docs(forms): PMS-515 form-validation audit and decomposition #349

Merged

nrupard merged 1 commit from docs/PMS-515-form-validation-audit into main

2026-06-25 19:02:32 +02:00

nrupard commented

2026-06-25 18:54:02 +02:00

Owner

What

Adds dev-docs/form-validation-audit.md, the working doc for the PMS-515 epic (unify the mokosh-apps form-field validation system). Audit deliverable only - no code change.

Root cause: the shared form.rs field components do no validation; required is cosmetic (asterisk + aria_required; native HTML required removed in MAPPS-277, and inert anyway since every handler prevent_defaults). Each component already has an inline error slot - the surface exists, the enforcement does not.
Audit matrix: every form surface (~30, far more than the 13 onsubmit handlers once edit modals + inline editors are counted), per field: declared-required vs actually-enforced vs where the error surfaces. Produced by five parallel readers across all 10 form-bearing pages.
Summary of gaps: two silent unenforced required fields (new-ticket Description, log-time Description), two competing error-surface conventions (per-field inline vs top banner), ~2 dozen duplicated bespoke validators with divergent messages, contact Email never client-validated, inconsistent server-error-to-inline mapping.
Proposed design: in-house component-owned validation + a shared validator set + a Form submit guard (report all, focus first invalid) + truthful required and docs.
Decomposition: child issues PMS-516 (component-owned validation + shared validators), PMS-517 (submit guard), PMS-518 (migrate every form), linked under the epic with the dependency chain.

Per-page migration is tracked against the matrix and split into issues once the foundation API (PMS-516/517) is set, rather than filing ~10 speculative migration specs now.

Closes epic AC1 (the audit matrix).

## What Adds `dev-docs/form-validation-audit.md`, the working doc for the PMS-515 epic (unify the mokosh-apps form-field validation system). Audit deliverable only - no code change. ## Contents - **Root cause:** the shared `form.rs` field components do no validation; `required` is cosmetic (asterisk + `aria_required`; native HTML `required` removed in MAPPS-277, and inert anyway since every handler `prevent_default`s). Each component already has an inline `error` slot - the surface exists, the enforcement does not. - **Audit matrix:** every form surface (~30, far more than the 13 `onsubmit` handlers once edit modals + inline editors are counted), per field: declared-required vs actually-enforced vs where the error surfaces. Produced by five parallel readers across all 10 form-bearing pages. - **Summary of gaps:** two silent unenforced required fields (new-ticket Description, log-time Description), two competing error-surface conventions (per-field inline vs top banner), ~2 dozen duplicated bespoke validators with divergent messages, contact Email never client-validated, inconsistent server-error-to-inline mapping. - **Proposed design:** in-house component-owned validation + a shared validator set + a `Form` submit guard (report all, focus first invalid) + truthful `required` and docs. - **Decomposition:** child issues PMS-516 (component-owned validation + shared validators), PMS-517 (submit guard), PMS-518 (migrate every form), linked under the epic with the dependency chain. Per-page migration is tracked against the matrix and split into issues once the foundation API (PMS-516/517) is set, rather than filing ~10 speculative migration specs now. Closes epic AC1 (the audit matrix).

nrupard added 1 commit

2026-06-25 18:54:02 +02:00

docs(forms): add PMS-515 form-validation audit and decomposition

Check / fmt + clippy + tests (pull_request) Successful in 8m27s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

9cf48d28c8

Adds dev-docs/form-validation-audit.md, the working doc for the PMS-515 epic: the ground-truth audit matrix of every mokosh-apps form surface (~30, across create pages, edit/create modals, and inline editors) recording declared-vs-enforced required state and where each field's error surfaces, plus the root-cause analysis (shared form.rs components do no validation; required is cosmetic since MAPPS-277), the summary of gaps (two silent unenforced required Descriptions, two competing error-surface conventions, ~2 dozen duplicated bespoke validators), the proposed unified design, and the decomposition into child issues PMS-516 (component-owned validation + shared validator set), PMS-517 (shared submit guard), and PMS-518 (migrate every form).

No code change; this is the epic's audit deliverable (AC1).

#PMS-515

nrupard scheduled this pull request to auto merge when all checks succeed

2026-06-25 18:58:06 +02:00