gecoit84/heyform repository overview

⁠HeyForm — Geco-IT patches

Patches applied on top of the official next branch (eb93574⁠).

• Source: https://github.com/cduchenoy/heyform/tree/next-geco⁠
• Docker image: https://hub.docker.com/r/gecoit84/heyform⁠

⁠Features

⁠Generic OIDC login

Adds support for any standards-compliant OpenID Connect provider (Authelia, Keycloak, Authentik, etc.) as a login method, using the certified openid-client library.

The iss parameter is forwarded through the full callback chain to satisfy providers that implement RFC9207 (authorization_response_iss_parameter_supported). Tested with Authelia.

Redirect URI to register in your identity provider:

https://forms.example.com/connect/oidc/callback

⁠Disable email/password authentication

Disables email-based login and registration to enforce SSO-only authentication. The email/password form is hidden in the UI and blocked at the API level.

⁠Allow user provisioning via SSO when registration is disabled

When APP_DISABLE_REGISTRATION=true, new users coming from a social/OIDC login are still blocked by default. Set ENABLE_SOCIAL_REGISTRATION=true to allow first-login provisioning via SSO while keeping email sign-up disabled.

⁠Remove HeyForm branding by default

Sets removeBranding to true at workspace creation time, hiding the "Powered by HeyForm" badge in the form footer for all new workspaces.

⁠Typical SSO-only setup

# Authentication
APP_DISABLE_REGISTRATION=true
APP_DISABLE_EMAIL_LOGIN=true
ENABLE_SOCIAL_REGISTRATION=true

# OIDC provider
OIDC_CLIENT_ID=heyform
OIDC_CLIENT_SECRET=your-secret
OIDC_ISSUER=https://sso.example.com
OIDC_DISPLAY_NAME=Company SSO

# Branding
APP_REMOVE_BRANDING=true

⁠Bugfixes

• Mongoose numeric enum validation — Object.values() on TypeScript numeric enums includes string reverse mappings, causing Mongoose to accept string values like "ADMIN" or "TRASH" instead of rejecting them. Fixed by filtering to numeric values only. Affected models: form, template, submission, app, attachment, integration, team-activity, team-member.
• disableLoginWithGoogle / disableLoginWithApple missing from runtimeConfig — Google and Apple login buttons were always visible even when unconfigured.
• removeBranding missing from PUBLIC_FORM_GQL — the field was returned by the server but not requested by the frontend GraphQL query, so the branding badge was never hidden even when removeBranding=true in the workspace settings.