Web Forms Overview
Relevant source files
The following files were used as context for generating this wiki page:
The Web Forms system in TrackerBot provides a public-facing portal for users to report bugs and data inaccuracies. These forms act as a bridge between the TarkovTracker community and GitHub repositories, automatically converting user submissions into tracked GitHub issues. The system is designed to be accessible to users while maintaining security through rate limiting and spam prevention mechanisms.
Sources: AGENTS.md:8-10, README.md:16-25
System Architecture
The web forms are served by a dedicated Express.js server (webserver.js) that runs alongside the main Discord bot. The architecture consists of a static front-end hosted in the /web directory and a RESTful backend that handles authentication and communication with the GitHub API.
Component Interaction
The following diagram illustrates the flow from a user filling out a form to the creation of a GitHub issue:
The system routes reports to different repositories based on the form type: REPO_DEV for website bugs and REPO_DATA_REPORT for dataset issues.
Sources: webserver.js:10-30, webserver.js:145-189, AGENTS.md:12-25
Public Interface
The portal provides three primary entry points for users: a central landing page and two specific reporting forms.
Portal Pages
| Page | Path | Purpose |
|---|---|---|
| Issue Portal | / | Main hub linking to reporting forms and community resources. |
| Website Issue Form | /issue | For reporting bugs related to the website experience. |
| Data Report Form | /data | For reporting incorrect quest data, item stats, or maps. |
Sources: web/index.html:15-35, web/issue/index.html:15-20, web/data/index.html:15-20
Form Fields and Validation
The backend enforces strict length caps on all submitted fields to prevent abuse of the GitHub API.
| Field | Max Length | Description |
|---|---|---|
title | 200 | Concise summary of the issue. |
discord | 64 | Submitter's Discord handle (e.g., Username#1234). |
category | 64 | Impacted area (Data reports only). |
reference | 500 | Optional link to screenshots or sources (Data reports only). |
description | 8000 | Detailed steps to reproduce or data corrections. |
Sources: webserver.js:46-52, webserver.js:54-57, web/data/index.html:36-52
Backend Logic and Security
The server implements several layers of security to ensure the stability of the GitHub integration.
Submission Lifecycle
The sequence below details the processing of a POST request:
Security Measures
- Rate Limiting: Separate limiter instances are used for
/dataand/issueendpoints, allowing a maximum of 5 submissions per minute per IP address. - Origin Filtering: An allowlist (
ALLOWED_ORIGINS) blocks requests from unauthorized domains or suffix attacks. - Honeypot Spam Protection: A hidden input field named
companyis included in the HTML forms. If this field is populated (typically by bots), the server returns a successful response but discards the data without calling the GitHub API. - Credential Safety: The system uses
logSanitizedErrorto prevent GitHub tokens from leaking into logs via Axios error objects.
Sources: webserver.js:64-75, webserver.js:83-100, webserver.js:108-115, webserver.js:203-207
Data Report Pre-filling
The Data Report form supports pre-filling fields via URL parameters. This is useful for creating reporting links from other parts of the TarkovTracker application.
// Example implementation for parsing parameters
const params = new URLSearchParams(window.location.search);
const titleParam = params.get("title");
const categoryParam = params.get("category");
// ... application to form inputs
Sources: web/data/index.html:84-110
Conclusion
The Web Forms system provides a structured, secure method for community feedback. By automating the creation of GitHub issues and implementing robust validation and anti-spam measures, it allows the TarkovTracker team to manage website and data improvements efficiently while protecting their development infrastructure.