
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
hof-form-wizard
Advanced tools
Creates routing and request handling for a multi-step form process.
Given a set of form steps and field definitions, the wizard function will create an express router with routing bound to each step of the form and input validation applied as configured.
Additional checks are also applied to ensure a user completes the form in the correct order.
Define a set of steps:
// steps.js
module.exports = {
'/step1': {
next: '/step2'
},
'/step2': {
next: '/step3',
fields: ['name']
},
'/step3': {
next: '/step4',
fields: ['age']
},
'/step4': {}
}
Define field rules:
// fields.js
module.exports = {
'name': {
validate: 'required'
},
'age': {
validate: 'required'
}
}
Create a wizard and bind it as middleware to an app:
var wizard = require('hof-form-wizard'),
steps = require('./steps'),
fields = require('./fields');
app.use(wizard(steps, fields));
The wizard expects some kind of session to have been created in previous middleware layers.
For production use a database backed session store is recommended - such as connect-redis.
The minimum amount of configuration for a wizard step is the next property to determine where the user should be taken after completing a step. A number of additional properties can be defined.
fields - specifies which of the fields from the field definition list are applied to this step. Form inputs which are not named on this list will not be processed. Default: []template - Specifies the template to render for GET requests to this step. Defaults to the route (without trailing slash)backLink - Specifies the location of the step previous to this one. If not specified then an algorithm is applied which checks the previously visited steps which have the current step set as next.behaviours - A single behaviour, or an array of behaviours to be mixed into the base controller to extend functionality. If an array of behaviours is given, they are applied left-to-right, so calling super in the right-most behaviour will point to the previous behaviour in the array.forks - Specifies a list of forks that can be taken depending on a particular field value or conditional function - See handling forking journeys in hof-form-controller.allowPostComplete - If set to true allows a step to be accessed after the application has been completed. If not set then accessing this step will reset the session.invalidates - an array of field names that will be 'invalidated' when this field value is set or changed. Any fields specified in the invalidates array will be removed from the sessionModel. Further to this any future steps from the invalidating step field will be removed from the sessionModel.Remaining field options documentation can be found in the hof-template-mixins README.
A number of options can be passed to the wizard as a third argument to customise aspects of the behaviour for all steps.
translate - provide a function for translating validation error codes into usable messages. Previous implementations have used i18next to do translations.
templatePath - provides the location within app.get('views') that templates are stored. Default pages.
controller - The constructor for the controller to be used for request handling. The default is an extension of the hof-form-controller, which is exported as a Controller property of this module. If custom behaviour is required for a particular form step then custom extensions can be defined by passing a list of Behaviours - see Behaviours
params - define a suffix for the routes for supporting additional URL parameters.
formatters - defines a standard list of formatters to be applied to all field data. Default: ['trim', 'singlespaces', 'hyphens'] - see formatters.js for a list of available formatters.Creating a behaviour:
// behaviour-one.js
module.exports = SuperClass => class extends SuperClass {
getValues(req, res, callback) {
super.getValues(req, res, (err, values) => {
if (err) {
return callback(err);
}
const errorValues = req.sessionModel.get('errorValues') || {};
return callback(null, Object.assign({}, values, errorValues))
});
}
}
//index.js
const app = require('express')();
const Wizard = require('hof-form-wizard')
const BehaviourOne = require('./behaviours/behaviour-one')
const BehaviourTwo = require('./behaviours/behaviour-two')
app.use(Wizard({
'/': {
behaviours: [BehaviourOne, BehaviourTwo]
}
}, {}, {}));
Some behaviours are built-in to the Wizard, and can be declared by passing a string as a behaviour.
These are:
complete - if applied to a step then this step will mark the application as complete. The user will then have their session reset if they attempt to access any step of the form. The next step of a completing step will always be accessible following completion. Any other steps which should also be accessible on a complete session should have their allowPostComplete option set to true.//index.js
const app = require('express')();
const Wizard = require('hof-form-wizard')
app.use(Wizard({
...
'/confirm-submission': {
behaviours: ['complete'],
next: '/finished'
},
'/finished': {},
'/download-receipt': {
allowPostComplete: true
}
}, {}, {}));
FAQs
routing and request handling for a multi-step form processes
The npm package hof-form-wizard receives a total of 107 weekly downloads. As such, hof-form-wizard popularity was classified as not popular.
We found that hof-form-wizard demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.