EmbeddedHtmlTaskForm: hardcoded substring(13) breaks embedded:deployment: forms and non-root context paths

[javahippie]

Summary

EmbeddedHtmlTaskForm resolves the embedded form path by blindly stripping the first 13 characters of the form key:

// src/components/TaskForm.jsx
void engine_rest.task.get_task_form(state, formKey.substring(13));

13 is the length of embedded:app: — the code silently assumes that specific prefix.

Impact

• embedded:deployment:forms/foo.html (forms stored in the deployment instead of the application) → substring(13) yields loyment:forms/foo.html → broken fetch, no form. The correct source for these is GET /task/{id}/deployed-form, for which an API function (get_task_deployed_form) already exists.
• The application contextPath (returned by the form endpoints) is ignored, so embedded:app: forms of process applications with a non-root context also resolve incorrectly.

The same pattern existed in the start-form flow and is addressed by the fix suggested in #90; this issue covers the task-side occurrence.

Suggested fix

Replace the offset arithmetic with explicit prefix handling:

const EMBEDDED_APP = 'embedded:app:'
const EMBEDDED_DEPLOYMENT = 'embedded:deployment:'

if (formKey.startsWith(EMBEDDED_APP)) {
  const path = formKey.substring(EMBEDDED_APP.length),
    context_path = form_meta?.contextPath ?? ''
  void engine_rest.task.get_task_form(state, `${context_path}/${path}`.replace(/^\/+/, ''))
} else if (formKey.startsWith(EMBEDDED_DEPLOYMENT)) {
  void engine_rest.task.get_task_deployed_form(state, task.id)
}

(The TaskForm dispatch already guarantees formKey.startsWith("embedded:") at this point.)

[lambdaschmied2]

@javahippie the issue seems to be redundant to me. We won't show camunda 7 (.html) forms. I would suggest to just show a info box with the following information:

legacy camunda 7 (.html) forms [whatever naming is best] are not supported by the new web applications.
please migrate to form-js forms. Look at this guide {link to docs}