feat(landing): reintroduce /contact page styled like /demo by waleedlatif1 · Pull Request #5315 · simstudioai/sim

waleedlatif1 · 2026-07-01T07:39:14Z

Summary

Reintroduce the /contact page (removed in improvement(landing): refine hero and mothership visuals #5181) with a two-column layout mirroring /demo: value proposition + trusted-by logos on the left, a message-form card on the right
Styled wholly on the platform light tokens and chip components — card chrome, field rhythm, and responsive tiers are identical to the demo booking card
Restore the contact contract and /api/contact route (rate-limit, honeypot, Turnstile, help-inbox notification + visitor confirmation email), now fully contract-bound via parseRequest
Add a useSubmitContact React Query mutation hook (contract-bound requestJson)
Link Contact from the footer Resources column and add /contact to the sitemap

Type of Change

New feature (reintroduction)

Testing

Tested manually. tsc, biome, check:api-validation:strict, check:react-query, and check:client-boundary all pass.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

- Restore the /contact page (removed in #5181) with a two-column layout mirroring /demo: value prop + trusted-by logos on the left, a message form card on the right, on the platform light tokens and chip components - Restore the contact contract, /api/contact route (rate-limit, honeypot, Turnstile, help-inbox notification + visitor confirmation), now fully contract-bound via parseRequest - Add a useSubmitContact React Query mutation hook - Link Contact from the footer Resources column and add it to the sitemap

vercel · 2026-07-01T07:39:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 1, 2026 8:14am

cursor · 2026-07-01T07:39:24Z

PR Summary

Medium Risk
New unauthenticated public endpoint handles PII and outbound email; abuse controls (rate limit, honeypot, Turnstile, fail-closed backstop) are substantive but email and captcha misconfiguration could still affect availability or deliverability.

Overview
Reintroduces a public /contact landing page (demo-style two-column layout with chip form, Turnstile, honeypot, and success state) wired through a new submitContactContract, useSubmitContact, and POST /api/contact.

The API path applies per-IP rate limits, honeypot discard, Turnstile verification with a stricter no-captcha bucket when the widget or transport fails, emails help@, and sends a best-effort visitor confirmation. checkRateLimitDirect now accepts failClosed for that captcha backstop (with tests).

Discovery updates: footer Contact link, sitemap /contact, and API route-count baseline 882.

^{Reviewed by Cursor Bugbot for commit 45d333e. Configure here.}

greptile-apps · 2026-07-01T07:41:33Z

Greptile Summary

This PR reintroduces the public contact page and its submission flow. The main changes are:

New /contact landing page styled like the demo page.
Contact form with shared contract validation, honeypot, and Turnstile support.
New /api/contact route for help-inbox notifications and visitor confirmation email.
Contact mutation hook, footer link, sitemap entry, and rate-limiter fail-closed support.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/api/contact/route.ts	Adds the contact API route with contract parsing, Turnstile verification, honeypot handling, no-captcha fallback throttling, and email delivery.
apps/sim/app/(landing)/contact/components/contact-form/contact-form.tsx	Adds the client contact form with shared validation, invisible Turnstile execution, and React Query submission.
apps/sim/lib/core/rate-limiter/rate-limiter.ts	Adds an opt-in fail-closed mode for direct rate-limit checks.
apps/sim/lib/api/contracts/contact.ts	Adds the shared contact request and response contract used by the route and client hook.

_{Reviews (5): Last reviewed commit: "refactor(contact): TSDoc over inline com..." | Re-trigger Greptile}

- Make captcha server-authoritative: drop the client-trusted captchaUnavailable flag; a valid Turnstile token is the only way past the stricter fallback bucket, so callers can't opt out of the challenge - Re-execute the Turnstile widget on every submit (incl. after expiry) instead of falling into the no-captcha path once the token expires - Reset the pre-submit gate on mutation settle so rapid double-clicks can't fire a duplicate /api/contact request - Map only feature_request to its email type; every other topic resolves to a General Inquiry confirmation so support requests aren't labeled bug reports - Drop the confirmation-email promise from the success copy (it's best-effort) - Collapse the duplicated no-captcha rate-limit branch; hoist shared response constants; read the Turnstile site key as a module constant

waleedlatif1 · 2026-07-01T07:52:19Z

@greptile

waleedlatif1 · 2026-07-01T07:52:20Z

@cursor review

The Turnstile site key is already domain-bound in Cloudflare, so pinning expectedHostname to the marketing SITE_URL (www.sim.ai) only rejected valid tokens issued on self-hosted, preview, and apex-vs-www hosts. Remove the pin and rely on Cloudflare's own domain binding.

waleedlatif1 · 2026-07-01T07:59:09Z

@greptile

waleedlatif1 · 2026-07-01T07:59:10Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2b54626. Configure here.}

checkRateLimitDirect fails open on limiter-storage errors so a limiter outage never takes down normal traffic. But the contact route's no-captcha bucket is the only throttle on token-less submits, so a fail-open there let uncaptcha'd requests reach the email path unthrottled during an outage. - Add an opt-in { failClosed } option to checkRateLimitDirect; default behavior (fail open) is unchanged - Use failClosed on the contact no-captcha backstop so an unenforceable limit rejects instead of admitting - Cover both fail-open and fail-closed paths with tests

waleedlatif1 · 2026-07-01T08:08:25Z

@greptile

waleedlatif1 · 2026-07-01T08:08:27Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2d44d47. Configure here.}

Move the captcha-design rationale into the route handler's TSDoc and drop the inline body/JSX comments, per the project's TSDoc-only comment convention.

waleedlatif1 · 2026-07-01T08:15:07Z

@greptile

waleedlatif1 · 2026-07-01T08:15:08Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 45d333e. Configure here.}