refactor(forms): enable approved Form A placements by default
This commit is contained in:
41 files changed
+862
-523
No files matched your search
@@ -76,12 +76,11 @@ Use a private ciphertext file generated by `collect` or `rewrite`:
|
||||
```sh
|
||||
AIA_PORTAL_LOCAL_PREVIEW_APPROVED=true \
|
||||
AIA_PORTAL_CIPHERTEXT_FILE=/absolute/private/ciphertext-TIMESTAMP.json \
|
||||
PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test \
|
||||
PUBLIC_AIA_FORMS_MODE=off PUBLIC_ALLOW_INDEXING=false \
|
||||
npm run dev -- --host 127.0.0.1
|
||||
```
|
||||
|
||||
The page defaults to locked/unavailable without approved valid input. Indexing
|
||||
The 2026-10-30 revision removes dependence on the retired Form A environment role. Form mode is independent; `off` above is optional for local testing and cannot grant portal approval. The page defaults to locked/unavailable without its own explicit approval and valid private input. Indexing
|
||||
builds cannot include it. The codes never go to a server, storage or URL. No
|
||||
native form submits; Enter and Unlock use local WebCrypto. Only the matching
|
||||
stream is displayed; refresh or leaving the page locks it again.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# AIA Form A Jotform styling and conditional-button guide
|
||||
|
||||
This directory contains the nonproduction visual handoff for the new AIA Form A. [`aia-form-a.css`](./aia-form-a.css) is intended for Jotform Classic Forms' **Form Designer → Styles → Inject Custom CSS** after the form is created and its settings are approved.
|
||||
This directory contains the accepted CSS backup and integration guidance for AIA Form A. [`aia-form-a.css`](./aia-form-a.css) is intended for Jotform Classic Forms' **Form Designer → Styles → Inject Custom CSS** under owner-controlled configuration review. The existing repository CSS is the accepted backup; do not regenerate it from Astro styles.
|
||||
|
||||
The CSS translates the existing AIA form treatment: Rubik typography, blue labels and text, `#fcf9f5` inputs with `#edeef3` borders, the `#ffbd59` filled button, the `#ff914d` hover/focus border, four-pixel corners, visible validation errors, and strong keyboard focus. The Astro page supplies the heading, introduction, privacy-policy link, and surrounding card. The stylesheet therefore removes the Jotform surface rather than adding another header, footer, or nested card.
|
||||
|
||||
@@ -11,54 +11,104 @@ The current Builder theme reconciliation adds narrowly scoped `!important` decla
|
||||
## Installation and comparison
|
||||
|
||||
1. Open the approved Form A in AIA's HIPAA-enabled Jotform account. Do not change its fields or settings from this repository workflow.
|
||||
2. Keep production activation disabled while embedded-runtime, accessibility, telemetry/privacy, and release review remain pending.
|
||||
2. Preserve the approved account configuration; account changes and site cutover require their separate authorization.
|
||||
3. Paste the contents of `aia-form-a.css` into Jotform's custom CSS area.
|
||||
4. Compare the Jotform preview with the Astro Form A mock at 390px and 1440px. Check the form surface, label rhythm, input height, button fill, outlined hover/focus state, error state, and mobile reflow.
|
||||
5. Check both English and Spanish configurations. Confirm translated labels, required indicators, validation messages, confirmation copy, and the accessible iframe title supplied by the parent Astro integration.
|
||||
6. Test the form in a real embedded iframe and on the direct hosted-form fallback. Confirm the iframe has a practical mobile height, does not create horizontal overflow, and does not trap keyboard focus.
|
||||
|
||||
The current Astro meeting preview remains `off` by default and can only be shown in a non-indexing mock build. It does not load Jotform and is not a live submission test.
|
||||
The optional Astro meeting preview requires `PUBLIC_AIA_FORMS_MODE=mock` and `PUBLIC_AIA_FORM_A_PREVIEW=true` in a non-indexing build. It does not load Jotform and is not a live submission test.
|
||||
|
||||
## Isolated Form A iframe adapter
|
||||
## Current Form A operation — superseding decision, 2026-10-30
|
||||
|
||||
The Astro adapter exists only for a separately approved, non-indexing isolated test. It can render Form A at the two contact routes and five explicitly allowlisted landing routes when **all** of the following are set at build time:
|
||||
The owner authorizes real Form A on the publicly reachable development host
|
||||
`https://aia.web3app.dev/`. Normal development and static builds use **live** Form A
|
||||
without environment flags. This intentionally supersedes the former isolated-test
|
||||
and seven-route production approval gates. It is not site-cutover authorization.
|
||||
|
||||
From `www/`:
|
||||
|
||||
```sh
|
||||
PUBLIC_AIA_FORMS_MODE=isolated-test
|
||||
PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test
|
||||
PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true
|
||||
PUBLIC_AIA_FORMS_LIVE_APPROVED=false
|
||||
PUBLIC_ALLOW_INDEXING=false
|
||||
npm run dev
|
||||
npm run build
|
||||
# Optional offline/restricted artifact:
|
||||
PUBLIC_AIA_FORMS_MODE=off npm run build
|
||||
# Optional synthetic fixtures:
|
||||
PUBLIC_AIA_FORMS_MODE=mock npm run dev
|
||||
```
|
||||
|
||||
It uses fixed allowlisted hosted URLs only: the contact routes use `formContext=contact` with their fixed English or Spanish language value, and the five landing routes use `formContext=landing&language=en`. `formContext` is the exact case-sensitive Jotform Unique Name supplied by the owner; it is presentation-only and does not accept visitor query values. In `isolated-test` mode, a missing gate, any other environment role, an indexing-enabled build or a route outside that seven-route allowlist renders the normal fail-closed Astro fallback. The separately documented `live` gate uses the same route allowlist and its own independent approvals.
|
||||
`PUBLIC_AIA_FORMS_MODE` is optional; missing/empty means `live`. The only accepted
|
||||
values are `live`, `off`, and `mock`. Remove obsolete `isolated-test` settings from
|
||||
local environment files; invalid explicit values stop the build with actionable
|
||||
guidance. The former live/isolated/consultation/production approvals and form
|
||||
environment role are removed, with no replacement gates. `PUBLIC_ALLOW_INDEXING`
|
||||
controls publication independently: both staging and indexing builds use the same
|
||||
16 placements. Explicit off/mock builds contain no real Form A iframe.
|
||||
|
||||
## Production-gated Form A adapter
|
||||
One typed registry in `src/utils/form-integration.ts` fixes every route, locale
|
||||
and context. No visitor query, referrer, arbitrary URL or option preselection is
|
||||
forwarded. The only origin/ID is `https://form.jotform.com/262946078314059`.
|
||||
Every URL has exactly `formContext` and `language` parameters:
|
||||
|
||||
The adapter remains off in normal builds. A production artifact may render Form A only when all four independent settings are present at build time:
|
||||
| Context | Routes | Loading |
|
||||
|---|---|---|
|
||||
| contact | `/contact` (en), `/es/contact` (es) | Immediate, 2 |
|
||||
| landing | `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, `/lp/early-intervention` (en) | Immediate, 5 |
|
||||
| consultation | `/client-consultation` (en), `/es/client-consultation` (es), `/schedule-consultation` (en) | Immediate, 3 |
|
||||
| consultation | `/aba-therapy`, `/autism-evaluations`, `/learner-social-club` (en), and their `/es/` counterparts (es) | Deferred, 6 |
|
||||
|
||||
The context is presentation-only. Physical Form B is retired. Form C and
|
||||
`/referrals` remain inactive; other routes cannot acquire Form A by setting a mode.
|
||||
The typed future Academy service copy does not publish another page.
|
||||
|
||||
Live service drawers open at four seconds OR 50% scroll, canceling the unused
|
||||
trigger. Dismissal or verified completion sets the existing shared 30-day
|
||||
suppression timestamp. The existing service CTA overrides automatic suppression;
|
||||
without JavaScript it remains a normal consultation-page link. Jotform loads only
|
||||
when the drawer opens. Off mode never automatically opens an inactive drawer.
|
||||
Mock mode retains the existing synthetic fixture workflow.
|
||||
|
||||
A verified `submission-completed` message must match the exact approved origin,
|
||||
actual activated/open iframe window, approved form ID and action. It displays a
|
||||
localized acknowledgment, waits five seconds, then uses the existing slide-out.
|
||||
Duplicate messages cannot restart the countdown. Manual close/navigation cancels
|
||||
it; suppression remains. Deliberate reopening after completion creates a fresh
|
||||
iframe. Provider-envelope acceptance still requires the owner-controlled real
|
||||
submission check; synthetic browser messages are not that acceptance.
|
||||
|
||||
The shared iframe preserves fixed responsive heights, accessible EN/ES titles,
|
||||
`referrerpolicy="no-referrer"`, and
|
||||
`sandbox="allow-forms allow-scripts allow-same-origin"`. No popup, top-navigation,
|
||||
camera, microphone, payment or geolocation permissions are added. The hosted
|
||||
fallback is outside the iframe and hidden without layout space until a 15-second
|
||||
missing-load timeout. Late load hides it; disposal cancels timers. A localized
|
||||
`noscript` fallback remains. Load does not prove application health or submission.
|
||||
No helper script, cross-origin DOM inspection, arbitrary messaging or submission
|
||||
forwarding is introduced. The official resize handler remains unimplemented and
|
||||
conditionally acceptable only after its separate security/browser review.
|
||||
|
||||
Owner-reported direct EN/ES synthetic acceptance and sampled embedded acceptance
|
||||
(English contact, Spanish contact and one ABA landing page) remain recorded as
|
||||
owner evidence. This change does not independently verify Jotform or resolve its
|
||||
Spanish consultation dropdown discrepancy, runtime telemetry, fluent-language,
|
||||
screen-reader, final HTTPS-host or operational recipient review.
|
||||
|
||||
For form rollback, explicitly set `PUBLIC_AIA_FORMS_MODE=off`, rebuild, verify
|
||||
`--forms=off`, and use the separately authorized artifact-switch procedure.
|
||||
Removing that override restores live, so removing settings is **not** rollback.
|
||||
Do not change the Jotform account as part of an Astro rollback.
|
||||
|
||||
Artifact checks (build matching output first):
|
||||
|
||||
```sh
|
||||
PUBLIC_AIA_FORMS_MODE=live
|
||||
PUBLIC_AIA_FORMS_LIVE_APPROVED=true
|
||||
PUBLIC_AIA_FORMS_ENVIRONMENT=production
|
||||
PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true
|
||||
node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
|
||||
# For PUBLIC_ALLOW_INDEXING=true output:
|
||||
node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
|
||||
# For explicit off or mock output, select the matching --forms value.
|
||||
```
|
||||
|
||||
`PUBLIC_ALLOW_INDEXING=true` is required for an indexing-enabled release artifact, but it is **not** a Form A authorization setting and cannot activate a frame by itself. The production gate preserves the same fixed seven-route allowlist, URLs, `formContext`, locale parameters, fixed heights, sandbox, no-referrer policy and conditional fallback. It does not enable future Form C, service drawers, native POST forms, analytics, advertising, tracking, webhooks, API forwarding or the Jotform resize handler.
|
||||
|
||||
For a deployment rollback, set `PUBLIC_AIA_FORMS_MODE=off` or remove any one of the three approval/environment values, rebuild the static artifact, verify no Form A identifier is emitted, and switch to the reviewed artifact. This disables Form A in Astro without changing the static site or the Jotform account. Do not change Jotform notification recipients, fields or availability as part of that rollback.
|
||||
|
||||
The adapter has a localized iframe title, a fixed-height responsive frame, a `no-referrer` policy, a minimal sandbox, and a direct hosted-form fallback. The fallback is outside the iframe, initially hidden without layout space, revealed after a 15-second missing-load timeout, cleared on frame load or component disposal, and duplicated only as localized `<noscript>` content. A frame `load` cancels the timeout but is never treated as Jotform initialization, accepted submission, conversion, or proof that the cross-origin application is healthy. It loads no Jotform helper script, reads no iframe DOM, and installs no `postMessage` handler.
|
||||
|
||||
Direct-Jotform Form A synthetic EN/ES submission, native thank-you, conditional-email/language, generic staff notification, autoresponder delivery, fixed Reply-To, no-answer/no-PDF and no-webhook/integration evidence is owner-confirmed. The owner also reports successful synthetic submission and confirmation through the isolated Astro iframe on English contact, Spanish contact and one ABA landing placement. This establishes owner-reported Form A functional submission acceptance for the sampled routes; it does not replace final seven-route responsive/keyboard/accessibility acceptance, Jotform runtime/network and telemetry privacy review, deployment review or site-release authorization.
|
||||
|
||||
### Landing-route extension — 2026-10-25 / 2026-10-26
|
||||
|
||||
The owner has extended this same **isolated-test-only** adapter to `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`. Those five English landing routes use the fixed URL parameter pair `formContext=landing&language=en`; the contact routes continue to use `formContext=contact` with their fixed page locale. This supersedes their earlier Form B mapping. Physical Form B is retired; the separately documented consultation routes are Form A isolated-test-only placements.
|
||||
|
||||
The campaign adapter uses the existing campaign form surface rather than creating a second card. Its native Jotform Submit label is not overridden by Astro. The current sandbox is deliberately limited to `allow-forms allow-scripts allow-same-origin`, which is the minimum anticipated set for Jotform validation and in-frame confirmation. It intentionally does not grant popups, modals, top navigation, downloads, or a feature-policy `allow` list. Owner-authorized synthetic acceptance must confirm the real form's validation, confirmation, and any required in-frame navigation before this sandbox can be accepted for production.
|
||||
|
||||
The versioned P9-03 contract and implementation plan must record this owner decision and reconcile the superseded campaign mapping without erasing the prior decision history. Keep any documentation PR review aligned with those versioned records.
|
||||
Employee-portal ciphertext remains separately gated by its own approval, private
|
||||
input and non-indexing preview requirement. Form A modes cannot authorize it.
|
||||
|
||||
## Form context and button labels
|
||||
|
||||
@@ -71,7 +121,10 @@ The current Form A design uses a hidden `formContext` value with fixed, approved
|
||||
- Make the no-context and invalid-context states fail closed: no ambiguous extra button and no unintended submission path.
|
||||
- Verify keyboard order, focus visibility, screen-reader names, English/Spanish labels, and mobile layout for every variant.
|
||||
|
||||
The owner-approved Form A landing extension applies only to `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`, using its fixed `landing` context under the isolated-test gate. Physical Form B is retired; a planned Form A `consultation` context requires separate Builder approval, synthetic acceptance and an allowlist change before it can appear on other service-consultation journeys. No Form A landing placement is approved for live production activation. Do not add an external Astro button that attempts to submit a cross-origin iframe.
|
||||
All five landing routes use Form A's fixed `landing` context. The nine consultation
|
||||
placements use its fixed `consultation` context. Jotform owns native Submit labels
|
||||
and conditions. Do not add an external Astro button that attempts to submit a
|
||||
cross-origin iframe.
|
||||
|
||||
## Verification checklist
|
||||
|
||||
@@ -84,31 +137,8 @@ The owner-approved Form A landing extension applies only to `/lp/aba-therapy`, `
|
||||
- [ ] Invalid or missing context does not expose an unintended submission path.
|
||||
- [ ] No PHI-bearing answer, PDF, recipient, redirect, webhook, or HTTP POST forwarding is inherited without privacy/security approval.
|
||||
- [x] Owner-reported embedded synthetic submission and confirmation passed on English contact, Spanish contact and one ABA landing placement; record the exact ABA path in the owner test log before release.
|
||||
- [ ] All seven placements have final responsive, keyboard, screen-reader and fluent-language acceptance, including timeout/fallback and error expansion.
|
||||
- [ ] All sixteen placements have final responsive, keyboard, screen-reader and fluent-language acceptance, including timeout/fallback and error expansion.
|
||||
- [ ] Jotform runtime requests, telemetry and cross-origin failure behavior are reviewed with privacy/security owners.
|
||||
- [ ] No Jotform, Contabo, analytics, advertising, or production API request is made by off/mock builds.
|
||||
|
||||
JF-01 through JF-09, privacy/security review, operations approval, fluent-language review, and production activation remain pending. This guide does not authorize Jotform account changes or live integration.
|
||||
|
||||
## 2026-10-28 reconciliation
|
||||
|
||||
The current records supersede the earlier Form B mapping: all five named landing journeys use Form A under the seven-route isolated-test or separately approved production gate, and physical Form B is retired. The Form A `consultation` context is owner-reported configured and emitted only by its separate non-indexing isolated-test gate. The [two-form integration specification](../../reports/phase-9-two-form-integration-specification-2026-10-28.md) defines its fixed planning contract and the separate Form C referral work. The official Jotform JavaScript embed handler is **conditionally acceptable pending targeted verification**; it is not included in this adapter. Any future adoption must first verify its current source, origin and source-window validation, parent-page privileges, URL mutation, network requests, Firefox behavior and all supported error states. Fixed heights remain the current approved architecture until that review is separately accepted.
|
||||
|
||||
## Consultation isolated-test extension — 2026-10-29
|
||||
|
||||
Form A's owner-reported `consultation` context is implemented in Astro for a separate isolated-test path only. It uses the fixed query pair `formContext=consultation` plus `language=en` or `language=es`; the value is selected from a trusted route/locale allowlist and never from visitor input. The three standalone routes are `/client-consultation`, `/es/client-consultation`, and `/schedule-consultation`. The six service drawers are `/aba-therapy`, `/autism-evaluations`, `/learner-social-club`, `/es/aba-therapy`, `/es/autism-evaluations`, and `/es/learner-social-club`.
|
||||
|
||||
All of the following are required to render a consultation iframe:
|
||||
|
||||
```sh
|
||||
PUBLIC_AIA_FORMS_MODE=isolated-test
|
||||
PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test
|
||||
PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true
|
||||
PUBLIC_AIA_FORMS_LIVE_APPROVED=false
|
||||
PUBLIC_AIA_FORMS_CONSULTATION_TEST_APPROVED=true
|
||||
PUBLIC_ALLOW_INDEXING=false
|
||||
```
|
||||
|
||||
The service drawers use a shared bilingual component. In this mode, their visible opener is explicit and keyboard-accessible; the external iframe URL is not assigned until the visitor opens the dialog. The adapter then preserves the fixed height, minimal sandbox, no-referrer policy, localized hosted-form fallback and no-JavaScript fallback. It does not auto-open, preselect a service, use the Jotform resize handler, inspect the child document or install cross-origin messaging.
|
||||
|
||||
These nine routes are **not** part of the production resolver. The existing production gate remains exactly seven contact/landing placements, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true` cannot activate a consultation route. The reported Jotform configuration requires owner browser acceptance for the visible service question, option text, requiredness, English/Spanish translation, validation, confirmation and privacy boundary. The former diagnostic-evaluation explanatory note is superseded: no such note should be added to Form A or Astro; an AIA client advocate will discuss available options in follow-up.
|
||||
Existing owner-verification scopes remain recorded in the contract/checklist. Outstanding consultation configuration acceptance, runtime/privacy, accessibility, fluent-language and site-release gates remain open. Default-live Form A is owner-authorized; this guide does not authorize Jotform account changes or site deployment.
|
||||
Reference in new issue
Block a user