ObjectStackObjectStack

Sharing schema — UI Protocol reference

Sharing & Embedding Protocol — Public-link sharing of a form view. Reference for SharingConfig: every property with its type and default.

Sharing & Embedding Protocol

Public-link sharing of a form view. The module name is plural for historical reasons: it once held two shapes in opposite postures, and #4001 批 14 measured them per SCHEMA rather than assuming a file-level verdict — SharingConfigSchema a live authoring door, EmbedConfigSchema no door at all. That measurement is what let the two be disposed of separately, and the asymmetry survives as the reason this file reads the way it does:

  • SharingConfigSchema has a live authoring door. FormViewSchema.sharing carries it (view.zod.ts), view is a metadata-type root, and the runtime really reads it: rest-server.ts serves the anonymous form endpoints only when sharing.enabled === true, sharing.allowAnonymous === true and a sharing.publicLink slug matches (anonymousFormIntakeCandidates in anonymous-form-intake.ts beside this module, which @objectstack/metadata-core re-exports to the server's doors). Both example apps author it (app-showcase inquiry.view.ts, app-crm lead.view.ts). It is strictObject as of #4001 批 14.
  • EmbedConfigSchema was REMOVED at the no-door retirement (ADR-0049 enforce-or-remove) — see the block below where it stood.

The ledger's classification question is "who writes this schema's input?", and it is answered per SCHEMA, not per file; before 批 14 this file's row carried one verdict for both, and a file-level verdict would have been wrong in one direction or the other whichever way it fell.

Source: packages/spec/src/ui/sharing.zod.ts

TypeScript Usage

import { SharingConfigSchema } from '@objectstack/spec/ui';
import type { SharingConfig } from '@objectstack/spec/ui';

// Validate data
const result = SharingConfigSchema.parse(data);

SharingConfig

Properties

PropertyTypeRequiredDescription
enabledbooleanoptional (default: false)Enable public sharing
publicLinkstringoptionalPublic slug of the form, chosen by the author: not a URL, and never generated. /forms/x, forms/x and x name one slug, x. It is served to anonymous visitors only while enabled and allowAnonymous are both true: the REST form door answers GET /api/v1/forms/:slug (default API base), and a host that serves the console shows the form at /_console/f/:slug and redirects /forms/:slug there, query string carried.
passwordstringoptionalPassword required to access shared link
allowedDomainsstring[]optionalRestrict access to specific email domains (e.g. ["example.com"])
expiresAtstringoptionalExpiration date/time in ISO 8601 format
allowAnonymousbooleanoptional (default: false)Allow access without authentication

On this page