Initial commit

application/Espo/Tools/LeadCapture/Api/PostForm.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture\Api;
+
+use Espo\Core\Api\Action;
+use Espo\Core\Api\Request;
+use Espo\Core\Api\Response;
+use Espo\Core\Api\ResponseComposer;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Tools\LeadCapture\CaptureService;
+
+/**
+ * @noinspection PhpUnused
+ */
+class PostForm implements Action
+{
+    public function __construct(
+        private CaptureService $service,
+    ) {}
+
+    public function process(Request $request): Response
+    {
+        $data = $request->getParsedBody();
+        $id = $request->getRouteParam('id') ?? throw new BadRequest();
+        $captchaToken = $request->getHeader('X-Captcha-Token');
+
+        $result = $this->service->captureForm($id, $data, $captchaToken);
+
+        return ResponseComposer::json([
+            'redirectUrl' => $result->redirectUrl,
+        ]);
+    }
+}

application/Espo/Tools/LeadCapture/CaptureService.php

@@ -0,0 +1,773 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Field\Link;
+use Espo\Core\FieldValidation\Exceptions\ValidationError;
+use Espo\Core\FieldValidation\Failure as ValidationFailure;
+use Espo\Core\FieldValidation\Type as ValidationType;
+use Espo\Core\Name\Field;
+use Espo\Core\PhoneNumber\Sanitizer as PhoneNumberSanitizer;
+use Espo\Core\Job\JobSchedulerFactory;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\FieldValidation\FieldValidationManager;
+use Espo\Core\FieldValidation\FieldValidationParams as ValidationParams;
+use Espo\Core\HookManager;
+use Espo\Core\Job\QueueName;
+use Espo\Core\ORM\EntityManager;
+use Espo\Core\Record\ServiceContainer;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Espo\Core\Utils\FieldUtil;
+use Espo\Core\Utils\Language;
+use Espo\Core\Utils\Log;
+use Espo\ORM\Entity;
+use Espo\Entities\UniqueId;
+use Espo\Entities\LeadCapture;
+use Espo\Entities\LeadCaptureLogRecord;
+use Espo\Modules\Crm\Entities\Campaign;
+use Espo\Modules\Crm\Entities\TargetList;
+use Espo\Modules\Crm\Tools\Campaign\LogService as CampaignService;
+use Espo\Modules\Crm\Entities\Contact;
+use Espo\Modules\Crm\Entities\Lead;
+use Espo\Tools\LeadCapture\Jobs\OptInConfirmation;
+use Espo\Tools\Captcha\Checker as CaptchaChecker;
+use stdClass;
+use DateTime;
+
+class CaptureService
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private FieldUtil $fieldUtil,
+        private Language $defaultLanguage,
+        private HookManager $hookManager,
+        private Log $log,
+        private FieldValidationManager $fieldValidationManager,
+        private JobSchedulerFactory $jobSchedulerFactory,
+        private CampaignService $campaignService,
+        private PhoneNumberSanitizer $phoneNumberSanitizer,
+        private ServiceContainer $serviceContainer,
+        private CaptchaChecker $captchaChecker,
+    ) {}
+
+    /**
+     * Capture a lead from a web form.
+     *
+     * @param string $id A form ID.
+     * @param stdClass $data A payload.
+     * @param ?string $captchaToken A captcha token.
+     * @throws BadRequest
+     * @throws Error
+     * @throws NotFound
+     * @throws Forbidden
+     */
+    public function captureForm(string $id, stdClass $data, ?string $captchaToken = null): FormResult
+    {
+        $leadCapture = $this->getLeadCaptureByFormId($id);
+
+        $apiKey = $leadCapture->getApiKey();
+
+        if (!$apiKey) {
+            throw new Error("No API key.");
+        }
+
+        if ($leadCapture->hasFormCaptcha()) {
+            $this->captchaChecker->check($captchaToken ?? '', 'leadCaptureSubmit');
+        }
+
+        $this->capture($apiKey, $data);
+
+        return new FormResult(
+            redirectUrl: $leadCapture->getFormSuccessRedirectUrl(),
+        );
+    }
+
+    /**
+     * Capture a lead. A main entry method.
+     *
+     * @param string $apiKey An API key.
+     * @param stdClass $data A payload.
+     * @throws BadRequest
+     * @throws Error
+     * @throws NotFound
+     */
+    public function capture(string $apiKey, stdClass $data): void
+    {
+        $leadCapture = $this->getLeadCapture($apiKey);
+
+        if (!$leadCapture->optInConfirmation()) {
+            $this->proceed($leadCapture, $data);
+
+            return;
+        }
+
+        if (empty($data->emailAddress)) {
+            throw new Error('LeadCapture: No emailAddress passed in the payload.');
+        }
+
+        if (!$leadCapture->getOptInConfirmationEmailTemplateId()) {
+            throw new Error('LeadCapture: No optInConfirmationEmailTemplate specified.');
+        }
+
+        $lead = $this->getLeadWithPopulatedData($leadCapture, $data);
+
+        $target = $lead;
+
+        $duplicateData = $this->findLeadDuplicates($leadCapture, $lead);
+
+        if ($duplicateData['lead']) {
+            $target = $duplicateData['lead'];
+        }
+
+        if ($duplicateData['contact']) {
+            $target = $duplicateData['contact'];
+        }
+
+        $hasDuplicate = $duplicateData['lead'] || $duplicateData['contact'];
+
+        $isLogged = false;
+
+        if ($hasDuplicate) {
+            $this->log($leadCapture, $target, $data, false);
+
+            $isLogged = true;
+
+            $targetListId = $leadCapture->getTargetListId();
+
+            if ($leadCapture->skipOptInConfirmationIfSubscribed() && $targetListId) {
+                $isAlreadyOptedIn = $this->isTargetOptedIn($target, $targetListId);
+
+                if ($isAlreadyOptedIn) {
+                    $this->log->debug("LeadCapture: Already opted in. Skipped.");
+
+                    return;
+                }
+            }
+        }
+
+        if ($leadCapture->createLeadBeforeOptInConfirmation() && !$hasDuplicate) {
+            $this->entityManager->saveEntity($lead);
+
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
+            $this->log($leadCapture, $target, $data, true);
+
+            $isLogged = true;
+        }
+
+        $lifetime = $leadCapture->getOptInConfirmationLifetime();
+
+        if (!$lifetime) {
+            $lifetime = 100;
+        }
+
+        $dt = new DateTime();
+
+        $dt->modify('+' . $lifetime . ' hours');
+
+        $terminateAt = $dt->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
+
+        /** @var UniqueId $uniqueId */
+        $uniqueId = $this->entityManager->getNewEntity(UniqueId::ENTITY_TYPE);
+
+        $uniqueId->set([
+            'terminateAt' => $terminateAt,
+            'data' => (object) [
+                'leadCaptureId' => $leadCapture->getId(),
+                'data' => $data,
+                'leadId' => $lead->hasId() ? $lead->getId() : null,
+                'isLogged' => $isLogged,
+            ],
+        ]);
+
+        $this->entityManager->saveEntity($uniqueId);
+
+        $this->jobSchedulerFactory
+            ->create()
+            ->setClassName(OptInConfirmation::class)
+            ->setData([
+                'id' => $uniqueId->getIdValue(),
+            ])
+            ->setQueue(QueueName::E0)
+            ->schedule();
+    }
+
+    /**
+     * @throws BadRequest
+     * @throws NotFound
+     * @throws Error
+     */
+    private function proceed(
+        LeadCapture $leadCapture,
+        stdClass $data,
+        ?string $leadId = null,
+        bool $isLogged = false
+    ): void {
+
+        if ($leadId) {
+            /** @var ?Lead $lead */
+            $lead = $this->entityManager->getEntityById(Lead::ENTITY_TYPE, $leadId);
+
+            if (!$lead) {
+                throw new NotFound("Lead '$leadId' not found.");
+            }
+        } else {
+            $lead = $this->getLeadWithPopulatedData($leadCapture, $data);
+        }
+
+        $campaign = null;
+
+        /** @var ?string $campaignId */
+        $campaignId = $leadCapture->getCampaignId();
+
+        if ($campaignId) {
+            $campaign = $this->entityManager->getEntityById(Campaign::ENTITY_TYPE, $campaignId);
+        }
+
+        $toRelateLead = false;
+
+        $target = $lead;
+
+        $duplicateData = $this->findLeadDuplicates($leadCapture, $lead);
+
+        $duplicate = $duplicateData['lead'];
+        $contact = $duplicateData['contact'];
+
+        $targetLead = $duplicateData['lead'] ?? $lead;
+
+        if ($contact) {
+            assert($contact instanceof Contact);
+
+            $target = $contact;
+        }
+
+        if ($duplicate) {
+            assert($duplicate instanceof Lead);
+
+            $lead = $duplicate;
+
+            if (!$contact) {
+                $target = $lead;
+            }
+        }
+
+        $isContactOptedIn = false;
+
+        $targetListId = $leadCapture->getTargetListId();
+
+        if ($leadCapture->subscribeToTargetList() && $targetListId) {
+            $isAlreadyOptedIn = false;
+
+            if ($contact && $leadCapture->subscribeContactToTargetList()) {
+                $isAlreadyOptedIn = $this->isTargetOptedIn($contact, $targetListId);
+
+                $isContactOptedIn = $isAlreadyOptedIn;
+
+                if (!$isAlreadyOptedIn) {
+                    $this->entityManager
+                        ->getRDBRepository(Contact::ENTITY_TYPE)
+                        ->getRelation($contact, 'targetLists')
+                        ->relateById($targetListId, ['optedOut' => false]);
+
+                    $isAlreadyOptedIn = true;
+
+                    if ($campaign) {
+                        $this->campaignService->logOptedIn($campaign->getId(), null, $contact);
+                    }
+
+                    $targetList = $this->entityManager->getEntityById(TargetList::ENTITY_TYPE, $targetListId);
+
+                    if ($targetList) {
+                        $this->hookManager->process(TargetList::ENTITY_TYPE, 'afterOptIn', $targetList, [], [
+                           'link' => 'contacts',
+                           'targetId' => $contact->getId(),
+                           'targetType' => Contact::ENTITY_TYPE,
+                           'leadCaptureId' => $leadCapture->getId(),
+                        ]);
+                    }
+                }
+            }
+
+            if (!$isAlreadyOptedIn) {
+                if ($targetLead->isNew()) {
+                    $toRelateLead = true;
+                } else {
+                    $isAlreadyOptedIn = $this->isTargetOptedIn($targetLead, $targetListId);
+
+                    if (!$isAlreadyOptedIn) {
+                        $toRelateLead = true;
+                    }
+                }
+            }
+        }
+
+        if (
+            $contact &&
+            (!$isContactOptedIn || !$leadCapture->subscribeToTargetList()) &&
+            $leadCapture->subscribeContactToTargetList()
+        ) {
+            $this->hookManager->process(LeadCapture::ENTITY_TYPE, 'afterLeadCapture', $leadCapture, [], [
+               'targetId' => $contact->getId(),
+               'targetType' => Contact::ENTITY_TYPE,
+            ]);
+
+            $this->hookManager->process(Contact::ENTITY_TYPE, 'afterLeadCapture', $contact, [], [
+               'leadCaptureId' => $leadCapture->getId(),
+            ]);
+        }
+
+        $isNew = !$duplicate && !$contact;
+
+        if (!$contact || !$leadCapture->subscribeContactToTargetList()) {
+            $targetTeamId = $leadCapture->getTargetTeamId();
+
+            if ($targetTeamId) {
+                $lead->addLinkMultipleId(Field::TEAMS, $targetTeamId);
+            }
+
+            $this->entityManager->saveEntity($lead);
+
+            if (!$duplicate && $campaign) {
+                $this->campaignService->logLeadCreated($campaign->getId(), $lead);
+            }
+        }
+
+        if ($toRelateLead && $targetLead->hasId() && $targetListId) {
+            $this->entityManager
+                ->getRDBRepository(Lead::ENTITY_TYPE)
+                ->getRelation($targetLead, 'targetLists')
+                ->relateById($targetListId, ['optedOut' => false]);
+
+            if ($campaign) {
+                $this->campaignService->logOptedIn($campaign->getId(), null, $targetLead);
+            }
+
+            $targetList = $this->entityManager->getEntityById(TargetList::ENTITY_TYPE, $targetListId);
+
+            if ($targetList) {
+                $this->hookManager->process(TargetList::ENTITY_TYPE, 'afterOptIn', $targetList, [], [
+                   'link' => 'leads',
+                   'targetId' => $targetLead->getId(),
+                   'targetType' => Lead::ENTITY_TYPE,
+                   'leadCaptureId' => $leadCapture->getId(),
+                ]);
+            }
+        }
+
+        if ($toRelateLead  || !$leadCapture->subscribeToTargetList()) {
+            $this->hookManager->process(
+                LeadCapture::ENTITY_TYPE,
+                'afterLeadCapture',
+                $leadCapture,
+                [],
+                [
+                   'targetId' => $targetLead->getId(),
+                   'targetType' => Lead::ENTITY_TYPE,
+                ]
+            );
+
+            $this->hookManager->process(
+                Lead::ENTITY_TYPE,
+                'afterLeadCapture',
+                $targetLead,
+                [],
+                [
+                   'leadCaptureId' => $leadCapture->getId(),
+                ]
+            );
+        }
+
+        if (!$isLogged) {
+            $this->log($leadCapture, $target, $data, $isNew);
+        }
+    }
+
+    /**
+     * Confirm opt-in.
+     *
+     * @throws BadRequest
+     * @throws Error
+     * @throws NotFound
+     * @param string $id A unique ID.
+     */
+    public function confirmOptIn(string $id): ConfirmResult
+    {
+        /** @var ?UniqueId $uniqueId */
+        $uniqueId = $this->entityManager
+            ->getRDBRepository(UniqueId::ENTITY_TYPE)
+            ->where(['name' => $id])
+            ->findOne();
+
+        if (!$uniqueId) {
+            throw new NotFound("LeadCapture Confirm: UniqueId not found.");
+        }
+
+        $uniqueIdData = $uniqueId->getData();
+
+        if (empty($uniqueIdData->data)) {
+            throw new Error("LeadCapture Confirm: data not found.");
+        }
+
+        if (empty($uniqueIdData->leadCaptureId)) {
+            throw new Error("LeadCapture Confirm: leadCaptureId not found.");
+        }
+
+        $data = $uniqueIdData->data;
+        $leadCaptureId = $uniqueIdData->leadCaptureId;
+        $leadId = $uniqueIdData->leadId ?? null;
+        $isLogged = $uniqueIdData->isLogged ?? false;
+
+        $terminateAt = $uniqueId->getTerminateAt();
+
+        if ($terminateAt && time() > strtotime($terminateAt->toString())) {
+            return new ConfirmResult(
+                ConfirmResult::STATUS_EXPIRED,
+                $this->defaultLanguage
+                    ->translateLabel('optInConfirmationExpired', 'messages', LeadCapture::ENTITY_TYPE)
+            );
+        }
+
+        /** @var ?LeadCapture $leadCapture */
+        $leadCapture = $this->entityManager->getEntityById(LeadCapture::ENTITY_TYPE, $leadCaptureId);
+
+        if (!$leadCapture) {
+            throw new Error("LeadCapture Confirm: LeadCapture not found.");
+        }
+
+        if (empty($uniqueIdData->isProcessed)) {
+            $this->proceed($leadCapture, $data, $leadId, $isLogged);
+
+            $uniqueIdData->isProcessed = true;
+
+            $uniqueId->set('data', $uniqueIdData);
+
+            $this->entityManager->saveEntity($uniqueId);
+        }
+
+        return new ConfirmResult(
+            ConfirmResult::STATUS_SUCCESS,
+            $leadCapture->getOptInConfirmationSuccessMessage(),
+            $leadCapture->getId(),
+            $leadCapture->getName()
+        );
+    }
+
+    /**
+     * @throws BadRequest
+     * @throws Error
+     */
+    private function getLeadWithPopulatedData(LeadCapture $leadCapture, stdClass $data): Lead
+    {
+        $lead = $this->entityManager->getRDBRepositoryByClass(Lead::class)->getNew();
+
+        $fieldList = $leadCapture->getFieldList();
+
+        if ($fieldList === []) {
+            throw new Error('No field list specified.');
+        }
+
+        $this->sanitizePhoneNumber($fieldList, $data, $leadCapture);
+        $this->serviceContainer->getByClass(Lead::class)->sanitizeInput($data);
+
+        $this->setFields($fieldList, $data, $lead);
+
+        if ($leadCapture->getLeadSource()) {
+            $lead->setSource($leadCapture->getLeadSource());
+        }
+
+        if ($leadCapture->getCampaignId()) {
+            $lead->setCampaign(Link::create($leadCapture->getCampaignId()));
+        }
+
+        if ($leadCapture->getTargetTeamId()) {
+            $lead->addLinkMultipleId(Field::TEAMS, $leadCapture->getTargetTeamId());
+        }
+
+        $validationParams = ValidationParams::create()->withTypeSkipFieldList(ValidationType::REQUIRED, $fieldList);
+
+        $this->fieldValidationManager->process($lead, $data, $validationParams);
+
+        foreach ($fieldList as $field) {
+            if (!$leadCapture->isFieldRequired($field)) {
+                continue;
+            }
+
+            $notValid = $this->fieldValidationManager->check($lead, $field, ValidationType::REQUIRED, $data, true);
+
+            if (!$notValid) {
+                $failure = new ValidationFailure(Lead::ENTITY_TYPE, $field, ValidationType::REQUIRED);
+
+                throw ValidationError::create($failure);
+            }
+        }
+
+        return $lead;
+    }
+
+    /**
+     * @return array{
+     *   contact: ?Contact,
+     *   lead: ?Lead,
+     * }
+     */
+    private function findLeadDuplicates(LeadCapture $leadCapture, Lead $lead): array
+    {
+        $duplicate = null;
+        $contact = null;
+
+        $emailAddress = $lead->getEmailAddress();
+        $phoneNumber = $lead->getPhoneNumber();
+
+        if ($emailAddress || $phoneNumber) {
+            $groupOr = [];
+
+            if ($emailAddress) {
+                $groupOr['emailAddress'] = $emailAddress;
+            }
+
+            if ($phoneNumber) {
+                $groupOr['phoneNumber'] = $phoneNumber;
+            }
+
+            if ($lead->isNew() && $leadCapture->duplicateCheck()) {
+                $duplicate = $this->entityManager
+                    ->getRDBRepository(Lead::ENTITY_TYPE)
+                    ->where(['OR' => $groupOr])
+                    ->findOne();
+            }
+
+            if ($leadCapture->subscribeToTargetList() && $leadCapture->subscribeContactToTargetList()) {
+                $contact = $this->entityManager
+                    ->getRDBRepository(Contact::ENTITY_TYPE)
+                    ->where(['OR' => $groupOr])
+                    ->findOne();
+            }
+        }
+
+        return [
+            'contact' => $contact,
+            'lead' => $duplicate,
+        ];
+    }
+
+    private function isTargetOptedIn(Entity $target, string $targetListId): bool
+    {
+        $targetList = $this->entityManager->getEntityById(TargetList::ENTITY_TYPE, $targetListId);
+
+        if (!$targetList) {
+            return false;
+        }
+
+        $isAlreadyOptedIn = $this->entityManager
+            ->getRDBRepository($target->getEntityType())
+            ->getRelation($target, 'targetLists')
+            ->isRelated($targetList);
+
+        if (!$isAlreadyOptedIn) {
+            return false;
+        }
+
+        $link = null;
+
+        if ($target->getEntityType() === Contact::ENTITY_TYPE) {
+            $link = 'contacts';
+        }
+
+        if ($target->getEntityType() === Lead::ENTITY_TYPE) {
+            $link = 'leads';
+        }
+
+        if (!$link) {
+            return false;
+        }
+
+        $targetFound = $this->entityManager
+            ->getRDBRepository(TargetList::ENTITY_TYPE)
+            ->getRelation($targetList, $link)
+            ->where([
+                'id' => $target->getId(),
+            ])
+            ->findOne();
+
+        if ($targetFound && $targetFound->get('targetListIsOptedOut')) {
+            return false;
+        }
+
+        return true;
+    }
+
+    private function log(
+        LeadCapture $leadCapture,
+        Entity $target,
+        stdClass $data,
+        bool $isNew = true
+    ): void {
+
+        $logRecord = $this->entityManager->getNewEntity(LeadCaptureLogRecord::ENTITY_TYPE);
+
+        $logRecord->set([
+            'targetId' => $target->hasId() ? $target->getId() : null,
+            'targetType' => $target->getEntityType(),
+            'leadCaptureId' => $leadCapture->getId(),
+            'isCreated' => $isNew,
+            'data' => $data,
+        ]);
+
+        if (!empty($data->description)) {
+            $logRecord->set('description', $data->description);
+        }
+
+        $this->entityManager->saveEntity($logRecord);
+    }
+
+    /**
+     * @param string[] $fieldList
+     * @throws BadRequest
+     */
+    private function setFields(array $fieldList, stdClass $data, Lead $lead): void
+    {
+        $this->unsetAttributes($data);
+
+        $isEmpty = true;
+
+        foreach ($fieldList as $field) {
+            if ($field === Field::NAME) {
+                $name = $data->{Field::NAME} ?? null;
+
+                if (is_string($name) && !isset($data->firstName) && !isset($data->lastName)) {
+                    $name = trim($name);
+                    $parts = explode(' ', $name);
+
+                    $lastName = array_pop($parts);
+                    $firstName = implode(' ', $parts);
+
+                    $lead->setFirstName($firstName);
+                    $lead->setLastName($lastName);
+
+                    $isEmpty = false;
+
+                    continue;
+                }
+            }
+
+            $attributeList = $this->fieldUtil->getActualAttributeList(Lead::ENTITY_TYPE, $field);
+
+            foreach ($attributeList as $attribute) {
+                if (!property_exists($data, $attribute)) {
+                    continue;
+                }
+
+                $lead->set($attribute, $data->$attribute);
+
+                if (!empty($data->$attribute)) {
+                    $isEmpty = false;
+                }
+            }
+        }
+
+        if ($isEmpty) {
+            throw new BadRequest('empty');
+        }
+    }
+
+    /**
+     * @param string[] $fieldList
+     */
+    private function sanitizePhoneNumber(
+        array $fieldList,
+        stdClass $data,
+        LeadCapture $leadCapture
+    ): void {
+
+        if (
+            !in_array('phoneNumber', $fieldList) ||
+            !isset($data->phoneNumber) ||
+            !is_string($data->phoneNumber)
+        ) {
+            return;
+        }
+
+        $data->phoneNumber = $this->phoneNumberSanitizer
+            ->sanitize($data->phoneNumber, $leadCapture->getPhoneNumberCountry());
+    }
+
+    private function unsetAttributes(stdClass $data): void
+    {
+        unset($data->{Field::EMAIL_ADDRESS . 'Data'});
+        unset($data->{Field::EMAIL_ADDRESS . 'IsInvalid'});
+        unset($data->{Field::EMAIL_ADDRESS . 'IsOptedOut'});
+
+        unset($data->{Field::PHONE_NUMBER . 'Data'});
+        unset($data->{Field::PHONE_NUMBER . 'IsInvalid'});
+        unset($data->{Field::PHONE_NUMBER . 'IsOptedOut'});
+    }
+
+    /**
+     * @throws NotFound
+     */
+    private function getLeadCapture(string $apiKey): LeadCapture
+    {
+        $leadCapture = $this->entityManager
+            ->getRDBRepositoryByClass(LeadCapture::class)
+            ->where([
+                'apiKey' => $apiKey,
+                'isActive' => true,
+            ])
+            ->findOne();
+
+        if (!$leadCapture) {
+            throw new NotFound('Form ID is not valid.');
+        }
+
+        return $leadCapture;
+    }
+
+    /**
+     * @throws NotFound
+     */
+    private function getLeadCaptureByFormId(string $id): LeadCapture
+    {
+        $leadCapture = $this->entityManager
+            ->getRDBRepositoryByClass(LeadCapture::class)
+            ->where([
+                'formId' => $id,
+                'isActive' => true,
+            ])
+            ->findOne();
+
+        if (!$leadCapture) {
+            throw new NotFound('API key is not valid.');
+        }
+
+        return $leadCapture;
+    }
+}

application/Espo/Tools/LeadCapture/ConfirmResult.php

@@ -0,0 +1,63 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+class ConfirmResult
+{
+    public const STATUS_SUCCESS = 'success';
+    public const STATUS_EXPIRED = 'expired';
+
+    public function __construct(
+        private string $status,
+        private ?string $message,
+        private ?string $leadCaptureId = null,
+        private ?string $leadCaptureName = null
+    ) {}
+
+    public function getStatus(): string
+    {
+        return $this->status;
+    }
+
+    public function getMessage(): ?string
+    {
+        return $this->message;
+    }
+
+    public function getLeadCaptureId(): ?string
+    {
+        return $this->leadCaptureId;
+    }
+
+    public function getLeadCaptureName(): ?string
+    {
+        return $this->leadCaptureName;
+    }
+}

application/Espo/Tools/LeadCapture/ConfirmationSender.php

@@ -0,0 +1,232 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Mail\Account\GroupAccount\AccountFactory;
+use Espo\Core\Mail\EmailSender;
+use Espo\Core\Mail\Exceptions\NoSmtp;
+use Espo\Core\Mail\Exceptions\SendingError;
+use Espo\Core\Templates\Entities\Person;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Config\ApplicationConfig;
+use Espo\Core\Utils\DateTime;
+use Espo\Core\Utils\Language;
+use Espo\Entities\Email;
+use Espo\Entities\EmailTemplate;
+use Espo\Entities\LeadCapture as LeadCaptureEntity;
+use Espo\Entities\UniqueId;
+use Espo\Modules\Crm\Entities\Lead;
+use Espo\ORM\EntityManager;
+use Espo\Tools\EmailTemplate\Data as EmailTemplateData;
+use Espo\Tools\EmailTemplate\Params as EmailTemplateParams;
+use Espo\Tools\EmailTemplate\Processor as EmailTemplateProcessor;
+
+class ConfirmationSender
+{
+
+    public function __construct(
+        private EntityManager $entityManager,
+        private Language $defaultLanguage,
+        private EmailSender $emailSender,
+        private AccountFactory $accountFactory,
+        private DateTime $dateTime,
+        private EmailTemplateProcessor $emailTemplateProcessor,
+        private ApplicationConfig $appConfig,
+        private Config $config,
+    ) {}
+
+    /**
+     * Send opt-in confirmation email.
+     *
+     * @param string $id A unique ID.
+     * @throws Error
+     * @throws NoSmtp
+     * @throws SendingError
+     */
+    public function send(string $id): void
+    {
+        /** @var ?UniqueId $uniqueId */
+        $uniqueId = $this->entityManager
+            ->getRDBRepositoryByClass(UniqueId::class)
+            ->where(['name' => $id])
+            ->findOne();
+
+        if (!$uniqueId) {
+            throw new Error("LeadCapture: UniqueId not found.");
+        }
+
+        $uniqueIdData = $uniqueId->getData();
+
+        if (empty($uniqueIdData->data)) {
+            throw new Error("LeadCapture: data not found.");
+        }
+
+        if (empty($uniqueIdData->leadCaptureId)) {
+            throw new Error("LeadCapture: leadCaptureId not found.");
+        }
+
+        $data = $uniqueIdData->data;
+        $leadCaptureId = $uniqueIdData->leadCaptureId;
+        $leadId = $uniqueIdData->leadId ?? null;
+
+        $terminateAt = $uniqueId->getTerminateAt();
+
+        if ($terminateAt && time() > strtotime($terminateAt->toString())) {
+            throw new Error("LeadCapture: Opt-in confirmation expired.");
+        }
+
+        /** @var ?LeadCaptureEntity $leadCapture */
+        $leadCapture = $this->entityManager->getEntityById(LeadCaptureEntity::ENTITY_TYPE, $leadCaptureId);
+
+        if (!$leadCapture) {
+            throw new Error("LeadCapture: LeadCapture not found.");
+        }
+
+        $optInConfirmationEmailTemplateId = $leadCapture->getOptInConfirmationEmailTemplateId();
+
+        if (!$optInConfirmationEmailTemplateId) {
+            throw new Error("LeadCapture: No optInConfirmationEmailTemplateId.");
+        }
+
+        /** @var ?EmailTemplate $emailTemplate */
+        $emailTemplate = $this->entityManager
+            ->getEntityById(EmailTemplate::ENTITY_TYPE, $optInConfirmationEmailTemplateId);
+
+        if (!$emailTemplate) {
+            throw new Error("LeadCapture: EmailTemplate not found.");
+        }
+
+        if ($leadId) {
+            /** @var ?Lead $lead */
+            $lead = $this->entityManager->getEntityById(Lead::ENTITY_TYPE, $leadId);
+        } else {
+            $lead = $this->entityManager->getNewEntity(Lead::ENTITY_TYPE);
+
+            $lead->set($data);
+        }
+
+        if (!$lead) {
+            throw new Error("Lead Capture: Could not find lead.");
+        }
+
+        $emailAddress = $lead->getEmailAddress();
+
+        if (!$emailAddress) {
+            throw new Error("Lead Capture: No lead email address.");
+        }
+
+        $emailData = $this->emailTemplateProcessor->process(
+            $emailTemplate,
+            EmailTemplateParams::create(),
+            EmailTemplateData::create()
+                ->withEntityHash([
+                    Person::TEMPLATE_TYPE => $lead,
+                    Lead::ENTITY_TYPE => $lead,
+                ])
+        );
+
+        $subject = $emailData->getSubject();
+        $body = $emailData->getBody();
+        $isHtml = $emailData->isHtml();
+
+        if (
+            mb_strpos($body, '{optInUrl}') === false &&
+            mb_strpos($body, '{optInLink}') === false
+        ) {
+            if ($isHtml) {
+                $body .= "<p>{optInLink}</p>";
+            } else {
+                $body .= "\n\n{optInUrl}";
+            }
+        }
+
+        $url = $this->getSiteUrl() . '/?entryPoint=confirmOptIn&id=' . $uniqueId->getIdValue();
+
+        $linkHtml =
+            '<a href='.$url.'>' .
+            $this->defaultLanguage->translateLabel('Confirm Opt-In', 'labels', LeadCaptureEntity::ENTITY_TYPE) .
+            '</a>';
+
+        $body = str_replace('{optInUrl}', $url, $body);
+        $body = str_replace('{optInLink}', $linkHtml, $body);
+
+        $createdAt = $uniqueId->getCreatedAt()->toString();
+
+        if ($createdAt) {
+            $dateString = $this->dateTime->convertSystemDateTime($createdAt, null, $this->appConfig->getDateFormat());
+            $timeString = $this->dateTime->convertSystemDateTime($createdAt, null, $this->appConfig->getTimeFormat());
+            $dateTimeString = $this->dateTime->convertSystemDateTime($createdAt);
+
+            $body = str_replace('{optInDate}', $dateString, $body);
+            $body = str_replace('{optInTime}', $timeString, $body);
+            $body = str_replace('{optInDateTime}', $dateTimeString, $body);
+        }
+
+        /** @var Email $email */
+        $email = $this->entityManager->getNewEntity(Email::ENTITY_TYPE);
+
+        $email
+            ->setSubject($subject)
+            ->setBody($body)
+            ->setIsHtml($isHtml)
+            ->addToAddress($emailAddress);
+
+        $smtpParams = null;
+
+        $inboundEmailId = $leadCapture->getInboundEmailId();
+
+        if ($inboundEmailId) {
+            $account = $this->accountFactory->create($inboundEmailId);
+
+            if (!$account->isAvailableForSending()) {
+                throw new Error("Lead Capture: Group email account {$inboundEmailId} can't be used for sending.");
+            }
+
+            $smtpParams = $account->getSmtpParams();
+        }
+
+        $sender = $this->emailSender->create();
+
+        if ($smtpParams) {
+            $sender->withSmtpParams($smtpParams);
+        }
+
+        $sender
+            ->withAddedHeader('Auto-Submitted', 'auto-generated')
+            ->withAttachments($emailData->getAttachmentList())
+            ->send($email);
+    }
+
+    private function getSiteUrl(): string
+    {
+        return $this->config->get('leadCaptureSiteUrl') ?? $this->appConfig->getSiteUrl();
+    }
+}

application/Espo/Tools/LeadCapture/FormResult.php

@@ -0,0 +1,37 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+class FormResult
+{
+    public function __construct(
+        readonly public ?string $redirectUrl,
+    ) {}
+}

application/Espo/Tools/LeadCapture/FormService.php

@@ -0,0 +1,486 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\ORM\Type\FieldType;
+use Espo\Core\Utils\Address\CountryDataProvider;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\DataCache;
+use Espo\Core\Utils\Language;
+use Espo\Core\Utils\Metadata;
+use Espo\Core\Utils\Theme\MetadataProvider as ThemeMetadataProvider;
+use Espo\Core\Utils\ThemeManager;
+use Espo\Entities\Integration;
+use Espo\Entities\LeadCapture;
+use Espo\Modules\Crm\Entities\Lead;
+use Espo\ORM\Defs\EntityDefs;
+use Espo\ORM\EntityManager;
+use Espo\Tools\App\LanguageService;
+use RuntimeException;
+
+class FormService
+{
+    private const CACHE_KEY_PREFIX = 'leadCaptureForm';
+
+    public function __construct(
+        private EntityManager $entityManager,
+        private Config $config,
+        private Metadata $metadata,
+        private Language $defaultLanguage,
+        private CountryDataProvider $countryDataProvider,
+        private LanguageService $languageService,
+        private Language\LanguageFactory $languageFactory,
+        private DataCache $dataCache,
+        private ThemeManager $themeManager,
+        private Config\SystemConfig $systemConfig,
+        private ThemeMetadataProvider $themeMetadataProvider,
+    ) {}
+
+    /**
+     * @return array{LeadCapture, array<string, mixed>, ?string}
+     * @throws NotFound
+     */
+    public function getData(string $id): array
+    {
+        $leadCapture = $this->getLeadCapture($id);
+        $captchaKey = $this->getCaptchaKey($leadCapture);
+        $captchaScript = $this->getCaptchaScript($captchaKey);
+
+        $data = $this->getDataInternal($leadCapture);
+
+        $data['captchaKey'] = $captchaKey;
+
+        return [$leadCapture, $data, $captchaScript];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function getDataInternal(LeadCapture $leadCapture): array
+    {
+        $cacheKey = $this->getCacheKey($leadCapture);
+
+        if ($this->systemConfig->useCache() && $this->dataCache->has($cacheKey)) {
+            return $this->getFromCache($cacheKey);
+        }
+
+        $data = $this->prepareData($leadCapture);
+
+        $this->dataCache->store($cacheKey, $data);
+
+        return $data;
+    }
+
+    private function getRequestUrl(LeadCapture $leadCapture): string
+    {
+        $formId = $leadCapture->getFormId();
+
+        if (!$formId) {
+            throw new RuntimeException("No API key.");
+        }
+
+        return "LeadCapture/form/$formId";
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getFieldList(LeadCapture $leadCapture): array
+    {
+        /** @var string[] $allowedTypeList */
+        $allowedTypeList = $this->metadata->get("entityDefs.LeadCapture.fields.fieldList.webFormFieldTypeList") ?? [];
+
+        $entityDefs = $this->entityManager->getDefs()->getEntity(Lead::ENTITY_TYPE);
+
+        $fieldList = [];
+
+        foreach ($leadCapture->getFieldList() as $field) {
+            if (!$entityDefs->hasField($field)) {
+                continue;
+            }
+
+            $itemDefs = $entityDefs->getField($field);
+
+            if (!in_array($itemDefs->getType(), $allowedTypeList)) {
+                continue;
+            }
+
+            $fieldList[] = $field;
+        }
+
+        return $fieldList;
+    }
+
+    /**
+     * @param string[] $fieldList
+     * @param array<string, array<string, mixed>> $languageData
+     * @return array<string, array<string, mixed>>
+     */
+    private function getFieldDefs(
+        array $fieldList,
+        LeadCapture $leadCapture,
+        array &$languageData,
+        Language $language
+    ): array {
+
+        $entityDefs = $this->entityManager->getDefs()->getEntity(Lead::ENTITY_TYPE);
+
+        $fieldDefs = [];
+
+        foreach ($fieldList as $field) {
+            $fieldDefs[$field] = $this->metadata->get("entityDefs.Lead.fields.$field");
+
+            if (!$fieldDefs[$field]) {
+                continue;
+            }
+
+            $this->applyFieldDefsItem(
+                $leadCapture,
+                $entityDefs,
+                $field,
+                $fieldDefs,
+                $languageData,
+                $language
+            );
+        }
+
+        return $fieldDefs;
+    }
+
+    /**
+     * @param string[] $fieldList
+     * @return array<int, mixed>
+     */
+    private function getDetailLayout(array $fieldList): array
+    {
+        $rows = [];
+
+        foreach ($fieldList as $field) {
+            $rows[] = [['name' => $field]];
+        }
+
+        return [['rows' => $rows]];
+    }
+
+    /**
+     * @param string[] $fieldList
+     * @return array<string, mixed>
+     */
+    private function getMetadataFields(array $fieldList): array
+    {
+        $metadataFields = [];
+
+        $entityDefs = $this->entityManager->getDefs()->getEntity(Lead::ENTITY_TYPE);
+
+        foreach ($fieldList as $field) {
+            $type = $entityDefs->getField($field)->getType();
+
+            if (array_key_exists($type, $metadataFields)) {
+                continue;
+            }
+
+            $metadataFields[$type] = $this->metadata->get("fields.$type");
+        }
+
+        return $metadataFields;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function getConfig(): array
+    {
+        $params = [
+            'decimalMark',
+            'thousandSeparator',
+            'phoneNumberInternational',
+            'phoneNumberExtensions',
+            'phoneNumberPreferredCountryList',
+            'defaultCurrency',
+            'currencyList',
+            'currencyDecimalPlaces',
+            'addressFormat',
+            'dateFormat',
+            'timeFormat',
+            'timeZone',
+            'weekStart',
+        ];
+
+        $data = [];
+
+        foreach ($params as $param) {
+            $data[$param] = $this->config->get($param);
+        }
+
+        return $data;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function getAppParams(): array
+    {
+        return [
+            'addressCountryData' => $this->countryDataProvider->get(),
+        ];
+    }
+
+    /**
+     * @param array<string, array<string, mixed>> $fieldDefs
+     * @param array<string, array<string, mixed>> $languageData
+     */
+    private function applyFieldDefsItem(
+        LeadCapture $leadCapture,
+        EntityDefs $entityDefs,
+        string $field,
+        array &$fieldDefs,
+        array &$languageData,
+        Language $language,
+    ): void {
+
+        $fieldDefs[$field]['required'] = $leadCapture->isFieldRequired($field);
+
+        $itDefs = $entityDefs->getField($field);
+
+        $type = $itDefs->getType();
+
+        if ($type === FieldType::ADDRESS) {
+            $subList = [
+                $field . 'Street',
+                $field . 'Country',
+                $field . 'State',
+                $field . 'PostalCode',
+                $field . 'City',
+            ];
+
+            foreach ($subList as $sub) {
+                /** @var array<string, mixed> $subItem */
+                $subItem = $this->metadata->get("entityDefs.Lead.fields.$sub");
+
+                $fieldDefs[$sub] = $subItem;
+            }
+        }
+
+        if ($type === FieldType::PERSON_NAME) {
+            $subList = [
+                'first' . ucfirst($field),
+                'middle' . ucfirst($field),
+                'last' . ucfirst($field),
+                'salutation' . ucfirst($field),
+            ];
+
+            foreach ($subList as $sub) {
+                /** @var array<string, mixed> $subItem */
+                $subItem = $this->metadata->get("entityDefs.Lead.fields.$sub");
+
+                $fieldDefs[$sub] = $subItem;
+            }
+        }
+
+        if ($type === FieldType::EMAIL) {
+            if ($leadCapture->optInConfirmation()) {
+                $fieldDefs[$field]['required'] = true;
+            }
+
+            $fieldDefs[$field]['onlyPrimary'] = true;
+        }
+
+        if ($type === FieldType::PHONE) {
+            $fieldDefs[$field]['onlyPrimary'] = true;
+        }
+
+        if (
+            in_array($type, [
+                FieldType::ENUM,
+                FieldType::MULTI_ENUM,
+                FieldType::ARRAY,
+                FieldType::CHECKLIST,
+            ])
+        ) {
+            $reference = $itDefs->getParam('optionsReference');
+
+            if ($reference) {
+                [$refEntityType, $refField] = explode('.', $reference);
+
+                $options = $this->entityManager
+                    ->getDefs()
+                    ->tryGetEntity($refEntityType)
+                    ?->tryGetField($refField)
+                    ?->getParam('options');
+
+                $fieldDefs[$field]['options'] = $options;
+                unset($fieldDefs[$field]['optionsReference']);
+
+                $languageData[Lead::ENTITY_TYPE] ??= [];
+                $languageData[Lead::ENTITY_TYPE]['options'] ??= [];
+                $languageData[Lead::ENTITY_TYPE]['options'][$field] =
+                    $language->get("$refEntityType.options.$refField");
+            }
+        }
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function getLanguageData(Language $language): array
+    {
+        $data = $this->languageService->getDataForFrontendFromLanguage($language);
+
+        $data[Lead::ENTITY_TYPE] = $language->get(Lead::ENTITY_TYPE);
+
+        return $data;
+    }
+
+    /**
+     * @throws NotFound
+     */
+    public function getLeadCapture(string $id): LeadCapture
+    {
+        $leadCapture = $this->entityManager
+            ->getRDBRepositoryByClass(LeadCapture::class)
+            ->where(['formId' => $id])
+            ->findOne();
+
+        if (!$leadCapture || !$leadCapture->hasFormEnabled() || !$leadCapture->isActive()) {
+            throw new NotFound();
+        }
+
+        return $leadCapture;
+    }
+
+    private function getSuccessText(LeadCapture $leadCapture): string
+    {
+        return $leadCapture->getFormSuccessText() ?? $this->defaultLanguage->translateLabel('Posted');
+    }
+
+    private function getCacheKey(LeadCapture $leadCapture): string
+    {
+        return self::CACHE_KEY_PREFIX . '/' .  $leadCapture->getId();
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function getFromCache(string $cacheKey): array
+    {
+        /** @var array<string, mixed> */
+        return $this->dataCache->get($cacheKey);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function prepareData(LeadCapture $leadCapture): array
+    {
+        $language = $this->getLanguage($leadCapture);
+
+        $languageData = $this->getLanguageData($language);
+        $fieldList = $this->getFieldList($leadCapture);
+        $fieldDefs = $this->getFieldDefs($fieldList, $leadCapture, $languageData, $language);
+        $detailLayout = $this->getDetailLayout($fieldList);
+        $metadataFields = $this->getMetadataFields($fieldList);
+        $successText = $this->getSuccessText($leadCapture);
+        $text = $leadCapture->getFormText();
+        $config = $this->getConfig();
+        $appParams = $this->getAppParams();
+
+        return [
+            'requestUrl' => $this->getRequestUrl($leadCapture),
+            'fieldDefs' => (object) $fieldDefs,
+            'metadata' => [
+                'fields' => (object) $metadataFields,
+                'app' => [
+                    'regExpPatterns' => $this->metadata->get("app.regExpPatterns"),
+                ],
+            ],
+            'isDark' => $this->isDark($leadCapture),
+            'detailLayout' => $detailLayout,
+            'language' => $languageData,
+            'successText' => $successText,
+            'text' => $text,
+            'title' => $leadCapture->getFormTitle(),
+            'config' => (object) $config,
+            'appParams' => (object) $appParams,
+        ];
+    }
+
+    private function getLanguage(LeadCapture $leadCapture): Language
+    {
+        $language = $this->defaultLanguage;
+
+        if ($leadCapture->getFormLanguage()) {
+            $language = $this->languageFactory->create($leadCapture->getFormLanguage());
+        }
+
+        return $language;
+    }
+
+    private function getCaptchaKey(LeadCapture $leadCapture): ?string
+    {
+        if (!$leadCapture->hasFormCaptcha()) {
+            return null;
+        }
+
+        $entity = $this->entityManager
+            ->getRepositoryByClass(Integration::class)
+            ->getById('GoogleReCaptcha');
+
+        if (!$entity) {
+            return null;
+        }
+
+        $siteKey = $entity->get('siteKey');
+
+        if (!$siteKey) {
+            return null;
+        }
+
+        return $siteKey;
+    }
+
+    private function getCaptchaScript(?string $siteKey): ?string
+    {
+        if (!$siteKey) {
+            return null;
+        }
+
+        return 'https://www.google.com/recaptcha/api.js?render=' . $siteKey;
+    }
+
+    private function isDark(LeadCapture $leadCapture): bool
+    {
+        if (!$leadCapture->getFormTheme()) {
+            return $this->themeManager->isDark();
+        }
+
+        return $this->themeMetadataProvider->isDark($leadCapture->getFormTheme());
+    }
+}

application/Espo/Tools/LeadCapture/Jobs/OptInConfirmation.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture\Jobs;
+
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Job\Job;
+use Espo\Core\Job\Job\Data;
+use Espo\Tools\LeadCapture\ConfirmationSender;
+use RuntimeException;
+
+class OptInConfirmation implements Job
+{
+    private ConfirmationSender $sender;
+
+    public function __construct(ConfirmationSender $sender)
+    {
+        $this->sender = $sender;
+    }
+
+    /**
+     * @throws Error
+     */
+    public function run(Data $data): void
+    {
+        $uniqueId = $data->get('id');
+
+        if (!$uniqueId) {
+            throw new RuntimeException();
+        }
+
+        $this->sender->send($uniqueId);
+    }
+}

application/Espo/Tools/LeadCapture/Service.php

@@ -0,0 +1,162 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Tools\LeadCapture;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\ForbiddenSilent;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Record\ServiceContainer;
+use Espo\Core\Utils\Util;
+use Espo\Entities\InboundEmail;
+use Espo\Entities\LeadCapture as LeadCaptureEntity;
+use Espo\Entities\User;
+use Espo\ORM\EntityManager;
+use stdClass;
+
+class Service
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private ServiceContainer $recordServiceContainer,
+        private User $user
+    ) {}
+
+    public function isApiKeyValid(string $apiKey): bool
+    {
+        $leadCapture = $this->entityManager
+            ->getRDBRepositoryByClass(LeadCaptureEntity::class)
+            ->where([
+                'apiKey' => $apiKey,
+                'isActive' => true,
+            ])
+            ->findOne();
+
+        if ($leadCapture) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @throws ForbiddenSilent
+     * @throws NotFound
+     * @throws Forbidden
+     */
+    public function generateNewApiKeyForEntity(string $id): LeadCaptureEntity
+    {
+        $service = $this->recordServiceContainer->getByClass(LeadCaptureEntity::class);
+
+        $entity = $service->getEntity($id);
+
+        if (!$entity) {
+            throw new NotFound();
+        }
+
+        $entity->setApiKey($this->generateApiKey());
+
+        $this->entityManager->saveEntity($entity);
+
+        $service->prepareEntityForOutput($entity);
+
+        return $entity;
+    }
+
+    /**
+     * @throws ForbiddenSilent
+     * @throws NotFound
+     * @throws Forbidden
+     */
+    public function generateNewFormIdForEntity(string $id): LeadCaptureEntity
+    {
+        $service = $this->recordServiceContainer->getByClass(LeadCaptureEntity::class);
+
+        $entity = $service->getEntity($id);
+
+        if (!$entity) {
+            throw new NotFound();
+        }
+
+        $entity->setFormId($this->generateFormId());
+
+        $this->entityManager->saveEntity($entity);
+
+        $service->prepareEntityForOutput($entity);
+
+        return $entity;
+    }
+
+    public function generateApiKey(): string
+    {
+        return Util::generateApiKey();
+    }
+
+    public function generateFormId(): string
+    {
+        return Util::generateId();
+    }
+
+    /**
+     * @return stdClass[]
+     * @throws Forbidden
+     */
+    public function getSmtpAccountDataList(): array
+    {
+        if (!$this->user->isAdmin()) {
+            throw new Forbidden();
+        }
+
+        $dataList = [];
+
+        $inboundEmailList = $this->entityManager
+            ->getRDBRepositoryByClass(InboundEmail::class)
+            ->where([
+                'useSmtp' => true,
+                'status' => InboundEmail::STATUS_ACTIVE,
+                ['emailAddress!=' => ''],
+                ['emailAddress!=' => null],
+            ])
+            ->find();
+
+        foreach ($inboundEmailList as $inboundEmail) {
+            $item = (object) [];
+
+            $key = 'inboundEmail:' . $inboundEmail->getId();
+
+            $item->key = $key;
+            $item->emailAddress = $inboundEmail->getEmailAddress();
+            $item->fromName = $inboundEmail->getFromName();
+
+            $dataList[] = $item;
+        }
+
+        return $dataList;
+    }
+}