feat(pgs): auto-forms

Author: neurosnap

AUTO_FORM.md

@@ -0,0 +1,124 @@
+# Auto-Form Feature for pgs.sh
+
+## Overview
+
+The auto-form feature allows users to create HTML forms on their pgs.sh sites that automatically submit data to the pgs database. Form submissions can then be retrieved via the pgs CLI in JSON format.
+
+## How It Works
+
+1. Form submissions are automatically captured and stored in PostgreSQL
+2. Users can retrieve form data via the pgs CLI
+
+## Database Schema
+
+```sql
+CREATE TABLE form_entries (
+  id uuid NOT NULL DEFAULT uuid_generate_v4(),
+  user_id uuid NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  data jsonb NOT NULL,
+  created_at timestamp without time zone NOT NULL DEFAULT NOW(),
+  CONSTRAINT form_entries_pkey PRIMARY KEY (id),
+  CONSTRAINT fk_form_entries_users
+    FOREIGN KEY(user_id)
+    REFERENCES app_users(id)
+    ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_form_entries_user ON form_entries(user_id);
+CREATE INDEX IF NOT EXISTS idx_form_entries_name ON form_entries(name);
+```
+
+### Migration
+
+Run the migration:
+```bash
+make latest
+```
+
+Or run all migrations:
+```bash
+make migrate
+```
+
+## HTML Form Example
+
+```html
+<form method="POST" action="/forms/example" data-pgs="true">
+  <p>
+    <label>Your Name: <input type="text" name="name" /></label>
+  </p>
+  <p>
+    <label>Your Email: <input type="email" name="email" /></label>
+  </p>
+  <p>
+    <label>Your Role: <select name="role[]" multiple>
+      <option value="leader">Leader</option>
+      <option value="follower">Follower</option>
+    </select></label>
+  </p>
+  <p>
+    <label>Message: <textarea name="message"></textarea></label>
+  </p>
+  <p>
+    <button type="submit">Send</button>
+  </p>
+</form>
+```
+
+## CLI Commands
+
+### List all form names for a user
+```bash
+ssh pgs.sh forms ls
+```
+
+### Get form submissions for a specific form
+```bash
+ssh pgs.sh forms show example
+```
+
+Output (JSON):
+```json
+[
+  {
+    "id": "uuid",
+    "name": "contact",
+    "data": {
+      "name": "John Doe",
+      "email": "john@example.com",
+      "role": ["leader", "follower"],
+      "message": "Hello!"
+    },
+    "created_at": "2026-03-05T12:00:00Z"
+  }
+]
+```
+
+### Delete all submissions for a form
+```bash
+ssh pgs.sh forms rm example --write
+```
+
+## Data Storage
+
+- Form data is stored in PostgreSQL `form_entries` table
+- Each submission is a JSON object with form field names as keys
+- Data is associated with the user, not the project
+- Form data is deleted when the user account is deleted (CASCADE)
+
+## Implementation Details
+
+### Database Methods
+
+```go
+InsertFormEntry(userID, name string, data map[string]interface{}) error
+FindFormEntriesByUserAndName(userID, name string) ([]*db.FormEntry, error)
+FindFormNamesByUser(userID string) ([]string, error)
+RemoveFormEntriesByUserAndName(userID, name string) error
+```
+
+## More features
+
+- Form validation and confirmation pages
+- CSRF token in form and validated in post handler

Makefile

@@ -145,10 +145,11 @@ migrate:
 	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20251217_add_access_logs_table.sql
 	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20251226_add_pipe_monitoring.sql
 	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20260116_add_analytics_filter_indexes.sql
+	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20260305_add_forms_table.sql
 .PHONY: migrate
 
 latest:
-	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20260116_add_analytics_filter_indexes.sql
+	$(DOCKER_CMD) exec -i $(DB_CONTAINER) psql -U $(PGUSER) -d $(PGDATABASE) < ./sql/migrations/20260305_add_forms_table.sql
 .PHONY: latest
 
 psql:

pkg/apps/pgs/auto_form.go

@@ -0,0 +1,81 @@
+package pgs
+
+import (
+	"net/http"
+
+	"github.com/picosh/pico/pkg/shared/router"
+)
+
+func handleAutoForm(w http.ResponseWriter, r *http.Request, cfg *PgsConfig) {
+	formName := r.PathValue("fname")
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	err := r.ParseForm()
+	if err != nil {
+		cfg.Logger.Error("failed to parse auto form", "err", err)
+		http.Error(w, "failed to parse auto form", http.StatusBadRequest)
+		return
+	}
+
+	formValues := make(map[string]interface{})
+	for key, values := range r.PostForm {
+		if len(values) == 1 {
+			formValues[key] = values[0]
+		} else if len(values) > 1 {
+			formValues[key] = values
+		}
+	}
+
+	subdomain := router.GetSubdomainFromRequest(r, cfg.Domain, cfg.TxtPrefix)
+	props, err := router.GetProjectFromSubdomain(subdomain)
+	if err != nil {
+		cfg.Logger.Error("could not get project from subdomain", "subdomain", subdomain, "err", err)
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+
+	user, err := cfg.DB.FindUserByName(props.Username)
+	if err != nil {
+		cfg.Logger.Error("user not found", "username", props.Username)
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+
+	err = cfg.DB.InsertFormEntry(user.ID, formName, formValues)
+	if err != nil {
+		cfg.Logger.Error("failed to save form data", "err", err)
+		http.Error(w, "failed to save form data", http.StatusInternalServerError)
+		return
+	}
+
+	serveAutoFormSubmitted(w, r, cfg)
+}
+
+type FormData struct {
+	Error string
+}
+
+func serveAutoFormSubmitted(w http.ResponseWriter, r *http.Request, cfg *PgsConfig) {
+	errorMsg := r.URL.Query().Get("error")
+	data := loginFormData{
+		Error: errorMsg,
+	}
+
+	w.WriteHeader(http.StatusUnprocessableEntity)
+
+	ts, err := renderTemplate(cfg, []string{cfg.StaticPath("html/auto_form.page.tmpl")})
+	if err != nil {
+		cfg.Logger.Error("could not render auto form template", "err", err.Error())
+		http.Error(w, "Server error", http.StatusInternalServerError)
+		return
+	}
+
+	err = ts.Execute(w, data)
+	if err != nil {
+		cfg.Logger.Error("could not execute login template", "err", err.Error())
+		http.Error(w, "Server error", http.StatusInternalServerError)
+	}
+}

pkg/apps/pgs/cli.go

@@ -1,6 +1,7 @@
 package pgs
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -561,3 +562,39 @@ func (c *Cmd) cacheAll() error {
 	}
 	return nil
 }
+
+func (c *Cmd) formsLs() error {
+	forms, err := c.Dbpool.FindFormNamesByUser(c.User.ID)
+	if err != nil {
+		return err
+	}
+	if len(forms) == 0 {
+		c.output("no forms found")
+		return nil
+	}
+	for _, name := range forms {
+		c.output(name)
+	}
+	return nil
+}
+
+func (c *Cmd) formData(formName string) error {
+	formData, err := c.Dbpool.FindFormEntriesByUserAndName(c.User.ID, formName)
+	if err != nil {
+		return err
+	}
+	data, err := json.Marshal(formData)
+	if err != nil {
+		return err
+	}
+	c.output(string(data))
+	return nil
+}
+
+func (c *Cmd) formRm(formName string) error {
+	c.output(fmt.Sprintf("removing all data associated with form: %s", formName))
+	if c.Write {
+		return c.Dbpool.RemoveFormEntriesByUserAndName(c.User.ID, formName)
+	}
+	return nil
+}

pkg/apps/pgs/cli_middleware.go

@@ -212,6 +212,29 @@ func Middleware(handler *UploadAssetHandler) pssh.SSHServerMiddleware {
 
 				err := opts.cache(projectName)
 				opts.notice()
+				opts.bail(err)
+				return err
+			case "forms":
+				formName := projectName
+				formsCmd, write := flagSet("forms", sesh)
+				rmForm := formsCmd.Bool("rm", false, "delete form data")
+				if !flagCheck(formsCmd, formName, cmdArgs) {
+					return nil
+				}
+				opts.Write = *write
+
+				var err error
+				if formName == "ls" {
+					err = opts.formsLs()
+				} else {
+					if *rmForm {
+						err = opts.formRm(formName)
+						opts.notice()
+					} else {
+						err = opts.formData(formName)
+					}
+				}
+
 				opts.bail(err)
 				return err
 			case "acl":

pkg/apps/pgs/db/db.go

@@ -27,6 +27,11 @@ type PgsDB interface {
 	FindProjectsByPrefix(userID, name string) ([]*db.Project, error)
 	FindProjects(by string) ([]*db.Project, error)
 
+	InsertFormEntry(userID, name string, data map[string]interface{}) error
+	FindFormEntriesByUserAndName(userID, name string) ([]*db.FormEntry, error)
+	FindFormNamesByUser(userID string) ([]string, error)
+	RemoveFormEntriesByUserAndName(userID, name string) error
+
 	RegisterAdmin(username, pubkey, pubkeyName string) error
 
 	Close() error

pkg/apps/pgs/db/memory.go

@@ -11,11 +11,12 @@ import (
 )
 
 type MemoryDB struct {
-	Logger   *slog.Logger
-	Users    []*db.User
-	Projects []*db.Project
-	Pubkeys  []*db.PublicKey
-	Feature  *db.FeatureFlag
+	Logger      *slog.Logger
+	Users       []*db.User
+	Projects    []*db.Project
+	Pubkeys     []*db.PublicKey
+	Feature     *db.FeatureFlag
+	FormEntries []*db.FormEntry
 }
 
 var _ PgsDB = (*MemoryDB)(nil)
@@ -195,3 +196,52 @@ func (me *MemoryDB) RegisterAdmin(username, pubkey, pubkeyName string) error {
 func (me *MemoryDB) InsertAccessLog(*db.AccessLog) error {
 	return errNotImpl
 }
+
+func (me *MemoryDB) InsertFormEntry(userID, name string, data map[string]interface{}) error {
+	id := uuid.NewString()
+	now := time.Now()
+	entry := &db.FormEntry{
+		ID:        id,
+		UserID:    userID,
+		Name:      name,
+		Data:      data,
+		CreatedAt: &now,
+	}
+	me.FormEntries = append(me.FormEntries, entry)
+	return nil
+}
+
+func (me *MemoryDB) FindFormEntriesByUserAndName(userID, name string) ([]*db.FormEntry, error) {
+	entries := []*db.FormEntry{}
+	for _, entry := range me.FormEntries {
+		if entry.UserID == userID && entry.Name == name {
+			entries = append(entries, entry)
+		}
+	}
+	return entries, nil
+}
+
+func (me *MemoryDB) FindFormNamesByUser(userID string) ([]string, error) {
+	names := make(map[string]bool)
+	for _, entry := range me.FormEntries {
+		if entry.UserID == userID {
+			names[entry.Name] = true
+		}
+	}
+	result := []string{}
+	for name := range names {
+		result = append(result, name)
+	}
+	return result, nil
+}
+
+func (me *MemoryDB) RemoveFormEntriesByUserAndName(userID, name string) error {
+	filtered := []*db.FormEntry{}
+	for _, entry := range me.FormEntries {
+		if entry.UserID != userID || entry.Name != name {
+			filtered = append(filtered, entry)
+		}
+	}
+	me.FormEntries = filtered
+	return nil
+}