Forms & Interaction

Forms live as CmsForm documents owned by a CmsSite. The form builder is a field-level editor: editors add fields (text, textarea, email, phone, select, checkbox, radio, date, file upload), set per-field validation, mark fields required, choose layout (single column, two-column responsive) and configure submit behavior (thank-you page, redirect, inline message). A form can be embedded on any CmsPage via the `form` block, which references the form by id; the same form can appear on multiple pages and aggregate submissions in one place.

Anti-spam is layered: Cloudflare Turnstile guards every submit by default, honeypot fields catch naive bots, rate limits per IP block flooding, and an optional moderation queue holds suspicious submissions for review. Submissions land in a CmsFormSubmission collection scoped to the form, viewable in admin with filters, search and CSV/Excel export. Editors configure one or more email recipients and an optional auto-reply to the submitter; templates use the site's BrandingConfig for sender-name and colors so the auto-reply matches the visual identity.

RSVP and sign-up forms get a structured event link: the form references an EventNode, captures attendee count and dietary preferences, decrements available seats, and surfaces a confirmation with calendar attachment. Submissions can trigger webhooks for federations that want to push leads into a CRM. Access control respects page gating — a members-only RSVP form only accepts submissions from authenticated members in the right groups, enforced server-side regardless of how the form is embedded.