/aba-insurance', locale: 'en', context: 'landing', screenshot: 'aba-insurance' },
+ { route: '/lp/aba-ahcccs', locale: 'en', context: 'landing', screenshot: 'aba-ahcccs' },
+ { route: '/lp/aba-private-pay', locale: 'en', context: 'landing', screenshot: 'aba-private-pay' },
+ { route: '/lp/early-intervention', locale: 'en', context: 'landing', screenshot: 'early-intervention' },
+];
+const widths = [320, 390, 768, 1440];
+const output = await fs.mkdtemp('/tmp/aia-form-a-iframe-');
+const evidence = { mode, routes, widths, checks: 0, blocked: [], jotformAttempts: [], screenshots: [], status: 'failed' };
+const reserve = net.createServer();
+await new Promise((resolve, reject) => { reserve.once('error', reject); reserve.listen(0, '127.0.0.1', resolve); });
+const port = reserve.address().port;
+await new Promise((resolve) => reserve.close(resolve));
+const origin = `http://127.0.0.1:${port}`;
+let browser;
+let preview;
+
+try {
+ const { chromium } = await import(moduleName);
+ browser = await chromium.launch(process.env.CHROMIUM_EXECUTABLE ? { headless: true, executablePath: process.env.CHROMIUM_EXECUTABLE } : { headless: true });
+ preview = spawn(process.execPath, ['node_modules/astro/bin/astro.mjs', 'preview', '--host', '127.0.0.1', '--port', String(port)], {
+ cwd: root,
+ env: { ...process.env, ASTRO_TELEMETRY_DISABLED: '1' },
+ stdio: 'ignore',
+ });
+ const reachable = () => new Promise((resolve) => {
+ const request = http.get(origin + '/', (response) => { response.resume(); resolve(response.statusCode === 200); });
+ request.setTimeout(500, () => request.destroy());
+ request.on('error', () => resolve(false));
+ });
+ for (let i = 0; i < 60 && !(await reachable()); i++) await delay(250);
+ assert.equal(await reachable(), true, 'Loopback preview did not become reachable');
+
+ for (const width of widths) {
+ const context = await browser.newContext({ viewport: { width, height: width < 500 ? 844 : 960 }, serviceWorkers: 'block' });
+ await context.routeWebSocket('**/*', (socket) => socket.close());
+ await context.route('**/*', async (route) => {
+ const request = route.request();
+ const url = new URL(request.url());
+ if (url.origin === origin && ['GET', 'HEAD'].includes(request.method())) return route.continue();
+ const item = { origin: url.origin, path: url.pathname, search: url.search, method: request.method() };
+ evidence.blocked.push(item);
+ if (url.origin === 'https://form.jotform.com') evidence.jotformAttempts.push(item);
+ return route.abort();
+ });
+ const page = await context.newPage();
+ for (const expected of routes) {
+ const { route, locale, context: formContext, screenshot: screenshotName } = expected;
+ evidence.checks++;
+ const response = await page.goto(origin + route, { waitUntil: 'domcontentloaded', timeout: 15000 });
+ assert.equal(response?.status(), 200, route);
+ assert.equal(await page.locator('main h1').count(), 1, route);
+ assert.equal(await page.locator('main form').count(), 0, route);
+ assert.ok(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1), `${route} at ${width}px has horizontal overflow`);
+ const iframe = page.locator('[data-jotform-form-a] iframe');
+ if (!expectedIframe) {
+ assert.equal(await iframe.count(), 0, `${route} should not emit an iframe in ${mode}`);
+ assert.equal(await page.locator('[data-jotform-form-a]').count(), 0, `${route} should not emit an adapter in ${mode}`);
+ continue;
+ }
+ const expectedUrl = `https://form.jotform.com/262946078314059?formContext=${formContext}&language=${locale}`;
+ assert.equal(await iframe.count(), 1, route);
+ assert.equal(await iframe.getAttribute('src'), expectedUrl, route);
+ assert.equal(await iframe.getAttribute('title'), locale === 'es' ? 'Formulario de consultas generales de AIA' : 'AIA general enquiries form', route);
+ assert.equal(await iframe.getAttribute('referrerpolicy'), 'no-referrer', route);
+ assert.equal(await iframe.getAttribute('sandbox'), 'allow-forms allow-scripts allow-same-origin', route);
+ assert.equal(await page.locator('[data-jotform-form-a][data-form-mode="isolated-test"]').count(), 1, route);
+ assert.equal(await page.locator(`[data-jotform-form-a][data-form-context="${formContext}"]`).count(), 1, route);
+ const frameBox = await iframe.boundingBox();
+ const expectedFrameHeight = formContext === 'contact'
+ ? width < 500 ? 1088 : 960
+ : width < 500 ? 800 : 672;
+ assert.ok(frameBox && frameBox.width > 0 && frameBox.height >= expectedFrameHeight, `${route} iframe has an insufficient context-specific responsive frame`);
+ if ((route === '/contact' || route === '/es/contact') && width >= 768) {
+ const copyBox = await page.locator('.contact-page__copy').boundingBox();
+ const adapterBox = await page.locator('[data-jotform-form-a]').boundingBox();
+ assert.ok(copyBox && adapterBox && Math.abs(copyBox.width - adapterBox.width) <= 1, `${route} should use the full desktop grid column`);
+ }
+ const fallbackMarkup = await iframe.evaluate((element) => element.innerHTML);
+ assert.match(fallbackMarkup, /class="jotform-iframe__fallback"/, route);
+ const encodedFallbackUrl = expectedUrl.replace(/&/g, '&');
+ assert.match(fallbackMarkup, new RegExp(`href="${encodedFallbackUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`), route);
+ assert.match(fallbackMarkup, /target="_blank" rel="noopener noreferrer"/, route);
+ assert.equal(await page.locator('[data-jotform-form-a] > .jotform-iframe__fallback').count(), 0, `${route} should not show a duplicate parent fallback`);
+ if (route.startsWith('/lp/')) {
+ const expectedSurface = route === '/lp/early-intervention'
+ ? '#consultation.lead-form > [data-jotform-form-a].jotform-iframe--embedded'
+ : '.form-wrap > [data-jotform-form-a].jotform-iframe--embedded';
+ assert.equal(await page.locator(expectedSurface).count(), 1, route);
+ assert.equal(await page.locator('#lead-form, [data-form-a-preview], #consultation input:enabled').count(), 0, route);
+ if (route !== '/lp/early-intervention') {
+ assert.equal(
+ await page.locator('[data-jotform-form-a] .jotform-iframe__description').innerText(),
+ 'Use this form to request a conversation. An AIA team member can explain the next steps for your family.',
+ `${route} should use the shared iframe description instead of repeating companion copy`,
+ );
+ }
+ }
+ await iframe.focus();
+ assert.equal(await page.evaluate(() => document.activeElement?.tagName), 'IFRAME', route);
+ const screenshot = path.join(output, `${screenshotName}-${width}.png`);
+ await page.screenshot({ path: screenshot, fullPage: true });
+ evidence.screenshots.push(screenshot);
+ }
+ await context.close();
+ }
+
+ if (expectedIframe) {
+ const context = await browser.newContext({ viewport: { width: 390, height: 844 }, javaScriptEnabled: false, serviceWorkers: 'block' });
+ await context.route('**/*', async (route) => {
+ const request = route.request();
+ const url = new URL(request.url());
+ if (url.origin === origin && ['GET', 'HEAD'].includes(request.method())) return route.continue();
+ const item = { origin: url.origin, path: url.pathname, search: url.search, method: request.method(), noJavaScript: true };
+ evidence.blocked.push(item);
+ if (url.origin === 'https://form.jotform.com') evidence.jotformAttempts.push(item);
+ return route.abort();
+ });
+ for (const { route } of routes) {
+ evidence.checks++;
+ const page = await context.newPage();
+ const response = await page.goto(origin + route, { waitUntil: 'domcontentloaded', timeout: 15000 });
+ assert.equal(response?.status(), 200, `${route} without JavaScript`);
+ assert.equal(await page.locator('[data-jotform-form-a] iframe').count(), 1, `${route} without JavaScript`);
+ const iframe = page.locator('[data-jotform-form-a] iframe');
+ const fallbackMarkup = await iframe.evaluate((element) => element.innerHTML);
+ assert.match(fallbackMarkup, /class="jotform-iframe__fallback"/, `${route} without JavaScript`);
+ assert.match(fallbackMarkup, /target="_blank" rel="noopener noreferrer"/, `${route} without JavaScript`);
+ assert.equal(await page.locator('[data-jotform-form-a] > .jotform-iframe__fallback').count(), 0, `${route} without JavaScript should not show a duplicate parent fallback`);
+ if (route.startsWith('/lp/')) {
+ const expectedSurface = route === '/lp/early-intervention'
+ ? '#consultation.lead-form > [data-jotform-form-a].jotform-iframe--embedded'
+ : '.form-wrap > [data-jotform-form-a].jotform-iframe--embedded';
+ assert.equal(await page.locator(expectedSurface).count(), 1, `${route} without JavaScript`);
+ }
+ assert.ok(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1), `${route} without JavaScript has horizontal overflow`);
+ }
+ await context.close();
+ }
+
+ const formAttempts = evidence.jotformAttempts;
+ if (expectedIframe) {
+ assert.ok(formAttempts.length >= routes.length, 'Expected intercepted Jotform iframe GET attempts');
+ for (const attempt of formAttempts) {
+ assert.equal(attempt.method, 'GET');
+ assert.equal(attempt.path, '/262946078314059');
+ assert.match(attempt.search, /^\?formContext=(?:contact|landing)&language=(?:en|es)$/);
+ }
+ } else {
+ assert.equal(formAttempts.length, 0, `${mode} attempted Jotform traffic`);
+ }
+ assert.equal(evidence.blocked.filter((item) => !['GET', 'HEAD'].includes(item.method)).length, 0, 'A blocked non-read request was attempted');
+ evidence.status = 'passed';
+} catch (error) {
+ evidence.error = error instanceof Error ? error.message : String(error);
+ throw error;
+} finally {
+ await fs.writeFile(path.join(output, 'evidence.json'), JSON.stringify(evidence, null, 2));
+ if (preview && preview.exitCode === null) {
+ preview.kill('SIGTERM');
+ await Promise.race([new Promise((resolve) => preview.once('exit', resolve)), delay(3000)]);
+ if (preview.exitCode === null) preview.kill('SIGKILL');
+ }
+ await browser?.close();
+ console.log(JSON.stringify({ ...evidence, screenshots: evidence.screenshots.map((file) => path.basename(file)), artifactDirectory: output }, null, 2));
+}
diff --git a/www/tools/jotform-form-a-real-iframe-sizing.mjs b/www/tools/jotform-form-a-real-iframe-sizing.mjs
new file mode 100644
index 0000000..c8422d9
--- /dev/null
+++ b/www/tools/jotform-form-a-real-iframe-sizing.mjs
@@ -0,0 +1,147 @@
+/**
+ * Read-only Form A iframe sizing acceptance probe.
+ *
+ * This intentionally requires a separate affirmative environment value
+ * because it permits GET/HEAD requests to form.jotform.com. It never fills,
+ * focuses, clicks, or submits an iframe control. All other external origins,
+ * non-read methods, downloads, and WebSockets are blocked and recorded.
+ *
+ * Build the isolated-test artifact first, then run:
+ * FORM_A_IFRAME_REAL_LOAD_APPROVED=true \
+ * FORM_A_IFRAME_JOTFORM_ASSETS_APPROVED=true \
+ * PLAYWRIGHT_MODULE=/path/to/playwright/index.mjs \
+ * CHROMIUM_EXECUTABLE=/path/to/chromium \
+ * node tools/jotform-form-a-real-iframe-sizing.mjs
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import http from 'node:http';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+
+if (process.env.FORM_A_IFRAME_REAL_LOAD_APPROVED !== 'true') {
+ throw new Error('Set FORM_A_IFRAME_REAL_LOAD_APPROVED=true to permit read-only requests to form.jotform.com.');
+}
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const playwrightModule = process.env.PLAYWRIGHT_MODULE
+ ? pathToFileURL(path.resolve(process.env.PLAYWRIGHT_MODULE)).href
+ : 'playwright';
+const jotformOrigin = 'https://form.jotform.com';
+const jotformAssetOrigin = 'https://cdn.jotfor.ms';
+const allowJotformAssets = process.env.FORM_A_IFRAME_JOTFORM_ASSETS_APPROVED === 'true';
+const allowedOrigins = new Set([jotformOrigin, ...(allowJotformAssets ? [jotformAssetOrigin] : [])]);
+const routes = [
+ { route: '/contact', context: 'contact', locale: 'en', file: 'contact' },
+ { route: '/es/contact', context: 'contact', locale: 'es', file: 'es-contact' },
+ { route: '/lp/aba-therapy', context: 'landing', locale: 'en', file: 'aba-therapy' },
+ { route: '/lp/aba-insurance', context: 'landing', locale: 'en', file: 'aba-insurance' },
+ { route: '/lp/aba-ahcccs', context: 'landing', locale: 'en', file: 'aba-ahcccs' },
+ { route: '/lp/aba-private-pay', context: 'landing', locale: 'en', file: 'aba-private-pay' },
+ { route: '/lp/early-intervention', context: 'landing', locale: 'en', file: 'early-intervention' },
+];
+const widths = [320, 390, 768, 1440];
+const output = await fs.mkdtemp('/tmp/aia-form-a-real-iframe-sizing-');
+const evidence = {
+ routes: routes.map(({ route, context, locale }) => ({ route, context, locale })),
+ widths,
+ allowedOrigins: [...allowedOrigins],
+ allowedJotformRequests: [],
+ blockedExternalRequests: [],
+ forbiddenAttempts: [],
+ screenshots: [],
+ status: 'failed',
+};
+const forbiddenHost = /(?:api\.azinstitute4autism\.com|google-analytics|googletagmanager|googleadservices|doubleclick)/i;
+const reserve = net.createServer();
+await new Promise((resolve, reject) => { reserve.once('error', reject); reserve.listen(0, '127.0.0.1', resolve); });
+const port = reserve.address().port;
+await new Promise((resolve) => reserve.close(resolve));
+const origin = `http://127.0.0.1:${port}`;
+let browser;
+let preview;
+
+try {
+ const { chromium } = await import(playwrightModule);
+ browser = await chromium.launch(process.env.CHROMIUM_EXECUTABLE
+ ? { headless: true, executablePath: process.env.CHROMIUM_EXECUTABLE }
+ : { headless: true });
+ preview = spawn(process.execPath, ['node_modules/astro/bin/astro.mjs', 'preview', '--host', '127.0.0.1', '--port', String(port)], {
+ cwd: root,
+ env: { ...process.env, ASTRO_TELEMETRY_DISABLED: '1' },
+ stdio: 'ignore',
+ });
+ const reachable = () => new Promise((resolve) => {
+ const request = http.get(origin + '/', (response) => { response.resume(); resolve(response.statusCode === 200); });
+ request.setTimeout(500, () => request.destroy());
+ request.on('error', () => resolve(false));
+ });
+ for (let attempts = 0; attempts < 60 && !(await reachable()); attempts++) await delay(250);
+ assert.equal(await reachable(), true, 'Loopback preview did not become reachable');
+
+ for (const width of widths) {
+ const context = await browser.newContext({
+ viewport: { width, height: width < 641 ? 844 : 960 },
+ serviceWorkers: 'block',
+ acceptDownloads: false,
+ });
+ await context.routeWebSocket('**/*', (socket) => socket.close());
+ await context.route('**/*', async (route) => {
+ const request = route.request();
+ const url = new URL(request.url());
+ const item = { origin: url.origin, path: url.pathname, method: request.method() };
+ if (url.origin === origin && ['GET', 'HEAD'].includes(request.method())) return route.continue();
+ if (allowedOrigins.has(url.origin) && ['GET', 'HEAD'].includes(request.method())) {
+ evidence.allowedJotformRequests.push(item);
+ return route.continue();
+ }
+ evidence.blockedExternalRequests.push(item);
+ if (forbiddenHost.test(url.hostname)) evidence.forbiddenAttempts.push(item);
+ return route.abort();
+ });
+ const page = await context.newPage();
+ for (const expected of routes) {
+ const response = await page.goto(origin + expected.route, { waitUntil: 'domcontentloaded', timeout: 15000 });
+ assert.equal(response?.status(), 200, expected.route);
+ const iframe = page.locator('[data-jotform-form-a] iframe');
+ const expectedUrl = `${jotformOrigin}/262946078314059?formContext=${expected.context}&language=${expected.locale}`;
+ assert.equal(await iframe.count(), 1, expected.route);
+ assert.equal(await iframe.getAttribute('src'), expectedUrl, expected.route);
+ assert.equal(await iframe.getAttribute('sandbox'), 'allow-forms allow-scripts allow-same-origin', expected.route);
+ assert.equal(await iframe.getAttribute('referrerpolicy'), 'no-referrer', expected.route);
+ const box = await iframe.boundingBox();
+ const expectedHeight = expected.context === 'contact'
+ ? width < 641 ? 1088 : 960
+ : width < 641 ? 800 : 672;
+ assert.ok(box && box.width > 0 && box.height >= expectedHeight, `${expected.route}: context-specific frame height is insufficient`);
+ await page.waitForTimeout(1200);
+ const screenshot = path.join(output, `${expected.file}-${width}.png`);
+ await page.screenshot({ path: screenshot, fullPage: true });
+ evidence.screenshots.push(screenshot);
+ }
+ await context.close();
+ }
+ assert.ok(evidence.allowedJotformRequests.length >= routes.length, 'Expected read-only Jotform iframe requests.');
+ assert.equal(evidence.forbiddenAttempts.length, 0, `Forbidden external requests: ${JSON.stringify(evidence.forbiddenAttempts)}`);
+ assert.equal(evidence.blockedExternalRequests.filter((item) => !['GET', 'HEAD'].includes(item.method)).length, 0, 'A non-read external request was attempted.');
+ evidence.status = 'passed';
+} catch (error) {
+ evidence.error = error instanceof Error ? error.message : String(error);
+ throw error;
+} finally {
+ await fs.writeFile(path.join(output, 'evidence.json'), JSON.stringify(evidence, null, 2));
+ if (preview?.exitCode === null) {
+ preview.kill('SIGTERM');
+ await Promise.race([new Promise((resolve) => preview.once('exit', resolve)), delay(3000)]);
+ if (preview.exitCode === null) preview.kill('SIGKILL');
+ }
+ await browser?.close();
+ console.log(JSON.stringify({
+ ...evidence,
+ screenshots: evidence.screenshots.map((file) => path.basename(file)),
+ artifactDirectory: output,
+ }, null, 2));
+}
diff --git a/www/tools/jotform-form-a.test.mjs b/www/tools/jotform-form-a.test.mjs
new file mode 100644
index 0000000..719e482
--- /dev/null
+++ b/www/tools/jotform-form-a.test.mjs
@@ -0,0 +1,120 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import test from 'node:test';
+import {
+ buildFormAIframeUrl,
+ formAIframeId,
+ formAIframeOrigin,
+ formAIframePlacements,
+ formModeForRuntime,
+ resolveFormAIframe,
+ resolveFormMode,
+} from '../src/utils/form-integration.ts';
+
+const isolated = (overrides = {}) => ({
+ rawMode: 'isolated-test',
+ liveApproved: 'false',
+ isolatedTestApproved: 'true',
+ environmentRole: 'isolated-test',
+ allowIndexing: 'false',
+ route: '/contact',
+ locale: 'en',
+ ...overrides,
+});
+
+test('Form A iframe uses only fixed, approved route parameters', () => {
+ assert.equal(formAIframeOrigin, 'https://form.jotform.com');
+ assert.equal(formAIframeId, '262946078314059');
+ assert.equal(
+ buildFormAIframeUrl('en', 'contact'),
+ 'https://form.jotform.com/262946078314059?formContext=contact&language=en',
+ );
+ assert.equal(
+ buildFormAIframeUrl('es', 'contact'),
+ 'https://form.jotform.com/262946078314059?formContext=contact&language=es',
+ );
+ assert.equal(
+ buildFormAIframeUrl('en', 'landing'),
+ 'https://form.jotform.com/262946078314059?formContext=landing&language=en',
+ );
+ assert.deepEqual(formAIframePlacements.map((placement) => placement.route), [
+ '/contact',
+ '/es/contact',
+ '/lp/aba-therapy',
+ '/lp/aba-insurance',
+ '/lp/aba-ahcccs',
+ '/lp/aba-private-pay',
+ '/lp/early-intervention',
+ ]);
+});
+
+test('Form A iframe requires every isolated-test gate and refuses live mode', () => {
+ const enabled = resolveFormAIframe(isolated());
+ assert.equal(enabled.enabled, true);
+ assert.equal(enabled.reason, 'enabled');
+ assert.equal(enabled.title, 'AIA general enquiries form');
+ assert.equal(resolveFormAIframe(isolated({ rawMode: undefined })).reason, 'mode-not-isolated-test');
+ assert.equal(resolveFormAIframe(isolated({ rawMode: 'mock' })).reason, 'mode-not-isolated-test');
+ assert.equal(resolveFormAIframe(isolated({ rawMode: 'live', liveApproved: 'true' })).reason, 'mode-not-isolated-test');
+ assert.equal(resolveFormAIframe(isolated({ isolatedTestApproved: 'false' })).reason, 'isolated-test-not-approved');
+ assert.equal(resolveFormAIframe(isolated({ environmentRole: 'staging' })).reason, 'invalid-environment-role');
+ assert.equal(resolveFormAIframe(isolated({ allowIndexing: 'true' })).reason, 'indexing-enabled');
+ assert.equal(resolveFormAIframe(isolated({ route: '/lp/early-intervention' })).url, 'https://form.jotform.com/262946078314059?formContext=landing&language=en');
+ assert.equal(resolveFormAIframe(isolated({ route: '/es/contact', locale: 'en' })).reason, 'locale-not-authorized');
+ assert.equal(resolveFormAIframe(isolated({ route: '/es/contact', locale: 'es' })).url, 'https://form.jotform.com/262946078314059?formContext=contact&language=es');
+ const campaign = resolveFormAIframe(isolated({ route: '/lp/aba-therapy' }));
+ assert.equal(campaign.url, 'https://form.jotform.com/262946078314059?formContext=landing&language=en');
+ assert.equal(campaign.context, 'landing');
+ assert.equal(formModeForRuntime(resolveFormMode('isolated-test', undefined)), 'off');
+ assert.equal(formModeForRuntime(resolveFormMode('live', 'true')), 'off');
+});
+
+test('Only the seven allowlisted placements can render the adapter, with no helper, tracking, or parent submission code', () => {
+ const contact = fs.readFileSync('src/components/pages/ContactPage.astro', 'utf8');
+ const adapter = fs.readFileSync('src/components/JotformIframe.astro', 'utf8');
+ const campaign = fs.readFileSync('src/components/campaign/ConsultationForm.astro', 'utf8');
+ const earlyIntervention = fs.readFileSync('src/components/campaign/EarlyInterventionPage.astro', 'utf8');
+
+ assert.match(contact, /resolveFormAIframe/);
+ assert.match(contact, /route = lang === 'es' \? '\/es\/contact' : '\/contact'/);
+ assert.match(contact, /JotformIframe/);
+ assert.match(campaign, /resolveFormAIframe/);
+ assert.match(campaign, /JotformIframe/);
+ assert.match(campaign, /variant="embedded"/);
+ assert.match(campaign, /\/lp\/aba-therapy/);
+ assert.match(campaign, /const iframeDescription = 'Use this form to request a conversation\. An AIA team member can explain the next steps for your family\.'/);
+ assert.match(campaign, /description=\{iframeDescription\}/);
+ assert.doesNotMatch(campaign, /description=\{intro\}/);
+ assert.match(earlyIntervention, /resolveFormAIframe/);
+ assert.match(earlyIntervention, /route: '\/lp\/early-intervention'/);
+ assert.match(earlyIntervention, /JotformIframe/);
+ assert.match(adapter, /referrerpolicy="no-referrer"/);
+ assert.match(adapter, /sandbox="allow-forms allow-scripts allow-same-origin"/);
+ assert.match(adapter, /const fallbackMarkup = `/);
+ assert.match(adapter, /set:html=\{fallbackMarkup\}/);
+ assert.match(adapter, /escapeHtml\(config\.url\)/);
+ assert.doesNotMatch(adapter, /<\/h3>\s*(?:\{description[^\n]*\}\s*)?
/);
+ assert.match(adapter, /target="_blank" rel="noopener noreferrer"/);
+ assert.match(adapter, /--jotform-frame-height: 60rem/);
+ assert.match(adapter, /max-width: none;/);
+ assert.match(adapter, /width: 100%;/);
+ assert.match(adapter, /\.jotform-iframe--embedded \{\s*--jotform-frame-height: 42rem/);
+ assert.match(adapter, /\.jotform-iframe__frame \{\s*height: 68rem/);
+ assert.match(adapter, /\.jotform-iframe--embedded \.jotform-iframe__frame \{\s*height: 50rem/);
+ assert.doesNotMatch(adapter, / {
+ const css = fs.readFileSync('integrations/jotform/aia-form-a.css', 'utf8');
+ for (const declaration of [
+ 'background: #fcf9f5 !important',
+ 'border: 1px solid #edeef3 !important',
+ 'background: #ffbd59 !important',
+ 'border: 2px solid #ffbd59 !important',
+ 'border-color: #ff914d !important',
+ 'color: #254080 !important',
+ ]) assert.match(css, new RegExp(declaration.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+ assert.match(css, /:focus-visible/);
+ assert.doesNotMatch(css, /https?:\/\/|@import|url\(/i);
+});
diff --git a/www/tools/phase10-artifact-verify.mjs b/www/tools/phase10-artifact-verify.mjs
index 86a40b9..db5412c 100644
--- a/www/tools/phase10-artifact-verify.mjs
+++ b/www/tools/phase10-artifact-verify.mjs
@@ -39,6 +39,7 @@ function hasTerminalSlash(url) {
function unsafeSignals(html) {
const signals = [];
if (/]*\bsrc=["'][^"']*jotform/i.test(html)) signals.push('active Jotform iframe');
+ if (/262946078314059/i.test(html)) signals.push('isolated-test Form A identifier');
if (/]*\bsrc=["'][^"']*(?:jotform|googletagmanager|google-analytics|doubleclick)/i.test(html)) signals.push('active vendor tracking/form script');
if (/data-(?:form|forms)-mode=["']live["']/i.test(html)) signals.push('live form mode');
if (/api\.azinstitute4autism\.com/i.test(html)) signals.push('production API origin');
@@ -98,14 +99,20 @@ export async function verifyArtifact(root, mode = 'staging') {
if (secretSignals.length) errors.push(`unsafe artifact signals: ${JSON.stringify(secretSignals)}`);
const files = (await fg('**/*', { cwd: root, absolute: true, onlyFiles: true })).sort();
+ const formAResourceFiles = [];
const digest = createHash('sha256');
for (const file of files) {
const relative = path.relative(root, file).replaceAll(path.sep, '/');
+ if (/\.(?:html?|js|mjs|css|json|xml|txt)$/i.test(relative)) {
+ const contents = await fs.readFile(file, 'utf8');
+ if (/262946078314059/i.test(contents)) formAResourceFiles.push(relative);
+ }
digest.update(relative);
digest.update('\0');
digest.update(createHash('sha256').update(await fs.readFile(file)).digest('hex'));
digest.update('\n');
}
+ if (formAResourceFiles.length) errors.push(`isolated-test Form A identifier appears in artifact: ${formAResourceFiles.join(', ')}`);
return {
mode,
htmlRoutes: htmlFiles.length,
diff --git a/www/tools/phase10-artifact.test.mjs b/www/tools/phase10-artifact.test.mjs
index b99f166..21a0252 100644
--- a/www/tools/phase10-artifact.test.mjs
+++ b/www/tools/phase10-artifact.test.mjs
@@ -49,6 +49,14 @@ test('artifact rejects live form mode and production API origin', async () => {
assert.ok(result.errors.some((error) => error.includes('unsafe artifact signals')));
});
+test('artifact rejects the isolated-test Form A identifier in any shipped text asset', async () => {
+ const root = await fixture('staging');
+ await fs.writeFile(path.join(root, 'assets.js'), 'https://form.jotform.com/262946078314059?formContext=contact');
+ const result = await verifyArtifact(root, 'staging');
+ assert.equal(result.passed, false);
+ assert.ok(result.errors.some((error) => error.includes('isolated-test Form A identifier')));
+});
+
test('artifact rejects root-relative URLs with terminal slashes', async () => {
const root = await fixture('staging');
await fs.appendFile(path.join(root, 'index.html'), 'Campaign');
diff --git a/www/tools/phase9-nonproduction.test.mjs b/www/tools/phase9-nonproduction.test.mjs
index 207d515..27b405a 100644
--- a/www/tools/phase9-nonproduction.test.mjs
+++ b/www/tools/phase9-nonproduction.test.mjs
@@ -51,7 +51,10 @@ test('form mapping covers nine native instances and five landing journeys', () =
assert.equal(logicalFormForRoute('/contact'), 'general');
assert.equal(logicalFormForRoute('/es/client-consultation'), 'service');
assert.equal(logicalFormForRoute('/referrals'), 'referral');
- assert.equal(logicalFormForRoute('/lp/early-intervention'), 'service');
+ for (const route of ['/lp/aba-therapy', '/lp/aba-insurance', '/lp/aba-ahcccs', '/lp/aba-private-pay']) {
+ assert.equal(logicalFormForRoute(route), 'general');
+ }
+ assert.equal(logicalFormForRoute('/lp/early-intervention'), 'general');
assert.equal(logicalFormForRoute('/ar/contact'), undefined);
});