feat: FORMS-25252 add server-side validation (SSV) by rajatofficial · Pull Request #1902 · adobe/aem-core-forms-components

rajatofficial · 2026-06-10T05:36:07Z

Add enableServerSideValidation checkbox and ssvCloudServicePath cloud service picker to the form container edit dialog (Submission tab)
SSV config path picker shown/hidden based on checkbox state (editDialog.js)
Read enableServerSideValidation and ssvCloudServicePath from JCR in AdaptiveFormSubmitServlet; call Adobe I/O endpoint before submit action runs
On SSV failure respond HTTP 400 with SSV_VALIDATION_ERROR body and x-aem-error-pass header so the client can show inline field errors
Expose formModel on globals in formcontainerview.js so defaultSubmitErrorHandler can call visit() / markAsInvalid() without proxy restrictions
Implement SSV-aware defaultSubmitErrorHandler in customFunctions.js; delegates to cf.defaultSubmitErrorHandler for non-SSV failures
Guard ssvCloudServicePath from being exported to form JSON (security)
Add ReservedProperties constants for both new JCR property names
Add FormContainerImplTest assertions verifying SSV props are excluded from JSON
Add Jest tests for SSV error handler logic

Description

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

I have signed the Adobe Open Source CLA.
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have read the CONTRIBUTING document.
I have added tests to cover my changes and the overall coverage did not decrease.
All unit tests pass on CircleCi.
I ran all tests locally and they pass.

adobe-bot · 2026-06-11T08:10:15Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-11T12:40:33Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
page-has-heading-one	moderate
target-size	serious

adobe-bot · 2026-06-11T13:15:28Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-11T13:17:33Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-12T06:28:08Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

dmaurya929 · 2026-06-15T05:06:52Z

                    submitProps.computeIfAbsent(SS_SPREADSHEET, k -> new LinkedHashMap<String, Object>());
                    ((Map<String, Object>) submitProps.get(SS_SPREADSHEET)).put(entry.getKey(), entry.getValue());
                }
+                // SSV properties (enableServerSideValidation, ssvCloudServicePath) are intentionally


nitpick: comment not required here

dmaurya929 · 2026-06-15T05:07:11Z

+                                      granite:class="cmp-adaptiveform-container__enablessv"
+                                      name="./enableServerSideValidation"
+                                      text="Enable Server-Side Validation"
+                                      value="true"


I think default value should be false

Yes made it false.

adobe-bot · 2026-06-15T07:40:35Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-15T10:44:53Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

rismehta · 2026-06-15T12:40:04Z

    public static final String PN_SUBMIT_EMAIL_CC = "cc";
    public static final String PN_SUBMIT_EMAIL_BCC = "bcc";
    public static final String PN_SUBMIT_SPREADSHEETURL = "spreadsheetUrl";
+    public static final String PN_ENABLE_SERVER_SIDE_VALIDATION = "enableServerSideValidation";


all OOTB properties should be prefixed with fd:

These properties should not be part of the model.json output since they are server side, there can be a use-case for EDS submit, that can be handled later

These are not part of model.json; these are just for internal code use.

rismehta · 2026-06-15T12:41:11Z

                                            </cui>
                                        </uiSettings>
                                    </thankYouMessage>
+                                    <enableServerSideValidation


This should be hidden and only enabled if someone selects enable server side validation

Discussed with Anurag and Sudhanshu that, in order to improve the archaic behaviour, we should keep only one dropdown with a default value of None.

rismehta · 2026-06-15T12:41:24Z

+                                      jcr:primaryType="nt:unstructured"
+                                      sling:resourceType="granite/ui/components/coral/foundation/form/checkbox"
+                                      fieldLabel="Server-Side Validation"
+                                      fieldDescription="Call an Adobe I/O validator endpoint before the submit action runs."


We need to have help article for users to understand how to create one

Yes I will be creating a Doc for the customer.

rismehta · 2026-06-15T12:42:02Z

                    let defaultSubmissionError = FormView.LanguageUtils.getTranslatedString(self.getLang(), "InternalFormSubmissionError");
                    const globals = {
                        form: self.getModel().getRuleNode(),
+                        formModel: self.getModel(),


why is this required ?

rismehta · 2026-06-15T12:43:07Z

+                                    <enableServerSideValidation
+                                      jcr:primaryType="nt:unstructured"
+                                      sling:resourceType="granite/ui/components/coral/foundation/form/checkbox"
+                                      fieldLabel="Server-Side Validation"


Can we create a github clone so that users can refer that as sample to deploy Adobe IO action ? I want to make sure that they dont spend a lot of time doing this

Yes, I will be creating one.

rismehta

check comments

rismehta

check comments

…container - Add enableServerSideValidation checkbox and ssvCloudServicePath cloud service picker to the form container edit dialog (Submission tab) - SSV config path picker shown/hidden based on checkbox state (editDialog.js) - Read enableServerSideValidation and ssvCloudServicePath from JCR in AdaptiveFormSubmitServlet; call Adobe I/O endpoint before submit action runs - On SSV failure respond HTTP 400 with SSV_VALIDATION_ERROR body and x-aem-error-pass header so the client can show inline field errors - Expose formModel on globals in formcontainerview.js so defaultSubmitErrorHandler can call visit() / markAsInvalid() without proxy restrictions - Implement SSV-aware defaultSubmitErrorHandler in customFunctions.js; delegates to cf.defaultSubmitErrorHandler for non-SSV failures - Guard ssvCloudServicePath from being exported to form JSON (security) - Add ReservedProperties constants for both new JCR property names - Add FormContainerImplTest assertions verifying SSV props are excluded from JSON - Add Jest tests for SSV error handler logic

field.id is the stable JCR-path-based identifier; field.name is the author-assigned name. Either can be returned by the IO Runtime action depending on how the action was written, so check both.

@typehint

- Dialog: add @typehint=Boolean hidden field for enableServerSideValidation so Sling POST stores it as JCR Boolean, not String (B2a) - editDialog.js: replace bare visibility toggle with updateSsvVisibility() that calls manageDeleteFields — clears value, marks ssvCloudServicePath not-required, and adds @delete when checkbox is unchecked; reverses on re-check so stale JCR paths are not left behind (B3) - customFunctions.js: log console.warn when an SSV fieldName has no matching field in the form, so developers can diagnose name mismatches instead of errors silently disappearing (I4)

…container - Add enableServerSideValidation checkbox and ssvCloudServicePath cloud service picker to the form container edit dialog (Submission tab) - SSV config path picker shown/hidden based on checkbox state (editDialog.js) - Read enableServerSideValidation and ssvCloudServicePath from JCR in AdaptiveFormSubmitServlet; call Adobe I/O endpoint before submit action runs - On SSV failure respond HTTP 400 with SSV_VALIDATION_ERROR body and x-aem-error-pass header so the client can show inline field errors - Expose formModel on globals in formcontainerview.js so defaultSubmitErrorHandler can call visit() / markAsInvalid() without proxy restrictions - Implement SSV-aware defaultSubmitErrorHandler in customFunctions.js; delegates to cf.defaultSubmitErrorHandler for non-SSV failures - Guard ssvCloudServicePath from being exported to form JSON (security) - Add ReservedProperties constants for both new JCR property names - Add FormContainerImplTest assertions verifying SSV props are excluded from JSON - Add Jest tests for SSV error handler logic

field.id is the stable JCR-path-based identifier; field.name is the author-assigned name. Either can be returned by the IO Runtime action depending on how the action was written, so check both.

@typehint

- Dialog: add @typehint=Boolean hidden field for enableServerSideValidation so Sling POST stores it as JCR Boolean, not String (B2a) - editDialog.js: replace bare visibility toggle with updateSsvVisibility() that calls manageDeleteFields — clears value, marks ssvCloudServicePath not-required, and adds @delete when checkbox is unchecked; reverses on re-check so stale JCR paths are not left behind (B3) - customFunctions.js: log console.warn when an SSV fieldName has no matching field in the form, so developers can diagnose name mismatches instead of errors silently disappearing (I4)

adobe-bot · 2026-06-16T05:42:24Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-16T05:46:40Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

adobe-bot · 2026-06-16T07:24:00Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
page-has-heading-one	moderate
target-size	serious

adobe-bot · 2026-06-16T08:16:14Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
page-has-heading-one	moderate
target-size	serious

adobe-bot · 2026-06-16T17:33:27Z

Accessibility Violations Found

Id	Impact
aria-required-attr	critical
empty-heading	minor
label-title-only	serious
target-size	serious

github-actions Bot force-pushed the feat/FORMS-25252-server-side-validation branch from 10d09e8 to 3d10aa4 Compare June 11, 2026 12:35

rajatofficial changed the title ~~feat(af-core): FORMS-25252 add server-side validation (SSV)~~ feat: FORMS-25252 add server-side validation (SSV) Jun 11, 2026

dmaurya929 reviewed Jun 15, 2026

View reviewed changes

rismehta reviewed Jun 15, 2026

View reviewed changes

rismehta requested changes Jun 15, 2026

View reviewed changes

rajatkhurana-adobe added 9 commits June 16, 2026 10:18

test file name changed

4bc4312

feat(af-core): FORMS-25252 match SSV field errors by id as well as name

e3f62e1

field.id is the stable JCR-path-based identifier; field.name is the author-assigned name. Either can be returned by the IO Runtime action depending on how the action was written, so check both.

default SSV disabled

edc6bef

test file name changed

768aad1

feat(af-core): FORMS-25252 match SSV field errors by id as well as name

bf1b96f

field.id is the stable JCR-path-based identifier; field.name is the author-assigned name. Either can be returned by the IO Runtime action depending on how the action was written, so check both.

rajatofficial force-pushed the feat/FORMS-25252-server-side-validation branch from 7b1c652 to 665f05d Compare June 16, 2026 05:02

server side validation rebased

1ad7102

form container test cases fixed

f936515

form container test cases fixed II

328f2ac

Conversation

rajatofficial commented Jun 10, 2026

Description

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

Uh oh!

adobe-bot commented Jun 11, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 11, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 11, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 11, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 12, 2026

Accessibility Violations Found

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adobe-bot commented Jun 15, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 15, 2026

Accessibility Violations Found

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rismehta Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rismehta left a comment

Choose a reason for hiding this comment

Uh oh!

rismehta left a comment

Choose a reason for hiding this comment

Uh oh!

adobe-bot commented Jun 16, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 16, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 16, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 16, 2026

Accessibility Violations Found

Uh oh!

adobe-bot commented Jun 16, 2026

rismehta Jun 15, 2026 •

edited

Loading