[6.x] Forms 2: SubmitForm action

[duncanmcclean]

This pull request extracts the form submission logic from Statamic's FormController into a reusable SubmitForm action class, allowing third-party developers to use it in Livewire components or custom API endpoints.

Usage

use Statamic\Facades\Form;
use Statamic\Facades\Site;
use Statamic\Forms\SubmitForm;
use Statamic\Exceptions\SilentFormFailureException;
use Illuminate\Validation\ValidationException;

$form = Form::find('contact');

try {
    $submission = app(SubmitForm::class)
        ->form($form)
        ->submit(
            data: ['name' => 'John', 'email' => 'john@example.com'],
            files: [], // Optional
        );
} catch (ValidationException $e) {
    return back()->withErrors($e->errors());
} catch (SilentFormFailureException $e) {
    // Honeypot triggered or event listener rejected
    // $e->submission() contains the submission data

    return back()->with('success', 'Form submitted successfully!');
}

return back()->with('success', 'Form submitted successfully!');

Methods:

• submit() handles everything from validation, honeypot, file uploads, dispatching the FormSubmitted event and persisting the submission. It returns a Submission instance.
• validate() validates the data and throws a ValidationException on failure.
• resume() binds an existing incomplete submission so the next submit() call uses it, rather than creating an entirely new submission.

The only argument on the submit() and validate() methods scopes validation to a given set of fields. When omitted, the whole form is validated.

The submitting hook

The FormController now has a submitting hook so addons (namely Forms Pro) can take over the submission process.

It may return a response (eg. to return a special payload), a Submission instance (eg. because it handles creating the submission itself) or nothing (which leads to a normal submission).

Precognition

Validation used to live in a FrontendFormRequest, which is where Precognition was handled.

However, now that validation lives in the action, the form request has been deleted and Precognition is now handled explicitly in the controller. It validates via the action (scoped to the Precognition-Validate-Only fields) and halts without storing a submission.

Laravel's HandlePrecognitiveRequests middleware short-circuts the controller before its code is executed, so the form route uses a slim HandleFormPrecognitiveRequests subclass which keeps Precognition detection and headers but lets the request reach the controller.

---

Replaces #14375
Depends on #14832
Closes statamic/ideas#1409