From 2e94918ae9eda0c0b0f9edac703ed9468ef2d13c Mon Sep 17 00:00:00 2001
From: Vijaivir Dhaliwal <91633223+vijaivir@users.noreply.github.com>
Date: Wed, 7 Aug 2024 15:12:11 -0700
Subject: [PATCH 01/20] update formiojs (#1458)

---
 app/frontend/package-lock.json | 16 ++++++++--------
 app/frontend/package.json      |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/app/frontend/package-lock.json b/app/frontend/package-lock.json
index b471325c8..07d6e6a58 100644
--- a/app/frontend/package-lock.json
+++ b/app/frontend/package-lock.json
@@ -19,7 +19,7 @@
         "crypto-js": "^4.1.1",
         "fast-json-patch": "^3.1.1",
         "font-awesome": "^4.7.0",
-        "formiojs": "^4.14.13",
+        "formiojs": "^4.19.5",
         "keycloak-js": "^21.1.1",
         "lodash": "^4.17.21",
         "mitt": "^3.0.0",
@@ -515,9 +515,9 @@
       }
     },
     "node_modules/@formio/choices.js": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/@formio/choices.js/-/choices.js-10.2.0.tgz",
-      "integrity": "sha512-dEF+es4yj3pstKHif7Ck14vQCZdN+b1Afojl0ufTmKw5WIjqas1KXEIBBgtsg4eY6bxqFkgEjtxsK4ecvEeZsA==",
+      "version": "10.2.1",
+      "resolved": "https://registry.npmjs.org/@formio/choices.js/-/choices.js-10.2.1.tgz",
+      "integrity": "sha512-NCE5u7jG3XGokJP16MyAbVSUptKu/mpJYAxd4PPIoLiO/l9Do5uoOQ0MgNb9qG9qABJiOX+qNRE8q8RybY/SwQ==",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "fuse.js": "^6.6.2",
@@ -2704,12 +2704,12 @@
       }
     },
     "node_modules/formiojs": {
-      "version": "4.17.4",
-      "resolved": "https://registry.npmjs.org/formiojs/-/formiojs-4.17.4.tgz",
-      "integrity": "sha512-1wUWPLKTJ6/FWa5jCtw5YfsUzgr85TYh8aMhXUWxxRNBtYxZMLg4RcFsArqDJP9Lfh9z4N8p/sLSaOik6iu7kA==",
+      "version": "4.19.5",
+      "resolved": "https://registry.npmjs.org/formiojs/-/formiojs-4.19.5.tgz",
+      "integrity": "sha512-jkFothZR+Fz85br6gzneHhOXf4MZJYyheBtDL3k9NdjOaPhRsfyQZuGaWtvoMCYvZNYWcERoD6UtUwEdyMMY1w==",
       "dependencies": {
         "@formio/bootstrap3": "2.12.4-rc.1",
-        "@formio/choices.js": "10.2.0",
+        "@formio/choices.js": "10.2.1",
         "@formio/semantic": "2.6.1",
         "@formio/text-mask-addons": "^3.8.0-formio.2",
         "@formio/vanilla-text-mask": "^5.1.1-formio.1",
diff --git a/app/frontend/package.json b/app/frontend/package.json
index 76a987ddd..ca3dfb2fc 100644
--- a/app/frontend/package.json
+++ b/app/frontend/package.json
@@ -40,7 +40,7 @@
     "crypto-js": "^4.1.1",
     "fast-json-patch": "^3.1.1",
     "font-awesome": "^4.7.0",
-    "formiojs": "^4.14.13",
+    "formiojs": "^4.19.5",
     "keycloak-js": "^21.1.1",
     "lodash": "^4.17.21",
     "mitt": "^3.0.0",

From 607204684857c46671de905b7ffbf579f4c85240 Mon Sep 17 00:00:00 2001
From: Vijaivir Dhaliwal <91633223+vijaivir@users.noreply.github.com>
Date: Wed, 7 Aug 2024 17:32:58 -0700
Subject: [PATCH 02/20] Revert "update formiojs (#1458)" (#1462)

This reverts commit 2e94918ae9eda0c0b0f9edac703ed9468ef2d13c.
---
 app/frontend/package-lock.json | 16 ++++++++--------
 app/frontend/package.json      |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/app/frontend/package-lock.json b/app/frontend/package-lock.json
index 07d6e6a58..b471325c8 100644
--- a/app/frontend/package-lock.json
+++ b/app/frontend/package-lock.json
@@ -19,7 +19,7 @@
         "crypto-js": "^4.1.1",
         "fast-json-patch": "^3.1.1",
         "font-awesome": "^4.7.0",
-        "formiojs": "^4.19.5",
+        "formiojs": "^4.14.13",
         "keycloak-js": "^21.1.1",
         "lodash": "^4.17.21",
         "mitt": "^3.0.0",
@@ -515,9 +515,9 @@
       }
     },
     "node_modules/@formio/choices.js": {
-      "version": "10.2.1",
-      "resolved": "https://registry.npmjs.org/@formio/choices.js/-/choices.js-10.2.1.tgz",
-      "integrity": "sha512-NCE5u7jG3XGokJP16MyAbVSUptKu/mpJYAxd4PPIoLiO/l9Do5uoOQ0MgNb9qG9qABJiOX+qNRE8q8RybY/SwQ==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/@formio/choices.js/-/choices.js-10.2.0.tgz",
+      "integrity": "sha512-dEF+es4yj3pstKHif7Ck14vQCZdN+b1Afojl0ufTmKw5WIjqas1KXEIBBgtsg4eY6bxqFkgEjtxsK4ecvEeZsA==",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "fuse.js": "^6.6.2",
@@ -2704,12 +2704,12 @@
       }
     },
     "node_modules/formiojs": {
-      "version": "4.19.5",
-      "resolved": "https://registry.npmjs.org/formiojs/-/formiojs-4.19.5.tgz",
-      "integrity": "sha512-jkFothZR+Fz85br6gzneHhOXf4MZJYyheBtDL3k9NdjOaPhRsfyQZuGaWtvoMCYvZNYWcERoD6UtUwEdyMMY1w==",
+      "version": "4.17.4",
+      "resolved": "https://registry.npmjs.org/formiojs/-/formiojs-4.17.4.tgz",
+      "integrity": "sha512-1wUWPLKTJ6/FWa5jCtw5YfsUzgr85TYh8aMhXUWxxRNBtYxZMLg4RcFsArqDJP9Lfh9z4N8p/sLSaOik6iu7kA==",
       "dependencies": {
         "@formio/bootstrap3": "2.12.4-rc.1",
-        "@formio/choices.js": "10.2.1",
+        "@formio/choices.js": "10.2.0",
         "@formio/semantic": "2.6.1",
         "@formio/text-mask-addons": "^3.8.0-formio.2",
         "@formio/vanilla-text-mask": "^5.1.1-formio.1",
diff --git a/app/frontend/package.json b/app/frontend/package.json
index ca3dfb2fc..76a987ddd 100644
--- a/app/frontend/package.json
+++ b/app/frontend/package.json
@@ -40,7 +40,7 @@
     "crypto-js": "^4.1.1",
     "fast-json-patch": "^3.1.1",
     "font-awesome": "^4.7.0",
-    "formiojs": "^4.19.5",
+    "formiojs": "^4.14.13",
     "keycloak-js": "^21.1.1",
     "lodash": "^4.17.21",
     "mitt": "^3.0.0",

From d07aed8eaa27ebf9013669e2d99be59d07dcddaa Mon Sep 17 00:00:00 2001
From: Vijaivir Dhaliwal <91633223+vijaivir@users.noreply.github.com>
Date: Thu, 8 Aug 2024 10:02:48 -0700
Subject: [PATCH 03/20] Fix: Update error message for unauthorized form access
 and fix button size for late submissions (#1442)

* added tooltip

* update unauthorized status

* added translation files

* fix form render post schedule expiration

* fix button size

* added else block for generic errors
---
 .../src/components/designer/FormViewer.vue    | 49 +++++++++++++------
 .../designer/settings/FormAccessSettings.vue  | 18 +++++--
 .../trans/chefs/ar/ar.json                    |  4 +-
 .../trans/chefs/de/de.json                    |  4 +-
 .../trans/chefs/en/en.json                    |  4 +-
 .../trans/chefs/es/es.json                    |  4 +-
 .../trans/chefs/fa/fa.json                    |  4 +-
 .../trans/chefs/fr/fr.json                    |  4 +-
 .../trans/chefs/hi/hi.json                    |  4 +-
 .../trans/chefs/it/it.json                    |  4 +-
 .../trans/chefs/ja/ja.json                    |  4 +-
 .../trans/chefs/ko/ko.json                    |  4 +-
 .../trans/chefs/pa/pa.json                    |  4 +-
 .../trans/chefs/pt/pt.json                    |  4 +-
 .../trans/chefs/ru/ru.json                    |  4 +-
 .../trans/chefs/tl/tl.json                    |  4 +-
 .../trans/chefs/uk/uk.json                    |  4 +-
 .../trans/chefs/vi/vi.json                    |  4 +-
 .../trans/chefs/zh/zh.json                    |  4 +-
 .../trans/chefs/zhTW/zh-TW.json               |  4 +-
 20 files changed, 102 insertions(+), 37 deletions(-)

diff --git a/app/frontend/src/components/designer/FormViewer.vue b/app/frontend/src/components/designer/FormViewer.vue
index 102436eff..74ddcc4c4 100644
--- a/app/frontend/src/components/designer/FormViewer.vue
+++ b/app/frontend/src/components/designer/FormViewer.vue
@@ -115,6 +115,7 @@ export default {
       submissionRecord: {},
       version: 0,
       versionIdToSubmitTo: this.versionId,
+      isAuthorized: true,
     };
   },
   computed: {
@@ -130,6 +131,9 @@ export default {
     formScheduleExpireMessage() {
       return this.$t('trans.formViewer.formScheduleExpireMessage');
     },
+    formUnauthorizedMessage() {
+      return this.$t('trans.formViewer.formUnauthorizedMessage');
+    },
     NOTIFICATIONS_TYPES() {
       return NotificationTypes;
     },
@@ -190,7 +194,6 @@ export default {
       this.showModal = true;
       await this.getFormSchema();
     }
-
     window.addEventListener('beforeunload', this.beforeWindowUnload);
 
     this.reRenderFormIo += 1;
@@ -403,19 +406,22 @@ export default {
         }
       } catch (error) {
         if (this.authenticated) {
-          this.isFormScheduleExpired = true;
-          this.isLateSubmissionAllowed = false;
-          this.formScheduleExpireMessage = error.message;
-          this.addNotification({
-            text: this.$t('trans.formViewer.fecthingFormErrMsg'),
-            consoleError: this.$t(
-              'trans.formViewer.fecthingFormConsoleErrMsg',
-              {
-                versionId: this.versionId,
-                error: error,
-              }
-            ),
-          });
+          // if 401 error, the user is not authorized to view the form
+          if (error.response && error.response.status === 401) {
+            this.isAuthorized = false;
+          } else {
+            // throw a generic error message
+            this.addNotification({
+              text: this.$t('trans.formViewer.fecthingFormErrMsg'),
+              consoleError: this.$t(
+                'trans.formViewer.fecthingFormConsoleErrMsg',
+                {
+                  versionId: this.versionId,
+                  error: error,
+                }
+              ),
+            });
+          }
         }
       }
     },
@@ -1144,7 +1150,18 @@ export default {
 <template>
   <v-skeleton-loader :loading="loadingSubmission" type="article, actions">
     <v-container fluid>
-      <div v-if="isFormScheduleExpired">
+      <div v-if="!isAuthorized">
+        <v-alert
+          :text="formUnauthorizedMessage"
+          prominent
+          type="error"
+          :class="{ 'dir-rtl': isRTL }"
+          :lang="locale"
+        >
+        </v-alert>
+      </div>
+
+      <div v-else-if="isFormScheduleExpired">
         <v-alert
           :text="
             isLateSubmissionAllowed
@@ -1159,7 +1176,7 @@ export default {
         </v-alert>
 
         <div v-if="isLateSubmissionAllowed">
-          <v-col cols="3" md="2">
+          <v-col cols="12" md="6">
             <v-btn
               color="primary"
               :class="{ 'dir-rtl': isRTL }"
diff --git a/app/frontend/src/components/designer/settings/FormAccessSettings.vue b/app/frontend/src/components/designer/settings/FormAccessSettings.vue
index 8d94c3b9d..33817caa5 100644
--- a/app/frontend/src/components/designer/settings/FormAccessSettings.vue
+++ b/app/frontend/src/components/designer/settings/FormAccessSettings.vue
@@ -170,9 +170,21 @@ defineExpose({ idpType, userTypeChanged, updateLoginType });
       </v-expand-transition>
       <v-radio :value="ID_MODE.TEAM">
         <template #label>
-          <span :class="{ 'mr-2': isRTL }" :lang="locale">
-            {{ $t('trans.formSettings.specificTeamMembers') }}
-          </span>
+          <v-tooltip location="bottom">
+            <template #activator="{ props }">
+              <span :class="{ 'mr-2': isRTL }" :lang="locale">
+                {{ $t('trans.formSettings.specificTeamMembers') }}
+              </span>
+              <v-icon
+                color="primary"
+                class="ml-3"
+                :class="{ 'mr-2': isRTL }"
+                v-bind="props"
+                icon="mdi:mdi-help-circle-outline"
+              />
+            </template>
+            <span>{{ $t('trans.formSettings.teamMemberTooltip') }}</span>
+          </v-tooltip>
         </template>
       </v-radio>
     </v-radio-group>
diff --git a/app/frontend/src/internationalization/trans/chefs/ar/ar.json b/app/frontend/src/internationalization/trans/chefs/ar/ar.json
index 2ac069b72..949e70408 100644
--- a/app/frontend/src/internationalization/trans/chefs/ar/ar.json
+++ b/app/frontend/src/internationalization/trans/chefs/ar/ar.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "دليل المستخدم",
     "referenceGuideC": "لمزيد من التفاصيل",
     "specificTeamMembers": "أعضاء الفريق المحدد",
+    "teamMemberTooltip": "أضف أعضاء الفريق من إعدادات إدارة الفريق بعد إنشاء هذا النموذج.",
     "formFunctionality": "وظيفة الشكل",
     "formSubmissinScheduleMsg": "سيكون جدول تقديم النموذج متاحًا في \"إعدادات النموذج\" بعد نشر النموذج.",
     "formSubmissionsSchedule": "جدول تقديم النموذج",
@@ -829,7 +830,8 @@
     "errorSavingFile": "خطأ في حفظ الملفات. اسم الملف: {fileName}. خطأ: {error}",
     "submittingDraftErrMsg": "حدث خطأ أثناء حفظ المسودة",
     "submittingDraftConsErrMsg": "خطأ في حفظ المسودة. معرف التقديم: {submitId}. خطأ: {error}",
-    "formDraftAccessErrMsg": "تم إرسال طلب التقديم بالفعل ، مع إعادة التوجيه إلى صفحة العرض"
+    "formDraftAccessErrMsg": "تم إرسال طلب التقديم بالفعل ، مع إعادة التوجيه إلى صفحة العرض",
+    "formUnauthorizedMessage": "غير مخول لك مشاهدة هذا النموذج، يرجى الاتصال بمالك النموذج للحصول على الوصول."
   },
   "bCGovFooter": {
     "home": "بيت",
diff --git a/app/frontend/src/internationalization/trans/chefs/de/de.json b/app/frontend/src/internationalization/trans/chefs/de/de.json
index a863abd1a..c35fa2d65 100644
--- a/app/frontend/src/internationalization/trans/chefs/de/de.json
+++ b/app/frontend/src/internationalization/trans/chefs/de/de.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "Benutzerhandbuch",
     "referenceGuideC": "für mehr Details",
     "specificTeamMembers": "Spezifische Teammitglieder",
+    "teamMemberTooltip": "Fügen Sie Teammitglieder aus den Teamverwaltungseinstellungen hinzu, nachdem Sie dieses Formular erstellt haben.",
     "formFunctionality": "Formularfunktionalität",
     "formSubmissinScheduleMsg": "Der Formulareinreichungsplan ist in den Formulareinstellungen verfügbar, nachdem das Formular veröffentlicht wurde.",
     "formSubmissionsSchedule": "Zeitplan für Formulareinreichungen",
@@ -830,7 +831,8 @@
     "errorSavingFile": "Fehler beim Speichern der Dateien. Dateiname: {fileName}. Fehler: {error}",
     "submittingDraftErrMsg": "Beim Speichern eines Entwurfs ist ein Fehler aufgetreten",
     "submittingDraftConsErrMsg": "Fehler beim Speichern des Entwurfs. Einreichungs-ID: {submissionId}. Fehler: {error}",
-    "formDraftAccessErrMsg": "Die angeforderte Übermittlung wurde bereits übermittelt und wird zur Ansichtsseite weitergeleitet"
+    "formDraftAccessErrMsg": "Die angeforderte Übermittlung wurde bereits übermittelt und wird zur Ansichtsseite weitergeleitet",
+    "formUnauthorizedMessage": "Sie sind nicht berechtigt, dieses Formular anzusehen. Bitte kontaktieren Sie den Formulareigentümer für den Zugang."
   },
   "bCGovFooter": {
     "home": "Heim",
diff --git a/app/frontend/src/internationalization/trans/chefs/en/en.json b/app/frontend/src/internationalization/trans/chefs/en/en.json
index de26b6e95..863545419 100644
--- a/app/frontend/src/internationalization/trans/chefs/en/en.json
+++ b/app/frontend/src/internationalization/trans/chefs/en/en.json
@@ -130,6 +130,7 @@
     "referenceGuideB": "user guide",
     "referenceGuideC": "for more details",
     "specificTeamMembers": "Specific Team Members",
+    "teamMemberTooltip": "Add team members from the Team Management settings after creating this form.",
     "formFunctionality": "Form Functionality",
     "formSubmissinScheduleMsg": "The Form Submissions Schedule will be available in the Form Settings after the form is published.",
     "formSubmissionsSchedule": "Form Submissions Schedule",
@@ -880,7 +881,8 @@
     "errorSavingFile": "Error saving files. Filename: {fileName}. Error: {error}",
     "submittingDraftErrMsg": "An error occurred while saving a draft",
     "submittingDraftConsErrMsg": "Error saving draft. SubmissionId: {submissionId}. Error: {error}",
-    "formDraftAccessErrMsg": "Requested submission is already submitted, redirecting to View page"
+    "formDraftAccessErrMsg": "Requested submission is already submitted, redirecting to View page",
+    "formUnauthorizedMessage": "You are not authorized to view this form, please contact the form owner for access."
   },
   "bCGovFooter": {
     "home": "Home",
diff --git a/app/frontend/src/internationalization/trans/chefs/es/es.json b/app/frontend/src/internationalization/trans/chefs/es/es.json
index 20ec42680..aa005e6c0 100644
--- a/app/frontend/src/internationalization/trans/chefs/es/es.json
+++ b/app/frontend/src/internationalization/trans/chefs/es/es.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "guía del usuario",
     "referenceGuideC": "para más detalles",
     "specificTeamMembers": "Miembros del equipo específicos",
+    "teamMemberTooltip": "Añade miembros del equipo desde la configuración de Gestión de Equipos después de crear este formulario.",
     "formFunctionality": "Funcionalidad de formulario",
     "formSubmissinScheduleMsg": "El programa de envío de formularios estará disponible en la configuración del formulario después de que se publique el formulario.",
     "formSubmissionsSchedule": "Calendario de envío de formularios",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Error al guardar archivos. Nombre de archivo: {fileName}. Error: {error}",
     "submittingDraftErrMsg": "Se produjo un error al guardar un borrador",
     "submittingDraftConsErrMsg": "Error al guardar el borrador. Id de envío: {submissionId}. Error: {error}",
-    "formDraftAccessErrMsg": "El envío solicitado ya se envió, redirigiendo a la página Ver"
+    "formDraftAccessErrMsg": "El envío solicitado ya se envió, redirigiendo a la página Ver",
+    "formUnauthorizedMessage": "No tienes autorización para ver este formulario, por favor contacta al propietario del formulario para acceder."
   },
   "bCGovFooter": {
     "home": "Hogar",
diff --git a/app/frontend/src/internationalization/trans/chefs/fa/fa.json b/app/frontend/src/internationalization/trans/chefs/fa/fa.json
index b2d5f27a2..29cd29556 100644
--- a/app/frontend/src/internationalization/trans/chefs/fa/fa.json
+++ b/app/frontend/src/internationalization/trans/chefs/fa/fa.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "راهنمای کاربر",
     "referenceGuideC": "برای جزئیات بیشتر",
     "specificTeamMembers": "اعضای تیم خاص",
+    "teamMemberTooltip": "پس از ایجاد این فرم، اعضای تیم را از تنظیمات مدیریت تیم اضافه کنید.",
     "formFunctionality": "عملکرد فرم",
     "formSubmissinScheduleMsg": "پس از انتشار فرم، برنامه ارسال فرم در تنظیمات فرم در دسترس خواهد بود.",
     "formSubmissionsSchedule": "جدول ارسال فرم ها",
@@ -829,7 +830,8 @@
     "errorSavingFile": "خطا در ذخیره فایل ها. نام فایل: {fileName}. خطا: {error}",
     "submittingDraftErrMsg": "هنگام ذخیره پیش نویس خطایی روی داد",
     "submittingDraftConsErrMsg": "خطا در ذخیره پیش نویس. SubmissionId: {submissionId}. خطا: {error}",
-    "formDraftAccessErrMsg": "ارسال درخواستی قبلا ارسال شده است، به صفحه مشاهده هدایت می شود"
+    "formDraftAccessErrMsg": "ارسال درخواستی قبلا ارسال شده است، به صفحه مشاهده هدایت می شود",
+    "formUnauthorizedMessage": "شما مجاز به مشاهده این فرم نیستید، لطفاً برای دسترسی با مالک فرم تماس بگیرید."
   },
   "bCGovFooter": {
     "home": "صفحه اصلی",
diff --git a/app/frontend/src/internationalization/trans/chefs/fr/fr.json b/app/frontend/src/internationalization/trans/chefs/fr/fr.json
index f0dcdbe75..0d287188f 100644
--- a/app/frontend/src/internationalization/trans/chefs/fr/fr.json
+++ b/app/frontend/src/internationalization/trans/chefs/fr/fr.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "mode d'emploi",
     "referenceGuideC": "pour plus de détails",
     "specificTeamMembers": "Membres spécifiques de l'équipe",
+    "teamMemberTooltip": "Ajoutez des membres de l'équipe depuis les paramètres de Gestion d'Équipe après avoir créé ce formulaire.",
     "formFunctionality": "Fonctionnalité du formulaire",
     "formSubmissinScheduleMsg": "Le calendrier de soumission des formulaires sera disponible dans les paramètres du formulaire après la publication du formulaire.",
     "formSubmissionsSchedule": "Calendrier de soumission des formulaires",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Erreur lors de l'enregistrement des fichiers. Nom de fichier : {fileName}. Erreur : {error}",
     "submittingDraftErrMsg": "Une erreur s'est produite lors de l'enregistrement d'un brouillon",
     "submittingDraftConsErrMsg": "Erreur lors de l'enregistrement du brouillon. ID de soumission : {submissionId}. Erreur : {error}",
-    "formDraftAccessErrMsg": "La soumission demandée est déjà soumise, redirigeant vers la page Afficher"
+    "formDraftAccessErrMsg": "La soumission demandée est déjà soumise, redirigeant vers la page Afficher",
+    "formUnauthorizedMessage": "Vous n'êtes pas autorisé à voir ce formulaire, veuillez contacter le propriétaire du formulaire pour accéder."
   },
   "bCGovFooter": {
     "home": "Maison",
diff --git a/app/frontend/src/internationalization/trans/chefs/hi/hi.json b/app/frontend/src/internationalization/trans/chefs/hi/hi.json
index 01e6d3890..bf23ba611 100644
--- a/app/frontend/src/internationalization/trans/chefs/hi/hi.json
+++ b/app/frontend/src/internationalization/trans/chefs/hi/hi.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "उपयोगकर्ता गाइड",
     "referenceGuideC": "अधिक जानकारी के लिए",
     "specificTeamMembers": "विशिष्ट टीम के सदस्य",
+    "teamMemberTooltip": "इस फॉर्म को बनाने के बाद टीम प्रबंधन सेटिंग्स से टीम के सदस्यों को जोड़ें।",
     "formFunctionality": "फॉर्म की कार्यक्षमता",
     "formSubmissinScheduleMsg": "फॉर्म सबमिशन शेड्यूल फॉर्म प्रकाशित होने के बाद फॉर्म सेटिंग्स में उपलब्ध होगा।",
     "formSubmissionsSchedule": "फॉर्म जमा करने की अनुसूची",
@@ -829,7 +830,8 @@
     "errorSavingFile": "फ़ाइलें सहेजने में त्रुटि. फ़ाइल का नाम: {fileName}. त्रुटि: {error}",
     "submittingDraftErrMsg": "ड्राफ्ट सहेजते समय एक त्रुटि उत्पन्न हुई",
     "submittingDraftConsErrMsg": "ड्राफ्ट सहेजने में त्रुटि. सबमिशनआईडी: {submissionId}। त्रुटि: {error}",
-    "formDraftAccessErrMsg": "अनुरोधित सबमिशन पहले ही सबमिट किया जा चुका है, व्यू पेज पर रीडायरेक्ट किया जा रहा है"
+    "formDraftAccessErrMsg": "अनुरोधित सबमिशन पहले ही सबमिट किया जा चुका है, व्यू पेज पर रीडायरेक्ट किया जा रहा है",
+    "formUnauthorizedMessage": "आप इस फॉर्म को देखने के लिए अधिकृत नहीं हैं, कृपया पहुँच प्राप्त करने के लिए फॉर्म के मालिक से संपर्क करें।"
   },
   "bCGovFooter": {
     "home": "घर",
diff --git a/app/frontend/src/internationalization/trans/chefs/it/it.json b/app/frontend/src/internationalization/trans/chefs/it/it.json
index 2806f98db..d614f6798 100644
--- a/app/frontend/src/internationalization/trans/chefs/it/it.json
+++ b/app/frontend/src/internationalization/trans/chefs/it/it.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "guida utente",
     "referenceGuideC": "per ulteriori dettagli",
     "specificTeamMembers": "Membri specifici del team",
+    "teamMemberTooltip": "Aggiungi membri del team dalle impostazioni di Gestione del Team dopo aver creato questo modulo.",
     "formFunctionality": "Funzionalità della forma",
     "formSubmissinScheduleMsg": "Il programma di invio del modulo sarà disponibile nelle Impostazioni del modulo dopo la pubblicazione del modulo.",
     "formSubmissionsSchedule": "Programma di invio dei moduli",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Errore durante il salvataggio dei file. nome file: {fileName}. Errore: {error}",
     "submittingDraftErrMsg": "Si è verificato un errore durante il salvataggio di una bozza",
     "submittingDraftConsErrMsg": "Errore durante il salvataggio della bozza. SubmissionId: {submissionId}. Errore: {error}",
-    "formDraftAccessErrMsg": "L'invio richiesto è già stato inviato, reindirizzamento alla pagina Visualizza"
+    "formDraftAccessErrMsg": "L'invio richiesto è già stato inviato, reindirizzamento alla pagina Visualizza",
+    "formUnauthorizedMessage": "Non sei autorizzato a visualizzare questo modulo, si prega di contattare il proprietario del modulo per l'accesso."
   },
   "bCGovFooter": {
     "home": "Casa",
diff --git a/app/frontend/src/internationalization/trans/chefs/ja/ja.json b/app/frontend/src/internationalization/trans/chefs/ja/ja.json
index 80cdbe558..4db0ec2c4 100644
--- a/app/frontend/src/internationalization/trans/chefs/ja/ja.json
+++ b/app/frontend/src/internationalization/trans/chefs/ja/ja.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "ユーザーガイド",
     "referenceGuideC": "詳細については",
     "specificTeamMembers": "特定のチームメンバー",
+    "teamMemberTooltip": "このフォームを作成した後、チーム管理設定からチームメンバーを追加してください。",
     "formFunctionality": "フォーム機能",
     "formSubmissinScheduleMsg": "フォーム送信スケジュールは、フォームが公開された後、フォーム設定で利用できるようになります。",
     "formSubmissionsSchedule": "フォーム送信スケジュール",
@@ -829,7 +830,8 @@
     "errorSavingFile": "ファイルの保存中にエラーが発生しました。ファイル名: {fileName}。エラー: {error}",
     "submittingDraftErrMsg": "下書きの保存中にエラーが発生しました",
     "submittingDraftConsErrMsg": "下書きの保存中にエラーが発生しました。送信 ID: {submissionId}。エラー: {error}",
-    "formDraftAccessErrMsg": "リクエストされた送信はすでに送信されており、[表示] ページにリダイレクトされます。"
+    "formDraftAccessErrMsg": "リクエストされた送信はすでに送信されており、[表示] ページにリダイレクトされます。",
+    "formUnauthorizedMessage": "このフォームを表示する権限がありません。アクセスするにはフォームの所有者に連絡してください。"
   },
   "bCGovFooter": {
     "home": "家",
diff --git a/app/frontend/src/internationalization/trans/chefs/ko/ko.json b/app/frontend/src/internationalization/trans/chefs/ko/ko.json
index 5fe33a00e..f59332df6 100644
--- a/app/frontend/src/internationalization/trans/chefs/ko/ko.json
+++ b/app/frontend/src/internationalization/trans/chefs/ko/ko.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "사용자 설명서",
     "referenceGuideC": "상세 사항은",
     "specificTeamMembers": "특정 팀원",
+    "teamMemberTooltip": "이 양식을 생성한 후 팀 관리 설정에서 팀 멤버를 추가하세요.",
     "formFunctionality": "양식 기능",
     "formSubmissinScheduleMsg": "양식 제출 일정은 양식이 게시된 후 양식 설정에서 사용할 수 있습니다.",
     "formSubmissionsSchedule": "양식 제출 일정",
@@ -829,7 +830,8 @@
     "errorSavingFile": "파일을 저장하는 중에 오류가 발생했습니다. 파일 이름: {fileName}. 오류: {error}",
     "submittingDraftErrMsg": "초안을 저장하는 중에 오류가 발생했습니다.",
     "submittingDraftConsErrMsg": "초안을 저장하는 중에 오류가 발생했습니다. 제출 ID: {submissionId}. 오류: {error}",
-    "formDraftAccessErrMsg": "요청한 제출이 이미 제출되었으며 보기 페이지로 리디렉션됩니다."
+    "formDraftAccessErrMsg": "요청한 제출이 이미 제출되었으며 보기 페이지로 리디렉션됩니다.",
+    "formUnauthorizedMessage": "이 양식을 볼 수 있는 권한이 없습니다. 접근하려면 양식 소유자에게 연락하세요."
   },
   "bCGovFooter": {
     "home": "집",
diff --git a/app/frontend/src/internationalization/trans/chefs/pa/pa.json b/app/frontend/src/internationalization/trans/chefs/pa/pa.json
index 49840c46a..1c04cf1c7 100644
--- a/app/frontend/src/internationalization/trans/chefs/pa/pa.json
+++ b/app/frontend/src/internationalization/trans/chefs/pa/pa.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "ਉਪਭੋਗਤਾ ਗਾਈਡ",
     "referenceGuideC": "ਹੋਰ ਵੇਰਵਿਆਂ ਲਈ",
     "specificTeamMembers": "ਖਾਸ ਟੀਮ ਦੇ ਮੈਂਬਰ",
+    "teamMemberTooltip": "ਇਸ ਫਾਰਮ ਨੂੰ ਬਣਾਉਣ ਤੋਂ ਬਾਅਦ ਟੀਮ ਪ੍ਰਬੰਧਨ ਸੈਟਿੰਗਾਂ ਤੋਂ ਟੀਮ ਦੇ ਮੈਂਬਰ ਨੂੰ ਜੋੜੋ।",
     "formFunctionality": "ਫਾਰਮ ਕਾਰਜਕੁਸ਼ਲਤਾ",
     "formSubmissinScheduleMsg": "ਫਾਰਮ ਪ੍ਰਕਾਸ਼ਿਤ ਹੋਣ ਤੋਂ ਬਾਅਦ ਫਾਰਮ ਸਬਮਿਸ਼ਨ ਅਨੁਸੂਚੀ ਫਾਰਮ ਸੈਟਿੰਗਾਂ ਵਿੱਚ ਉਪਲਬਧ ਹੋਵੇਗੀ।",
     "formSubmissionsSchedule": "ਫਾਰਮ ਸਬਮਿਸ਼ਨ ਅਨੁਸੂਚੀ",
@@ -829,7 +830,8 @@
     "errorSavingFile": "ਫ਼ਾਈਲਾਂ ਨੂੰ ਰੱਖਿਅਤ ਕਰਨ ਵਿੱਚ ਗੜਬੜ ਹੋਈ। ਫ਼ਾਈਲ ਦਾ ਨਾਮ: {fileName}। ਗਲਤੀ: {error}",
     "submittingDraftErrMsg": "ਡਰਾਫਟ ਨੂੰ ਸੁਰੱਖਿਅਤ ਕਰਨ ਦੌਰਾਨ ਇੱਕ ਤਰੁੱਟੀ ਉਤਪੰਨ ਹੋਈ",
     "submittingDraftConsErrMsg": "ਡਰਾਫਟ ਸੁਰੱਖਿਅਤ ਕਰਨ ਵਿੱਚ ਤਰੁੱਟੀ। SubmissionId: {submissionId}। ਗਲਤੀ: {error}",
-    "formDraftAccessErrMsg": "ਬੇਨਤੀ ਕੀਤੀ ਸਪੁਰਦਗੀ ਪਹਿਲਾਂ ਹੀ ਸਪੁਰਦ ਕੀਤੀ ਗਈ ਹੈ, ਵੇਖੋ ਪੰਨੇ 'ਤੇ ਰੀਡਾਇਰੈਕਟ ਕੀਤਾ ਜਾ ਰਿਹਾ ਹੈ"
+    "formDraftAccessErrMsg": "ਬੇਨਤੀ ਕੀਤੀ ਸਪੁਰਦਗੀ ਪਹਿਲਾਂ ਹੀ ਸਪੁਰਦ ਕੀਤੀ ਗਈ ਹੈ, ਵੇਖੋ ਪੰਨੇ 'ਤੇ ਰੀਡਾਇਰੈਕਟ ਕੀਤਾ ਜਾ ਰਿਹਾ ਹੈ",
+    "formUnauthorizedMessage": "ਤੁਹਾਨੂੰ ਇਸ ਫਾਰਮ ਨੂੰ ਵੇਖਣ ਦੀ ਅਧਿਕਾਰਤਾ ਨਹੀਂ ਹੈ, ਕਿਰਪਾ ਕਰਕੇ ਪਹੁੰਚ ਲਈ ਫਾਰਮ ਦੇ ਮਾਲਕ ਨਾਲ ਸੰਪਰਕ ਕਰੋ।"
   },
   "bCGovFooter": {
     "home": "ਘਰ",
diff --git a/app/frontend/src/internationalization/trans/chefs/pt/pt.json b/app/frontend/src/internationalization/trans/chefs/pt/pt.json
index ddaac6dd3..b3a4e6528 100644
--- a/app/frontend/src/internationalization/trans/chefs/pt/pt.json
+++ b/app/frontend/src/internationalization/trans/chefs/pt/pt.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "guia de usuario",
     "referenceGuideC": "para mais detalhes",
     "specificTeamMembers": "Membros Específicos da Equipe",
+    "teamMemberTooltip": "Adicione membros da equipe a partir das configurações de Gestão de Equipe após criar este formulário.",
     "formFunctionality": "Funcionalidade do formulário",
     "formSubmissinScheduleMsg": "A Agenda de envios de formulários estará disponível nas Configurações de formulários após a publicação do formulário.",
     "formSubmissionsSchedule": "Cronograma de Envios de Formulários",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Erro ao salvar arquivos. Nome do arquivo: {fileName}. Erro: {error}",
     "submittingDraftErrMsg": "Ocorreu um erro ao salvar um rascunho",
     "submittingDraftConsErrMsg": "Erro ao salvar rascunho. SubmissãoId: {submissionId}. Erro: {error}",
-    "formDraftAccessErrMsg": "O envio solicitado já foi enviado, redirecionando para a página Exibir"
+    "formDraftAccessErrMsg": "O envio solicitado já foi enviado, redirecionando para a página Exibir",
+    "formUnauthorizedMessage": "Você não está autorizado a visualizar este formulário, por favor, contate o proprietário do formulário para acesso."
   },
   "bCGovFooter": {
     "home": "Lar",
diff --git a/app/frontend/src/internationalization/trans/chefs/ru/ru.json b/app/frontend/src/internationalization/trans/chefs/ru/ru.json
index 53f020b39..8af28b6fc 100644
--- a/app/frontend/src/internationalization/trans/chefs/ru/ru.json
+++ b/app/frontend/src/internationalization/trans/chefs/ru/ru.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "руководству пользователя",
     "referenceGuideC": "для подробностей",
     "specificTeamMembers": "Конкретные члены команды",
+    "teamMemberTooltip": "Добавьте членов команды из настроек управления командой после создания этой формы.",
     "formFunctionality": "Функциональность формы",
     "formSubmissinScheduleMsg": "Расписание отправки формы будет доступно в настройках формы после публикации формы.",
     "formSubmissionsSchedule": "Расписание отправки формы",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Ошибка сохранения файлов. Имя файла: {fileName}. Ошибка: {error}",
     "submittingDraftErrMsg": "Произошла ошибка при сохранении черновика",
     "submittingDraftConsErrMsg": "Не удалось сохранить черновик. Идентификатор записи: {submissionId}. Ошибка: {error}",
-    "formDraftAccessErrMsg": "Запрошенная отправка уже отправлена, перенаправление на страницу просмотра"
+    "formDraftAccessErrMsg": "Запрошенная отправка уже отправлена, перенаправление на страницу просмотра",
+    "formUnauthorizedMessage": "Вы не авторизованы для просмотра этой формы, пожалуйста, свяжитесь с владельцем формы для доступа."
   },
   "bCGovFooter": {
     "home": "Главная страница",
diff --git a/app/frontend/src/internationalization/trans/chefs/tl/tl.json b/app/frontend/src/internationalization/trans/chefs/tl/tl.json
index 7e852beaa..bccdaa983 100644
--- a/app/frontend/src/internationalization/trans/chefs/tl/tl.json
+++ b/app/frontend/src/internationalization/trans/chefs/tl/tl.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "gabay sa gumagamit",
     "referenceGuideC": "para sa karagdagang detalye",
     "specificTeamMembers": "Mga Partikular na Miyembro ng Koponan",
+    "teamMemberTooltip": "Idagdag ang mga miyembro ng team mula sa Mga Setting ng Pamamahala ng Team matapos likhain ang form na ito.",
     "formFunctionality": "Pag-andar ng Form",
     "formSubmissinScheduleMsg": "Ang Iskedyul ng Pagsusumite ng Form ay magiging available sa Mga Setting ng Form pagkatapos mailathala ang form.",
     "formSubmissionsSchedule": "Iskedyul ng Pagsusumite ng Form",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Error sa pag-save ng mga file. Filename: {fileName}. Error: {error}",
     "submittingDraftErrMsg": "Nagkaroon ng error habang nagse-save ng draft",
     "submittingDraftConsErrMsg": "Error sa pag-save ng draft. SubmissionId: {submissionId}. Error: {error}",
-    "formDraftAccessErrMsg": "Ang hiniling na pagsusumite ay naisumite na, nagre-redirect sa View page"
+    "formDraftAccessErrMsg": "Ang hiniling na pagsusumite ay naisumite na, nagre-redirect sa View page",
+    "formUnauthorizedMessage": "Hindi ka awtorisadong tingnan ang form na ito, mangyaring makipag-ugnayan sa may-ari ng form para sa access."
   },
   "bCGovFooter": {
     "home": "Bahay",
diff --git a/app/frontend/src/internationalization/trans/chefs/uk/uk.json b/app/frontend/src/internationalization/trans/chefs/uk/uk.json
index 962ea4db6..e915db0de 100644
--- a/app/frontend/src/internationalization/trans/chefs/uk/uk.json
+++ b/app/frontend/src/internationalization/trans/chefs/uk/uk.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "керівництво користувача",
     "referenceGuideC": "для більш детальної інформації",
     "specificTeamMembers": "Конкретні члени команди",
+    "teamMemberTooltip": "Додайте членів команди з налаштувань управління командою після створення цієї форми.",
     "formFunctionality": "Функціональність форми",
     "formSubmissinScheduleMsg": "Розклад подання форми буде доступний у налаштуваннях форми після публікації форми.",
     "formSubmissionsSchedule": "Графік подання форм",
@@ -828,7 +829,8 @@
     "errorSavingFile": "Помилка збереження файлів. Ім'я файлу: {fileName}. Помилка: {error}",
     "submittingDraftErrMsg": "Під час збереження чернетки сталася помилка",
     "submittingDraftConsErrMsg": "Помилка збереження чернетки. SubmissionId: {submissionId}. Помилка: {error}",
-    "formDraftAccessErrMsg": "Запитане подання вже подано, переспрямовує на сторінку перегляду"
+    "formDraftAccessErrMsg": "Запитане подання вже подано, переспрямовує на сторінку перегляду",
+    "formUnauthorizedMessage": "Ви не маєте права переглядати цю форму, будь ласка, зв'яжіться з власником форми для доступу."
   },
   "bCGovFooter": {
     "home": "додому",
diff --git a/app/frontend/src/internationalization/trans/chefs/vi/vi.json b/app/frontend/src/internationalization/trans/chefs/vi/vi.json
index ff842ecf7..09b45483a 100644
--- a/app/frontend/src/internationalization/trans/chefs/vi/vi.json
+++ b/app/frontend/src/internationalization/trans/chefs/vi/vi.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "hướng dẫn sử dụng",
     "referenceGuideC": "để biết thêm chi tiết",
     "specificTeamMembers": "Thành viên nhóm cụ thể",
+    "teamMemberTooltip": "Thêm thành viên nhóm từ cài đặt Quản lý Nhóm sau khi tạo mẫu này.",
     "formFunctionality": "Chức năng biểu mẫu",
     "formSubmissinScheduleMsg": "Lịch gửi biểu mẫu sẽ có sẵn trong Cài đặt biểu mẫu sau khi biểu mẫu được xuất bản.",
     "formSubmissionsSchedule": "Lịch gửi biểu mẫu",
@@ -829,7 +830,8 @@
     "errorSavingFile": "Lỗi khi lưu tệp. Tên tệp: {fileName}. Lỗi: {error}",
     "submittingDraftErrMsg": "Đã xảy ra lỗi khi lưu bản nháp",
     "submittingDraftConsErrMsg": "Lỗi khi lưu bản nháp. Đệ trìnhId: {submissionId}. Lỗi: {error}",
-    "formDraftAccessErrMsg": "Yêu cầu gửi đã được gửi, chuyển hướng đến Xem trang"
+    "formDraftAccessErrMsg": "Yêu cầu gửi đã được gửi, chuyển hướng đến Xem trang",
+    "formUnauthorizedMessage": "Bạn không được phép xem mẫu này, vui lòng liên hệ với chủ sở hữu mẫu để được truy cập."
   },
   "bCGovFooter": {
     "home": "Trang chủ",
diff --git a/app/frontend/src/internationalization/trans/chefs/zh/zh.json b/app/frontend/src/internationalization/trans/chefs/zh/zh.json
index 5f039c577..a093b928c 100644
--- a/app/frontend/src/internationalization/trans/chefs/zh/zh.json
+++ b/app/frontend/src/internationalization/trans/chefs/zh/zh.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "用户指南",
     "referenceGuideC": "更多细节",
     "specificTeamMembers": "具体团队成员",
+    "teamMemberTooltip": "在创建此表单后，从团队管理设置中添加团队成员。",
     "formFunctionality": "表单功能",
     "formSubmissinScheduleMsg": "表单发布后，表单提交计划将在表单设置中可用。",
     "formSubmissionsSchedule": "表格提交时间表",
@@ -829,7 +830,8 @@
     "errorSavingFile": "保存文件时出错。文件名：{fileName}。错误：{error}",
     "submittingDraftErrMsg": "保存草稿时出错",
     "submittingDraftConsErrMsg": "保存草稿时出错。提交 ID：{submissionId}。错误：{error}",
-    "formDraftAccessErrMsg": "请求的提交已提交，正在重定向到查看页面"
+    "formDraftAccessErrMsg": "请求的提交已提交，正在重定向到查看页面",
+    "formUnauthorizedMessage": "您无权查看此表单，请联系表单所有者以获取访问权限。"
   },
   "bCGovFooter": {
     "home": "家",
diff --git a/app/frontend/src/internationalization/trans/chefs/zhTW/zh-TW.json b/app/frontend/src/internationalization/trans/chefs/zhTW/zh-TW.json
index 5b51619b0..a0020fd7b 100644
--- a/app/frontend/src/internationalization/trans/chefs/zhTW/zh-TW.json
+++ b/app/frontend/src/internationalization/trans/chefs/zhTW/zh-TW.json
@@ -100,6 +100,7 @@
     "referenceGuideB": "用戶指南",
     "referenceGuideC": "更多細節",
     "specificTeamMembers": "具體團隊成員",
+    "teamMemberTooltip": "在創建此表單後，從團隊管理設置中添加團隊成員。",
     "formFunctionality": "表單功能",
     "formSubmissinScheduleMsg": "表單發布後，表單提交計劃將在表單設置中可用。",
     "formSubmissionsSchedule": "表格提交時間表",
@@ -829,7 +830,8 @@
     "errorSavingFile": "保存文件時出錯。文件名：{fileName}。錯誤：{error}",
     "submittingDraftErrMsg": "保存草稿時出錯",
     "submittingDraftConsErrMsg": "保存草稿時出錯。提交 ID：{submissionId}。錯誤：{error}",
-    "formDraftAccessErrMsg": "請求的提交已提交，正在重定向到查看頁面"
+    "formDraftAccessErrMsg": "請求的提交已提交，正在重定向到查看頁面",
+    "formUnauthorizedMessage": "您無權查看此表單，請聯繫表單所有者以獲取訪問權限。"
   },
   "bCGovFooter": {
     "home": "家",

From 69d7f69c7f6d02c42b7d26c256273f6fbc4dd8ba Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Mon, 12 Aug 2024 11:00:19 -0700
Subject: [PATCH 04/20] fix: FORMS-1237 validate formSubmissionId parameters
 (#1457)

* fix: FORMS-1237 validate formSubmissionId parameters

* add tests

* added some philosophical docs
---
 app/src/README.md                             |  67 ++++
 .../common/middleware/validateParameter.js    |  19 ++
 app/src/forms/submission/routes.js            |   9 +-
 .../forms/auth/middleware/apiAccess.spec.js   |  10 +-
 .../middleware/validateParameter.spec.js      |  71 ++++-
 app/tests/unit/forms/file/controller.spec.js  |   4 +-
 app/tests/unit/forms/file/routes.spec.js      |   4 +-
 app/tests/unit/forms/form/controller.spec.js  |  34 +-
 .../unit/forms/form/exportService.spec.js     |   4 +-
 .../forms/form/externalApi/controller.spec.js |  14 +-
 .../forms/form/externalApi/routes.spec.js     |   6 +-
 .../forms/form/externalApi/service.spec.js    |  18 +-
 app/tests/unit/forms/form/routes.spec.js      |   9 +-
 app/tests/unit/forms/form/service.spec.js     |  12 +-
 app/tests/unit/forms/proxy/service.spec.js    |   6 +-
 .../unit/forms/submission/routes.spec.js      | 299 +++++++++++++++++-
 .../unit/forms/submission/service.spec.js     |  10 +-
 app/tests/unit/routes/v1/form.spec.js         |   8 +-
 app/tests/unit/routes/v1/submission.spec.js   |  26 +-
 19 files changed, 527 insertions(+), 103 deletions(-)
 create mode 100644 app/src/README.md

diff --git a/app/src/README.md b/app/src/README.md
new file mode 100644
index 000000000..7879b4bd6
--- /dev/null
+++ b/app/src/README.md
@@ -0,0 +1,67 @@
+# Backend API
+
+This is the source code for the Express API. It contains all routes (endpoints) needed to run the application.
+
+## Design
+
+The code is broken down into layers:
+
+- The `middleware` layer provides a collection of utility functions that validate requests, check permissions, etc.
+- The `route` layer uses `middleware` to validate requests and check permissions, and then performs work by calling a `controller`
+- The `controller` layer deals with HTTP requests and responses, and performs work by calling a `service`
+- The `service` layer contains business logic and manipulates data by calling the `model`
+- The `model` layer is the ORM that deals with the database
+
+> Note: Between the `controller` and `service` there is a logical division where nothing below the `controller` knows about requests and responses, and nothing above the `service` touches the `model`.
+
+### Middleware
+
+Express middleware always has to call `next`, otherwise the request hangs.
+
+- when called as `next()` it chains to the next piece of middleware
+- when called as `next(obj)` execution jumps to the error handler with `obj` as the error object
+
+We wrap middleware in a `try`/`catch` to make it obvious that `next` is always called:
+
+```javascript
+const middleware = async (req, _res, next) => {
+  try {
+    // If possible the helper functions should throw a Problem rather than
+    // return a response that needs handling logic.
+    const formId = _getValidFormId(req);
+    const foo = service.getForm(formId);
+
+    next();
+  } catch (error) {
+    next(error);
+  }
+};
+```
+
+#### Testing
+
+Testing the middleware should include but is not limited to:
+
+- TODO
+
+### Routes
+
+Sets up routes with Middleware and then calls a Controller.
+
+#### Testing
+
+Testing the routes should include but is not limited to:
+
+- TODO
+
+### Controllers
+
+Calls Services
+
+### Services
+
+Calls ORM
+
+### ORM
+
+Calls DB
diff --git a/app/src/forms/common/middleware/validateParameter.js b/app/src/forms/common/middleware/validateParameter.js
index 2132b2794..d25e0b702 100644
--- a/app/src/forms/common/middleware/validateParameter.js
+++ b/app/src/forms/common/middleware/validateParameter.js
@@ -122,6 +122,24 @@ const validateFormId = async (_req, _res, next, formId) => {
   }
 };
 
+/**
+ * Validates that the :formSubmissionId route parameter exists and is a UUID.
+ *
+ * @param {*} _req the Express object representing the HTTP request - unused.
+ * @param {*} _res the Express object representing the HTTP response - unused.
+ * @param {*} next the Express chaining function.
+ * @param {*} formSubmissionId the :formSubmissionId value from the route.
+ */
+const validateFormSubmissionId = async (_req, _res, next, formSubmissionId) => {
+  try {
+    _validateUuid(formSubmissionId, 'formSubmissionId');
+
+    next();
+  } catch (error) {
+    next(error);
+  }
+};
+
 /**
  * Validates that the :formVersionDraftId route parameter exists and is a UUID.
  * This validator requires that the :formId route parameter also exists.
@@ -179,6 +197,7 @@ module.exports = {
   validateExternalAPIId,
   validateFileId,
   validateFormId,
+  validateFormSubmissionId,
   validateFormVersionDraftId,
   validateFormVersionId,
 };
diff --git a/app/src/forms/submission/routes.js b/app/src/forms/submission/routes.js
index 2425ef4bf..22622204b 100644
--- a/app/src/forms/submission/routes.js
+++ b/app/src/forms/submission/routes.js
@@ -1,15 +1,18 @@
-const apiAccess = require('../auth/middleware/apiAccess');
 const routes = require('express').Router();
 
-const controller = require('./controller');
-const P = require('../common/constants').Permissions;
+const apiAccess = require('../auth/middleware/apiAccess');
 const { currentUser, hasSubmissionPermissions, filterMultipleSubmissions } = require('../auth/middleware/userAccess');
+const P = require('../common/constants').Permissions;
 const rateLimiter = require('../common/middleware').apiKeyRateLimiter;
 const validateParameter = require('../common/middleware/validateParameter');
 
+const controller = require('./controller');
+
 routes.use(currentUser);
 
 routes.param('documentTemplateId', validateParameter.validateDocumentTemplateId);
+routes.param('formId', validateParameter.validateFormId);
+routes.param('formSubmissionId', validateParameter.validateFormSubmissionId);
 
 routes.get('/:formSubmissionId', rateLimiter, apiAccess, hasSubmissionPermissions([P.SUBMISSION_READ]), async (req, res, next) => {
   await controller.read(req, res, next);
diff --git a/app/tests/unit/forms/auth/middleware/apiAccess.spec.js b/app/tests/unit/forms/auth/middleware/apiAccess.spec.js
index 2a494bf6c..cb6b9be8c 100644
--- a/app/tests/unit/forms/auth/middleware/apiAccess.spec.js
+++ b/app/tests/unit/forms/auth/middleware/apiAccess.spec.js
@@ -1,5 +1,5 @@
 const { getMockReq, getMockRes } = require('@jest-mock/express');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const apiAccess = require('../../../../../src/forms/auth/middleware/apiAccess');
 const formService = require('../../../../../src/forms/form/service');
@@ -8,10 +8,10 @@ const fileService = require('../../../../../src/forms/file/service');
 const { NotFoundError } = require('objection');
 
 describe('apiAccess', () => {
-  const fileId = uuidv4();
-  const formId = uuidv4();
-  const formSubmissionId = uuidv4();
-  const secret = uuidv4();
+  const fileId = uuid.v4();
+  const formId = uuid.v4();
+  const formSubmissionId = uuid.v4();
+  const secret = uuid.v4();
 
   const token = Buffer.from(`${formId}:${secret}`).toString('base64');
   const authHeader = `Basic ${token}`;
diff --git a/app/tests/unit/forms/common/middleware/validateParameter.spec.js b/app/tests/unit/forms/common/middleware/validateParameter.spec.js
index 8aeb0baf3..3aa9076c2 100644
--- a/app/tests/unit/forms/common/middleware/validateParameter.spec.js
+++ b/app/tests/unit/forms/common/middleware/validateParameter.spec.js
@@ -1,24 +1,24 @@
 const { getMockReq, getMockRes } = require('@jest-mock/express');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const validateParameter = require('../../../../../src/forms/common/middleware/validateParameter');
 const externalApiService = require('../../../../../src/forms/form/externalApi/service');
 const formService = require('../../../../../src/forms/form/service');
 const submissionService = require('../../../../../src/forms/submission/service');
 
-const fileId = uuidv4();
-const formId = uuidv4();
-const formSubmissionId = uuidv4();
+const fileId = uuid.v4();
+const formId = uuid.v4();
+const formSubmissionId = uuid.v4();
 
 // Various types of invalid UUIDs that we see in API calls.
-const invalidUuids = [[''], ['undefined'], ['{{id}}'], ['${id}'], [uuidv4() + '.'], [' ' + uuidv4() + ' ']];
+const invalidUuids = [[''], ['undefined'], ['{{id}}'], ['${id}'], [uuid.v4() + '.'], [' ' + uuid.v4() + ' ']];
 
 afterEach(() => {
   jest.clearAllMocks();
 });
 
 describe('validateDocumentTemplateId', () => {
-  const documentTemplateId = uuidv4();
+  const documentTemplateId = uuid.v4();
 
   const mockReadDocumentTemplateResponse = {
     formId: formId,
@@ -86,7 +86,7 @@ describe('validateDocumentTemplateId', () => {
 
     test('formId does not match', async () => {
       formService.documentTemplateRead.mockReturnValueOnce({
-        formId: uuidv4(),
+        formId: uuid.v4(),
         id: documentTemplateId,
       });
       const req = getMockReq({
@@ -107,7 +107,7 @@ describe('validateDocumentTemplateId', () => {
     test('submission formId does not match', async () => {
       submissionService.read.mockReturnValueOnce({
         form: {
-          id: uuidv4(),
+          id: uuid.v4(),
         },
       });
       const req = getMockReq({
@@ -200,7 +200,7 @@ describe('validateDocumentTemplateId', () => {
 });
 
 describe('validateExternalApiId', () => {
-  const externalApiId = uuidv4();
+  const externalApiId = uuid.v4();
 
   const mockReadExternalApiResponse = {
     formId: formId,
@@ -261,7 +261,7 @@ describe('validateExternalApiId', () => {
 
     test('formId does not match', async () => {
       externalApiService.readExternalAPI.mockReturnValueOnce({
-        formId: uuidv4(),
+        formId: uuid.v4(),
         id: externalApiId,
       });
       const req = getMockReq({
@@ -402,8 +402,51 @@ describe('validateFormId', () => {
   });
 });
 
+describe('validateFormSubmissionId', () => {
+  describe('400 response when', () => {
+    const expectedStatus = { status: 400 };
+
+    test('formSubmissionId is missing', async () => {
+      const req = getMockReq({
+        params: {},
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateFormSubmissionId(req, res, next);
+
+      expect(next).toBeCalledWith(expect.objectContaining(expectedStatus));
+    });
+
+    test.each(invalidUuids)('formSubmissionId is "%s"', async (eachFormSubmissionId) => {
+      const req = getMockReq({
+        params: { formSubmissionId: eachFormSubmissionId },
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateFormSubmissionId(req, res, next, eachFormSubmissionId);
+
+      expect(next).toBeCalledWith(expect.objectContaining(expectedStatus));
+    });
+  });
+
+  describe('allows', () => {
+    test('uuid for formSubmissionId', async () => {
+      const req = getMockReq({
+        params: {
+          formSubmissionId: formSubmissionId,
+        },
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateFormSubmissionId(req, res, next, formSubmissionId);
+
+      expect(next).toBeCalledWith();
+    });
+  });
+});
+
 describe('validateFormVersionDraftId', () => {
-  const formVersionDraftId = uuidv4();
+  const formVersionDraftId = uuid.v4();
 
   const mockReadDraftResponse = {
     formId: formId,
@@ -461,7 +504,7 @@ describe('validateFormVersionDraftId', () => {
 
     test('formId does not match', async () => {
       formService.readDraft.mockReturnValueOnce({
-        formId: uuidv4(),
+        formId: uuid.v4(),
         id: formVersionDraftId,
       });
       const req = getMockReq({
@@ -517,7 +560,7 @@ describe('validateFormVersionDraftId', () => {
 });
 
 describe('validateFormVersionId', () => {
-  const formVersionId = uuidv4();
+  const formVersionId = uuid.v4();
 
   const mockReadVersionResponse = {
     formId: formId,
@@ -575,7 +618,7 @@ describe('validateFormVersionId', () => {
 
     test('formId does not match', async () => {
       formService.readVersion.mockReturnValueOnce({
-        formId: uuidv4(),
+        formId: uuid.v4(),
         id: formVersionId,
       });
       const req = getMockReq({
diff --git a/app/tests/unit/forms/file/controller.spec.js b/app/tests/unit/forms/file/controller.spec.js
index e23c62db5..cbe00f3be 100644
--- a/app/tests/unit/forms/file/controller.spec.js
+++ b/app/tests/unit/forms/file/controller.spec.js
@@ -1,5 +1,5 @@
 const { getMockReq, getMockRes } = require('@jest-mock/express');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const controller = require('../../../../src/forms/file/controller');
 const service = require('../../../../src/forms/file/service');
@@ -12,7 +12,7 @@ const currentUser = {
 const fileStorage = {
   createdAt: '2024-06-25T13:53:01-0700',
   createdBy: currentUser.usernameIdp,
-  id: uuidv4(),
+  id: uuid.v4(),
   mimeType: 'text/plain',
   originalName: 'testfile.txt',
   path: '/some/path',
diff --git a/app/tests/unit/forms/file/routes.spec.js b/app/tests/unit/forms/file/routes.spec.js
index 206ea04a1..69d7f8fa1 100644
--- a/app/tests/unit/forms/file/routes.spec.js
+++ b/app/tests/unit/forms/file/routes.spec.js
@@ -1,5 +1,5 @@
 const request = require('supertest');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
@@ -94,7 +94,7 @@ describe(`${basePath}`, () => {
 });
 
 describe(`${basePath}/:id`, () => {
-  const fileId = uuidv4();
+  const fileId = uuid.v4();
   const path = `${basePath}/${fileId}`;
 
   it('should have correct middleware for DELETE', async () => {
diff --git a/app/tests/unit/forms/form/controller.spec.js b/app/tests/unit/forms/form/controller.spec.js
index 78e70f65c..630ba5899 100644
--- a/app/tests/unit/forms/form/controller.spec.js
+++ b/app/tests/unit/forms/form/controller.spec.js
@@ -1,5 +1,5 @@
 const { getMockReq, getMockRes } = require('@jest-mock/express');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const controller = require('../../../../src/forms/form/controller');
 const exportService = require('../../../../src/forms/form/exportService');
@@ -11,15 +11,15 @@ const currentUser = {
 
 const documentTemplate = {
   filename: 'cdogs_template.txt',
-  formId: uuidv4(),
-  id: uuidv4(),
+  formId: uuid.v4(),
+  id: uuid.v4(),
   template: 'My Template',
 };
 
 const error = new Error('error');
 
 // Various strings that should produce 400 errors when used as UUIDs.
-const testCases400 = [[''], ['undefined'], ['{{oops}}'], [uuidv4() + '.']];
+const testCases400 = [[''], ['undefined'], ['{{oops}}'], [uuid.v4() + '.']];
 
 //
 // Mock out all happy-path service calls.
@@ -275,7 +275,7 @@ describe('form controller', () => {
 });
 
 describe('listFormSubmissions', () => {
-  const uuid = uuidv4();
+  const formId = uuid.v4();
   const mockResponse = {
     results: [
       {
@@ -287,7 +287,7 @@ describe('listFormSubmissions', () => {
   it('should 200 if the formId is valid', async () => {
     // Arrange
     service.listFormSubmissions = jest.fn().mockReturnValue(mockResponse);
-    const req = getMockReq({ params: { formId: uuid } });
+    const req = getMockReq({ params: { formId: formId } });
     const { res, next } = getMockRes();
 
     // Act
@@ -313,9 +313,9 @@ describe('listFormSubmissions', () => {
     expect(res.json).toBeCalledWith({ detail: 'Bad formId "undefined".' });
   });
 
-  test.each(testCases400)('should 400 if the formId is "%s"', async (formId) => {
+  test.each(testCases400)('should 400 if the formId is "%s"', async (eachFormId) => {
     // Arrange
-    const req = getMockReq({ params: { formId: formId } });
+    const req = getMockReq({ params: { formId: eachFormId } });
     const { res, next } = getMockRes();
 
     // Act
@@ -324,7 +324,7 @@ describe('listFormSubmissions', () => {
     // Assert
     expect(service.listFormSubmissions).toBeCalledTimes(0);
     expect(res.status).toBeCalledWith(400);
-    expect(res.json).toBeCalledWith({ detail: `Bad formId "${formId}".` });
+    expect(res.json).toBeCalledWith({ detail: `Bad formId "${eachFormId}".` });
   });
 
   it('should forward service errors for handling elsewhere', async () => {
@@ -333,7 +333,7 @@ describe('listFormSubmissions', () => {
     service.listFormSubmissions = jest.fn(() => {
       throw error;
     });
-    const req = getMockReq({ params: { formId: uuid } });
+    const req = getMockReq({ params: { formId: formId } });
     const { res, next } = getMockRes();
 
     // Act
@@ -346,17 +346,17 @@ describe('listFormSubmissions', () => {
 });
 
 describe('readFormOptions', () => {
-  const uuid = uuidv4();
+  const formId = uuid.v4();
   const mockReadResponse = {
     form: {
-      id: uuid,
+      id: formId,
     },
   };
 
   it('should 200 if the formId is valid', async () => {
     // Arrange
     service.readFormOptions = jest.fn().mockReturnValue(mockReadResponse);
-    const req = getMockReq({ params: { formId: uuid } });
+    const req = getMockReq({ params: { formId: formId } });
     const { res, next } = getMockRes();
 
     // Act
@@ -382,9 +382,9 @@ describe('readFormOptions', () => {
     expect(res.json).toBeCalledWith({ detail: 'Bad formId "undefined".' });
   });
 
-  test.each(testCases400)('should 400 if the formId is "%s"', async (formId) => {
+  test.each(testCases400)('should 400 if the formId is "%s"', async (eachFormId) => {
     // Arrange
-    const req = getMockReq({ params: { formId: formId } });
+    const req = getMockReq({ params: { formId: eachFormId } });
     const { res, next } = getMockRes();
 
     // Act
@@ -393,7 +393,7 @@ describe('readFormOptions', () => {
     // Assert
     expect(service.readFormOptions).toBeCalledTimes(0);
     expect(res.status).toBeCalledWith(400);
-    expect(res.json).toBeCalledWith({ detail: `Bad formId "${formId}".` });
+    expect(res.json).toBeCalledWith({ detail: `Bad formId "${eachFormId}".` });
   });
 
   it('should forward service errors for handling elsewhere', async () => {
@@ -402,7 +402,7 @@ describe('readFormOptions', () => {
     service.readFormOptions = jest.fn(() => {
       throw error;
     });
-    const req = getMockReq({ params: { formId: uuid } });
+    const req = getMockReq({ params: { formId: formId } });
     const { res, next } = getMockRes();
 
     // Act
diff --git a/app/tests/unit/forms/form/exportService.spec.js b/app/tests/unit/forms/form/exportService.spec.js
index 329355431..b57895ee2 100644
--- a/app/tests/unit/forms/form/exportService.spec.js
+++ b/app/tests/unit/forms/form/exportService.spec.js
@@ -1,4 +1,4 @@
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const exportService = require('../../../../src/forms/form/exportService');
 const emailService = require('../../../../src/forms/email/emailService');
@@ -14,7 +14,7 @@ jest.mock('../../../../src/forms/common/models/views/submissionData', () => ({
   then: jest.fn().mockReturnThis(),
 }));
 
-const formId = uuidv4();
+const formId = uuid.v4();
 
 const getCsvRowCount = (result) => {
   return result.data.split('\n').length;
diff --git a/app/tests/unit/forms/form/externalApi/controller.spec.js b/app/tests/unit/forms/form/externalApi/controller.spec.js
index 69aa55532..9983bd4b6 100644
--- a/app/tests/unit/forms/form/externalApi/controller.spec.js
+++ b/app/tests/unit/forms/form/externalApi/controller.spec.js
@@ -1,5 +1,5 @@
 const { getMockReq, getMockRes } = require('@jest-mock/express');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { ENCRYPTION_ALGORITHMS } = require('../../../../../src/components/encryptionService');
 
@@ -96,9 +96,9 @@ describe('createExternalAPI', () => {
     });
   });
 
-  const formId = uuidv4();
+  const formId = uuid.v4();
   const externalApi = {
-    id: uuidv4(),
+    id: uuid.v4(),
     formId: formId,
     name: 'test_api',
     endpointUrl: 'http://external.api/',
@@ -192,8 +192,8 @@ describe('updateExternalAPI', () => {
     });
   });
 
-  const formId = uuidv4();
-  const externalAPIId = uuidv4();
+  const formId = uuid.v4();
+  const externalAPIId = uuid.v4();
   const externalApi = {
     id: externalAPIId,
     formId: formId,
@@ -289,8 +289,8 @@ describe('deleteExternalAPI', () => {
     });
   });
 
-  const formId = uuidv4();
-  const externalAPIId = uuidv4();
+  const formId = uuid.v4();
+  const externalAPIId = uuid.v4();
 
   const validRequest = {
     currentUser: currentUser,
diff --git a/app/tests/unit/forms/form/externalApi/routes.spec.js b/app/tests/unit/forms/form/externalApi/routes.spec.js
index 6a9605a58..94fd983c8 100644
--- a/app/tests/unit/forms/form/externalApi/routes.spec.js
+++ b/app/tests/unit/forms/form/externalApi/routes.spec.js
@@ -1,5 +1,5 @@
 const request = require('supertest');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../../common/helper');
 
@@ -69,7 +69,7 @@ validateParameter.validateFormId = jest.fn((_req, _res, next) => {
 validateParameter.validateExternalAPIId = jest.fn((_req, _res, next) => {
   next();
 });
-const formId = uuidv4();
+const formId = uuid.v4();
 
 //
 // Create the router and a simple Express server.
@@ -127,7 +127,7 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
 });
 
 describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
-  const externalAPIId = uuidv4();
+  const externalAPIId = uuid.v4();
   const path = `${basePath}/${formId}/externalAPIs/${externalAPIId}`;
   controller.updateExternalAPI = jest.fn((_req, _res, next) => {
     next();
diff --git a/app/tests/unit/forms/form/externalApi/service.spec.js b/app/tests/unit/forms/form/externalApi/service.spec.js
index 3d1903064..620429d02 100644
--- a/app/tests/unit/forms/form/externalApi/service.spec.js
+++ b/app/tests/unit/forms/form/externalApi/service.spec.js
@@ -1,6 +1,6 @@
 const { MockModel, MockTransaction } = require('../../../../common/dbHelper');
 
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { ExternalAPIStatuses } = require('../../../../../src/forms/common/constants');
 const service = require('../../../../../src/forms/form/externalApi/service');
@@ -21,8 +21,8 @@ describe('checkAllowSendUserToken', () => {
   let validData = null;
   beforeEach(() => {
     validData = {
-      id: uuidv4(),
-      formId: uuidv4(),
+      id: uuid.v4(),
+      formId: uuid.v4(),
       name: 'test_api',
       endpointUrl: 'http://external.api/',
       sendApiKey: true,
@@ -65,8 +65,8 @@ describe('validateExternalAPI', () => {
   let validData = null;
   beforeEach(() => {
     validData = {
-      id: uuidv4(),
-      formId: uuidv4(),
+      id: uuid.v4(),
+      formId: uuid.v4(),
       name: 'test_api',
       endpointUrl: 'http://external.api/',
       sendApiKey: true,
@@ -130,8 +130,8 @@ describe('createExternalAPI', () => {
     MockModel.mockReset();
     MockTransaction.mockReset();
     validData = {
-      id: uuidv4(),
-      formId: uuidv4(),
+      id: uuid.v4(),
+      formId: uuid.v4(),
       name: 'test_api',
       endpointUrl: 'http://external.api/',
       sendApiKey: true,
@@ -180,8 +180,8 @@ describe('updateExternalAPI', () => {
     MockModel.mockReset();
     MockTransaction.mockReset();
     validData = {
-      id: uuidv4(),
-      formId: uuidv4(),
+      id: uuid.v4(),
+      formId: uuid.v4(),
       name: 'test_api',
       endpointUrl: 'http://external.api/',
       sendApiKey: true,
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 242958cd8..2ab130875 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -1,5 +1,5 @@
 const request = require('supertest');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
@@ -13,9 +13,6 @@ const controller = require('../../../../src/forms/form/controller');
 // Mock out all the middleware - we're testing that the routes are set up
 // correctly, not the functionality of the middleware.
 //
-//
-// mock middleware
-//
 const jwtService = require('../../../../src/components/jwtService');
 
 //
@@ -70,8 +67,8 @@ validateParameter.validateFormId = jest.fn((_req, _res, next) => {
   next();
 });
 
-const documentTemplateId = uuidv4();
-const formId = uuidv4();
+const documentTemplateId = uuid.v4();
+const formId = uuid.v4();
 
 //
 // Create the router and a simple Express server.
diff --git a/app/tests/unit/forms/form/service.spec.js b/app/tests/unit/forms/form/service.spec.js
index 8e91daa48..9ae660f54 100644
--- a/app/tests/unit/forms/form/service.spec.js
+++ b/app/tests/unit/forms/form/service.spec.js
@@ -1,6 +1,6 @@
 const { MockModel, MockTransaction } = require('../../../common/dbHelper');
 
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { EmailTypes } = require('../../../../src/forms/common/constants');
 const service = require('../../../../src/forms/form/service');
@@ -9,8 +9,8 @@ jest.mock('../../../../src/forms/common/models/tables/documentTemplate', () => M
 jest.mock('../../../../src/forms/common/models/tables/formEmailTemplate', () => MockModel);
 jest.mock('../../../../src/forms/common/models/views/submissionMetadata', () => MockModel);
 
-const documentTemplateId = uuidv4();
-const formId = uuidv4();
+const documentTemplateId = uuid.v4();
+const formId = uuid.v4();
 
 const currentUser = {
   usernameIdp: 'TESTER',
@@ -689,7 +689,7 @@ describe('popFormLevelInfo', () => {
 
 describe('_getDefaultEmailTemplate', () => {
   it('should return a template', async () => {
-    const formId = uuidv4();
+    const formId = uuid.v4();
     const template = service._getDefaultEmailTemplate(formId, EmailTypes.SUBMISSION_CONFIRMATION);
 
     expect(template.formId).toEqual(formId);
@@ -773,7 +773,7 @@ describe('createOrUpdateEmailTemplates', () => {
   });
 
   it('should update template when it already exists', async () => {
-    const id = uuidv4();
+    const id = uuid.v4();
     service.readEmailTemplate = jest.fn().mockReturnValue({ id: id, ...emailTemplate });
     service.readEmailTemplates = jest.fn().mockReturnValue([{ id: id, ...emailTemplate }]);
 
@@ -806,7 +806,7 @@ describe('createOrUpdateEmailTemplates', () => {
   });
 
   it('should rollback when an update error occurs inside transaction', async () => {
-    const id = uuidv4();
+    const id = uuid.v4();
     service.readEmailTemplate = jest.fn().mockReturnValue({ id: id, ...emailTemplate });
     service.readEmailTemplates = jest.fn().mockReturnValue([{ id: id, ...emailTemplate }]);
     MockModel.update = jest.fn().mockRejectedValueOnce(new Error('SQL Error'));
diff --git a/app/tests/unit/forms/proxy/service.spec.js b/app/tests/unit/forms/proxy/service.spec.js
index 2fa294125..7c3d953dc 100644
--- a/app/tests/unit/forms/proxy/service.spec.js
+++ b/app/tests/unit/forms/proxy/service.spec.js
@@ -1,6 +1,6 @@
 const { MockModel, MockTransaction } = require('../../../common/dbHelper');
 
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { encryptionService, ENCRYPTION_ALGORITHMS } = require('../../../../src/components/encryptionService');
 const service = require('../../../../src/forms/proxy/service');
@@ -33,8 +33,8 @@ const goodProxyHeaderInfo = {
 delete goodProxyHeaderInfo.idpUserId;
 
 const goodExternalApi = {
-  id: uuidv4(),
-  formId: uuidv4(),
+  id: uuid.v4(),
+  formId: uuid.v4(),
   name: 'test_api',
   endpointUrl: 'http://external.api/',
   sendApiKey: true,
diff --git a/app/tests/unit/forms/submission/routes.spec.js b/app/tests/unit/forms/submission/routes.spec.js
index d47f04df3..f44af8400 100644
--- a/app/tests/unit/forms/submission/routes.spec.js
+++ b/app/tests/unit/forms/submission/routes.spec.js
@@ -1,5 +1,5 @@
 const request = require('supertest');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
@@ -31,9 +31,51 @@ apiAccess.mockImplementation(
   })
 );
 
+controller.addNote = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.addStatus = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.delete = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.deleteMutipleSubmissions = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.email = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.getNotes = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.getStatus = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.listEdits = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.read = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.readOptions = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.restore = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.restoreMutipleSubmissions = jest.fn((_req, _res, next) => {
+  next();
+});
 controller.templateRender = jest.fn((_req, _res, next) => {
   next();
 });
+controller.templateUploadAndRender = jest.fn((_req, _res, next) => {
+  next();
+});
+controller.update = jest.fn((_req, _res, next) => {
+  next();
+});
 
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
@@ -46,7 +88,9 @@ const hasSubmissionPermissionsMock = jest.fn((_req, _res, next) => {
 userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
-
+userAccess.filterMultipleSubmissions = jest.fn((_req, _res, next) => {
+  next();
+});
 userAccess.hasSubmissionPermissions = jest.fn(() => {
   return hasSubmissionPermissionsMock;
 });
@@ -54,9 +98,16 @@ userAccess.hasSubmissionPermissions = jest.fn(() => {
 validateParameter.validateDocumentTemplateId = jest.fn((_req, _res, next) => {
   next();
 });
+validateParameter.validateFormId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateFormSubmissionId = jest.fn((_req, _res, next) => {
+  next();
+});
 
-const documentTemplateId = uuidv4();
-const formSubmissionId = uuidv4();
+const documentTemplateId = uuid.v4();
+const formId = uuid.v4();
+const formSubmissionId = uuid.v4();
 
 //
 // Create the router and a simple Express server.
@@ -71,16 +122,256 @@ afterEach(() => {
   jest.clearAllMocks();
 });
 
+describe(`${basePath}/:formSubmissionId`, () => {
+  const path = `${basePath}/${formSubmissionId}`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.delete).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.read).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.update).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
+  const path = `${basePath}/${formSubmissionId}/${formId}/submissions`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
+    expect(controller.deleteMutipleSubmissions).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
+  const path = `${basePath}/${formSubmissionId}/${formId}/submissions/restore`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
+    expect(controller.restoreMutipleSubmissions).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/edits`, () => {
+  const path = `${basePath}/${formSubmissionId}/edits`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.listEdits).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/email`, () => {
+  const path = `${basePath}/${formSubmissionId}/email`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.email).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/notes`, () => {
+  const path = `${basePath}/${formSubmissionId}/notes`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.getNotes).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.addNote).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/options`, () => {
+  const path = `${basePath}/${formSubmissionId}/options`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.readOptions).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/restore`, () => {
+  const path = `${basePath}/${formSubmissionId}/restore`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.restore).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formSubmissionId/status`, () => {
+  const path = `${basePath}/${formSubmissionId}/status`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.getStatus).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.addStatus).toBeCalledTimes(1);
+  });
+});
+
 describe(`${basePath}/:formSubmissionId/template/:documentTemplateId/render`, () => {
   const path = `${basePath}/${formSubmissionId}/template/${documentTemplateId}/render`;
 
   it('should have correct middleware for GET', async () => {
     await appRequest.get(path);
 
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
     expect(apiAccess).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(controller.templateRender).toBeCalledTimes(1);
   });
 });
+
+describe(`${basePath}/:formSubmissionId/template/render`, () => {
+  const path = `${basePath}/${formSubmissionId}/template/render`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
+    expect(controller.templateUploadAndRender).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/submission/service.spec.js b/app/tests/unit/forms/submission/service.spec.js
index 2070af1b1..40a5b8db6 100644
--- a/app/tests/unit/forms/submission/service.spec.js
+++ b/app/tests/unit/forms/submission/service.spec.js
@@ -1,5 +1,5 @@
 const { MockModel, MockTransaction } = require('../../../common/dbHelper');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 jest.mock('../../../../src/forms/common/models/tables/formSubmissionStatus', () => MockModel);
 jest.mock('../../../../src/forms/common/models/tables/formSubmission', () => MockModel);
@@ -54,8 +54,8 @@ describe('createStatus', () => {
 
 describe('deleteMutipleSubmissions', () => {
   it('should delete the selected submissions', async () => {
-    let submissionId1 = uuidv4();
-    let submissionId2 = uuidv4();
+    let submissionId1 = uuid.v4();
+    let submissionId2 = uuid.v4();
     const submissionIds = [submissionId1, submissionId2];
 
     const returnValue = {
@@ -85,8 +85,8 @@ describe('deleteMutipleSubmissions', () => {
 
 describe('restoreMutipleSubmissions', () => {
   it('should delete the selected submissions', async () => {
-    let submissionId1 = uuidv4();
-    let submissionId2 = uuidv4();
+    let submissionId1 = uuid.v4();
+    let submissionId2 = uuid.v4();
     const submissionIds = [submissionId1, submissionId2];
 
     const returnValue = {
diff --git a/app/tests/unit/routes/v1/form.spec.js b/app/tests/unit/routes/v1/form.spec.js
index ffdb78efc..c2a0fa4bf 100644
--- a/app/tests/unit/routes/v1/form.spec.js
+++ b/app/tests/unit/routes/v1/form.spec.js
@@ -1,6 +1,6 @@
 const request = require('supertest');
 const Problem = require('api-problem');
-const { v4: uuidv4 } = require('uuid');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
@@ -28,9 +28,9 @@ userAccess.hasFormPermissions = jest.fn(() => {
   });
 });
 
-const formId = uuidv4();
-const formVersionDraftId = uuidv4();
-const formVersionId = uuidv4();
+const formId = uuid.v4();
+const formVersionDraftId = uuid.v4();
+const formVersionId = uuid.v4();
 
 //
 // we will mock the underlying data service calls...
diff --git a/app/tests/unit/routes/v1/submission.spec.js b/app/tests/unit/routes/v1/submission.spec.js
index a2871efb7..de4fb20b4 100644
--- a/app/tests/unit/routes/v1/submission.spec.js
+++ b/app/tests/unit/routes/v1/submission.spec.js
@@ -1,8 +1,12 @@
-const request = require('supertest');
 const Problem = require('api-problem');
+const request = require('supertest');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
+const formId = uuid.v4();
+const formSubmissionId = uuid.v4();
+
 //
 // mock middleware
 //
@@ -49,7 +53,7 @@ afterEach(() => {
 });
 
 describe(`${basePath}/:formSubmissionId`, () => {
-  const path = `${basePath}/:formSubmissionId`;
+  const path = `${basePath}/${formSubmissionId}`;
 
   describe('DELETE', () => {
     it('should return 200', async () => {
@@ -161,7 +165,7 @@ describe(`${basePath}/:formSubmissionId`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/edits`, () => {
-  const path = `${basePath}/:formSubmissionId/edits`;
+  const path = `${basePath}/${formSubmissionId}/edits`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -201,7 +205,7 @@ describe(`${basePath}/:formSubmissionId/edits`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/email`, () => {
-  const path = `${basePath}/:formSubmissionId/email`;
+  const path = `${basePath}/${formSubmissionId}/email`;
 
   describe('POST', () => {
     const submissionResult = { form: { id: '' }, submission: { id: '' }, version: { id: '' } };
@@ -259,7 +263,7 @@ describe(`${basePath}/:formSubmissionId/email`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
-  const path = `${basePath}/:formSubmissionId/:formId/submissions`;
+  const path = `${basePath}/${formSubmissionId}/${formId}/submissions`;
 
   describe('DELETE', () => {
     it('should return 200', async () => {
@@ -299,7 +303,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
-  const path = `${basePath}/:formSubmissionId/:formId/submissions/restore`;
+  const path = `${basePath}/${formSubmissionId}/${formId}/submissions/restore`;
 
   describe('PUT', () => {
     it('should return 200', async () => {
@@ -339,7 +343,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/notes`, () => {
-  const path = `${basePath}/:formSubmissionId/notes`;
+  const path = `${basePath}/${formSubmissionId}/notes`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -416,7 +420,7 @@ describe(`${basePath}/:formSubmissionId/notes`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/options`, () => {
-  const path = `${basePath}/:formSubmissionId/options`;
+  const path = `${basePath}/${formSubmissionId}/options`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -456,7 +460,7 @@ describe(`${basePath}/:formSubmissionId/options`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/restore`, () => {
-  const path = `${basePath}/:formSubmissionId/restore`;
+  const path = `${basePath}/${formSubmissionId}/restore`;
 
   describe('PUT', () => {
     it('should return 200', async () => {
@@ -496,7 +500,7 @@ describe(`${basePath}/:formSubmissionId/restore`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/status`, () => {
-  const path = `${basePath}/:formSubmissionId/status`;
+  const path = `${basePath}/${formSubmissionId}/status`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -577,7 +581,7 @@ describe(`${basePath}/:formSubmissionId/status`, () => {
 });
 
 describe(`${basePath}/:formSubmissionId/template/render`, () => {
-  const path = `${basePath}/:formSubmissionId/template/render`;
+  const path = `${basePath}/${formSubmissionId}/template/render`;
 
   describe('POST', () => {
     it('should return 200', async () => {

From b37ca7a96cb8c4689530c5eeba53cd8508b800aa Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Mon, 12 Aug 2024 11:48:16 -0700
Subject: [PATCH 05/20] fix: FORMS-1409 fix mutiple typos (#1464)

---
 app/frontend/src/services/formService.js      |  4 ++--
 app/frontend/src/store/form.js                |  2 +-
 .../tests/unit/services/formService.spec.js   |  2 +-
 .../unit/store/modules/form.actions.spec.js   |  2 +-
 app/src/forms/submission/controller.js        |  8 +++----
 app/src/forms/submission/routes.js            |  4 ++--
 app/src/forms/submission/service.js           |  4 ++--
 .../unit/forms/submission/controller.spec.js  | 24 +++++++++----------
 .../unit/forms/submission/routes.spec.js      |  8 +++----
 .../unit/forms/submission/service.spec.js     |  8 +++----
 app/tests/unit/routes/v1/submission.spec.js   | 12 +++++-----
 11 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/app/frontend/src/services/formService.js b/app/frontend/src/services/formService.js
index 31bfa75ca..957b9dea2 100644
--- a/app/frontend/src/services/formService.js
+++ b/app/frontend/src/services/formService.js
@@ -320,12 +320,12 @@ export default {
   },
 
   /**
-   * @function restoreMutipleSubmissions
+   * @function restoreMultipleSubmissions
    * Restores an existing submission
    * @param {string} submissionId The form uuid
    * @returns {Promise} An axios response
    */
-  restoreMutipleSubmissions(submissionId, formId, requestBody) {
+  restoreMultipleSubmissions(submissionId, formId, requestBody) {
     return appAxios().put(
       `${ApiRoutes.SUBMISSION}/${submissionId}/${formId}/submissions/restore`,
       requestBody
diff --git a/app/frontend/src/store/form.js b/app/frontend/src/store/form.js
index 27ee6ae43..739ddbff7 100644
--- a/app/frontend/src/store/form.js
+++ b/app/frontend/src/store/form.js
@@ -513,7 +513,7 @@ export const useFormStore = defineStore('form', {
       const notificationStore = useNotificationStore();
       try {
         // Get this submission
-        await formService.restoreMutipleSubmissions(submissionIds[0], formId, {
+        await formService.restoreMultipleSubmissions(submissionIds[0], formId, {
           submissionIds: submissionIds,
         });
         notificationStore.addNotification({
diff --git a/app/frontend/tests/unit/services/formService.spec.js b/app/frontend/tests/unit/services/formService.spec.js
index a3782a7dc..2576556a7 100644
--- a/app/frontend/tests/unit/services/formService.spec.js
+++ b/app/frontend/tests/unit/services/formService.spec.js
@@ -491,7 +491,7 @@ describe('Form Service', () => {
         '0715b1ac-4069-4778-a868-b4f71fdea18d',
       ];
 
-      const result = await formService.restoreMutipleSubmissions(
+      const result = await formService.restoreMultipleSubmissions(
         submissionId,
         formId,
         { submissionIds }
diff --git a/app/frontend/tests/unit/store/modules/form.actions.spec.js b/app/frontend/tests/unit/store/modules/form.actions.spec.js
index 6d559c41a..555f6683e 100644
--- a/app/frontend/tests/unit/store/modules/form.actions.spec.js
+++ b/app/frontend/tests/unit/store/modules/form.actions.spec.js
@@ -259,7 +259,7 @@ describe('form actions', () => {
     });
 
     it('restoreMultiSubmissions should dispatch to notifications/addNotification', async () => {
-      formService.restoreMutipleSubmissions.mockRejectedValue('');
+      formService.restoreMultipleSubmissions.mockRejectedValue('');
       await mockStore.restoreMultiSubmissions(['sId']);
 
       expect(addNotificationSpy).toHaveBeenCalledTimes(1);
diff --git a/app/src/forms/submission/controller.js b/app/src/forms/submission/controller.js
index b29a9c853..fbd8cf20e 100644
--- a/app/src/forms/submission/controller.js
+++ b/app/src/forms/submission/controller.js
@@ -36,19 +36,19 @@ module.exports = {
       next(error);
     }
   },
-  deleteMutipleSubmissions: async (req, res, next) => {
+  deleteMultipleSubmissions: async (req, res, next) => {
     try {
       let submissionIds = req.body && req.body.submissionIds ? req.body.submissionIds : [];
-      const response = await service.deleteMutipleSubmissions(submissionIds, req.currentUser);
+      const response = await service.deleteMultipleSubmissions(submissionIds, req.currentUser);
       res.status(200).json(response);
     } catch (error) {
       next(error);
     }
   },
-  restoreMutipleSubmissions: async (req, res, next) => {
+  restoreMultipleSubmissions: async (req, res, next) => {
     try {
       let submissionIds = req.body && req.body.submissionIds ? req.body.submissionIds : [];
-      const response = await service.restoreMutipleSubmissions(submissionIds, req.currentUser);
+      const response = await service.restoreMultipleSubmissions(submissionIds, req.currentUser);
       res.status(200).json(response);
     } catch (error) {
       next(error);
diff --git a/app/src/forms/submission/routes.js b/app/src/forms/submission/routes.js
index 22622204b..f18cab3ce 100644
--- a/app/src/forms/submission/routes.js
+++ b/app/src/forms/submission/routes.js
@@ -27,7 +27,7 @@ routes.delete('/:formSubmissionId', rateLimiter, apiAccess, hasSubmissionPermiss
 });
 
 routes.put('/:formSubmissionId/:formId/submissions/restore', hasSubmissionPermissions([P.SUBMISSION_DELETE]), filterMultipleSubmissions, async (req, res, next) => {
-  await controller.restoreMutipleSubmissions(req, res, next);
+  await controller.restoreMultipleSubmissions(req, res, next);
 });
 
 routes.put('/:formSubmissionId/restore', hasSubmissionPermissions([P.SUBMISSION_DELETE]), async (req, res, next) => {
@@ -71,7 +71,7 @@ routes.post('/:formSubmissionId/template/render', rateLimiter, apiAccess, hasSub
 });
 
 routes.delete('/:formSubmissionId/:formId/submissions', hasSubmissionPermissions([P.SUBMISSION_DELETE]), filterMultipleSubmissions, async (req, res, next) => {
-  await controller.deleteMutipleSubmissions(req, res, next);
+  await controller.deleteMultipleSubmissions(req, res, next);
 });
 
 module.exports = routes;
diff --git a/app/src/forms/submission/service.js b/app/src/forms/submission/service.js
index 36c9a642f..a87c101fa 100644
--- a/app/src/forms/submission/service.js
+++ b/app/src/forms/submission/service.js
@@ -191,7 +191,7 @@ const service = {
     }
   },
 
-  deleteMutipleSubmissions: async (submissionIds, currentUser) => {
+  deleteMultipleSubmissions: async (submissionIds, currentUser) => {
     let trx;
     try {
       trx = await FormSubmission.startTransaction();
@@ -204,7 +204,7 @@ const service = {
     }
   },
 
-  restoreMutipleSubmissions: async (submissionIds, currentUser) => {
+  restoreMultipleSubmissions: async (submissionIds, currentUser) => {
     let trx;
     try {
       trx = await FormSubmission.startTransaction();
diff --git a/app/tests/unit/forms/submission/controller.spec.js b/app/tests/unit/forms/submission/controller.spec.js
index da2f96e6d..b2fb8da37 100644
--- a/app/tests/unit/forms/submission/controller.spec.js
+++ b/app/tests/unit/forms/submission/controller.spec.js
@@ -357,7 +357,7 @@ describe('template rendering', () => {
   });
 });
 
-describe('deleteMutipleSubmissions', () => {
+describe('deleteMultipleSubmissions', () => {
   const returnValue = {
     submission: [
       { id: 'ac4ef441-43b1-414a-a0d4-1e2f67c2a745', formVersionId: '8d8e24ce-326f-4536-9100-a0844c27d5a0', confirmationId: 'AC4EF441', draft: false, deleted: true },
@@ -373,16 +373,16 @@ describe('deleteMutipleSubmissions', () => {
     currentUser: {},
     headers: {},
   };
-  it('should call deleteMutipleSubmissions service in controller', async () => {
-    service.deleteMutipleSubmissions = jest.fn().mockReturnValue(returnValue);
-    await controller.deleteMutipleSubmissions(req, {}, jest.fn());
+  it('should call deleteMultipleSubmissions service in controller', async () => {
+    service.deleteMultipleSubmissions = jest.fn().mockReturnValue(returnValue);
+    await controller.deleteMultipleSubmissions(req, {}, jest.fn());
 
-    expect(service.deleteMutipleSubmissions).toBeCalledTimes(1);
-    expect(service.deleteMutipleSubmissions).toBeCalledWith(req.body.submissionIds, req.currentUser);
+    expect(service.deleteMultipleSubmissions).toBeCalledTimes(1);
+    expect(service.deleteMultipleSubmissions).toBeCalledWith(req.body.submissionIds, req.currentUser);
   });
 });
 
-describe('restoreMutipleSubmissions', () => {
+describe('restoreMultipleSubmissions', () => {
   const returnValue = {
     submission: [
       { id: 'ac4ef441-43b1-414a-a0d4-1e2f67c2a745', formVersionId: '8d8e24ce-326f-4536-9100-a0844c27d5a0', confirmationId: 'AC4EF441', draft: false, deleted: false },
@@ -398,11 +398,11 @@ describe('restoreMutipleSubmissions', () => {
     currentUser: {},
     headers: {},
   };
-  it('should call restoreMutipleSubmissions service in controller', async () => {
-    service.restoreMutipleSubmissions = jest.fn().mockReturnValue(returnValue);
-    await controller.restoreMutipleSubmissions(req, {}, jest.fn());
+  it('should call restoreMultipleSubmissions service in controller', async () => {
+    service.restoreMultipleSubmissions = jest.fn().mockReturnValue(returnValue);
+    await controller.restoreMultipleSubmissions(req, {}, jest.fn());
 
-    expect(service.restoreMutipleSubmissions).toBeCalledTimes(1);
-    expect(service.restoreMutipleSubmissions).toBeCalledWith(req.body.submissionIds, req.currentUser);
+    expect(service.restoreMultipleSubmissions).toBeCalledTimes(1);
+    expect(service.restoreMultipleSubmissions).toBeCalledWith(req.body.submissionIds, req.currentUser);
   });
 });
diff --git a/app/tests/unit/forms/submission/routes.spec.js b/app/tests/unit/forms/submission/routes.spec.js
index f44af8400..8ab849cca 100644
--- a/app/tests/unit/forms/submission/routes.spec.js
+++ b/app/tests/unit/forms/submission/routes.spec.js
@@ -40,7 +40,7 @@ controller.addStatus = jest.fn((_req, _res, next) => {
 controller.delete = jest.fn((_req, _res, next) => {
   next();
 });
-controller.deleteMutipleSubmissions = jest.fn((_req, _res, next) => {
+controller.deleteMultipleSubmissions = jest.fn((_req, _res, next) => {
   next();
 });
 controller.email = jest.fn((_req, _res, next) => {
@@ -64,7 +64,7 @@ controller.readOptions = jest.fn((_req, _res, next) => {
 controller.restore = jest.fn((_req, _res, next) => {
   next();
 });
-controller.restoreMutipleSubmissions = jest.fn((_req, _res, next) => {
+controller.restoreMultipleSubmissions = jest.fn((_req, _res, next) => {
   next();
 });
 controller.templateRender = jest.fn((_req, _res, next) => {
@@ -182,7 +182,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
     expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
-    expect(controller.deleteMutipleSubmissions).toBeCalledTimes(1);
+    expect(controller.deleteMultipleSubmissions).toBeCalledTimes(1);
   });
 });
 
@@ -200,7 +200,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
     expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
-    expect(controller.restoreMutipleSubmissions).toBeCalledTimes(1);
+    expect(controller.restoreMultipleSubmissions).toBeCalledTimes(1);
   });
 });
 
diff --git a/app/tests/unit/forms/submission/service.spec.js b/app/tests/unit/forms/submission/service.spec.js
index 40a5b8db6..3794fc962 100644
--- a/app/tests/unit/forms/submission/service.spec.js
+++ b/app/tests/unit/forms/submission/service.spec.js
@@ -52,7 +52,7 @@ describe('createStatus', () => {
   });
 });
 
-describe('deleteMutipleSubmissions', () => {
+describe('deleteMultipleSubmissions', () => {
   it('should delete the selected submissions', async () => {
     let submissionId1 = uuid.v4();
     let submissionId2 = uuid.v4();
@@ -70,7 +70,7 @@ describe('deleteMutipleSubmissions', () => {
     const currentUser = { usernameIdp: 'TEST@idir' };
     service.readSubmissionData = jest.fn().mockReturnValue(returnValue);
     const spy = jest.spyOn(service, 'readSubmissionData');
-    const res = await service.deleteMutipleSubmissions(submissionIds, currentUser);
+    const res = await service.deleteMultipleSubmissions(submissionIds, currentUser);
     expect(MockModel.startTransaction).toBeCalledTimes(1);
     expect(MockModel.query).toBeCalledTimes(1);
     expect(MockModel.query).toBeCalledWith(expect.anything());
@@ -83,7 +83,7 @@ describe('deleteMutipleSubmissions', () => {
   });
 });
 
-describe('restoreMutipleSubmissions', () => {
+describe('restoreMultipleSubmissions', () => {
   it('should delete the selected submissions', async () => {
     let submissionId1 = uuid.v4();
     let submissionId2 = uuid.v4();
@@ -101,7 +101,7 @@ describe('restoreMutipleSubmissions', () => {
     const currentUser = { usernameIdp: 'TEST@idir' };
     service.readSubmissionData = jest.fn().mockReturnValue(returnValue);
     const spy = jest.spyOn(service, 'readSubmissionData');
-    const res = await service.restoreMutipleSubmissions(submissionIds, currentUser);
+    const res = await service.restoreMultipleSubmissions(submissionIds, currentUser);
     expect(MockModel.startTransaction).toBeCalledTimes(1);
     expect(MockModel.query).toBeCalledTimes(1);
     expect(MockModel.query).toBeCalledWith(expect.anything());
diff --git a/app/tests/unit/routes/v1/submission.spec.js b/app/tests/unit/routes/v1/submission.spec.js
index de4fb20b4..b21523010 100644
--- a/app/tests/unit/routes/v1/submission.spec.js
+++ b/app/tests/unit/routes/v1/submission.spec.js
@@ -268,7 +268,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
   describe('DELETE', () => {
     it('should return 200', async () => {
       // mock a success return value...
-      service.deleteMutipleSubmissions = jest.fn().mockReturnValue({});
+      service.deleteMultipleSubmissions = jest.fn().mockReturnValue({});
 
       const response = await appRequest.delete(path);
 
@@ -278,7 +278,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
 
     it('should handle 401', async () => {
       // mock an authentication/permission issue...
-      service.deleteMutipleSubmissions = jest.fn(() => {
+      service.deleteMultipleSubmissions = jest.fn(() => {
         throw new Problem(401);
       });
 
@@ -290,7 +290,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
 
     it('should handle 500', async () => {
       // mock an unexpected error...
-      service.deleteMutipleSubmissions = jest.fn(() => {
+      service.deleteMultipleSubmissions = jest.fn(() => {
         throw new Error();
       });
 
@@ -308,7 +308,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
   describe('PUT', () => {
     it('should return 200', async () => {
       // mock a success return value...
-      service.restoreMutipleSubmissions = jest.fn().mockReturnValue({});
+      service.restoreMultipleSubmissions = jest.fn().mockReturnValue({});
 
       const response = await appRequest.put(path);
 
@@ -318,7 +318,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
 
     it('should handle 401', async () => {
       // mock an authentication/permission issue...
-      service.restoreMutipleSubmissions = jest.fn(() => {
+      service.restoreMultipleSubmissions = jest.fn(() => {
         throw new Problem(401);
       });
 
@@ -330,7 +330,7 @@ describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
 
     it('should handle 500', async () => {
       // mock an unexpected error...
-      service.restoreMutipleSubmissions = jest.fn(() => {
+      service.restoreMultipleSubmissions = jest.fn(() => {
         throw new Error();
       });
 

From 9ff472ad958fb153c7d2e812461ab41bcbe9a882 Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Mon, 12 Aug 2024 13:36:52 -0700
Subject: [PATCH 06/20] refactor: FORMS-1348 consistently use sendStatus
 (#1465)

---
 app/src/forms/form/controller.js                         | 2 +-
 app/src/forms/form/externalApi/controller.js             | 2 +-
 app/src/forms/user/controller.js                         | 4 ++--
 app/tests/unit/forms/form/controller.spec.js             | 2 +-
 app/tests/unit/forms/form/externalApi/controller.spec.js | 3 ++-
 5 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/app/src/forms/form/controller.js b/app/src/forms/form/controller.js
index 23833a987..b98e0af37 100644
--- a/app/src/forms/form/controller.js
+++ b/app/src/forms/form/controller.js
@@ -33,7 +33,7 @@ module.exports = {
   documentTemplateDelete: async (req, res, next) => {
     try {
       await service.documentTemplateDelete(req.params.documentTemplateId, req.currentUser.usernameIdp);
-      res.status(204).send();
+      res.sendStatus(204);
     } catch (error) {
       next(error);
     }
diff --git a/app/src/forms/form/externalApi/controller.js b/app/src/forms/form/externalApi/controller.js
index 324a0cbbb..d4f7339d4 100644
--- a/app/src/forms/form/externalApi/controller.js
+++ b/app/src/forms/form/externalApi/controller.js
@@ -44,7 +44,7 @@ module.exports = {
   deleteExternalAPI: async (req, res, next) => {
     try {
       await service.deleteExternalAPI(req.params.formId, req.params.externalAPIId);
-      res.status(204).send();
+      res.sendStatus(204);
     } catch (error) {
       next(error);
     }
diff --git a/app/src/forms/user/controller.js b/app/src/forms/user/controller.js
index 7da76d75a..191781d74 100644
--- a/app/src/forms/user/controller.js
+++ b/app/src/forms/user/controller.js
@@ -57,7 +57,7 @@ module.exports = {
   deleteUserPreferences: async (req, res, next) => {
     try {
       await service.deleteUserPreferences(req.currentUser);
-      res.status(204).send();
+      res.sendStatus(204);
     } catch (error) {
       next(error);
     }
@@ -93,7 +93,7 @@ module.exports = {
   deleteUserFormPreferences: async (req, res, next) => {
     try {
       await service.deleteUserFormPreferences(req.currentUser, req.params.formId);
-      res.status(204).send();
+      res.sendStatus(204);
     } catch (error) {
       next(error);
     }
diff --git a/app/tests/unit/forms/form/controller.spec.js b/app/tests/unit/forms/form/controller.spec.js
index 630ba5899..e615d6abe 100644
--- a/app/tests/unit/forms/form/controller.spec.js
+++ b/app/tests/unit/forms/form/controller.spec.js
@@ -152,7 +152,7 @@ describe('documentTemplateDelete', () => {
 
       expect(service.documentTemplateDelete).toBeCalledWith(validRequest.params.documentTemplateId, validRequest.currentUser.usernameIdp);
       expect(res.json).not.toBeCalled();
-      expect(res.status).toBeCalledWith(204);
+      expect(res.sendStatus).toBeCalledWith(204);
       expect(next).not.toBeCalled();
     });
   });
diff --git a/app/tests/unit/forms/form/externalApi/controller.spec.js b/app/tests/unit/forms/form/externalApi/controller.spec.js
index 9983bd4b6..c0d278f85 100644
--- a/app/tests/unit/forms/form/externalApi/controller.spec.js
+++ b/app/tests/unit/forms/form/externalApi/controller.spec.js
@@ -337,7 +337,8 @@ describe('deleteExternalAPI', () => {
       await controller.deleteExternalAPI(req, res, next);
 
       expect(service.deleteExternalAPI).toBeCalledWith(validRequest.params.formId, validRequest.params.externalAPIId);
-      expect(res.status).toBeCalledWith(204);
+      expect(res.json).not.toBeCalled();
+      expect(res.sendStatus).toBeCalledWith(204);
       expect(next).not.toBeCalled();
     });
   });

From 999ec0973360b7fbc1a76ebd1ad72fe0258c0cd0 Mon Sep 17 00:00:00 2001
From: Vijaivir Dhaliwal <91633223+vijaivir@users.noreply.github.com>
Date: Mon, 12 Aug 2024 13:53:50 -0700
Subject: [PATCH 07/20] Fix: CDOGS reupload bug (#1463)

* fix reupload template issue

* fix typo
---
 .../src/components/forms/PrintOptions.vue         | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/frontend/src/components/forms/PrintOptions.vue b/app/frontend/src/components/forms/PrintOptions.vue
index ec67ce693..718decbf2 100644
--- a/app/frontend/src/components/forms/PrintOptions.vue
+++ b/app/frontend/src/components/forms/PrintOptions.vue
@@ -50,6 +50,7 @@ export default {
       defaultReportname: '',
       displayTemplatePrintButton: false,
       isValidFile: true,
+      fileInputKey: 0,
       validFileExtensions: ['txt', 'docx', 'html', 'odt', 'pptx', 'xlsx'],
       defaultExportFileTypes: ['pdf'],
       uploadExportFileTypes: ['pdf'],
@@ -184,6 +185,7 @@ export default {
         ? disposition.substring(disposition.indexOf('filename=') + 9)
         : undefined;
     },
+
     createDownload(blob, filename = undefined) {
       const url = window.URL.createObjectURL(blob);
       const a = document.createElement('a');
@@ -256,6 +258,7 @@ export default {
         this.loading = false;
       }
     },
+
     createBody(content, contentFileType, outputFileName, outputFileType) {
       return {
         options: {
@@ -270,6 +273,7 @@ export default {
         },
       };
     },
+
     async fetchDefaultTemplate() {
       // Calling the API to check whether the form has any uploaded document templates
       this.loading = true;
@@ -313,6 +317,7 @@ export default {
         this.loading = false;
       }
     },
+
     validateFileExtension(event) {
       if (event.length > 0) {
         const fileExtension = event[0].name.split('.').pop();
@@ -325,6 +330,7 @@ export default {
         this.uploadExportFileTypes = ['pdf'];
         // reset the v-select value
         this.templateForm.outputFileType = null;
+
         if (this.validFileExtensions.includes(fileExtension)) {
           this.isValidFile = true;
         } else {
@@ -341,6 +347,12 @@ export default {
         this.isValidFile = true;
       }
     },
+
+    handleFileUpload(event) {
+      this.fileInputKey += 1;
+      this.templateForm.files = event;
+      this.validateFileExtension(event);
+    },
   },
 };
 </script>
@@ -475,6 +487,7 @@ export default {
                   value="upload"
                 ></v-radio>
                 <v-file-input
+                  :key="fileInputKey"
                   v-model="templateForm.files"
                   :class="{ label: isRTL }"
                   :style="isRTL ? { gap: '10px' } : null"
@@ -489,7 +502,7 @@ export default {
                   :lang="locale"
                   :rules="validationRules"
                   :disabled="selectedOption !== 'upload'"
-                  @update:model-value="validateFileExtension($event)"
+                  @update:model-value="handleFileUpload"
                 />
                 <v-select
                   v-if="selectedOption === 'upload'"

From 9eddc891907f5fd3316ae42a79551b7980772c63 Mon Sep 17 00:00:00 2001
From: jasonchung1871 <101672465+jasonchung1871@users.noreply.github.com>
Date: Mon, 12 Aug 2024 16:24:57 -0700
Subject: [PATCH 08/20] BaseFilter translation fixed (#1467)

BaseFilter was using the wrong default value, making it say the wrong text. This fixes it, added in a test for it as well.
---
 app/frontend/src/components/base/BaseFilter.vue            | 2 +-
 app/frontend/tests/unit/components/base/BaseFilter.spec.js | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/frontend/src/components/base/BaseFilter.vue b/app/frontend/src/components/base/BaseFilter.vue
index ed6519895..fedc171a4 100644
--- a/app/frontend/src/components/base/BaseFilter.vue
+++ b/app/frontend/src/components/base/BaseFilter.vue
@@ -62,7 +62,7 @@ const inputFilter = ref('');
 const inputFilterPlaceholder =
   properties.inputFilterPlaceholder || t('trans.baseFilter.exampleText2');
 const inputSaveButtonText =
-  properties.inputFilterPlaceholder || t('trans.baseFilter.filter');
+  properties.inputSaveButtonText || t('trans.baseFilter.filter');
 const selectedData = ref([]);
 
 const { isRTL } = storeToRefs(useFormStore());
diff --git a/app/frontend/tests/unit/components/base/BaseFilter.spec.js b/app/frontend/tests/unit/components/base/BaseFilter.spec.js
index 00dc15d34..8293bd219 100644
--- a/app/frontend/tests/unit/components/base/BaseFilter.spec.js
+++ b/app/frontend/tests/unit/components/base/BaseFilter.spec.js
@@ -66,6 +66,7 @@ describe('BaseFilter.vue', () => {
           },
         ],
         inputFilterPlaceholder: 'Filter Something',
+        inputSaveButtonText: 'Save Text',
       },
       global: {
         plugins: [pinia],
@@ -97,6 +98,7 @@ describe('BaseFilter.vue', () => {
     expect(wrapper.html()).toContain('TEST HEADER');
     expect(wrapper.html()).toContain('TEST NAME');
     expect(wrapper.html()).toContain('Filter Something');
+    expect(wrapper.html()).toContain('Save Text');
 
     expect(wrapper.vm.RTL).toBe('mr-3');
   });

From 1b65a855fe3d1469a782cf2fe424414934f89b83 Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Tue, 13 Aug 2024 08:17:52 -0700
Subject: [PATCH 09/20] fix: FORMS-1209 add user id validation (#1466)

---
 .../common/middleware/validateParameter.js    |  19 ++
 app/src/forms/user/routes.js                  |   8 +-
 .../middleware/validateParameter.spec.js      |  44 +++++
 app/tests/unit/forms/user/routes.spec.js      | 180 ++++++++++++++++++
 app/tests/unit/routes/v1/user.spec.js         |  10 +-
 5 files changed, 256 insertions(+), 5 deletions(-)
 create mode 100644 app/tests/unit/forms/user/routes.spec.js

diff --git a/app/src/forms/common/middleware/validateParameter.js b/app/src/forms/common/middleware/validateParameter.js
index d25e0b702..411c2ec2c 100644
--- a/app/src/forms/common/middleware/validateParameter.js
+++ b/app/src/forms/common/middleware/validateParameter.js
@@ -192,6 +192,24 @@ const validateFormVersionId = async (req, _res, next, formVersionId) => {
   }
 };
 
+/**
+ * Validates that the :userId route parameter exists and is a UUID.
+ *
+ * @param {*} _req the Express object representing the HTTP request - unused.
+ * @param {*} _res the Express object representing the HTTP response - unused.
+ * @param {*} next the Express chaining function.
+ * @param {*} userId the :userId value from the route.
+ */
+const validateUserId = async (_req, _res, next, userId) => {
+  try {
+    _validateUuid(userId, 'userId');
+
+    next();
+  } catch (error) {
+    next(error);
+  }
+};
+
 module.exports = {
   validateDocumentTemplateId,
   validateExternalAPIId,
@@ -200,4 +218,5 @@ module.exports = {
   validateFormSubmissionId,
   validateFormVersionDraftId,
   validateFormVersionId,
+  validateUserId,
 };
diff --git a/app/src/forms/user/routes.js b/app/src/forms/user/routes.js
index 032cd6513..31ff6bc77 100644
--- a/app/src/forms/user/routes.js
+++ b/app/src/forms/user/routes.js
@@ -1,12 +1,16 @@
 const routes = require('express').Router();
-const controller = require('./controller');
 
-const currentUser = require('../auth/middleware/userAccess').currentUser;
 const jwtService = require('../../components/jwtService');
+const currentUser = require('../auth/middleware/userAccess').currentUser;
+const validateParameter = require('../common/middleware/validateParameter');
+const controller = require('./controller');
 
 routes.use(jwtService.protect());
 routes.use(currentUser);
 
+routes.param('formId', validateParameter.validateFormId);
+routes.param('userId', validateParameter.validateUserId);
+
 //
 // User Preferences
 // This must be defined before /:userId route to work as intended
diff --git a/app/tests/unit/forms/common/middleware/validateParameter.spec.js b/app/tests/unit/forms/common/middleware/validateParameter.spec.js
index 3aa9076c2..4abebaeda 100644
--- a/app/tests/unit/forms/common/middleware/validateParameter.spec.js
+++ b/app/tests/unit/forms/common/middleware/validateParameter.spec.js
@@ -9,6 +9,7 @@ const submissionService = require('../../../../../src/forms/submission/service')
 const fileId = uuid.v4();
 const formId = uuid.v4();
 const formSubmissionId = uuid.v4();
+const userId = uuid.v4();
 
 // Various types of invalid UUIDs that we see in API calls.
 const invalidUuids = [[''], ['undefined'], ['{{id}}'], ['${id}'], [uuid.v4() + '.'], [' ' + uuid.v4() + ' ']];
@@ -672,3 +673,46 @@ describe('validateFormVersionId', () => {
     });
   });
 });
+
+describe('validateUserId', () => {
+  describe('400 response when', () => {
+    const expectedStatus = { status: 400 };
+
+    test('userId is missing', async () => {
+      const req = getMockReq({
+        params: {},
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateUserId(req, res, next);
+
+      expect(next).toBeCalledWith(expect.objectContaining(expectedStatus));
+    });
+
+    test.each(invalidUuids)('userId is "%s"', async (eachUserId) => {
+      const req = getMockReq({
+        params: { userId: eachUserId },
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateUserId(req, res, next, eachUserId);
+
+      expect(next).toBeCalledWith(expect.objectContaining(expectedStatus));
+    });
+  });
+
+  describe('allows', () => {
+    test('uuid for userId', async () => {
+      const req = getMockReq({
+        params: {
+          userId: userId,
+        },
+      });
+      const { res, next } = getMockRes();
+
+      await validateParameter.validateUserId(req, res, next, userId);
+
+      expect(next).toBeCalledWith();
+    });
+  });
+});
diff --git a/app/tests/unit/forms/user/routes.spec.js b/app/tests/unit/forms/user/routes.spec.js
new file mode 100644
index 000000000..67dffb363
--- /dev/null
+++ b/app/tests/unit/forms/user/routes.spec.js
@@ -0,0 +1,180 @@
+const request = require('supertest');
+const uuid = require('uuid');
+
+const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const validateParameter = require('../../../../src/forms/common/middleware/validateParameter');
+const controller = require('../../../../src/forms/user/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
+});
+
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+
+validateParameter.validateFormId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateUserId = jest.fn((_req, _res, next) => {
+  next();
+});
+
+// Mock the controller functions with happy path results.
+
+controller.deleteUserFormPreferences = jest.fn((_req, res) => {
+  res.sendStatus(204);
+});
+controller.deleteUserPreferences = jest.fn((_req, res) => {
+  res.sendStatus(204);
+});
+controller.list = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.read = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readUserFormPreferences = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readUserLabels = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readUserPreferences = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.updateUserFormPreferences = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.updateUserLabels = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.updateUserPreferences = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+
+const formId = uuid.v4();
+const userId = uuid.v4();
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/user/routes');
+const basePath = '/users';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe(`${basePath}/`, () => {
+  const path = `${basePath}/`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.list).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:userId`, () => {
+  const path = `${basePath}/${userId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(1);
+    expect(controller.read).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/labels`, () => {
+  const path = `${basePath}/labels`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.readUserLabels).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.updateUserLabels).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/preferences`, () => {
+  const path = `${basePath}/preferences`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.deleteUserPreferences).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.readUserPreferences).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.updateUserPreferences).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/preferences/forms/:formId`, () => {
+  const path = `${basePath}/preferences/forms/${formId}`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.deleteUserFormPreferences).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.readUserFormPreferences).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
+    expect(controller.updateUserFormPreferences).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/routes/v1/user.spec.js b/app/tests/unit/routes/v1/user.spec.js
index 1bb9d0f0c..d29bd285b 100644
--- a/app/tests/unit/routes/v1/user.spec.js
+++ b/app/tests/unit/routes/v1/user.spec.js
@@ -1,5 +1,6 @@
-const request = require('supertest');
 const Problem = require('api-problem');
+const request = require('supertest');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
@@ -27,6 +28,9 @@ userAccess.currentUser = jest.fn((_req, _res, next) => {
 //
 const service = require('../../../../src/forms/user/service');
 
+const formId = uuid.v4();
+const userId = uuid.v4();
+
 //
 // mocks are in place, create the router
 //
@@ -82,7 +86,7 @@ describe(`${basePath}`, () => {
 });
 
 describe(`${basePath}/:userId`, () => {
-  const path = `${basePath}/:userId`;
+  const path = `${basePath}/${userId}`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -234,7 +238,7 @@ describe(`${basePath}/preferences`, () => {
 });
 
 describe(`${basePath}/preferences/forms/:formId`, () => {
-  const path = `${basePath}/preferences/forms/:formId`;
+  const path = `${basePath}/preferences/forms/${formId}`;
 
   describe('DELETE', () => {
     it('should return 204', async () => {

From 11f64825cbe6b2095b3424b4e459cdfb08ff570a Mon Sep 17 00:00:00 2001
From: usingtechnology <39388115+usingtechnology@users.noreply.github.com>
Date: Tue, 13 Aug 2024 11:05:50 -0700
Subject: [PATCH 10/20] Handle no Ministry of form when managing External APIs
 (#1459)

Signed-off-by: Jason Sherman <tools@usingtechnolo.gy>
---
 .../src/components/admin/AdminAPIsTable.vue   | 55 ++++++++++++-------
 .../trans/chefs/en/en.json                    |  2 +
 2 files changed, 38 insertions(+), 19 deletions(-)

diff --git a/app/frontend/src/components/admin/AdminAPIsTable.vue b/app/frontend/src/components/admin/AdminAPIsTable.vue
index cafb69d10..4ab8ea0d6 100644
--- a/app/frontend/src/components/admin/AdminAPIsTable.vue
+++ b/app/frontend/src/components/admin/AdminAPIsTable.vue
@@ -5,7 +5,6 @@ import { i18n } from '~/internationalization';
 
 import { useAdminStore } from '~/store/admin';
 import { useFormStore } from '~/store/form';
-import { Ministries } from '~/utils/constants';
 import BaseDialog from '~/components/base/BaseDialog.vue';
 
 export default {
@@ -35,12 +34,6 @@ export default {
   computed: {
     ...mapState(useAdminStore, ['externalAPIList', 'externalAPIStatusCodes']),
     ...mapState(useFormStore, ['isRTL', 'lang']),
-    ministryList() {
-      return Ministries.map((ministry) => ({
-        id: ministry.id,
-        text: i18n.t(`trans.ministries.${ministry.id}`),
-      }));
-    },
     headers() {
       return [
         {
@@ -48,20 +41,33 @@ export default {
           align: 'start',
           key: 'ministry',
         },
+        {
+          title: i18n.t('trans.adminAPIsTable.ministryName'),
+          align: 'start',
+          key: 'ministryName',
+          // we don't want to see this (too long)
+          // but we need it for searching, so it needs to be in the DOM
+          headerProps: {
+            class: 'hidden',
+          },
+          cellProps: {
+            class: 'hidden',
+          },
+        },
         {
           title: i18n.t('trans.adminAPIsTable.formName'),
           align: 'start',
           key: 'formName',
         },
         {
-          title: i18n.t('trans.adminAPIsTable.name'),
+          title: i18n.t('trans.adminAPIsTable.formId'),
           align: 'start',
-          key: 'name',
+          key: 'formId',
         },
         {
-          title: i18n.t('trans.adminAPIsTable.endpointUrl'),
+          title: i18n.t('trans.adminAPIsTable.name'),
           align: 'start',
-          key: 'endpointUrl',
+          key: 'name',
         },
         {
           title: i18n.t('trans.adminAPIsTable.display'),
@@ -77,6 +83,13 @@ export default {
         },
       ];
     },
+    items() {
+      // add ministry name to objects so we can search on them
+      return this.externalAPIList.map((x) => ({
+        ...x,
+        ministryName: this.getMinistryName(x),
+      }));
+    },
   },
   async mounted() {
     await this.getExternalAPIStatusCodes();
@@ -89,6 +102,9 @@ export default {
       'updateExternalAPI',
       'getExternalAPIStatusCodes',
     ]),
+    getMinistryName(item) {
+      return item.ministry ? i18n.t(`trans.ministries.${item.ministry}`) : '';
+    },
     resetEditDialog() {
       this.editDialog = {
         title: '',
@@ -107,9 +123,7 @@ export default {
     handleEdit(item) {
       this.resetEditDialog();
       this.editDialog.item = { ...item };
-      this.editDialog.item.ministryText = this.ministryList.find(
-        (x) => x.id === item.ministry
-      )['text'];
+      this.editDialog.item.ministryText = this.getMinistryName(item);
       this.editDialog.title = i18n.t('trans.adminAPIsTable.editTitle');
       this.editDialog.show = true;
     },
@@ -162,24 +176,27 @@ export default {
       hover
       :headers="headers"
       item-key="title"
-      :items="externalAPIList"
+      :items="items"
       :search="search"
       :loading="loading"
       :loading-text="$t('trans.adminAPIsTable.loadingText')"
       :lang="lang"
     >
       <template #item.ministry="{ item }">
-        {{ ministryList.find((x) => x.id === item.ministry)['text'] }}
+        {{ item.ministry }}
+      </template>
+      <template #item.ministryName="{ item }">
+        {{ getMinistryName(item) }}
       </template>
       <template #item.formName="{ item }">
         {{ item.formName }}
       </template>
+      <template #item.endpointUrl="{ item }">
+        {{ item.formId }}
+      </template>
       <template #item.name="{ item }">
         {{ item.name }}
       </template>
-      <template #item.endpointUrl="{ item }">
-        {{ item.endpointUrl }}
-      </template>
       <template #item.display="{ item }">
         {{ item.display }}
       </template>
diff --git a/app/frontend/src/internationalization/trans/chefs/en/en.json b/app/frontend/src/internationalization/trans/chefs/en/en.json
index 863545419..8f52970a2 100644
--- a/app/frontend/src/internationalization/trans/chefs/en/en.json
+++ b/app/frontend/src/internationalization/trans/chefs/en/en.json
@@ -377,7 +377,9 @@
     "search": "Search",
     "loadingText": "Loading... Please wait",
     "ministry": "Ministry",
+    "ministryName": "Ministry Name",
     "formName": "Form",
+    "formId": "Form ID",
     "name": "API Name",
     "endpointUrl": "Endpoint URL",
     "display": "Status",

From 5cfc4ea2f2aa068b3302e76ef275b9fa7e200adf Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Wed, 14 Aug 2024 15:43:25 -0700
Subject: [PATCH 11/20] test: FORMS-1444 admin and address routes (#1471)

---
 app/tests/unit/forms/admin/routes.spec.js     | 299 ++++++++++++++++++
 .../unit/forms/bcgeoaddress/routes.spec.js    |  50 +++
 2 files changed, 349 insertions(+)
 create mode 100644 app/tests/unit/forms/admin/routes.spec.js
 create mode 100644 app/tests/unit/forms/bcgeoaddress/routes.spec.js

diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
new file mode 100644
index 000000000..dcf21aab2
--- /dev/null
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -0,0 +1,299 @@
+const request = require('supertest');
+const uuid = require('uuid');
+
+const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const controller = require('../../../../src/forms/admin/controller');
+const userController = require('../../../../src/forms/user/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+// TODO: Add a test the confirms that jwtService.protect is called with "admin"
+// when the file is loaded.
+
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
+jwtService.protect = jest.fn(() => {
+  return mockJwtServiceProtect;
+});
+
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+
+controller.createFormComponentsProactiveHelp = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.deleteApiKey = jest.fn((_req, res) => {
+  res.sendStatus(204);
+});
+controller.getFormUserRoles = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.getExternalAPIs = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.getExternalAPIStatusCodes = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.getUsers = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.listForms = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readApiDetails = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readForm = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.readVersion = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.restoreForm = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.setFormUserRoles = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.updateExternalAPI = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.updateFormComponentsProactiveHelp = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+userController.read = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+
+const componentId = uuid.v4();
+const externalApiId = uuid.v4();
+const formId = uuid.v4();
+const formVersionId = uuid.v4();
+const userId = uuid.v4();
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/admin/routes');
+const basePath = '/admin';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe(`${basePath}/externalAPIs`, () => {
+  const path = `${basePath}/externalAPIs`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.getExternalAPIs).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/externalAPIs/:externalApiId`, () => {
+  const path = `${basePath}/externalAPIs/${externalApiId}`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.updateExternalAPI).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/externalAPIs/statusCodes`, () => {
+  const path = `${basePath}/externalAPIs/statusCodes`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.getExternalAPIStatusCodes).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/:publishStatus/${componentId}`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.updateFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/imageUrl/${componentId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.getFCProactiveHelpImageUrl).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/list`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.listFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/object`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/object`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.createFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms`, () => {
+  const path = `${basePath}/forms`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.listForms).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId`, () => {
+  const path = `${basePath}/forms/${formId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.readForm).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId/addUser`, () => {
+  const path = `${basePath}/forms/${formId}/addUser`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.setFormUserRoles).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId/apiKey`, () => {
+  const path = `${basePath}/forms/${formId}/apiKey`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.deleteApiKey).toHaveBeenCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.readApiDetails).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId/formUsers`, () => {
+  const path = `${basePath}/forms/${formId}/formUsers`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.getFormUserRoles).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId/restore`, () => {
+  const path = `${basePath}/forms/${formId}/restore`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.restoreForm).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/forms/:formId/versions/:formVersionId`, () => {
+  const path = `${basePath}/forms/${formId}/versions/${formVersionId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.readVersion).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/users`, () => {
+  const path = `${basePath}/users`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(controller.getUsers).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/users/:userId`, () => {
+  const path = `${basePath}/users/${userId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
+    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
+    expect(userController.read).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/bcgeoaddress/routes.spec.js b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
new file mode 100644
index 000000000..ed8c4cb94
--- /dev/null
+++ b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
@@ -0,0 +1,50 @@
+const request = require('supertest');
+
+const { expressHelper } = require('../../../common/helper');
+
+const controller = require('../../../../src/forms/bcgeoaddress/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+controller.advanceSearchBCGeoAddress = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+controller.searchBCGeoAddress = jest.fn((_req, res) => {
+  res.status(200).json({});
+});
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/bcgeoaddress/routes');
+const basePath = '/bcgeoaddress';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe(`${basePath}/address`, () => {
+  const path = `${basePath}/address`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(controller.searchBCGeoAddress).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/advance/address`, () => {
+  const path = `${basePath}/advance/address`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(controller.advanceSearchBCGeoAddress).toHaveBeenCalledTimes(1);
+  });
+});

From 56583b70796631b494a0ef9e4673593d037274bd Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Thu, 15 Aug 2024 08:14:34 -0700
Subject: [PATCH 12/20] test: FORMS-1444 update forms routes tests (#1472)

* test: FORMS-1444 form routes

* standardize controller mocks with sendstatus 200
---
 app/tests/unit/forms/admin/routes.spec.js     |  40 +-
 .../unit/forms/bcgeoaddress/routes.spec.js    |   4 +-
 app/tests/unit/forms/form/routes.spec.js      | 712 +++++++++++++++++-
 app/tests/unit/forms/user/routes.spec.js      |  24 +-
 4 files changed, 727 insertions(+), 53 deletions(-)

diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
index dcf21aab2..4775fa88c 100644
--- a/app/tests/unit/forms/admin/routes.spec.js
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -28,55 +28,55 @@ userAccess.currentUser = jest.fn((_req, _res, next) => {
 });
 
 controller.createFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.deleteApiKey = jest.fn((_req, res) => {
-  res.sendStatus(204);
+  res.sendStatus(200);
 });
-controller.getFormUserRoles = jest.fn((_req, res) => {
-  res.status(200).json({});
+controller.getExternalAPIStatusCodes = jest.fn((_req, res) => {
+  res.sendStatus(200);
 });
 controller.getExternalAPIs = jest.fn((_req, res) => {
-  res.status(200).json({});
-});
-controller.getExternalAPIStatusCodes = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
+});
+controller.getFormUserRoles = jest.fn((_req, res) => {
+  res.sendStatus(200);
 });
 controller.getUsers = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.listForms = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readApiDetails = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readForm = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readVersion = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.restoreForm = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.setFormUserRoles = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.updateExternalAPI = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.updateFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 userController.read = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 
 const componentId = uuid.v4();
diff --git a/app/tests/unit/forms/bcgeoaddress/routes.spec.js b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
index ed8c4cb94..5edec2e81 100644
--- a/app/tests/unit/forms/bcgeoaddress/routes.spec.js
+++ b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
@@ -10,10 +10,10 @@ const controller = require('../../../../src/forms/bcgeoaddress/controller');
 //
 
 controller.advanceSearchBCGeoAddress = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.searchBCGeoAddress = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 
 //
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 2ab130875..195072755 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -3,6 +3,7 @@ const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
+const jwtService = require('../../../../src/components/jwtService');
 const apiAccess = require('../../../../src/forms/auth/middleware/apiAccess');
 const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
@@ -13,11 +14,7 @@ const controller = require('../../../../src/forms/form/controller');
 // Mock out all the middleware - we're testing that the routes are set up
 // correctly, not the functionality of the middleware.
 //
-const jwtService = require('../../../../src/components/jwtService');
 
-//
-// test assumes that caller has appropriate token, we are not testing middleware here...
-//
 jwtService.protect = jest.fn(() => {
   return jest.fn((_req, _res, next) => {
     next();
@@ -31,19 +28,6 @@ apiAccess.mockImplementation(
   })
 );
 
-controller.documentTemplateCreate = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateDelete = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateList = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateRead = jest.fn((_req, _res, next) => {
-  next();
-});
-
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
@@ -51,11 +35,9 @@ rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
 const hasFormPermissionsMock = jest.fn((_req, _res, next) => {
   next();
 });
-
 userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
-
 userAccess.hasFormPermissions = jest.fn(() => {
   return hasFormPermissionsMock;
 });
@@ -66,9 +48,136 @@ validateParameter.validateDocumentTemplateId = jest.fn((_req, _res, next) => {
 validateParameter.validateFormId = jest.fn((_req, _res, next) => {
   next();
 });
+validateParameter.validateFormVersionDraftId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateFormVersionId = jest.fn((_req, _res, next) => {
+  next();
+});
 
+controller.createDraft = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createForm = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createMultiSubmission = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createOrReplaceApiKey = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createOrUpdateEmailTemplate = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createOrUpdateSubscriptionDetails = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.createSubmission = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.deleteApiKey = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.deleteDraft = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.deleteForm = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.documentTemplateCreate = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.documentTemplateDelete = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.documentTemplateList = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.documentTemplateRead = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.getStatusCodes = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.export = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.exportWithFields = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.filesApiKeyAccess = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listDrafts = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listFormSubmissions = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listForms = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listSubmissionFields = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.listSubmissions = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.publishDraft = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.publishVersion = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readApiKey = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readDraft = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readEmailTemplates = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readFieldsForCSVExport = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readForm = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readFormOptions = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readFormSubscriptionDetails = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readPublishedForm = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readVersion = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.readVersionFields = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.updateDraft = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+controller.updateForm = jest.fn((_req, res) => {
+  res.sendStatus(200);
+});
+
+const componentId = uuid.v4();
 const documentTemplateId = uuid.v4();
 const formId = uuid.v4();
+const formVersionDraftId = uuid.v4();
+const formVersionId = uuid.v4();
 
 //
 // Create the router and a simple Express server.
@@ -83,13 +192,166 @@ afterEach(() => {
   jest.clearAllMocks();
 });
 
+describe(`${basePath}`, () => {
+  const path = `${basePath}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(controller.listForms).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(controller.createForm).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId`, () => {
+  const path = `${basePath}/${formId}`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.deleteForm).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readForm).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.updateForm).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/apiKey`, () => {
+  const path = `${basePath}/${formId}/apiKey`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.deleteApiKey).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readApiKey).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createOrReplaceApiKey).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
+  const path = `${basePath}/${formId}/apiKey/filesApiAccess`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.filesApiKeyAccess).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/csvexport/fields`, () => {
+  const path = `${basePath}/${formId}/csvexport/fields`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readFieldsForCSVExport).toBeCalledTimes(1);
+  });
+});
+
 describe(`${basePath}/:formId/documentTemplates`, () => {
   const path = `${basePath}/${formId}/documentTemplates`;
 
   it('should have correct middleware for GET', async () => {
     await appRequest.get(path);
 
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
@@ -99,7 +361,10 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
   it('should have correct middleware for POST', async () => {
     await appRequest.post(path);
 
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
@@ -115,6 +380,8 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
@@ -126,9 +393,416 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.documentTemplateRead).toBeCalledTimes(1);
   });
 });
+
+describe(`${basePath}/:formId/drafts`, () => {
+  const path = `${basePath}/${formId}/drafts`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.listDrafts).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createDraft).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
+  const path = `${basePath}/${formId}/drafts/${formVersionDraftId}`;
+
+  it('should have correct middleware for DELETE', async () => {
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.deleteDraft).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readDraft).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.updateDraft).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
+  const path = `${basePath}/${formId}/drafts/${formVersionDraftId}/publish`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.publishDraft).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/emailTemplate`, () => {
+  const path = `${basePath}/${formId}/emailTemplate`;
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createOrUpdateEmailTemplate).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/emailTemplates`, () => {
+  const path = `${basePath}/${formId}/emailTemplates`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readEmailTemplates).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/export`, () => {
+  const path = `${basePath}/${formId}/export`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.export).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/export/fields`, () => {
+  const path = `${basePath}/${formId}/export/fields`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.exportWithFields).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/options`, () => {
+  const path = `${basePath}/${formId}/options`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(controller.readFormOptions).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/statusCodes`, () => {
+  const path = `${basePath}/${formId}/statusCodes`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.getStatusCodes).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/submissions`, () => {
+  const path = `${basePath}/${formId}/submissions`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.listFormSubmissions).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/subscriptions`, () => {
+  const path = `${basePath}/${formId}/subscriptions`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readFormSubscriptionDetails).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    await appRequest.put(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createOrUpdateSubscriptionDetails).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/version`, () => {
+  const path = `${basePath}/${formId}/version`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readPublishedForm).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readVersion).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}/fields`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.readVersionFields).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}/multiSubmission`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createMultiSubmission).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}/publish`;
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.publishVersion).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}/submissions`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.listSubmissions).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    await appRequest.post(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.createSubmission).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, () => {
+  const path = `${basePath}/${formId}/versions/${formVersionId}/submissions/discover`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.listSubmissionFields).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/imageUrl/${componentId}`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
+  const path = `${basePath}/formcomponents/proactivehelp/list`;
+
+  it('should have correct middleware for GET', async () => {
+    await appRequest.get(path);
+
+    expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/user/routes.spec.js b/app/tests/unit/forms/user/routes.spec.js
index 67dffb363..0836ba778 100644
--- a/app/tests/unit/forms/user/routes.spec.js
+++ b/app/tests/unit/forms/user/routes.spec.js
@@ -33,34 +33,34 @@ validateParameter.validateUserId = jest.fn((_req, _res, next) => {
 // Mock the controller functions with happy path results.
 
 controller.deleteUserFormPreferences = jest.fn((_req, res) => {
-  res.sendStatus(204);
+  res.sendStatus(200);
 });
 controller.deleteUserPreferences = jest.fn((_req, res) => {
-  res.sendStatus(204);
+  res.sendStatus(200);
 });
 controller.list = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.read = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readUserFormPreferences = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readUserLabels = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.readUserPreferences = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.updateUserFormPreferences = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.updateUserLabels = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 controller.updateUserPreferences = jest.fn((_req, res) => {
-  res.status(200).json({});
+  res.sendStatus(200);
 });
 
 const formId = uuid.v4();
@@ -79,8 +79,8 @@ afterEach(() => {
   jest.clearAllMocks();
 });
 
-describe(`${basePath}/`, () => {
-  const path = `${basePath}/`;
+describe(`${basePath}`, () => {
+  const path = `${basePath}`;
 
   it('should have correct middleware for GET', async () => {
     await appRequest.get(path);

From 413668ae54c0cab3c2f6d50c05a5cbc074921ba0 Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Thu, 15 Aug 2024 09:35:09 -0700
Subject: [PATCH 13/20] test: FORMS-1444 external api routes (#1474)

* test: FORMS-1444 form external api routes

* refactor: move controller mocks and uuids into tests
---
 app/tests/unit/forms/admin/routes.spec.js     | 137 ++++----
 .../unit/forms/bcgeoaddress/routes.spec.js    |  20 +-
 app/tests/unit/forms/file/routes.spec.js      |  22 +-
 .../forms/form/externalApi/routes.spec.js     | 174 +++++++---
 app/tests/unit/forms/form/routes.spec.js      | 314 +++++++++++-------
 5 files changed, 409 insertions(+), 258 deletions(-)

diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
index 4775fa88c..8410d78b1 100644
--- a/app/tests/unit/forms/admin/routes.spec.js
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -27,64 +27,6 @@ userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
 
-controller.createFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.deleteApiKey = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getExternalAPIStatusCodes = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getExternalAPIs = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getFormUserRoles = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getUsers = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listForms = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readApiDetails = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readVersion = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.restoreForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.setFormUserRoles = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateExternalAPI = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-userController.read = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-
-const componentId = uuid.v4();
-const externalApiId = uuid.v4();
-const formId = uuid.v4();
-const formVersionId = uuid.v4();
-const userId = uuid.v4();
-
 //
 // Create the router and a simple Express server.
 //
@@ -102,6 +44,10 @@ describe(`${basePath}/externalAPIs`, () => {
   const path = `${basePath}/externalAPIs`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getExternalAPIs = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -111,9 +57,14 @@ describe(`${basePath}/externalAPIs`, () => {
 });
 
 describe(`${basePath}/externalAPIs/:externalApiId`, () => {
+  const externalApiId = uuid.v4();
   const path = `${basePath}/externalAPIs/${externalApiId}`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateExternalAPI = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -126,6 +77,10 @@ describe(`${basePath}/externalAPIs/statusCodes`, () => {
   const path = `${basePath}/externalAPIs/statusCodes`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getExternalAPIStatusCodes = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -135,9 +90,14 @@ describe(`${basePath}/externalAPIs/statusCodes`, () => {
 });
 
 describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`, () => {
+  const componentId = uuid.v4();
   const path = `${basePath}/formcomponents/proactivehelp/:publishStatus/${componentId}`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateFormComponentsProactiveHelp = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -147,9 +107,14 @@ describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`,
 });
 
 describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () => {
+  const componentId = uuid.v4();
   const path = `${basePath}/formcomponents/proactivehelp/imageUrl/${componentId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -162,6 +127,10 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
   const path = `${basePath}/formcomponents/proactivehelp/list`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -174,6 +143,10 @@ describe(`${basePath}/formcomponents/proactivehelp/object`, () => {
   const path = `${basePath}/formcomponents/proactivehelp/object`;
 
   it('should have correct middleware for POST', async () => {
+    controller.createFormComponentsProactiveHelp = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -186,6 +159,10 @@ describe(`${basePath}/forms`, () => {
   const path = `${basePath}/forms`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listForms = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -195,9 +172,14 @@ describe(`${basePath}/forms`, () => {
 });
 
 describe(`${basePath}/forms/:formId`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/forms/${formId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -207,9 +189,14 @@ describe(`${basePath}/forms/:formId`, () => {
 });
 
 describe(`${basePath}/forms/:formId/addUser`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/forms/${formId}/addUser`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.setFormUserRoles = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -219,9 +206,14 @@ describe(`${basePath}/forms/:formId/addUser`, () => {
 });
 
 describe(`${basePath}/forms/:formId/apiKey`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/forms/${formId}/apiKey`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteApiKey = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -230,6 +222,10 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readApiDetails = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -239,9 +235,14 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
 });
 
 describe(`${basePath}/forms/:formId/formUsers`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/forms/${formId}/formUsers`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getFormUserRoles = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -251,9 +252,14 @@ describe(`${basePath}/forms/:formId/formUsers`, () => {
 });
 
 describe(`${basePath}/forms/:formId/restore`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/forms/${formId}/restore`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.restoreForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -263,9 +269,15 @@ describe(`${basePath}/forms/:formId/restore`, () => {
 });
 
 describe(`${basePath}/forms/:formId/versions/:formVersionId`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/forms/${formId}/versions/${formVersionId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readVersion = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -278,6 +290,10 @@ describe(`${basePath}/users`, () => {
   const path = `${basePath}/users`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getUsers = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
@@ -287,9 +303,14 @@ describe(`${basePath}/users`, () => {
 });
 
 describe(`${basePath}/users/:userId`, () => {
+  const userId = uuid.v4();
   const path = `${basePath}/users/${userId}`;
 
   it('should have correct middleware for GET', async () => {
+    userController.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
diff --git a/app/tests/unit/forms/bcgeoaddress/routes.spec.js b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
index 5edec2e81..530ac6b6f 100644
--- a/app/tests/unit/forms/bcgeoaddress/routes.spec.js
+++ b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
@@ -4,18 +4,6 @@ const { expressHelper } = require('../../../common/helper');
 
 const controller = require('../../../../src/forms/bcgeoaddress/controller');
 
-//
-// Mock out all the middleware - we're testing that the routes are set up
-// correctly, not the functionality of the middleware.
-//
-
-controller.advanceSearchBCGeoAddress = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.searchBCGeoAddress = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-
 //
 // Create the router and a simple Express server.
 //
@@ -33,6 +21,10 @@ describe(`${basePath}/address`, () => {
   const path = `${basePath}/address`;
 
   it('should have correct middleware for GET', async () => {
+    controller.searchBCGeoAddress = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(controller.searchBCGeoAddress).toHaveBeenCalledTimes(1);
@@ -43,6 +35,10 @@ describe(`${basePath}/advance/address`, () => {
   const path = `${basePath}/advance/address`;
 
   it('should have correct middleware for GET', async () => {
+    controller.advanceSearchBCGeoAddress = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(controller.advanceSearchBCGeoAddress).toHaveBeenCalledTimes(1);
diff --git a/app/tests/unit/forms/file/routes.spec.js b/app/tests/unit/forms/file/routes.spec.js
index 69d7f8fa1..af9db54fb 100644
--- a/app/tests/unit/forms/file/routes.spec.js
+++ b/app/tests/unit/forms/file/routes.spec.js
@@ -52,16 +52,6 @@ validateParameter.validateFileId = jest.fn((_req, _res, next) => {
   next();
 });
 
-controller.create = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.delete = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.read = jest.fn((_req, _res, next) => {
-  next();
-});
-
 //
 // Create the router and a simple Express server.
 //
@@ -79,6 +69,10 @@ describe(`${basePath}`, () => {
   const path = `${basePath}`;
 
   it('should have correct middleware for POST', async () => {
+    controller.create = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateFileId).toBeCalledTimes(0);
@@ -98,6 +92,10 @@ describe(`${basePath}/:id`, () => {
   const path = `${basePath}/${fileId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.delete = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(validateParameter.validateFileId).toBeCalledTimes(1);
@@ -112,6 +110,10 @@ describe(`${basePath}/:id`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateFileId).toBeCalledTimes(1);
diff --git a/app/tests/unit/forms/form/externalApi/routes.spec.js b/app/tests/unit/forms/form/externalApi/routes.spec.js
index 94fd983c8..6fd0041e0 100644
--- a/app/tests/unit/forms/form/externalApi/routes.spec.js
+++ b/app/tests/unit/forms/form/externalApi/routes.spec.js
@@ -3,6 +3,7 @@ const uuid = require('uuid');
 
 const { expressHelper } = require('../../../../common/helper');
 
+const jwtService = require('../../../../../src/components/jwtService');
 const apiAccess = require('../../../../../src/forms/auth/middleware/apiAccess');
 const userAccess = require('../../../../../src/forms/auth/middleware/userAccess');
 const rateLimiter = require('../../../../../src/forms/common/middleware/rateLimiter');
@@ -13,14 +14,7 @@ const controller = require('../../../../../src/forms/form/externalApi/controller
 // Mock out all the middleware - we're testing that the routes are set up
 // correctly, not the functionality of the middleware.
 //
-//
-// mock middleware
-//
-const jwtService = require('../../../../../src/components/jwtService');
 
-//
-// test assumes that caller has appropriate token, we are not testing middleware here...
-//
 jwtService.protect = jest.fn(() => {
   return jest.fn((_req, _res, next) => {
     next();
@@ -34,19 +28,6 @@ apiAccess.mockImplementation(
   })
 );
 
-controller.documentTemplateCreate = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateDelete = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateList = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.documentTemplateRead = jest.fn((_req, _res, next) => {
-  next();
-});
-
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
@@ -54,22 +35,19 @@ rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
 const hasFormPermissionsMock = jest.fn((_req, _res, next) => {
   next();
 });
-
 userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
-
 userAccess.hasFormPermissions = jest.fn(() => {
   return hasFormPermissionsMock;
 });
 
-validateParameter.validateFormId = jest.fn((_req, _res, next) => {
+validateParameter.validateExternalAPIId = jest.fn((_req, _res, next) => {
   next();
 });
-validateParameter.validateExternalAPIId = jest.fn((_req, _res, next) => {
+validateParameter.validateFormId = jest.fn((_req, _res, next) => {
   next();
 });
-const formId = uuid.v4();
 
 //
 // Create the router and a simple Express server.
@@ -85,13 +63,8 @@ afterEach(() => {
 });
 
 describe(`${basePath}/:formId/externalAPIs`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/externalAPIs`;
-  controller.listExternalAPIs = jest.fn((_req, _res, next) => {
-    next();
-  });
-  controller.createExternalAPI = jest.fn((_req, _res, next) => {
-    next();
-  });
 
   it('should return 404 for DELETE', async () => {
     const response = await appRequest.delete(path);
@@ -99,47 +72,61 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
     expect(response.statusCode).toBe(404);
   });
 
-  it('should return 404 for PUT', async () => {
-    const response = await appRequest.put(path);
-
-    expect(response.statusCode).toBe(404);
-  });
-
   it('should have correct middleware for GET', async () => {
+    controller.listExternalAPIs = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(controller.listExternalAPIs).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.createExternalAPI = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(controller.createExternalAPI).toBeCalledTimes(1);
   });
+
+  it('should return 404 for PUT', async () => {
+    const response = await appRequest.put(path);
+
+    expect(response.statusCode).toBe(404);
+  });
 });
 
 describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
+  const formId = uuid.v4();
   const externalAPIId = uuid.v4();
   const path = `${basePath}/${formId}/externalAPIs/${externalAPIId}`;
-  controller.updateExternalAPI = jest.fn((_req, _res, next) => {
-    next();
-  });
-  controller.deleteExternalAPI = jest.fn((_req, _res, next) => {
-    next();
-  });
 
-  it('should return 404 for POST', async () => {
-    const response = await appRequest.post(path);
+  it('should have correct middleware for DELETE', async () => {
+    controller.deleteExternalAPI = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
 
-    expect(response.statusCode).toBe(404);
+    await appRequest.delete(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.deleteExternalAPI).toBeCalledTimes(1);
   });
 
   it('should return 404 for GET', async () => {
@@ -148,25 +135,104 @@ describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
     expect(response.statusCode).toBe(404);
   });
 
+  it('should return 404 for POST', async () => {
+    const response = await appRequest.post(path);
+
+    expect(response.statusCode).toBe(404);
+  });
+
   it('should have correct middleware for PUT', async () => {
+    controller.updateExternalAPI = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.updateExternalAPI).toBeCalledTimes(1);
   });
+});
 
-  it('hould have correct middleware for DELETE', async () => {
-    await appRequest.delete(path);
+describe(`${basePath}/:formId/externalAPIs/algorithms`, () => {
+  const formId = uuid.v4();
+  const path = `${basePath}/${formId}/externalAPIs/algorithms`;
+
+  // TODO: This route is overloaded by the one that takes an externalApiId.
+  it.skip('should return 404 for DELETE', async () => {
+    const response = await appRequest.delete(path);
+
+    expect(response.statusCode).toBe(404);
+  });
 
+  it('should have correct middleware for GET', async () => {
+    controller.listExternalAPIAlgorithms = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(controller.listExternalAPIAlgorithms).toBeCalledTimes(1);
+  });
+
+  it('should return 404 for POST', async () => {
+    const response = await appRequest.post(path);
+
+    expect(response.statusCode).toBe(404);
+  });
+
+  // TODO: This route is overloaded by the one that takes an externalApiId.
+  it.skip('should return 404 for PUT', async () => {
+    const response = await appRequest.put(path);
+
+    expect(response.statusCode).toBe(404);
+  });
+});
+
+describe(`${basePath}/:formId/externalAPIs/statusCodes`, () => {
+  const formId = uuid.v4();
+  const path = `${basePath}/${formId}/externalAPIs/statusCodes`;
+
+  // TODO: This route is overloaded by the one that takes an externalApiId.
+  it.skip('should return 404 for DELETE', async () => {
+    const response = await appRequest.delete(path);
+
+    expect(response.statusCode).toBe(404);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    controller.listExternalAPIStatusCodes = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.deleteExternalAPI).toBeCalledTimes(1);
+    expect(controller.listExternalAPIStatusCodes).toBeCalledTimes(1);
+  });
+
+  it('should return 404 for POST', async () => {
+    const response = await appRequest.post(path);
+
+    expect(response.statusCode).toBe(404);
+  });
+
+  // TODO: This route is overloaded by the one that takes an externalApiId.
+  it.skip('should return 404 for PUT', async () => {
+    const response = await appRequest.put(path);
+
+    expect(response.statusCode).toBe(404);
   });
 });
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 195072755..2dabad95f 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -55,130 +55,6 @@ validateParameter.validateFormVersionId = jest.fn((_req, _res, next) => {
   next();
 });
 
-controller.createDraft = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createMultiSubmission = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createOrReplaceApiKey = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createOrUpdateEmailTemplate = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createOrUpdateSubscriptionDetails = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.createSubmission = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.deleteApiKey = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.deleteDraft = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.deleteForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.documentTemplateCreate = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.documentTemplateDelete = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.documentTemplateList = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.documentTemplateRead = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.getStatusCodes = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.export = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.exportWithFields = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.filesApiKeyAccess = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listDrafts = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listFormSubmissions = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listForms = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listSubmissionFields = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.listSubmissions = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.publishDraft = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.publishVersion = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readApiKey = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readDraft = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readEmailTemplates = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readFieldsForCSVExport = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readFormOptions = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readFormSubscriptionDetails = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readPublishedForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readVersion = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readVersionFields = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateDraft = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateForm = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-
-const componentId = uuid.v4();
-const documentTemplateId = uuid.v4();
-const formId = uuid.v4();
-const formVersionDraftId = uuid.v4();
-const formVersionId = uuid.v4();
-
 //
 // Create the router and a simple Express server.
 //
@@ -196,6 +72,10 @@ describe(`${basePath}`, () => {
   const path = `${basePath}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listForms = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -209,6 +89,10 @@ describe(`${basePath}`, () => {
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.createForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -223,9 +107,14 @@ describe(`${basePath}`, () => {
 });
 
 describe(`${basePath}/:formId`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -239,6 +128,10 @@ describe(`${basePath}/:formId`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -252,6 +145,10 @@ describe(`${basePath}/:formId`, () => {
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -266,9 +163,14 @@ describe(`${basePath}/:formId`, () => {
 });
 
 describe(`${basePath}/:formId/apiKey`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/apiKey`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteApiKey = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -282,6 +184,10 @@ describe(`${basePath}/:formId/apiKey`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readApiKey = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -295,6 +201,10 @@ describe(`${basePath}/:formId/apiKey`, () => {
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.createOrReplaceApiKey = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -309,9 +219,14 @@ describe(`${basePath}/:formId/apiKey`, () => {
 });
 
 describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/apiKey/filesApiAccess`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.filesApiKeyAccess = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -326,9 +241,14 @@ describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
 });
 
 describe(`${basePath}/:formId/csvexport/fields`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/csvexport/fields`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readFieldsForCSVExport = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -343,9 +263,14 @@ describe(`${basePath}/:formId/csvexport/fields`, () => {
 });
 
 describe(`${basePath}/:formId/documentTemplates`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/documentTemplates`;
 
   it('should have correct middleware for GET', async () => {
+    controller.documentTemplateList = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -359,6 +284,10 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.documentTemplateCreate = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -373,9 +302,15 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
 });
 
 describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
+  const documentTemplateId = uuid.v4();
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/documentTemplates/${documentTemplateId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.documentTemplateDelete = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
@@ -389,6 +324,10 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.documentTemplateRead = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
@@ -403,9 +342,14 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
 });
 
 describe(`${basePath}/:formId/drafts`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/drafts`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listDrafts = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -419,6 +363,10 @@ describe(`${basePath}/:formId/drafts`, () => {
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.createDraft = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -433,9 +381,15 @@ describe(`${basePath}/:formId/drafts`, () => {
 });
 
 describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
+  const formId = uuid.v4();
+  const formVersionDraftId = uuid.v4();
   const path = `${basePath}/${formId}/drafts/${formVersionDraftId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteDraft = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -449,6 +403,10 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readDraft = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -462,6 +420,10 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateDraft = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -476,9 +438,15 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
 });
 
 describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
+  const formId = uuid.v4();
+  const formVersionDraftId = uuid.v4();
   const path = `${basePath}/${formId}/drafts/${formVersionDraftId}/publish`;
 
   it('should have correct middleware for POST', async () => {
+    controller.publishDraft = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -493,9 +461,14 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
 });
 
 describe(`${basePath}/:formId/emailTemplate`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/emailTemplate`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.createOrUpdateEmailTemplate = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -510,9 +483,14 @@ describe(`${basePath}/:formId/emailTemplate`, () => {
 });
 
 describe(`${basePath}/:formId/emailTemplates`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/emailTemplates`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readEmailTemplates = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -527,9 +505,14 @@ describe(`${basePath}/:formId/emailTemplates`, () => {
 });
 
 describe(`${basePath}/:formId/export`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/export`;
 
   it('should have correct middleware for GET', async () => {
+    controller.export = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -544,9 +527,14 @@ describe(`${basePath}/:formId/export`, () => {
 });
 
 describe(`${basePath}/:formId/export/fields`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/export/fields`;
 
   it('should have correct middleware for POST', async () => {
+    controller.exportWithFields = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -561,9 +549,14 @@ describe(`${basePath}/:formId/export/fields`, () => {
 });
 
 describe(`${basePath}/:formId/options`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/options`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readFormOptions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -578,9 +571,14 @@ describe(`${basePath}/:formId/options`, () => {
 });
 
 describe(`${basePath}/:formId/statusCodes`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/statusCodes`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getStatusCodes = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -595,9 +593,14 @@ describe(`${basePath}/:formId/statusCodes`, () => {
 });
 
 describe(`${basePath}/:formId/submissions`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/submissions`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listFormSubmissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -612,9 +615,14 @@ describe(`${basePath}/:formId/submissions`, () => {
 });
 
 describe(`${basePath}/:formId/subscriptions`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/subscriptions`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readFormSubscriptionDetails = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -628,6 +636,10 @@ describe(`${basePath}/:formId/subscriptions`, () => {
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.createOrUpdateSubscriptionDetails = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -642,9 +654,14 @@ describe(`${basePath}/:formId/subscriptions`, () => {
 });
 
 describe(`${basePath}/:formId/version`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/${formId}/version`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readPublishedForm = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -659,9 +676,15 @@ describe(`${basePath}/:formId/version`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readVersion = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -676,9 +699,15 @@ describe(`${basePath}/:formId/versions/:formVersionId`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}/fields`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readVersionFields = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -693,9 +722,15 @@ describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}/multiSubmission`;
 
   it('should have correct middleware for POST', async () => {
+    controller.createMultiSubmission = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -710,9 +745,15 @@ describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}/publish`;
 
   it('should have correct middleware for POST', async () => {
+    controller.publishVersion = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -727,9 +768,15 @@ describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}/submissions`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listSubmissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -743,6 +790,10 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.createSubmission = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -757,9 +808,15 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
 });
 
 describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, () => {
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
   const path = `${basePath}/${formId}/versions/${formVersionId}/submissions/discover`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listSubmissionFields = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -774,9 +831,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, ()
 });
 
 describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () => {
+  const componentId = uuid.v4();
   const path = `${basePath}/formcomponents/proactivehelp/imageUrl/${componentId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getFCProactiveHelpImageUrl = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -794,6 +856,10 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
   const path = `${basePath}/formcomponents/proactivehelp/list`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listFormComponentsProactiveHelp = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);

From 5b45d8088fdcafbcd831a1ec31da1f7984abe0ef Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Thu, 15 Aug 2024 12:52:15 -0700
Subject: [PATCH 14/20] test: FORMS-1444 add rbac routes tests (#1476)

* test: FORMS-1444 add rbac routes

* route tests cleanup for consistency
---
 app/tests/unit/forms/admin/routes.spec.js     | 102 +++---
 .../unit/forms/bcgeoaddress/routes.spec.js    |   4 +-
 app/tests/unit/forms/file/routes.spec.js      |  12 +-
 .../forms/form/externalApi/routes.spec.js     |  52 +--
 app/tests/unit/forms/form/routes.spec.js      | 324 +++++++++---------
 app/tests/unit/forms/proxy/routes.spec.js     |  21 +-
 app/tests/unit/forms/rbac/routes.spec.js      | 246 +++++++++++++
 .../unit/forms/submission/routes.spec.js      | 288 ++++++++--------
 app/tests/unit/forms/user/routes.spec.js      |  98 +++---
 9 files changed, 709 insertions(+), 438 deletions(-)
 create mode 100644 app/tests/unit/forms/rbac/routes.spec.js

diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
index 8410d78b1..849d19d54 100644
--- a/app/tests/unit/forms/admin/routes.spec.js
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -50,9 +50,9 @@ describe(`${basePath}/externalAPIs`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.getExternalAPIs).toHaveBeenCalledTimes(1);
+    expect(controller.getExternalAPIs).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -67,9 +67,9 @@ describe(`${basePath}/externalAPIs/:externalApiId`, () => {
 
     await appRequest.put(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.updateExternalAPI).toHaveBeenCalledTimes(1);
+    expect(controller.updateExternalAPI).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -83,9 +83,9 @@ describe(`${basePath}/externalAPIs/statusCodes`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.getExternalAPIStatusCodes).toHaveBeenCalledTimes(1);
+    expect(controller.getExternalAPIStatusCodes).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -100,9 +100,9 @@ describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`,
 
     await appRequest.put(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.updateFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+    expect(controller.updateFormComponentsProactiveHelp).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -117,9 +117,9 @@ describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () =>
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.getFCProactiveHelpImageUrl).toHaveBeenCalledTimes(1);
+    expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -133,9 +133,9 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.listFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+    expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -149,9 +149,9 @@ describe(`${basePath}/formcomponents/proactivehelp/object`, () => {
 
     await appRequest.post(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.createFormComponentsProactiveHelp).toHaveBeenCalledTimes(1);
+    expect(controller.createFormComponentsProactiveHelp).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -165,9 +165,9 @@ describe(`${basePath}/forms`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.listForms).toHaveBeenCalledTimes(1);
+    expect(controller.listForms).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -182,9 +182,9 @@ describe(`${basePath}/forms/:formId`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.readForm).toHaveBeenCalledTimes(1);
+    expect(controller.readForm).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -199,9 +199,9 @@ describe(`${basePath}/forms/:formId/addUser`, () => {
 
     await appRequest.put(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.setFormUserRoles).toHaveBeenCalledTimes(1);
+    expect(controller.setFormUserRoles).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -216,9 +216,9 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
 
     await appRequest.delete(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.deleteApiKey).toHaveBeenCalledTimes(1);
+    expect(controller.deleteApiKey).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -228,9 +228,9 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.readApiDetails).toHaveBeenCalledTimes(1);
+    expect(controller.readApiDetails).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -245,9 +245,9 @@ describe(`${basePath}/forms/:formId/formUsers`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.getFormUserRoles).toHaveBeenCalledTimes(1);
+    expect(controller.getFormUserRoles).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -262,9 +262,9 @@ describe(`${basePath}/forms/:formId/restore`, () => {
 
     await appRequest.put(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.restoreForm).toHaveBeenCalledTimes(1);
+    expect(controller.restoreForm).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -280,9 +280,9 @@ describe(`${basePath}/forms/:formId/versions/:formVersionId`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.readVersion).toHaveBeenCalledTimes(1);
+    expect(controller.readVersion).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -296,9 +296,9 @@ describe(`${basePath}/users`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(controller.getUsers).toHaveBeenCalledTimes(1);
+    expect(controller.getUsers).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
   });
 });
 
@@ -313,8 +313,8 @@ describe(`${basePath}/users/:userId`, () => {
 
     await appRequest.get(path);
 
-    expect(mockJwtServiceProtect).toHaveBeenCalledTimes(1);
-    expect(userAccess.currentUser).toHaveBeenCalledTimes(1);
-    expect(userController.read).toHaveBeenCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userController.read).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/forms/bcgeoaddress/routes.spec.js b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
index 530ac6b6f..d14ed52a8 100644
--- a/app/tests/unit/forms/bcgeoaddress/routes.spec.js
+++ b/app/tests/unit/forms/bcgeoaddress/routes.spec.js
@@ -27,7 +27,7 @@ describe(`${basePath}/address`, () => {
 
     await appRequest.get(path);
 
-    expect(controller.searchBCGeoAddress).toHaveBeenCalledTimes(1);
+    expect(controller.searchBCGeoAddress).toBeCalledTimes(1);
   });
 });
 
@@ -41,6 +41,6 @@ describe(`${basePath}/advance/address`, () => {
 
     await appRequest.get(path);
 
-    expect(controller.advanceSearchBCGeoAddress).toHaveBeenCalledTimes(1);
+    expect(controller.advanceSearchBCGeoAddress).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/forms/file/routes.spec.js b/app/tests/unit/forms/file/routes.spec.js
index af9db54fb..d474948ca 100644
--- a/app/tests/unit/forms/file/routes.spec.js
+++ b/app/tests/unit/forms/file/routes.spec.js
@@ -75,15 +75,15 @@ describe(`${basePath}`, () => {
 
     await appRequest.post(path);
 
-    expect(validateParameter.validateFileId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.create).toBeCalledTimes(1);
     expect(filePermissions.currentFileRecord).toBeCalledTimes(0);
     expect(filePermissions.hasFileCreate).toBeCalledTimes(1);
     expect(hasFilePermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(upload.fileUpload.upload).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
-    expect(controller.create).toBeCalledTimes(1);
+    expect(validateParameter.validateFileId).toBeCalledTimes(0);
   });
 });
 
@@ -98,15 +98,15 @@ describe(`${basePath}/:id`, () => {
 
     await appRequest.delete(path);
 
-    expect(validateParameter.validateFileId).toBeCalledTimes(1);
     expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.delete).toBeCalledTimes(1);
     expect(filePermissions.currentFileRecord).toBeCalledTimes(1);
     expect(filePermissions.hasFileCreate).toBeCalledTimes(0);
     expect(hasFilePermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(upload.fileUpload.upload).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
-    expect(controller.delete).toBeCalledTimes(1);
+    expect(validateParameter.validateFileId).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -116,14 +116,14 @@ describe(`${basePath}/:id`, () => {
 
     await appRequest.get(path);
 
-    expect(validateParameter.validateFileId).toBeCalledTimes(1);
     expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.read).toBeCalledTimes(1);
     expect(filePermissions.currentFileRecord).toBeCalledTimes(1);
     expect(filePermissions.hasFileCreate).toBeCalledTimes(0);
     expect(hasFilePermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(upload.fileUpload.upload).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
-    expect(controller.read).toBeCalledTimes(1);
+    expect(validateParameter.validateFileId).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/forms/form/externalApi/routes.spec.js b/app/tests/unit/forms/form/externalApi/routes.spec.js
index 6fd0041e0..bc8e90451 100644
--- a/app/tests/unit/forms/form/externalApi/routes.spec.js
+++ b/app/tests/unit/forms/form/externalApi/routes.spec.js
@@ -15,12 +15,6 @@ const controller = require('../../../../../src/forms/form/externalApi/controller
 // correctly, not the functionality of the middleware.
 //
 
-jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
-});
-
 jest.mock('../../../../../src/forms/auth/middleware/apiAccess');
 apiAccess.mockImplementation(
   jest.fn((_req, _res, next) => {
@@ -28,6 +22,12 @@ apiAccess.mockImplementation(
   })
 );
 
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
+});
+
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
@@ -79,12 +79,12 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
 
     await appRequest.get(path);
 
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.listExternalAPIs).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
@@ -94,12 +94,12 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
 
     await appRequest.post(path);
 
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.createExternalAPI).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
 
   it('should return 404 for PUT', async () => {
@@ -121,12 +121,12 @@ describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
 
     await appRequest.delete(path);
 
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
     expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.deleteExternalAPI).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
 
   it('should return 404 for GET', async () => {
@@ -148,12 +148,12 @@ describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
 
     await appRequest.put(path);
 
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
     expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.updateExternalAPI).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
 });
 
@@ -215,12 +215,12 @@ describe(`${basePath}/:formId/externalAPIs/statusCodes`, () => {
 
     await appRequest.get(path);
 
-    expect(validateParameter.validateFormId).toBeCalledTimes(1);
-    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(controller.listExternalAPIStatusCodes).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
 
   it('should return 404 for POST', async () => {
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 2dabad95f..6189ba661 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -15,12 +15,6 @@ const controller = require('../../../../src/forms/form/controller');
 // correctly, not the functionality of the middleware.
 //
 
-jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
-});
-
 jest.mock('../../../../src/forms/auth/middleware/apiAccess');
 apiAccess.mockImplementation(
   jest.fn((_req, _res, next) => {
@@ -28,6 +22,12 @@ apiAccess.mockImplementation(
   })
 );
 
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
+});
+
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
@@ -78,14 +78,14 @@ describe(`${basePath}`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.listForms).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(0);
-    expect(controller.listForms).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
@@ -95,14 +95,14 @@ describe(`${basePath}`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.createForm).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(0);
-    expect(controller.createForm).toBeCalledTimes(1);
   });
 });
 
@@ -117,14 +117,14 @@ describe(`${basePath}/:formId`, () => {
 
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.deleteForm).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.deleteForm).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -134,14 +134,14 @@ describe(`${basePath}/:formId`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readForm).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readForm).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
@@ -151,14 +151,14 @@ describe(`${basePath}/:formId`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.updateForm).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.updateForm).toBeCalledTimes(1);
   });
 });
 
@@ -173,14 +173,14 @@ describe(`${basePath}/:formId/apiKey`, () => {
 
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.deleteApiKey).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.deleteApiKey).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -190,14 +190,14 @@ describe(`${basePath}/:formId/apiKey`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.readApiKey).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readApiKey).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
@@ -207,14 +207,14 @@ describe(`${basePath}/:formId/apiKey`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.createOrReplaceApiKey).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createOrReplaceApiKey).toBeCalledTimes(1);
   });
 });
 
@@ -229,14 +229,14 @@ describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.filesApiKeyAccess).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.filesApiKeyAccess).toBeCalledTimes(1);
   });
 });
 
@@ -251,14 +251,14 @@ describe(`${basePath}/:formId/csvexport/fields`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readFieldsForCSVExport).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readFieldsForCSVExport).toBeCalledTimes(1);
   });
 });
 
@@ -273,14 +273,14 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.documentTemplateList).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.documentTemplateList).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
@@ -290,14 +290,14 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.documentTemplateCreate).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.documentTemplateCreate).toBeCalledTimes(1);
   });
 });
 
@@ -313,14 +313,14 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
 
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.documentTemplateDelete).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.documentTemplateDelete).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -330,14 +330,14 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.documentTemplateRead).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.documentTemplateRead).toBeCalledTimes(1);
   });
 });
 
@@ -352,14 +352,14 @@ describe(`${basePath}/:formId/drafts`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.listDrafts).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.listDrafts).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
@@ -369,14 +369,14 @@ describe(`${basePath}/:formId/drafts`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.createDraft).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createDraft).toBeCalledTimes(1);
   });
 });
 
@@ -392,14 +392,14 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
 
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.deleteDraft).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.deleteDraft).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -409,14 +409,14 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readDraft).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readDraft).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
@@ -426,14 +426,14 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.updateDraft).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.updateDraft).toBeCalledTimes(1);
   });
 });
 
@@ -449,14 +449,14 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.publishDraft).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.publishDraft).toBeCalledTimes(1);
   });
 });
 
@@ -471,14 +471,14 @@ describe(`${basePath}/:formId/emailTemplate`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.createOrUpdateEmailTemplate).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createOrUpdateEmailTemplate).toBeCalledTimes(1);
   });
 });
 
@@ -493,14 +493,14 @@ describe(`${basePath}/:formId/emailTemplates`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.readEmailTemplates).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readEmailTemplates).toBeCalledTimes(1);
   });
 });
 
@@ -515,14 +515,14 @@ describe(`${basePath}/:formId/export`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.export).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.export).toBeCalledTimes(1);
   });
 });
 
@@ -537,14 +537,14 @@ describe(`${basePath}/:formId/export/fields`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.exportWithFields).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.exportWithFields).toBeCalledTimes(1);
   });
 });
 
@@ -559,14 +559,14 @@ describe(`${basePath}/:formId/options`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.readFormOptions).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(0);
-    expect(controller.readFormOptions).toBeCalledTimes(1);
   });
 });
 
@@ -581,14 +581,14 @@ describe(`${basePath}/:formId/statusCodes`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.getStatusCodes).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.getStatusCodes).toBeCalledTimes(1);
   });
 });
 
@@ -603,14 +603,14 @@ describe(`${basePath}/:formId/submissions`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.listFormSubmissions).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.listFormSubmissions).toBeCalledTimes(1);
   });
 });
 
@@ -625,14 +625,14 @@ describe(`${basePath}/:formId/subscriptions`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.readFormSubscriptionDetails).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readFormSubscriptionDetails).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
@@ -642,14 +642,14 @@ describe(`${basePath}/:formId/subscriptions`, () => {
 
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.createOrUpdateSubscriptionDetails).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createOrUpdateSubscriptionDetails).toBeCalledTimes(1);
   });
 });
 
@@ -664,14 +664,14 @@ describe(`${basePath}/:formId/version`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readPublishedForm).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readPublishedForm).toBeCalledTimes(1);
   });
 });
 
@@ -687,14 +687,14 @@ describe(`${basePath}/:formId/versions/:formVersionId`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readVersion).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readVersion).toBeCalledTimes(1);
   });
 });
 
@@ -710,14 +710,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.readVersionFields).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.readVersionFields).toBeCalledTimes(1);
   });
 });
 
@@ -733,14 +733,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.createMultiSubmission).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createMultiSubmission).toBeCalledTimes(1);
   });
 });
 
@@ -756,14 +756,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.publishVersion).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.publishVersion).toBeCalledTimes(1);
   });
 });
 
@@ -779,14 +779,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.listSubmissions).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.listSubmissions).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
@@ -796,14 +796,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
 
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.createSubmission).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.createSubmission).toBeCalledTimes(1);
   });
 });
 
@@ -819,14 +819,14 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, ()
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.listSubmissionFields).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasFormPermissionsMock).toBeCalledTimes(1);
-    expect(controller.listSubmissionFields).toBeCalledTimes(1);
   });
 });
 
@@ -841,14 +841,14 @@ describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () =>
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(0);
-    expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
   });
 });
 
@@ -862,13 +862,13 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
 
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasFormPermissionsMock).toBeCalledTimes(0);
-    expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/forms/proxy/routes.spec.js b/app/tests/unit/forms/proxy/routes.spec.js
index ec5340a8b..2313f1a2d 100644
--- a/app/tests/unit/forms/proxy/routes.spec.js
+++ b/app/tests/unit/forms/proxy/routes.spec.js
@@ -8,25 +8,18 @@ jest.mock('cors', () =>
 
 const request = require('supertest');
 const Problem = require('api-problem');
+
 const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
 const apiAccess = require('../../../../src/forms/auth/middleware/apiAccess');
-const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 
 //
 // Mock out all the middleware - we're testing that the routes are set up
 // correctly, not the functionality of the middleware.
 //
-const jwtService = require('../../../../src/components/jwtService');
-
-//
-// test assumes that caller has appropriate token, we are not testing middleware here...
-//
-jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
-});
 
 jest.mock('../../../../src/forms/auth/middleware/apiAccess');
 apiAccess.mockImplementation(
@@ -35,6 +28,12 @@ apiAccess.mockImplementation(
   })
 );
 
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
+});
+
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
diff --git a/app/tests/unit/forms/rbac/routes.spec.js b/app/tests/unit/forms/rbac/routes.spec.js
new file mode 100644
index 000000000..80d6e9734
--- /dev/null
+++ b/app/tests/unit/forms/rbac/routes.spec.js
@@ -0,0 +1,246 @@
+const request = require('supertest');
+
+const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const controller = require('../../../../src/forms/rbac/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
+});
+
+const hasFormPermissionsMock = jest.fn((_req, _res, next) => {
+  next();
+});
+const hasFormRolesMock = jest.fn((_req, _res, next) => {
+  next();
+});
+const hasSubmissionPermissionsMock = jest.fn((_req, _res, next) => {
+  next();
+});
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+userAccess.filterMultipleSubmissions = jest.fn((_req, _res, next) => {
+  next();
+});
+userAccess.hasFormPermissions = jest.fn(() => {
+  return hasFormPermissionsMock;
+});
+userAccess.hasFormRoles = jest.fn(() => {
+  return hasFormRolesMock;
+});
+userAccess.hasRoleDeletePermissions = jest.fn((_req, _res, next) => {
+  next();
+});
+userAccess.hasRoleModifyPermissions = jest.fn((_req, _res, next) => {
+  next();
+});
+userAccess.hasSubmissionPermissions = jest.fn(() => {
+  return hasSubmissionPermissionsMock;
+});
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/rbac/routes');
+const basePath = '/rbac';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe(`${basePath}/current`, () => {
+  const path = `${basePath}/current`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.getCurrentUser = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getCurrentUser).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+});
+
+describe(`${basePath}/current/submissions`, () => {
+  const path = `${basePath}/current/submissions`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.getCurrentUserSubmissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getCurrentUserSubmissions).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+});
+
+describe(`${basePath}/forms`, () => {
+  const path = `${basePath}/forms`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.getFormUsers = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getFormUsers).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    controller.setFormUsers = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.put(path);
+
+    expect(controller.setFormUsers).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+});
+
+describe(`${basePath}/idps`, () => {
+  const path = `${basePath}/idps`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.getIdentityProviders = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getIdentityProviders).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+});
+
+describe(`${basePath}/submissions`, () => {
+  const path = `${basePath}/submissions`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.getSubmissionUsers = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getSubmissionUsers).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    controller.setSubmissionUserPermissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.put(path);
+
+    expect(controller.setSubmissionUserPermissions).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+});
+
+describe(`${basePath}/users`, () => {
+  const path = `${basePath}/users`;
+
+  it('should have correct middleware for DELETE', async () => {
+    controller.removeMultiUsers = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.delete(path);
+
+    expect(controller.removeMultiUsers).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(hasFormRolesMock).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(1);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+
+  it('should have correct middleware for GET', async () => {
+    controller.getUserForms = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.getUserForms).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(hasFormRolesMock).toBeCalledTimes(0);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    controller.setUserForms = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.put(path);
+
+    expect(controller.setUserForms).toBeCalledTimes(1);
+    expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(hasFormRolesMock).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
+    expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/submission/routes.spec.js b/app/tests/unit/forms/submission/routes.spec.js
index 8ab849cca..5e80ff0a9 100644
--- a/app/tests/unit/forms/submission/routes.spec.js
+++ b/app/tests/unit/forms/submission/routes.spec.js
@@ -3,6 +3,7 @@ const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
+const jwtService = require('../../../../src/components/jwtService');
 const apiAccess = require('../../../../src/forms/auth/middleware/apiAccess');
 const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
@@ -13,16 +14,6 @@ const controller = require('../../../../src/forms/submission/controller');
 // Mock out all the middleware - we're testing that the routes are set up
 // correctly, not the functionality of the middleware.
 //
-const jwtService = require('../../../../src/components/jwtService');
-
-//
-// test assumes that caller has appropriate token, we are not testing middleware here...
-//
-jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
-});
 
 jest.mock('../../../../src/forms/auth/middleware/apiAccess');
 apiAccess.mockImplementation(
@@ -31,50 +22,10 @@ apiAccess.mockImplementation(
   })
 );
 
-controller.addNote = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.addStatus = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.delete = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.deleteMultipleSubmissions = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.email = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.getNotes = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.getStatus = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.listEdits = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.read = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.readOptions = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.restore = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.restoreMultipleSubmissions = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.templateRender = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.templateUploadAndRender = jest.fn((_req, _res, next) => {
-  next();
-});
-controller.update = jest.fn((_req, _res, next) => {
-  next();
+jwtService.protect = jest.fn(() => {
+  return jest.fn((_req, _res, next) => {
+    next();
+  });
 });
 
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
@@ -84,7 +35,6 @@ rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
 const hasSubmissionPermissionsMock = jest.fn((_req, _res, next) => {
   next();
 });
-
 userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
@@ -105,10 +55,6 @@ validateParameter.validateFormSubmissionId = jest.fn((_req, _res, next) => {
   next();
 });
 
-const documentTemplateId = uuid.v4();
-const formId = uuid.v4();
-const formSubmissionId = uuid.v4();
-
 //
 // Create the router and a simple Express server.
 //
@@ -123,255 +69,329 @@ afterEach(() => {
 });
 
 describe(`${basePath}/:formSubmissionId`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.delete = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.delete).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.delete).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.read).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.read).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.update = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.update).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.update).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/:formId/submissions`, () => {
+  const formId = uuid.v4();
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/${formId}/submissions`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteMultipleSubmissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.deleteMultipleSubmissions).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
-    expect(controller.deleteMultipleSubmissions).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/:formId/submissions/restore`, () => {
+  const formId = uuid.v4();
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/${formId}/submissions/restore`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.restoreMultipleSubmissions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.restoreMultipleSubmissions).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(1);
-    expect(controller.restoreMultipleSubmissions).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/edits`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/edits`;
 
   it('should have correct middleware for GET', async () => {
+    controller.listEdits = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.listEdits).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.listEdits).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/email`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/email`;
 
   it('should have correct middleware for POST', async () => {
+    controller.email = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.email).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.email).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/notes`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/notes`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getNotes = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.getNotes).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.getNotes).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.addNote = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.addNote).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.addNote).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/options`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/options`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readOptions = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.readOptions).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.readOptions).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/restore`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/restore`;
 
   it('should have correct middleware for PUT', async () => {
+    controller.restore = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.restore).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.restore).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/status`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/status`;
 
   it('should have correct middleware for GET', async () => {
+    controller.getStatus = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.getStatus).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.getStatus).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for POST', async () => {
+    controller.addStatus = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(0);
+    expect(controller.addStatus).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(0);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.addStatus).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/template/:documentTemplateId/render`, () => {
+  const documentTemplateId = uuid.v4();
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/template/${documentTemplateId}/render`;
 
   it('should have correct middleware for GET', async () => {
+    controller.templateRender = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.templateRender).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.templateRender).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:formSubmissionId/template/render`, () => {
+  const formSubmissionId = uuid.v4();
   const path = `${basePath}/${formSubmissionId}/template/render`;
 
   it('should have correct middleware for POST', async () => {
+    controller.templateUploadAndRender = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.post(path);
 
+    expect(apiAccess).toBeCalledTimes(1);
+    expect(controller.templateUploadAndRender).toBeCalledTimes(1);
+    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormSubmissionId).toBeCalledTimes(1);
-    expect(apiAccess).toBeCalledTimes(1);
-    expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
-    expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
-    expect(userAccess.filterMultipleSubmissions).toBeCalledTimes(0);
-    expect(controller.templateUploadAndRender).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/forms/user/routes.spec.js b/app/tests/unit/forms/user/routes.spec.js
index 0836ba778..02d096ff8 100644
--- a/app/tests/unit/forms/user/routes.spec.js
+++ b/app/tests/unit/forms/user/routes.spec.js
@@ -30,42 +30,6 @@ validateParameter.validateUserId = jest.fn((_req, _res, next) => {
   next();
 });
 
-// Mock the controller functions with happy path results.
-
-controller.deleteUserFormPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.deleteUserPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.list = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.read = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readUserFormPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readUserLabels = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.readUserPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateUserFormPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateUserLabels = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-controller.updateUserPreferences = jest.fn((_req, res) => {
-  res.sendStatus(200);
-});
-
-const formId = uuid.v4();
-const userId = uuid.v4();
-
 //
 // Create the router and a simple Express server.
 //
@@ -83,23 +47,32 @@ describe(`${basePath}`, () => {
   const path = `${basePath}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.list = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(controller.list).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.list).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/:userId`, () => {
+  const userId = uuid.v4();
   const path = `${basePath}/${userId}`;
 
   it('should have correct middleware for GET', async () => {
+    controller.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(controller.read).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(1);
-    expect(controller.read).toBeCalledTimes(1);
   });
 });
 
@@ -107,19 +80,27 @@ describe(`${basePath}/labels`, () => {
   const path = `${basePath}/labels`;
 
   it('should have correct middleware for GET', async () => {
+    controller.readUserLabels = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(controller.readUserLabels).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.readUserLabels).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateUserLabels = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(controller.updateUserLabels).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.updateUserLabels).toBeCalledTimes(1);
   });
 });
 
@@ -127,54 +108,79 @@ describe(`${basePath}/preferences`, () => {
   const path = `${basePath}/preferences`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteUserPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
+    expect(controller.deleteUserPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.deleteUserPreferences).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readUserPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(controller.readUserPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.readUserPreferences).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateUserPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(controller.updateUserPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.updateUserPreferences).toBeCalledTimes(1);
   });
 });
 
 describe(`${basePath}/preferences/forms/:formId`, () => {
+  const formId = uuid.v4();
   const path = `${basePath}/preferences/forms/${formId}`;
 
   it('should have correct middleware for DELETE', async () => {
+    controller.deleteUserFormPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.delete(path);
 
+    expect(controller.deleteUserFormPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.deleteUserFormPreferences).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for GET', async () => {
+    controller.readUserFormPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.get(path);
 
+    expect(controller.readUserFormPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.readUserFormPreferences).toBeCalledTimes(1);
   });
 
   it('should have correct middleware for PUT', async () => {
+    controller.updateUserFormPreferences = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
     await appRequest.put(path);
 
+    expect(controller.updateUserFormPreferences).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
-    expect(controller.updateUserFormPreferences).toBeCalledTimes(1);
   });
 });

From 6d573247a8beb6e63e55f318627475a23ff5a02a Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Thu, 15 Aug 2024 15:28:28 -0700
Subject: [PATCH 15/20] test: FORMS-1444 add public and utils routes tests
 (#1477)

* test: FORMS-1444 add public and utils routes

* for consistency check userAccess.currentUser

* docs: add some thoughts around the route testing

* docs: added brief notes on middleware testing

* refactor: updated the proxy routes tests for consistency
---
 app/tests/unit/README.md                      | 33 ++++++++
 .../forms/form/externalApi/routes.spec.js     |  5 ++
 app/tests/unit/forms/form/routes.spec.js      | 39 ++++++++++
 app/tests/unit/forms/proxy/routes.spec.js     |  5 +-
 app/tests/unit/forms/public/routes.spec.js    | 77 +++++++++++++++++++
 app/tests/unit/forms/user/routes.spec.js      | 10 +++
 app/tests/unit/forms/utils/routes.spec.js     | 43 +++++++++++
 7 files changed, 209 insertions(+), 3 deletions(-)
 create mode 100644 app/tests/unit/forms/public/routes.spec.js
 create mode 100644 app/tests/unit/forms/utils/routes.spec.js

diff --git a/app/tests/unit/README.md b/app/tests/unit/README.md
index 8bc172937..1baf80012 100644
--- a/app/tests/unit/README.md
+++ b/app/tests/unit/README.md
@@ -53,3 +53,36 @@ describe('my tests', () => {
 ```
 
 Similar to `.only` is the `.skip` modifier to skip a test or group of tests.
+
+## Testing Strategy
+
+The testing strategy for the backend unit tests can be broken down into the different layers of the backend. For all tests we should:
+
+- ensure that the tests are consistent
+- ensure that we have 100% test coverage
+- ensure that we have complete test coverage: we should be testing additional corner cases even once we reach 100% test coverage
+- test the interface, not the implementation
+- test the unit under test, not its dependencies
+
+### Middleware Testing
+
+The tests for the middleware files should:
+
+- mock all services calls used by the middleware, including both exception and minimal valid results
+- test all response codes produced by the middleware
+
+### Route Testing
+
+The tests for the `route.js` files should:
+
+- mock all middleware used by the file
+- each route test should check that every middleware is called the proper number of times
+- each route test should mock the controller function that it calls
+- mock controller functions with `res.sendStatus(200)`, as doing something like `next()` will call multiple controller functions when route paths are overloaded
+- check that the mocked controller function is called - this will catch when a new route path accidentally overloads an old one
+- for consistency and ease of comparison, alphabetize the expect clauses ("alphabetize when possible")
+
+Note:
+
+- Some middleware is called when the `routes.js` is loaded, not when the route is called. For example, the parameters to `userAccess.hasFormPermissions` cannot be tested by calling the route using it. Even if we reload the `routes.js` for each route test, it would be hard to tell which call to `hasFormPermissions` was the call for the route under test
+- Maybe we should refactor and create a set of standard middleware mocks that live outside the `routes.spec.js` files
diff --git a/app/tests/unit/forms/form/externalApi/routes.spec.js b/app/tests/unit/forms/form/externalApi/routes.spec.js
index bc8e90451..d31ac02ef 100644
--- a/app/tests/unit/forms/form/externalApi/routes.spec.js
+++ b/app/tests/unit/forms/form/externalApi/routes.spec.js
@@ -83,6 +83,7 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
     expect(controller.listExternalAPIs).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
@@ -98,6 +99,7 @@ describe(`${basePath}/:formId/externalAPIs`, () => {
     expect(controller.createExternalAPI).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
@@ -125,6 +127,7 @@ describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
     expect(controller.deleteExternalAPI).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
@@ -152,6 +155,7 @@ describe(`${basePath}/:formId/externalAPIs/:externalAPIId`, () => {
     expect(controller.updateExternalAPI).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
@@ -219,6 +223,7 @@ describe(`${basePath}/:formId/externalAPIs/statusCodes`, () => {
     expect(controller.listExternalAPIStatusCodes).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
   });
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 6189ba661..1ffae78ba 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -82,6 +82,7 @@ describe(`${basePath}`, () => {
     expect(controller.listForms).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -99,6 +100,7 @@ describe(`${basePath}`, () => {
     expect(controller.createForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -121,6 +123,7 @@ describe(`${basePath}/:formId`, () => {
     expect(controller.deleteForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -138,6 +141,7 @@ describe(`${basePath}/:formId`, () => {
     expect(controller.readForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -155,6 +159,7 @@ describe(`${basePath}/:formId`, () => {
     expect(controller.updateForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -177,6 +182,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(controller.deleteApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -194,6 +200,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(controller.readApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -211,6 +218,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(controller.createOrReplaceApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -233,6 +241,7 @@ describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
     expect(controller.filesApiKeyAccess).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -255,6 +264,7 @@ describe(`${basePath}/:formId/csvexport/fields`, () => {
     expect(controller.readFieldsForCSVExport).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -277,6 +287,7 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
     expect(controller.documentTemplateList).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -294,6 +305,7 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
     expect(controller.documentTemplateCreate).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -317,6 +329,7 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
     expect(controller.documentTemplateDelete).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -334,6 +347,7 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
     expect(controller.documentTemplateRead).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -356,6 +370,7 @@ describe(`${basePath}/:formId/drafts`, () => {
     expect(controller.listDrafts).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -373,6 +388,7 @@ describe(`${basePath}/:formId/drafts`, () => {
     expect(controller.createDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -396,6 +412,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(controller.deleteDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
@@ -413,6 +430,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(controller.readDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
@@ -430,6 +448,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(controller.updateDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
@@ -453,6 +472,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
     expect(controller.publishDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(1);
@@ -475,6 +495,7 @@ describe(`${basePath}/:formId/emailTemplate`, () => {
     expect(controller.createOrUpdateEmailTemplate).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -497,6 +518,7 @@ describe(`${basePath}/:formId/emailTemplates`, () => {
     expect(controller.readEmailTemplates).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -519,6 +541,7 @@ describe(`${basePath}/:formId/export`, () => {
     expect(controller.export).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -541,6 +564,7 @@ describe(`${basePath}/:formId/export/fields`, () => {
     expect(controller.exportWithFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -563,6 +587,7 @@ describe(`${basePath}/:formId/options`, () => {
     expect(controller.readFormOptions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -585,6 +610,7 @@ describe(`${basePath}/:formId/statusCodes`, () => {
     expect(controller.getStatusCodes).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -607,6 +633,7 @@ describe(`${basePath}/:formId/submissions`, () => {
     expect(controller.listFormSubmissions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -629,6 +656,7 @@ describe(`${basePath}/:formId/subscriptions`, () => {
     expect(controller.readFormSubscriptionDetails).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -646,6 +674,7 @@ describe(`${basePath}/:formId/subscriptions`, () => {
     expect(controller.createOrUpdateSubscriptionDetails).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -668,6 +697,7 @@ describe(`${basePath}/:formId/version`, () => {
     expect(controller.readPublishedForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -691,6 +721,7 @@ describe(`${basePath}/:formId/versions/:formVersionId`, () => {
     expect(controller.readVersion).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -714,6 +745,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
     expect(controller.readVersionFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -737,6 +769,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
     expect(controller.createMultiSubmission).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -760,6 +793,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
     expect(controller.publishVersion).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -783,6 +817,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
     expect(controller.listSubmissions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -800,6 +835,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
     expect(controller.createSubmission).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -823,6 +859,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, ()
     expect(controller.listSubmissionFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -845,6 +882,7 @@ describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () =>
     expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
@@ -866,6 +904,7 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
     expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateFormVersionDraftId).toBeCalledTimes(0);
diff --git a/app/tests/unit/forms/proxy/routes.spec.js b/app/tests/unit/forms/proxy/routes.spec.js
index 2313f1a2d..dc7bb9bd4 100644
--- a/app/tests/unit/forms/proxy/routes.spec.js
+++ b/app/tests/unit/forms/proxy/routes.spec.js
@@ -6,15 +6,15 @@ jest.mock('cors', () =>
   })
 );
 
-const request = require('supertest');
 const Problem = require('api-problem');
+const request = require('supertest');
 
 const { expressHelper } = require('../../../common/helper');
 
 const jwtService = require('../../../../src/components/jwtService');
 const apiAccess = require('../../../../src/forms/auth/middleware/apiAccess');
-const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
 const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
 
 //
 // Mock out all the middleware - we're testing that the routes are set up
@@ -49,7 +49,6 @@ const service = require('../../../../src/forms/proxy/service');
 //
 
 const router = require('../../../../src/forms/proxy/routes');
-
 const basePath = '/proxy';
 const app = expressHelper(basePath, router);
 const appRequest = request(app);
diff --git a/app/tests/unit/forms/public/routes.spec.js b/app/tests/unit/forms/public/routes.spec.js
new file mode 100644
index 000000000..504a09a21
--- /dev/null
+++ b/app/tests/unit/forms/public/routes.spec.js
@@ -0,0 +1,77 @@
+const request = require('supertest');
+const uuid = require('uuid');
+
+const { expressHelper } = require('../../../common/helper');
+
+const controller = require('../../../../src/forms/public/controller');
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/public/routes');
+const basePath = '/public';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+// TODO - move code out of the route and into middleware or the controller. The
+// tests should continue to pass, but should themselves be moved into the
+// middleware or controller tests.
+
+describe(`${basePath}/reminder`, () => {
+  const path = `${basePath}/reminder`;
+
+  controller.sendReminderToSubmitter = jest.fn((_req, res) => {
+    res.sendStatus(200);
+  });
+
+  it('200s when the APITOKEN matches apiKey', async () => {
+    process.env.APITOKEN = uuid.v4();
+
+    const response = await appRequest.get(path).set({ apikey: process.env.APITOKEN });
+
+    expect(controller.sendReminderToSubmitter).toBeCalledTimes(1);
+    expect(response.status).toBe(200);
+  });
+
+  // This is testing some strange code. Refactor the code and get rid of this.
+  it('401s when there is no APITOKEN or apiKey', async () => {
+    process.env.APITOKEN = '';
+
+    const response = await appRequest.get(path).set({ apikey: process.env.APITOKEN });
+
+    expect(controller.sendReminderToSubmitter).toBeCalledTimes(0);
+    expect(response.status).toBe(401);
+  });
+
+  it('401s when the apiKey is empty', async () => {
+    process.env.APITOKEN = uuid.v4();
+
+    const response = await appRequest.get(path).set({ apikey: '' });
+
+    expect(controller.sendReminderToSubmitter).toBeCalledTimes(0);
+    expect(response.status).toBe(401);
+  });
+
+  it('401s when the apiKey exists but does not match', async () => {
+    process.env.APITOKEN = uuid.v4();
+
+    const response = await appRequest.get(path).set({ apikey: uuid.v4() });
+
+    expect(controller.sendReminderToSubmitter).toBeCalledTimes(0);
+    expect(response.status).toBe(401);
+  });
+
+  // Ideally the code should be refactored to not create the 404 and let Express
+  // do it. Then this test should still pass.
+  it('404s on a non-GET', async () => {
+    const response = await appRequest.post(path);
+
+    expect(controller.sendReminderToSubmitter).toBeCalledTimes(0);
+    expect(response.status).toBe(404);
+  });
+});
diff --git a/app/tests/unit/forms/user/routes.spec.js b/app/tests/unit/forms/user/routes.spec.js
index 02d096ff8..f867d0fbf 100644
--- a/app/tests/unit/forms/user/routes.spec.js
+++ b/app/tests/unit/forms/user/routes.spec.js
@@ -54,6 +54,7 @@ describe(`${basePath}`, () => {
     await appRequest.get(path);
 
     expect(controller.list).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -71,6 +72,7 @@ describe(`${basePath}/:userId`, () => {
     await appRequest.get(path);
 
     expect(controller.read).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(1);
   });
@@ -87,6 +89,7 @@ describe(`${basePath}/labels`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserLabels).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -99,6 +102,7 @@ describe(`${basePath}/labels`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserLabels).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -115,6 +119,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.delete(path);
 
     expect(controller.deleteUserPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -127,6 +132,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -139,6 +145,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -156,6 +163,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.delete(path);
 
     expect(controller.deleteUserFormPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -168,6 +176,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserFormPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
@@ -180,6 +189,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserFormPreferences).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
diff --git a/app/tests/unit/forms/utils/routes.spec.js b/app/tests/unit/forms/utils/routes.spec.js
new file mode 100644
index 000000000..e7dd6b100
--- /dev/null
+++ b/app/tests/unit/forms/utils/routes.spec.js
@@ -0,0 +1,43 @@
+const request = require('supertest');
+
+const { expressHelper } = require('../../../common/helper');
+
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const controller = require('../../../../src/forms/submission/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/utils/routes');
+const basePath = '/utils';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe(`${basePath}/template/render`, () => {
+  const path = `${basePath}/template/render`;
+
+  it('should have correct middleware for POST', async () => {
+    controller.draftTemplateUploadAndRender = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.post(path);
+
+    expect(controller.draftTemplateUploadAndRender).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+});

From cdf4036304f68edc2262659f11f6ceb592b6ec4f Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Mon, 19 Aug 2024 08:22:05 -0700
Subject: [PATCH 16/20] build: FORMS-1206 upgrade axios to v1 (#1468)

* fix: FORMS-1206 upgrade axios to v1

* fix broken oauth interceptor code

* fix - removed underscores for new function names

* update axios to fix new vuln
---
 app/package-lock.json                  | 46 +++++++++++++-------------
 app/package.json                       |  4 +--
 app/src/components/clientConnection.js | 26 ++++++++++-----
 3 files changed, 42 insertions(+), 34 deletions(-)

diff --git a/app/package-lock.json b/app/package-lock.json
index 52864794e..5368e673d 100644
--- a/app/package-lock.json
+++ b/app/package-lock.json
@@ -13,8 +13,8 @@
         "@json2csv/transforms": "^6.1.3",
         "api-problem": "^9.0.2",
         "aws-sdk": "^2.1376.0",
-        "axios": "^0.28.1",
-        "axios-oauth-client": "^1.5.0",
+        "axios": "^1.7.4",
+        "axios-oauth-client": "^2.2.0",
         "axios-token-interceptor": "^0.2.0",
         "bytes": "^3.1.2",
         "compression": "^1.7.4",
@@ -2164,11 +2164,11 @@
       }
     },
     "node_modules/axios": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-0.28.1.tgz",
-      "integrity": "sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ==",
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.4.tgz",
+      "integrity": "sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==",
       "dependencies": {
-        "follow-redirects": "^1.15.0",
+        "follow-redirects": "^1.15.6",
         "form-data": "^4.0.0",
         "proxy-from-env": "^1.1.0"
       }
@@ -2187,14 +2187,14 @@
       }
     },
     "node_modules/axios-oauth-client": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/axios-oauth-client/-/axios-oauth-client-1.5.0.tgz",
-      "integrity": "sha512-CFuTfK9KdRnDDR6LQlUJ0GNKUZ3tHRSFdKPM9WqeCtUdcuKDgWt9aDFH7Xl87VpUcfNt5qRVl4iHdayqtXVv7g==",
-      "dependencies": {
-        "qs": "^6.10.1"
-      },
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/axios-oauth-client/-/axios-oauth-client-2.2.0.tgz",
+      "integrity": "sha512-rRaDtK6CuPs+4lDqpAEc4s0c0/Zc2SF4HjVq5DDUL3FkwE/khlxZfnts3MKu1HANODBJ3YOViZVmevx/OUDS2Q==",
       "engines": {
-        "node": ">=10"
+        "node": ">= 14"
+      },
+      "peerDependencies": {
+        "axios": "^1.2.1"
       }
     },
     "node_modules/axios-token-interceptor": {
@@ -9413,6 +9413,7 @@
       "version": "6.11.1",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.1.tgz",
       "integrity": "sha512-0wsrzgTz/kAVIeuxSjnpGC56rzYtr6JT/2BwEvMaPhFIoYa1aGO8LbzuU1R0uUYQkLpWBTOj0l/CLAJB64J6nQ==",
+      "dev": true,
       "dependencies": {
         "side-channel": "^1.0.4"
       },
@@ -12775,11 +12776,11 @@
       }
     },
     "axios": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-0.28.1.tgz",
-      "integrity": "sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ==",
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.4.tgz",
+      "integrity": "sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==",
       "requires": {
-        "follow-redirects": "^1.15.0",
+        "follow-redirects": "^1.15.6",
         "form-data": "^4.0.0",
         "proxy-from-env": "^1.1.0"
       }
@@ -12795,12 +12796,10 @@
       }
     },
     "axios-oauth-client": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/axios-oauth-client/-/axios-oauth-client-1.5.0.tgz",
-      "integrity": "sha512-CFuTfK9KdRnDDR6LQlUJ0GNKUZ3tHRSFdKPM9WqeCtUdcuKDgWt9aDFH7Xl87VpUcfNt5qRVl4iHdayqtXVv7g==",
-      "requires": {
-        "qs": "^6.10.1"
-      }
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/axios-oauth-client/-/axios-oauth-client-2.2.0.tgz",
+      "integrity": "sha512-rRaDtK6CuPs+4lDqpAEc4s0c0/Zc2SF4HjVq5DDUL3FkwE/khlxZfnts3MKu1HANODBJ3YOViZVmevx/OUDS2Q==",
+      "requires": {}
     },
     "axios-token-interceptor": {
       "version": "0.2.0",
@@ -18179,6 +18178,7 @@
       "version": "6.11.1",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.1.tgz",
       "integrity": "sha512-0wsrzgTz/kAVIeuxSjnpGC56rzYtr6JT/2BwEvMaPhFIoYa1aGO8LbzuU1R0uUYQkLpWBTOj0l/CLAJB64J6nQ==",
+      "dev": true,
       "requires": {
         "side-channel": "^1.0.4"
       }
diff --git a/app/package.json b/app/package.json
index 2b9cbd218..deee49383 100644
--- a/app/package.json
+++ b/app/package.json
@@ -51,8 +51,8 @@
     "@json2csv/transforms": "^6.1.3",
     "api-problem": "^9.0.2",
     "aws-sdk": "^2.1376.0",
-    "axios": "^0.28.1",
-    "axios-oauth-client": "^1.5.0",
+    "axios": "^1.7.4",
+    "axios-oauth-client": "^2.2.0",
     "axios-token-interceptor": "^0.2.0",
     "bytes": "^3.1.2",
     "compression": "^1.7.4",
diff --git a/app/src/components/clientConnection.js b/app/src/components/clientConnection.js
index 6b33853a0..60b2bdc57 100755
--- a/app/src/components/clientConnection.js
+++ b/app/src/components/clientConnection.js
@@ -4,6 +4,22 @@ const tokenProvider = require('axios-token-interceptor');
 
 const log = require('./log')(module.filename);
 
+// axios-oauth-client removed the "interceptor" in v2.2.0. Replicate it here.
+
+const getMaxAge = (res) => {
+  return res.expires_in * 1e3;
+};
+
+const headerFormatter = (res) => {
+  return 'Bearer ' + res.access_token;
+};
+
+const interceptor = (tokenProvider, authenticate) => {
+  const getToken = tokenProvider.tokenCache(authenticate, { getMaxAge });
+
+  return tokenProvider({ getToken, headerFormatter });
+};
+
 class ClientConnection {
   constructor({ tokenUrl, clientId, clientSecret }) {
     log.verbose(`Constructed with ${tokenUrl}, ${clientId}, clientSecret`, { function: 'constructor' });
@@ -19,15 +35,7 @@ class ClientConnection {
       // Wraps axios-token-interceptor with oauth-specific configuration,
       // fetches the token using the desired claim method, and caches
       // until the token expires
-      oauth.interceptor(
-        tokenProvider,
-        oauth.client(axios.create(), {
-          url: this.tokenUrl,
-          grant_type: 'client_credentials',
-          client_id: clientId,
-          client_secret: clientSecret,
-        })
-      )
+      interceptor(tokenProvider, oauth.clientCredentials(axios.create(), tokenUrl, clientId, clientSecret))
     );
   }
 }

From cb022d7f37c8297144aad10bd7fb75715c40a2e3 Mon Sep 17 00:00:00 2001
From: usingtechnology <39388115+usingtechnology@users.noreply.github.com>
Date: Mon, 19 Aug 2024 15:08:39 -0700
Subject: [PATCH 17/20] Generate Proxy Headers lookup form/version Id when
 provided submissionId (#1478)

* Generate Proxy Headers lookup form/version Id when provided submissionId

Signed-off-by: Jason Sherman <tools@usingtechnolo.gy>

* up the test coverage (and fix a bug!)

Signed-off-by: Jason Sherman <tools@usingtechnolo.gy>

---------

Signed-off-by: Jason Sherman <tools@usingtechnolo.gy>
---
 app/src/forms/proxy/service.js                | 31 +++++++-
 app/tests/unit/forms/proxy/controller.spec.js |  2 +
 app/tests/unit/forms/proxy/service.spec.js    | 76 +++++++++++++++++--
 3 files changed, 97 insertions(+), 12 deletions(-)

diff --git a/app/src/forms/proxy/service.js b/app/src/forms/proxy/service.js
index f6cd334a1..c624fc738 100644
--- a/app/src/forms/proxy/service.js
+++ b/app/src/forms/proxy/service.js
@@ -1,7 +1,7 @@
 const { encryptionService } = require('../../components/encryptionService');
 const jwtService = require('../../components/jwtService');
 const ProxyServiceError = require('./error');
-const { ExternalAPI } = require('../../forms/common/models');
+const { ExternalAPI, SubmissionMetadata } = require('../../forms/common/models');
 
 const headerValue = (headers, key) => {
   if (headers && key) {
@@ -19,15 +19,38 @@ const trimLeadingSlashes = (str) => str.replace(/^\/+|\$/g, '');
 const trimTrailingSlashes = (str) => str.replace(/\/+$/g, '');
 
 const service = {
+  _getIds: async (payload) => {
+    let formId = payload['formId'];
+    let versionId = payload['versionId'];
+    let submissionId = payload['submissionId'];
+    // when we are provided with a submission id (ex. submitting a draft submission)
+    // we need to fetch the related form and version id (if not provided)
+    if (submissionId) {
+      const meta = await SubmissionMetadata.query().where('submissionId', submissionId).first();
+      if (meta) {
+        formId = meta.formId;
+        versionId = meta.formVersionId;
+        submissionId = meta.submissionId;
+      }
+    }
+    return {
+      formId: formId,
+      versionId: versionId,
+      submissionId: submissionId,
+    };
+  },
+
   generateProxyHeaders: async (payload, currentUser, token) => {
     if (!payload || !currentUser || !currentUser.idp) {
       throw new ProxyServiceError('Cannot generate proxy headers with missing or incomplete parameters');
     }
 
+    const { formId, versionId, submissionId } = await service._getIds(payload);
+
     const headerData = {
-      formId: payload['formId'],
-      versionId: payload['versionId'],
-      submissionId: payload['submissionId'],
+      formId: formId,
+      versionId: versionId,
+      submissionId: submissionId,
       userId: currentUser.idpUserId,
       username: currentUser.username,
       firstName: currentUser.firstName,
diff --git a/app/tests/unit/forms/proxy/controller.spec.js b/app/tests/unit/forms/proxy/controller.spec.js
index d52ad6c68..8d2eec8bf 100644
--- a/app/tests/unit/forms/proxy/controller.spec.js
+++ b/app/tests/unit/forms/proxy/controller.spec.js
@@ -4,6 +4,7 @@ const { getMockReq, getMockRes } = require('@jest-mock/express');
 const controller = require('../../../../src/forms/proxy/controller');
 const service = require('../../../../src/forms/proxy/service');
 const jwtService = require('../../../../src/components/jwtService');
+
 const { NotFoundError } = require('objection');
 
 const bearerToken = Math.random().toString(36).substring(2);
@@ -29,6 +30,7 @@ describe('generateProxyHeaders', () => {
   };
 
   it('should generate headers', async () => {
+    service._getIds = jest.fn().mockReturnValue({ formId: '1234', versionId: '5678', submissionId: null });
     service.generateProxyHeaders = jest.fn().mockReturnValue({});
 
     await controller.generateProxyHeaders(req, {}, jest.fn());
diff --git a/app/tests/unit/forms/proxy/service.spec.js b/app/tests/unit/forms/proxy/service.spec.js
index 7c3d953dc..266966c53 100644
--- a/app/tests/unit/forms/proxy/service.spec.js
+++ b/app/tests/unit/forms/proxy/service.spec.js
@@ -6,9 +6,11 @@ const { encryptionService, ENCRYPTION_ALGORITHMS } = require('../../../../src/co
 const service = require('../../../../src/forms/proxy/service');
 const { ExternalAPI } = require('../../../../src/forms/common/models');
 
+jest.mock('../../../../src/forms/common/models/views/submissionMetadata', () => MockModel);
+
 const goodPayload = {
   formId: '123',
-  submissionId: '456',
+  submissionId: null,
   versionId: '789',
 };
 
@@ -60,9 +62,42 @@ afterEach(() => {
 });
 
 describe('Proxy Service', () => {
+  describe('_getIds', () => {
+    beforeEach(() => {
+      MockModel.mockReset();
+    });
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+    it('should return all ids', async () => {
+      const payload = { formId: null, versionId: null, submissionId: '1' };
+      const meta = { formId: '2', formVersionId: '3', submissionId: '1' }; // meta query result
+      const ids = { formId: '2', versionId: '3', submissionId: '1' }; // _getIds result
+      MockModel.mockResolvedValue(meta);
+      const result = await service._getIds(payload);
+      await expect(result).toStrictEqual(ids);
+      expect(MockModel.query).toBeCalledTimes(1); // submission id means we query
+      expect(MockModel.first).toBeCalledTimes(1);
+    });
+    it('should return form and version id', async () => {
+      const payload = { formId: '2', versionId: '3', submissionId: null };
+      const ids = { formId: '2', versionId: '3', submissionId: null }; // _getIds result
+      const result = await service._getIds(payload);
+      await expect(result).toStrictEqual(ids);
+      expect(MockModel.query).toBeCalledTimes(0); // no submission id, no query
+    });
+    it('should return form and version id when submission id not found', async () => {
+      const payload = { formId: null, versionId: null, submissionId: '1' };
+      const meta = null; // meta query result
+      const ids = { formId: null, versionId: null, submissionId: '1' }; // _getIds result
+      MockModel.mockResolvedValue(meta);
+      const result = await service._getIds(payload);
+      await expect(result).toStrictEqual(ids);
+      expect(MockModel.query).toBeCalledTimes(1); // submission id means we query
+      expect(MockModel.first).toBeCalledTimes(1);
+    });
+  });
   describe('generateProxyHeaders', () => {
-    beforeEach(() => {});
-
     it('should throw error with no payload', async () => {
       await expect(service.generateProxyHeaders(undefined, goodCurrentUser, token)).rejects.toThrow();
     });
@@ -85,14 +120,33 @@ describe('Proxy Service', () => {
       const decrypted = encryptionService.decryptProxy(result['X-CHEFS-PROXY-DATA']);
       expect(JSON.parse(decrypted)).toMatchObject(goodProxyHeaderInfo);
     });
+    it('should find formId and versionId when given submissionId', async () => {
+      const submissionPayload = { submissionId: '456' };
+      const idsPaylad = { ...goodPayload, ...submissionPayload };
+      service._getIds = jest.fn().mockResolvedValueOnce(idsPaylad);
+      const submissionProxyHeaderInfo = {
+        ...idsPaylad,
+        ...goodCurrentUser,
+        userId: goodCurrentUser.idpUserId,
+        token: token,
+      };
+      delete submissionProxyHeaderInfo.idpUserId;
+
+      const result = await service.generateProxyHeaders(submissionPayload, goodCurrentUser, token);
+      expect(result).toBeTruthy();
+      expect(result['X-CHEFS-PROXY-DATA']).toBeTruthy();
+      // check the encryption...
+      const decrypted = encryptionService.decryptProxy(result['X-CHEFS-PROXY-DATA']);
+      expect(JSON.parse(decrypted)).toMatchObject(submissionProxyHeaderInfo);
+    });
   });
   describe('readProxyHeaders', () => {
-    beforeEach(() => {});
-
     it('should throw error with no headers', async () => {
       await expect(service.readProxyHeaders(undefined)).rejects.toThrow();
     });
-
+    it('should throw error with bad headers', async () => {
+      await expect(service.readProxyHeaders('string-not-object')).rejects.toThrow();
+    });
     it('should throw error with wrong header name', async () => {
       await expect(service.readProxyHeaders({ 'X-CHEFS-WRONG_HEADER_NAME': 'headers' })).rejects.toThrow();
     });
@@ -108,6 +162,8 @@ describe('Proxy Service', () => {
     });
 
     it('should return decrypted header data', async () => {
+      service._getIds = jest.fn().mockResolvedValueOnce({ ...goodPayload, submissionId: null });
+
       const headers = await service.generateProxyHeaders(goodPayload, goodCurrentUser, token);
       const decrypted = await service.readProxyHeaders(headers);
       expect(decrypted).toBeTruthy();
@@ -137,6 +193,12 @@ describe('Proxy Service', () => {
       await expect(service.getExternalAPI(headers, goodProxyHeaderInfo)).rejects.toThrow();
     });
 
+    it('should throw error with bad header', async () => {
+      // set the external api name...
+      const headers = 'string-not-object';
+      await expect(service.getExternalAPI(headers, goodProxyHeaderInfo)).rejects.toThrow();
+    });
+
     it('should throw error with no proxy header info', async () => {
       // set the external api name...
       const headers = { 'X-CHEFS-EXTERNAL-API-NAME': 'testapi' };
@@ -194,8 +256,6 @@ describe('Proxy Service', () => {
     });
   });
   describe('createExternalAPIHeaders', () => {
-    beforeEach(() => {});
-
     it('should throw error with no headers', async () => {
       const externalAPI = undefined;
       const proxyHeaderInfo = goodProxyHeaderInfo;

From 09cafe0f0166147f88afa5519dc197085f78edd4 Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Tue, 20 Aug 2024 08:16:01 -0700
Subject: [PATCH 18/20] test: FORMS-1448 expand jwt service tests (#1479)

---
 app/tests/unit/README.md                      |   5 +-
 app/tests/unit/forms/admin/routes.spec.js     |  22 +++-
 app/tests/unit/forms/form/routes.spec.js      |  46 +++++++-
 .../unit/forms/permission/routes.spec.js      | 111 ++++++++++++++++++
 app/tests/unit/forms/proxy/routes.spec.js     |   7 --
 app/tests/unit/forms/rbac/routes.spec.js      |  17 ++-
 app/tests/unit/forms/role/routes.spec.js      | 111 ++++++++++++++++++
 app/tests/unit/forms/user/routes.spec.js      |  36 +++++-
 8 files changed, 334 insertions(+), 21 deletions(-)
 create mode 100644 app/tests/unit/forms/permission/routes.spec.js
 create mode 100644 app/tests/unit/forms/role/routes.spec.js

diff --git a/app/tests/unit/README.md b/app/tests/unit/README.md
index 1baf80012..ae2c15b5f 100644
--- a/app/tests/unit/README.md
+++ b/app/tests/unit/README.md
@@ -1,6 +1,6 @@
 # Unit Tests
 
-The backend unit tests can be run in VSCode by going to `Terminal` -> `Run Task...` -> `Unit Tests - API`.
+The backend unit tests are run in VSCode by going to `Terminal` -> `Run Task...` -> `Unit Tests - API`. Once the tests complete, the backend code coverage report is in `/app/coverage/lcov-report/index.html`.
 
 ## Running on the Command Line
 
@@ -84,5 +84,6 @@ The tests for the `route.js` files should:
 
 Note:
 
-- Some middleware is called when the `routes.js` is loaded, not when the route is called. For example, the parameters to `userAccess.hasFormPermissions` cannot be tested by calling the route using it. Even if we reload the `routes.js` for each route test, it would be hard to tell which call to `hasFormPermissions` was the call for the route under test
+- The order that middleware is called is very important, but we are not testing this. Perhaps integration tests are the best solution for this
+- Some middleware takes parameters and is created when a route is created. This means that, for example, the parameters to `jwtService.protect` or `userAccess.hasFormPermissions` cannot be tested by calling the route using it. Even if we reload the `routes.js` for each route test, it would be hard to tell which call to create the middleware was the call for the route under test
 - Maybe we should refactor and create a set of standard middleware mocks that live outside the `routes.spec.js` files
diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
index 849d19d54..f02a1e05d 100644
--- a/app/tests/unit/forms/admin/routes.spec.js
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -13,9 +13,6 @@ const userController = require('../../../../src/forms/user/controller');
 // correctly, not the functionality of the middleware.
 //
 
-// TODO: Add a test the confirms that jwtService.protect is called with "admin"
-// when the file is loaded.
-
 const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
   next();
 });
@@ -40,6 +37,25 @@ afterEach(() => {
   jest.clearAllMocks();
 });
 
+// jwtService.protect is tricky to test. This test is fragile as the file could
+// change and have routes that need admin and others that don't. This test only
+// works when we use(protect) at the file level, not individually in the routes.
+// However, this does test that we don't accidentally turn off the protection.
+describe('jwtService.protect', () => {
+  it('should be called with admin', () => {
+    jest.resetModules();
+    const jwtService = require('../../../../src/components/jwtService');
+    jwtService.protect = jest.fn(() => {
+      return jest.fn((_req, _res, next) => {
+        next();
+      });
+    });
+    require('../../../../src/forms/admin/routes');
+
+    expect(jwtService.protect).toBeCalledWith('admin');
+  });
+});
+
 describe(`${basePath}/externalAPIs`, () => {
   const path = `${basePath}/externalAPIs`;
 
diff --git a/app/tests/unit/forms/form/routes.spec.js b/app/tests/unit/forms/form/routes.spec.js
index 1ffae78ba..def2835b8 100644
--- a/app/tests/unit/forms/form/routes.spec.js
+++ b/app/tests/unit/forms/form/routes.spec.js
@@ -22,10 +22,11 @@ apiAccess.mockImplementation(
   })
 );
 
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
 jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
+  return mockJwtServiceProtect;
 });
 
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
@@ -81,6 +82,7 @@ describe(`${basePath}`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.listForms).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -99,6 +101,7 @@ describe(`${basePath}`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.createForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -122,6 +125,7 @@ describe(`${basePath}/:formId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.deleteForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -140,6 +144,7 @@ describe(`${basePath}/:formId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -158,6 +163,7 @@ describe(`${basePath}/:formId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.updateForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -181,6 +187,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.deleteApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -199,6 +206,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.readApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -217,6 +225,7 @@ describe(`${basePath}/:formId/apiKey`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.createOrReplaceApiKey).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -240,6 +249,7 @@ describe(`${basePath}/:formId/apiKey/filesApiAccess`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.filesApiKeyAccess).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -263,6 +273,7 @@ describe(`${basePath}/:formId/csvexport/fields`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readFieldsForCSVExport).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -286,6 +297,7 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.documentTemplateList).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -304,6 +316,7 @@ describe(`${basePath}/:formId/documentTemplates`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.documentTemplateCreate).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -328,6 +341,7 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.documentTemplateDelete).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
@@ -346,6 +360,7 @@ describe(`${basePath}/:formId/documentTemplates/:documentTemplateId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.documentTemplateRead).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(1);
@@ -369,6 +384,7 @@ describe(`${basePath}/:formId/drafts`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.listDrafts).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -387,6 +403,7 @@ describe(`${basePath}/:formId/drafts`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.createDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -411,6 +428,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.deleteDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -429,6 +447,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -447,6 +466,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.updateDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -471,6 +491,7 @@ describe(`${basePath}/:formId/drafts/:formVersionDraftId/publish`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.publishDraft).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -494,6 +515,7 @@ describe(`${basePath}/:formId/emailTemplate`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.createOrUpdateEmailTemplate).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -517,6 +539,7 @@ describe(`${basePath}/:formId/emailTemplates`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.readEmailTemplates).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -540,6 +563,7 @@ describe(`${basePath}/:formId/export`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.export).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -563,6 +587,7 @@ describe(`${basePath}/:formId/export/fields`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.exportWithFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -586,6 +611,7 @@ describe(`${basePath}/:formId/options`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.readFormOptions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -609,6 +635,7 @@ describe(`${basePath}/:formId/statusCodes`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.getStatusCodes).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -632,6 +659,7 @@ describe(`${basePath}/:formId/submissions`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.listFormSubmissions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -655,6 +683,7 @@ describe(`${basePath}/:formId/subscriptions`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.readFormSubscriptionDetails).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -673,6 +702,7 @@ describe(`${basePath}/:formId/subscriptions`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.createOrUpdateSubscriptionDetails).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -696,6 +726,7 @@ describe(`${basePath}/:formId/version`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readPublishedForm).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -720,6 +751,7 @@ describe(`${basePath}/:formId/versions/:formVersionId`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readVersion).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -744,6 +776,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/fields`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.readVersionFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -768,6 +801,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/multiSubmission`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.createMultiSubmission).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -792,6 +826,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/publish`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.publishVersion).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -816,6 +851,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.listSubmissions).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -834,6 +870,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions`, () => {
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.createSubmission).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -858,6 +895,7 @@ describe(`${basePath}/:formId/versions/:formVersionId/submissions/discover`, ()
     expect(apiAccess).toBeCalledTimes(1);
     expect(controller.listSubmissionFields).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -881,6 +919,7 @@ describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () =>
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
@@ -903,6 +942,7 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
     expect(apiAccess).toBeCalledTimes(0);
     expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(rateLimiter.apiKeyRateLimiter).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateDocumentTemplateId).toBeCalledTimes(0);
diff --git a/app/tests/unit/forms/permission/routes.spec.js b/app/tests/unit/forms/permission/routes.spec.js
new file mode 100644
index 000000000..d64f5afa9
--- /dev/null
+++ b/app/tests/unit/forms/permission/routes.spec.js
@@ -0,0 +1,111 @@
+const request = require('supertest');
+
+const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const controller = require('../../../../src/forms/permission/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
+jwtService.protect = jest.fn(() => {
+  return mockJwtServiceProtect;
+});
+
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/permission/routes');
+const basePath = '/permission';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+// jwtService.protect is tricky to test. This test is fragile as the file could
+// change and have routes that need admin and others that don't. This test only
+// works when we use(protect) at the file level, not individually in the routes.
+// However, this does test that we don't accidentally turn off the protection.
+describe('jwtService.protect', () => {
+  it('should be called with admin', () => {
+    jest.resetModules();
+    const jwtService = require('../../../../src/components/jwtService');
+    jwtService.protect = jest.fn(() => {
+      return jest.fn((_req, _res, next) => {
+        next();
+      });
+    });
+    require('../../../../src/forms/permission/routes');
+
+    expect(jwtService.protect).toBeCalledWith('admin');
+  });
+});
+
+describe(`${basePath}`, () => {
+  const path = `${basePath}`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.list = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.list).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    controller.create = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.post(path);
+
+    expect(controller.create).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:code`, () => {
+  const path = `${basePath}/code`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.read).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    controller.update = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.put(path);
+
+    expect(controller.update).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/proxy/routes.spec.js b/app/tests/unit/forms/proxy/routes.spec.js
index dc7bb9bd4..1d65140e1 100644
--- a/app/tests/unit/forms/proxy/routes.spec.js
+++ b/app/tests/unit/forms/proxy/routes.spec.js
@@ -11,7 +11,6 @@ const request = require('supertest');
 
 const { expressHelper } = require('../../../common/helper');
 
-const jwtService = require('../../../../src/components/jwtService');
 const apiAccess = require('../../../../src/forms/auth/middleware/apiAccess');
 const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 const rateLimiter = require('../../../../src/forms/common/middleware/rateLimiter');
@@ -28,12 +27,6 @@ apiAccess.mockImplementation(
   })
 );
 
-jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
-});
-
 rateLimiter.apiKeyRateLimiter = jest.fn((_req, _res, next) => {
   next();
 });
diff --git a/app/tests/unit/forms/rbac/routes.spec.js b/app/tests/unit/forms/rbac/routes.spec.js
index 80d6e9734..91ceb2b8b 100644
--- a/app/tests/unit/forms/rbac/routes.spec.js
+++ b/app/tests/unit/forms/rbac/routes.spec.js
@@ -11,10 +11,11 @@ const controller = require('../../../../src/forms/rbac/controller');
 // correctly, not the functionality of the middleware.
 //
 
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
 jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
+  return mockJwtServiceProtect;
 });
 
 const hasFormPermissionsMock = jest.fn((_req, _res, next) => {
@@ -75,6 +76,7 @@ describe(`${basePath}/current`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -95,6 +97,7 @@ describe(`${basePath}/current/submissions`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -115,6 +118,7 @@ describe(`${basePath}/forms`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -131,6 +135,7 @@ describe(`${basePath}/forms`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -151,6 +156,7 @@ describe(`${basePath}/idps`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -171,6 +177,7 @@ describe(`${basePath}/submissions`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -187,6 +194,7 @@ describe(`${basePath}/submissions`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -207,6 +215,7 @@ describe(`${basePath}/users`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(hasFormRolesMock).toBeCalledTimes(1);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(1);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -223,6 +232,7 @@ describe(`${basePath}/users`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(0);
     expect(hasFormRolesMock).toBeCalledTimes(0);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(0);
@@ -239,6 +249,7 @@ describe(`${basePath}/users`, () => {
     expect(hasFormPermissionsMock).toBeCalledTimes(1);
     expect(hasFormRolesMock).toBeCalledTimes(1);
     expect(hasSubmissionPermissionsMock).toBeCalledTimes(0);
+    expect(mockJwtServiceProtect).toBeCalledTimes(0);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userAccess.hasRoleDeletePermissions).toBeCalledTimes(0);
     expect(userAccess.hasRoleModifyPermissions).toBeCalledTimes(1);
diff --git a/app/tests/unit/forms/role/routes.spec.js b/app/tests/unit/forms/role/routes.spec.js
new file mode 100644
index 000000000..2a5c92267
--- /dev/null
+++ b/app/tests/unit/forms/role/routes.spec.js
@@ -0,0 +1,111 @@
+const request = require('supertest');
+
+const { expressHelper } = require('../../../common/helper');
+
+const jwtService = require('../../../../src/components/jwtService');
+const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
+const controller = require('../../../../src/forms/role/controller');
+
+//
+// Mock out all the middleware - we're testing that the routes are set up
+// correctly, not the functionality of the middleware.
+//
+
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
+jwtService.protect = jest.fn(() => {
+  return mockJwtServiceProtect;
+});
+
+userAccess.currentUser = jest.fn((_req, _res, next) => {
+  next();
+});
+
+//
+// Create the router and a simple Express server.
+//
+
+const router = require('../../../../src/forms/role/routes');
+const basePath = '/role';
+const app = expressHelper(basePath, router);
+const appRequest = request(app);
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+// jwtService.protect is tricky to test. This test is fragile as the file could
+// change and have routes that need admin and others that don't. This test only
+// works when we use(protect) at the file level, not individually in the routes.
+// However, this does test that we don't accidentally turn off the protection.
+describe('jwtService.protect', () => {
+  it('should be called with admin', () => {
+    jest.resetModules();
+    const jwtService = require('../../../../src/components/jwtService');
+    jwtService.protect = jest.fn(() => {
+      return jest.fn((_req, _res, next) => {
+        next();
+      });
+    });
+    require('../../../../src/forms/role/routes');
+
+    expect(jwtService.protect).toBeCalledWith('admin');
+  });
+});
+
+describe(`${basePath}`, () => {
+  const path = `${basePath}`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.list = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.list).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for POST', async () => {
+    controller.create = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.post(path);
+
+    expect(controller.create).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+});
+
+describe(`${basePath}/:code`, () => {
+  const path = `${basePath}/code`;
+
+  it('should have correct middleware for GET', async () => {
+    controller.read = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.get(path);
+
+    expect(controller.read).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+
+  it('should have correct middleware for PUT', async () => {
+    controller.update = jest.fn((_req, res) => {
+      res.sendStatus(200);
+    });
+
+    await appRequest.put(path);
+
+    expect(controller.update).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
+    expect(userAccess.currentUser).toBeCalledTimes(1);
+  });
+});
diff --git a/app/tests/unit/forms/user/routes.spec.js b/app/tests/unit/forms/user/routes.spec.js
index f867d0fbf..891374970 100644
--- a/app/tests/unit/forms/user/routes.spec.js
+++ b/app/tests/unit/forms/user/routes.spec.js
@@ -13,10 +13,11 @@ const controller = require('../../../../src/forms/user/controller');
 // correctly, not the functionality of the middleware.
 //
 
+const mockJwtServiceProtect = jest.fn((_req, _res, next) => {
+  next();
+});
 jwtService.protect = jest.fn(() => {
-  return jest.fn((_req, _res, next) => {
-    next();
-  });
+  return mockJwtServiceProtect;
 });
 
 userAccess.currentUser = jest.fn((_req, _res, next) => {
@@ -43,6 +44,25 @@ afterEach(() => {
   jest.clearAllMocks();
 });
 
+// jwtService.protect is tricky to test. This test is fragile as the file could
+// change and have routes that need admin and others that don't. This test only
+// works when we use(protect) at the file level, not individually in the routes.
+// However, this does test that we don't accidentally turn off the protection.
+describe('jwtService.protect', () => {
+  it('should be called with no argument', () => {
+    jest.resetModules();
+    const jwtService = require('../../../../src/components/jwtService');
+    jwtService.protect = jest.fn(() => {
+      return jest.fn((_req, _res, next) => {
+        next();
+      });
+    });
+    require('../../../../src/forms/user/routes');
+
+    expect(jwtService.protect).toBeCalledWith();
+  });
+});
+
 describe(`${basePath}`, () => {
   const path = `${basePath}`;
 
@@ -54,6 +74,7 @@ describe(`${basePath}`, () => {
     await appRequest.get(path);
 
     expect(controller.list).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -72,6 +93,7 @@ describe(`${basePath}/:userId`, () => {
     await appRequest.get(path);
 
     expect(controller.read).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(1);
@@ -89,6 +111,7 @@ describe(`${basePath}/labels`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserLabels).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -102,6 +125,7 @@ describe(`${basePath}/labels`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserLabels).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -119,6 +143,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.delete(path);
 
     expect(controller.deleteUserPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -132,6 +157,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -145,6 +171,7 @@ describe(`${basePath}/preferences`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(0);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -163,6 +190,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.delete(path);
 
     expect(controller.deleteUserFormPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -176,6 +204,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.get(path);
 
     expect(controller.readUserFormPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);
@@ -189,6 +218,7 @@ describe(`${basePath}/preferences/forms/:formId`, () => {
     await appRequest.put(path);
 
     expect(controller.updateUserFormPreferences).toBeCalledTimes(1);
+    expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(validateParameter.validateFormId).toBeCalledTimes(1);
     expect(validateParameter.validateUserId).toBeCalledTimes(0);

From ede7f958a4aa31f731386c4875ece2ddaa9e0911 Mon Sep 17 00:00:00 2001
From: Walter Moar <Walter.Moar@gov.bc.ca>
Date: Tue, 20 Aug 2024 08:53:03 -0700
Subject: [PATCH 19/20] fix: FORMS-1448 validate admin route parameters (#1480)

---
 app/src/forms/admin/controller.js             |   2 +-
 app/src/forms/admin/routes.js                 |  29 +++--
 .../common/middleware/validateParameter.js    |  19 ++++
 app/tests/unit/forms/admin/routes.spec.js     | 102 ++++++++++++++++++
 app/tests/unit/routes/v1/admin.spec.js        |  44 +++++---
 app/tests/unit/routes/v1/form.spec.js         |   2 +-
 6 files changed, 171 insertions(+), 27 deletions(-)

diff --git a/app/src/forms/admin/controller.js b/app/src/forms/admin/controller.js
index a3dc39d02..d25b1ea66 100644
--- a/app/src/forms/admin/controller.js
+++ b/app/src/forms/admin/controller.js
@@ -100,7 +100,7 @@ module.exports = {
   },
   updateExternalAPI: async (req, res, next) => {
     try {
-      const response = await service.updateExternalAPI(req.params.id, req.body);
+      const response = await service.updateExternalAPI(req.params.externalApiId, req.body);
       res.status(200).json(response);
     } catch (error) {
       next(error);
diff --git a/app/src/forms/admin/routes.js b/app/src/forms/admin/routes.js
index 0a1698232..638075ac4 100644
--- a/app/src/forms/admin/routes.js
+++ b/app/src/forms/admin/routes.js
@@ -1,22 +1,28 @@
 const routes = require('express').Router();
 
+const jwtService = require('../../components/jwtService');
 const currentUser = require('../auth/middleware/userAccess').currentUser;
-
-const controller = require('./controller');
+const validateParameter = require('../common/middleware/validateParameter');
 const userController = require('../user/controller');
-const jwtService = require('../../components/jwtService');
+const controller = require('./controller');
 
-// Always have this applied to all routes here
+// Routes under /admin fetch data without doing form permission checks. All
+// routes in this file should remain under the "admin" role check, with the
+// "admin" role only given to people who have permission to read all data.
 routes.use(jwtService.protect('admin'));
+
 routes.use(currentUser);
 
-// Routes under the /admin pathing will fetch data without doing Form permission checks in the database
-// As such, this should ALWAYS remain under the :admin role check and that KC role should not be given out
-// other than to people who have permission to read all data
+routes.param('componentId', validateParameter.validateComponentId);
+routes.param('externalApiId', validateParameter.validateExternalAPIId);
+routes.param('formId', validateParameter.validateFormId);
+routes.param('formVersionId', validateParameter.validateFormVersionId);
+routes.param('userId', validateParameter.validateUserId);
 
 //
 // Forms
 //
+
 routes.get('/forms', async (req, res, next) => {
   await controller.listForms(req, res, next);
 });
@@ -52,6 +58,7 @@ routes.put('/forms/:formId/addUser', async (req, res, next) => {
 //
 // Users
 //
+
 routes.get('/users', async (req, res, next) => {
   await controller.getUsers(req, res, next);
 });
@@ -61,21 +68,23 @@ routes.get('/users/:userId', async (req, res, next) => {
 });
 
 //
-// APIs
+// External APIs
 //
+
 routes.get('/externalAPIs', async (req, res, next) => {
   await controller.getExternalAPIs(req, res, next);
 });
 
-routes.put('/externalAPIs/:id', async (req, res, next) => {
+routes.put('/externalAPIs/:externalApiId', async (req, res, next) => {
   await controller.updateExternalAPI(req, res, next);
 });
 
 routes.get('/externalAPIs/statusCodes', async (req, res, next) => {
   await controller.getExternalAPIStatusCodes(req, res, next);
 });
+
 //
-//Form componets help info
+// Form Components Help
 //
 
 routes.post('/formcomponents/proactivehelp/object', async (req, res, next) => {
diff --git a/app/src/forms/common/middleware/validateParameter.js b/app/src/forms/common/middleware/validateParameter.js
index 411c2ec2c..f9f709fab 100644
--- a/app/src/forms/common/middleware/validateParameter.js
+++ b/app/src/forms/common/middleware/validateParameter.js
@@ -20,6 +20,24 @@ const _validateUuid = (parameter, parameterName) => {
   }
 };
 
+/**
+ * Validates that the :componentId route parameter exists and is a UUID.
+ *
+ * @param {*} _req the Express object representing the HTTP request - unused.
+ * @param {*} _res the Express object representing the HTTP response - unused.
+ * @param {*} next the Express chaining function.
+ * @param {*} componentId the :componentId value from the route.
+ */
+const validateComponentId = async (_req, _res, next, componentId) => {
+  try {
+    _validateUuid(componentId, 'componentId');
+
+    next();
+  } catch (error) {
+    next(error);
+  }
+};
+
 /**
  * Validates that the :documentTemplateId route parameter exists and is a UUID.
  * This validator requires that either the :formId or :formSubmissionId route
@@ -211,6 +229,7 @@ const validateUserId = async (_req, _res, next, userId) => {
 };
 
 module.exports = {
+  validateComponentId,
   validateDocumentTemplateId,
   validateExternalAPIId,
   validateFileId,
diff --git a/app/tests/unit/forms/admin/routes.spec.js b/app/tests/unit/forms/admin/routes.spec.js
index f02a1e05d..bc886272d 100644
--- a/app/tests/unit/forms/admin/routes.spec.js
+++ b/app/tests/unit/forms/admin/routes.spec.js
@@ -6,6 +6,7 @@ const { expressHelper } = require('../../../common/helper');
 const jwtService = require('../../../../src/components/jwtService');
 const userAccess = require('../../../../src/forms/auth/middleware/userAccess');
 const controller = require('../../../../src/forms/admin/controller');
+const validateParameter = require('../../../../src/forms/common/middleware/validateParameter');
 const userController = require('../../../../src/forms/user/controller');
 
 //
@@ -24,6 +25,22 @@ userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
 
+validateParameter.validateComponentId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateExternalAPIId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateFormId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateFormVersionId = jest.fn((_req, _res, next) => {
+  next();
+});
+validateParameter.validateUserId = jest.fn((_req, _res, next) => {
+  next();
+});
+
 //
 // Create the router and a simple Express server.
 //
@@ -69,6 +86,11 @@ describe(`${basePath}/externalAPIs`, () => {
     expect(controller.getExternalAPIs).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -86,6 +108,11 @@ describe(`${basePath}/externalAPIs/:externalApiId`, () => {
     expect(controller.updateExternalAPI).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -102,6 +129,11 @@ describe(`${basePath}/externalAPIs/statusCodes`, () => {
     expect(controller.getExternalAPIStatusCodes).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -119,6 +151,11 @@ describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`,
     expect(controller.updateFormComponentsProactiveHelp).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -136,6 +173,11 @@ describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () =>
     expect(controller.getFCProactiveHelpImageUrl).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(1);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -152,6 +194,11 @@ describe(`${basePath}/formcomponents/proactivehelp/list`, () => {
     expect(controller.listFormComponentsProactiveHelp).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -168,6 +215,11 @@ describe(`${basePath}/formcomponents/proactivehelp/object`, () => {
     expect(controller.createFormComponentsProactiveHelp).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -184,6 +236,11 @@ describe(`${basePath}/forms`, () => {
     expect(controller.listForms).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -201,6 +258,11 @@ describe(`${basePath}/forms/:formId`, () => {
     expect(controller.readForm).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -218,6 +280,11 @@ describe(`${basePath}/forms/:formId/addUser`, () => {
     expect(controller.setFormUserRoles).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -235,6 +302,11 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
     expect(controller.deleteApiKey).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 
   it('should have correct middleware for GET', async () => {
@@ -247,6 +319,11 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
     expect(controller.readApiDetails).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -264,6 +341,11 @@ describe(`${basePath}/forms/:formId/formUsers`, () => {
     expect(controller.getFormUserRoles).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -281,6 +363,11 @@ describe(`${basePath}/forms/:formId/restore`, () => {
     expect(controller.restoreForm).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -299,6 +386,11 @@ describe(`${basePath}/forms/:formId/versions/:formVersionId`, () => {
     expect(controller.readVersion).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(1);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(1);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -315,6 +407,11 @@ describe(`${basePath}/users`, () => {
     expect(controller.getUsers).toBeCalledTimes(1);
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(0);
   });
 });
 
@@ -332,5 +429,10 @@ describe(`${basePath}/users/:userId`, () => {
     expect(mockJwtServiceProtect).toBeCalledTimes(1);
     expect(userAccess.currentUser).toBeCalledTimes(1);
     expect(userController.read).toBeCalledTimes(1);
+    expect(validateParameter.validateComponentId).toBeCalledTimes(0);
+    expect(validateParameter.validateExternalAPIId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormId).toBeCalledTimes(0);
+    expect(validateParameter.validateFormVersionId).toBeCalledTimes(0);
+    expect(validateParameter.validateUserId).toBeCalledTimes(1);
   });
 });
diff --git a/app/tests/unit/routes/v1/admin.spec.js b/app/tests/unit/routes/v1/admin.spec.js
index 2160fe638..74de623df 100644
--- a/app/tests/unit/routes/v1/admin.spec.js
+++ b/app/tests/unit/routes/v1/admin.spec.js
@@ -1,16 +1,16 @@
-const request = require('supertest');
 const Problem = require('api-problem');
+const request = require('supertest');
+const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');
 
-//
-// mock middleware
-//
 const jwtService = require('../../../../src/components/jwtService');
+const validateParameter = require('../../../../src/forms/common/middleware/validateParameter');
 
 //
-// test assumes that caller has appropriate token, we are not testing middleware here...
+// mock middleware
 //
+
 jwtService.protect = jest.fn(() => {
   return jest.fn((_req, _res, next) => {
     next();
@@ -22,6 +22,10 @@ userAccess.currentUser = jest.fn((_req, _res, next) => {
   next();
 });
 
+validateParameter.validateFormVersionId = jest.fn((_req, _res, next) => {
+  next();
+});
+
 //
 // we will mock the underlying data service calls...
 //
@@ -46,7 +50,8 @@ afterEach(() => {
 });
 
 describe(`${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`, () => {
-  const path = `${basePath}/formcomponents/proactivehelp/imageUrl/:componentId`;
+  const componentId = uuid.v4();
+  const path = `${basePath}/formcomponents/proactivehelp/imageUrl/${componentId}`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -176,7 +181,8 @@ describe(`${basePath}/formcomponents/proactivehelp/object`, () => {
 });
 
 describe(`${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`, () => {
-  const path = `${basePath}/formcomponents/proactivehelp/:publishStatus/:componentId`;
+  const componentId = uuid.v4();
+  const path = `${basePath}/formcomponents/proactivehelp/:publishStatus/${componentId}`;
 
   describe('PUT', () => {
     it('should return 200', async () => {
@@ -266,7 +272,8 @@ describe(`${basePath}/forms`, () => {
 });
 
 describe(`${basePath}/forms/:formId`, () => {
-  const path = `${basePath}/forms/:formId`;
+  const formId = uuid.v4();
+  const path = `${basePath}/forms/${formId}`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -306,7 +313,8 @@ describe(`${basePath}/forms/:formId`, () => {
 });
 
 describe(`${basePath}/forms/:formId/addUser`, () => {
-  const path = `${basePath}/forms/:formId/addUser`;
+  const formId = uuid.v4();
+  const path = `${basePath}/forms/${formId}/addUser`;
 
   describe('PUT', () => {
     it('should return 200', async () => {
@@ -315,7 +323,7 @@ describe(`${basePath}/forms/:formId/addUser`, () => {
 
       const response = await appRequest.put(path).query({ userId: '123' }).send({ userId: '123' });
 
-      expect(rbacService.setFormUsers).toBeCalledWith(':formId', '123', { userId: '123' }, undefined);
+      expect(rbacService.setFormUsers).toBeCalledWith(formId, '123', { userId: '123' }, undefined);
       expect(response.statusCode).toBe(200);
       expect(response.body).toBeTruthy();
     });
@@ -357,7 +365,8 @@ describe(`${basePath}/forms/:formId/addUser`, () => {
 });
 
 describe(`${basePath}/forms/:formId/apiKey`, () => {
-  const path = `${basePath}/forms/:formId/apiKey`;
+  const formId = uuid.v4();
+  const path = `${basePath}/forms/${formId}/apiKey`;
 
   describe('DELETE', () => {
     it('should return 204', async () => {
@@ -433,7 +442,8 @@ describe(`${basePath}/forms/:formId/apiKey`, () => {
 });
 
 describe(`${basePath}/forms/:formId/formUsers`, () => {
-  const path = `${basePath}/forms/:formId/formUsers`;
+  const formId = uuid.v4();
+  const path = `${basePath}/forms/${formId}/formUsers`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -473,7 +483,8 @@ describe(`${basePath}/forms/:formId/formUsers`, () => {
 });
 
 describe(`${basePath}/forms/:formId/restore`, () => {
-  const path = `${basePath}/forms/:formId/restore`;
+  const formId = uuid.v4();
+  const path = `${basePath}/forms/${formId}/restore`;
 
   describe('PUT', () => {
     it('should return 200', async () => {
@@ -513,7 +524,9 @@ describe(`${basePath}/forms/:formId/restore`, () => {
 });
 
 describe(`${basePath}/forms/:formId/versions/:formVersionId`, () => {
-  const path = `${basePath}/forms/:formId/versions/:formVersionId`;
+  const formId = uuid.v4();
+  const formVersionId = uuid.v4();
+  const path = `${basePath}/forms/${formId}/versions/${formVersionId}`;
 
   describe('GET', () => {
     it('should return 200', async () => {
@@ -593,7 +606,8 @@ describe(`${basePath}/users`, () => {
 });
 
 describe(`${basePath}/users/:userId`, () => {
-  const path = `${basePath}/users/:userId`;
+  const userId = uuid.v4();
+  const path = `${basePath}/users/${userId}`;
 
   describe('GET', () => {
     it('should return 200', async () => {
diff --git a/app/tests/unit/routes/v1/form.spec.js b/app/tests/unit/routes/v1/form.spec.js
index c2a0fa4bf..750f6363f 100644
--- a/app/tests/unit/routes/v1/form.spec.js
+++ b/app/tests/unit/routes/v1/form.spec.js
@@ -1,5 +1,5 @@
-const request = require('supertest');
 const Problem = require('api-problem');
+const request = require('supertest');
 const uuid = require('uuid');
 
 const { expressHelper } = require('../../../common/helper');

From 5b398c6d015fa07e132d30b10924a352af022062 Mon Sep 17 00:00:00 2001
From: Nimya John <78105113+nimya-aot@users.noreply.github.com>
Date: Tue, 20 Aug 2024 10:01:19 -0700
Subject: [PATCH 20/20] Test/forms 1313 (#1428)

* #FORMS-974

* #974 updates

* #980 modification to cypress config

* FORMS-980

* #992

* #992 Fix cypress scripts

* #1011 Form design page

* #1011 test scripts

* #1023 cypress scripts

* #1023 advanced data components

* #1023 Updated scripts

* #1023 updation

* Updated json file

* Test/forms (#1011)(#1023) (#1307)

* #FORMS-974

* #974 updates

* #980 modification to cypress config

* FORMS-980

* #992

* #992 Fix cypress scripts

* #1011 Form design page

* #1011 test scripts

* #1023 cypress scripts

* #1023 advanced data components

* #1023 Updated scripts

* #1023 updation

* Updated json file

* #1059 workflow file for cypress

* #1059 updated the base url

* #1059 updated workflow

* Updated node version

* updated

* updated

* Updation

* updated file

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* updated package file

* Update cypress-ci.yaml

* Updated config file

* Update cypress-ci.yaml

* #1059 updated package

* #1060 scripts for Advanced fields and BC Gov components

* Fixing review comments

* Updated changes

* # Updated with PR comments

* updated

* Update form-design-basicfields.cy.js

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Modifies test scripts

* Updated files

* Fixed errors during CI/CD Run

* Updated browser type

* Updated Simple BC address component

* Updated

* Fields updated

* Test script changed

* Updated

* Updated fields

* Updated env variable

* Update form-design-basicfields.cy.js

* Updated

* Update cypress-ci.yaml

* Updated email input

* screenshots

* Updated path

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Updated version on workflow

* Fix to failed tests

* Fix to BC address component

* Updated the  component

* Changed button element

* Fixed BC components

* Modified submission

* Modified components

* Updated attribute

* Updated

* Changed simpleBC address component

* Update package.json

* Update package-lock.json

* Test scripts

* Updated

* Pushed the changes

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Env change

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Update cypress-ci.yaml

* Updated

* Updated to take default env variable

* Updated with current workflow

* updated

* Formatted

* Update cypress.config.js

* updated

* Test scripts for updating submission data

* Scripts for adding notes

* Added scripts for logout after each run

---------

Co-authored-by: jasonchung1871 <101672465+jasonchung1871@users.noreply.github.com>
Co-authored-by: Vijaivir Dhaliwal <91633223+vijaivir@users.noreply.github.com>
---
 .../cypress/e2e/form-apikey-cdogs.cy.js       |   3 +
 .../e2e/form-design-advanceddata.cy.js        |   1 +
 .../e2e/form-design-advancedfield.cy.js       |   1 +
 .../cypress/e2e/form-design-basicfields.cy.js |  17 +-
 ...m-design-basiclayout-advanced-layout.cy.js |   1 +
 .../e2e/form-edit-submission-data.cy.js       | 210 ++++++++++++++++++
 .../cypress/e2e/form-manage-form.cy.js        |   1 +
 .../e2e/form-simple-form-publish.cy.js        |   1 +
 .../cypress/e2e/form-team-management.cy.js    |   1 +
 9 files changed, 229 insertions(+), 7 deletions(-)
 create mode 100644 tests/functional/cypress/e2e/form-edit-submission-data.cy.js

diff --git a/tests/functional/cypress/e2e/form-apikey-cdogs.cy.js b/tests/functional/cypress/e2e/form-apikey-cdogs.cy.js
index ca4ced762..aed9c8c8a 100644
--- a/tests/functional/cypress/e2e/form-apikey-cdogs.cy.js
+++ b/tests/functional/cypress/e2e/form-apikey-cdogs.cy.js
@@ -119,6 +119,9 @@ describe('Form Designer', () => {
     
     cy.get('[data-test="canRemoveForm"]').click();
     cy.get('[data-test="continue-btn-continue"]').click();
+    cy.waitForLoad();
+    cy.waitForLoad();
+    cy.get('#logoutButton > .v-btn__content > span').click();
 
   })
 
diff --git a/tests/functional/cypress/e2e/form-design-advanceddata.cy.js b/tests/functional/cypress/e2e/form-design-advanceddata.cy.js
index b5a5b3bcf..522e32b29 100644
--- a/tests/functional/cypress/e2e/form-design-advanceddata.cy.js
+++ b/tests/functional/cypress/e2e/form-design-advanceddata.cy.js
@@ -227,6 +227,7 @@ it('Checks the Container component', () => {
       //cy.get('.mdi-delete').click();
       cy.get(':nth-child(5) > .v-btn > .v-btn__content > .mdi-delete').click();
       cy.get('[data-test="continue-btn-continue"]').click();
+      cy.get('#logoutButton > .v-btn__content > span').click();
      
    })
     
diff --git a/tests/functional/cypress/e2e/form-design-advancedfield.cy.js b/tests/functional/cypress/e2e/form-design-advancedfield.cy.js
index 1530de35c..eecdb660d 100644
--- a/tests/functional/cypress/e2e/form-design-advancedfield.cy.js
+++ b/tests/functional/cypress/e2e/form-design-advancedfield.cy.js
@@ -320,6 +320,7 @@ describe('Form Designer', () => {
         cy.waitForLoad();
         cy.get('.mdi-delete').click();
         cy.get('[data-test="continue-btn-continue"]').click();
+        cy.get('#logoutButton > .v-btn__content > span').click();
         
         })
 
diff --git a/tests/functional/cypress/e2e/form-design-basicfields.cy.js b/tests/functional/cypress/e2e/form-design-basicfields.cy.js
index e6a0854a3..822fa4146 100644
--- a/tests/functional/cypress/e2e/form-design-basicfields.cy.js
+++ b/tests/functional/cypress/e2e/form-design-basicfields.cy.js
@@ -243,14 +243,15 @@ describe('Form Designer', () => {
         
         cy.get('button').contains('Save').click();
       });
-      cy.get('[ref=removeComponent]').then($el => {
+      //cy.get('[ref=removeComponent]').then($el => {
 
-        const rem=$el[11];
-        rem.click();
+       // const rem=$el[11];
+        //rem.click();
         
-        });
-
+        //});
 
+      cy.waitForLoad();
+      cy.waitForLoad();
       cy.get('[data-cy=saveButton]').click();
       cy.waitForLoad();
 
@@ -288,9 +289,11 @@ describe('Form Designer', () => {
      cy.visit(`/${depEnv}/form/design?d=${arrayValues[0]}&f=${dval[0]}`);
      cy.waitForLoad();
      cy.waitForLoad();
-     //cy.get('[data-cy="settingsRouterLink"] > .text').click();
+     
      cy.get('[data-cy="settingsRouterLink"] > .v-btn').click();
-     cy.get('.mt-6 > :nth-child(2) > div > :nth-child(5) > .v-btn').click();
+     cy.waitForLoad();
+     cy.get('[data-test="canRemoveForm"]').click();
+     
      cy.get('[data-test="continue-btn-continue"]').click();
      
     });
diff --git a/tests/functional/cypress/e2e/form-design-basiclayout-advanced-layout.cy.js b/tests/functional/cypress/e2e/form-design-basiclayout-advanced-layout.cy.js
index 91b889e2c..1f9b63ab5 100644
--- a/tests/functional/cypress/e2e/form-design-basiclayout-advanced-layout.cy.js
+++ b/tests/functional/cypress/e2e/form-design-basiclayout-advanced-layout.cy.js
@@ -257,6 +257,7 @@ it('Checks the Table', () => {
       //cy.get('.mdi-delete').click();
       cy.get(':nth-child(5) > .v-btn > .v-btn__content > .mdi-delete').click();
       cy.get('[data-test="continue-btn-continue"]').click();
+      cy.get('#logoutButton > .v-btn__content > span').click();
 
      })
 
diff --git a/tests/functional/cypress/e2e/form-edit-submission-data.cy.js b/tests/functional/cypress/e2e/form-edit-submission-data.cy.js
new file mode 100644
index 000000000..88f429f37
--- /dev/null
+++ b/tests/functional/cypress/e2e/form-edit-submission-data.cy.js
@@ -0,0 +1,210 @@
+import 'cypress-keycloak-commands';
+import 'cypress-drag-drop';
+import { formsettings } from '../support/login.js';
+
+const depEnv = Cypress.env('depEnv');
+
+
+Cypress.Commands.add('waitForLoad', () => {
+  const loaderTimeout = 60000;
+
+  cy.get('.nprogress-busy', { timeout: loaderTimeout }).should('not.exist');
+});
+describe('Form Designer', () => {
+
+    beforeEach(()=>{
+      
+      
+      cy.on('uncaught:exception', (err, runnable) => {
+        // Form.io throws an uncaught exception for missing projectid
+        // Cypress catches it as undefined: undefined so we can't get the text
+        console.log(err);
+        return false;
+      });
+    });
+    it('Visits the form settings page', () => {
+    
+    
+        cy.viewport(1000, 1100);
+        cy.waitForLoad();
+        formsettings();
+        
+    }); 
+    it('Add some fields for submission', () => {
+
+    cy.viewport(1000, 1800);
+    cy.waitForLoad();
+    cy.get('button').contains('Basic Fields').click();
+    let textFields = ["First Name", "Middle Name", "Last Name"];
+
+    for(let i=0; i<textFields.length; i++) {
+      cy.get('button').contains('Basic Fields').click();
+      cy.get('div.formio-builder-form').then($el => {
+      const bounds = $el[0].getBoundingClientRect();
+      cy.get('span.btn').contains('Text Field')
+        .trigger('mousedown', { which: 1}, { force: true })
+        .trigger('mousemove', bounds.x, -100, { force: true })
+        .trigger('mouseup', { force: true });
+        cy.get('p').contains('Text Field Component');
+        cy.get('input[name="data[label]"]').clear();
+        cy.get('input[name="data[label]"]').clear();
+        cy.get('input[name="data[label]"]').type(textFields[i]);
+        cy.get('button').contains('Save').click();
+      });
+    }
+ 
+
+    });
+    it('Form Submission and Updation', () => {
+        cy.viewport(1000, 1100);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('div.formio-builder-form').then($el => {
+            const coords2 = $el[0].getBoundingClientRect();
+            cy.get('span.btn').contains('Checkbox')
+            
+            .trigger('mousedown', { which: 1}, { force: true })
+            .trigger('mousemove', coords2.x, -50, { force: true })
+            .trigger('mouseup', { force: true });
+            cy.get('p').contains('Checkbox Component');
+            cy.get('input[name="data[label]"]').clear();
+            cy.get('input[name="data[label]"]').clear();
+            cy.get('input[name="data[label]"]').type('Applying for self');
+            cy.get('button').contains('Save').click();
+        });
+        cy.intercept('GET', `/${depEnv}/api/v1/forms/*`).as('getForm');
+        // Form saving
+        let savedButton = cy.get('[data-cy=saveButton]');
+        expect(savedButton).to.not.be.null;
+        savedButton.trigger('click');
+        cy.waitForLoad();
+        
+      
+      
+        // Go to My forms  
+        cy.wait('@getForm').then(()=>{
+        let userFormsLinks = cy.get('[data-cy=userFormsLinks]');
+        expect(userFormsLinks).to.not.be.null;
+        userFormsLinks.trigger('click');
+        });
+        // Filter the newly created form
+        cy.location('search').then(search => {
+            //let pathName = fullUrl.pathname
+            let arr = search.split('=');
+            let arrayValues = arr[1].split('&');
+            cy.log(arrayValues[0]);
+            //cy.log(arrayValues[1]);
+            //cy.log(arrayValues[2]);
+            cy.visit(`/${depEnv}/form/manage?f=${arrayValues[0]}`);
+            cy.waitForLoad();
+        
+         
+          //Publish the form
+        cy.get('.v-label > span').click();
+      
+        cy.get('span').contains('Publish Version 1');
+      
+        cy.contains('Continue').should('be.visible');
+        cy.contains('Continue').trigger('click');
+        //Submit the form
+        cy.visit(`/${depEnv}/form/submit?f=${arrayValues[0]}`);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('button').contains('Submit').should('be.visible');
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('input[name="data[simpletextfield1]"').click();
+        cy.get('input[name="data[simpletextfield1]"').type('Alex');
+        cy.get('input[name="data[simpletextfield2]"').click();
+        cy.get('input[name="data[simpletextfield2]"').type('Smith');
+        //cy.get('.form-check-input').click();
+         //form submission
+        cy.get('button').contains('Submit').click();
+        cy.waitForLoad();
+        cy.get('button').contains('Submit').click();
+        cy.waitForLoad();
+        cy.get('button').contains('Submit').click();
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('label').contains('First Name').should('be.visible');
+        cy.get('label').contains('Last Name').should('be.visible');
+        cy.get('label').contains('Applying for self').should('be.visible');
+        
+        
+        //Update submission
+        cy.visit(`/${depEnv}/form/manage?f=${arrayValues[0]}`);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.visit(`/${depEnv}/form/submit?f=${arrayValues[0]}`);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('button').contains('Submit').should('be.visible');
+        cy.get('input[name="data[simpletextfield1]"').click();
+        cy.get('input[name="data[simpletextfield1]"').type('Alex');
+        cy.get('input[name="data[simpletextfield2]"').click();
+        cy.get('input[name="data[simpletextfield2]"').type('Smith');
+        cy.get('button').contains('Submit').click();
+        cy.waitForLoad();
+        cy.get('button').contains('Submit').click();
+        cy.get('[data-test="continue-btn-continue"]').click();
+        cy.get('label').contains('First Name').should('be.visible');
+        cy.get('label').contains('Last Name').should('be.visible');
+        cy.get('label').contains('Applying for self').should('be.visible')
+        //view submission
+        cy.visit(`/${depEnv}/form/manage?f=${arrayValues[0]}`);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        
+        cy.get('.mdi-list-box-outline').click();
+        cy.waitForLoad();
+        cy.get(':nth-child(1) > :nth-child(6) > a > .v-btn > .v-btn__content > .mdi-eye').click();
+        //Edit submission
+        cy.get('.mdi-pencil').click();
+        //check visibility of cancel button
+        cy.get('.v-col-2 > .v-btn').should('be.visible');
+        cy.get('button').contains('Submit').should('be.visible');
+        
+        //Edit submission data
+        cy.get('input[name="data[simpletextfield1]"').click();
+        cy.get('input[name="data[simpletextfield1]"').clear();
+        cy.get('input[name="data[simpletextfield1]"').type('Nancy');
+        cy.get('input[name="data[simpletextfield2]"').click();
+        cy.get('input[name="data[simpletextfield2]"').type('Smith');
+        cy.get('button').contains('Submit').click();
+        cy.waitForLoad();
+        cy.get('[data-test="continue-btn-continue"]').click();
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('label').contains('First Name').should('be.visible');
+        cy.get('label').contains('Last Name').should('be.visible');
+        //Adding notes to submission
+        cy.get('.mdi-plus').click();
+        cy.get('div').find('textarea').then($el => {
+
+          const rem=$el[0];
+          rem.click();
+          cy.get(rem).type('some notes');
+          
+          
+          });
+        cy.get('[data-test="canCancelNote"]').should('be.visible');
+        cy.get('[data-test="btn-add-note"]').click();
+        cy.get('.notes-text').contains('1');
+        //Delete form after test run
+        cy.visit(`/${depEnv}/form/manage?f=${arrayValues[0]}`);
+        cy.waitForLoad();
+        cy.waitForLoad();
+        cy.get('.mdi-delete').click();
+        cy.get('[data-test="continue-btn-continue"]').click();
+        cy.get('#logoutButton > .v-btn__content > span').click();
+        
+        
+        })
+
+        
+    });
+
+});
\ No newline at end of file
diff --git a/tests/functional/cypress/e2e/form-manage-form.cy.js b/tests/functional/cypress/e2e/form-manage-form.cy.js
index 03da3a0c2..297fe5a84 100644
--- a/tests/functional/cypress/e2e/form-manage-form.cy.js
+++ b/tests/functional/cypress/e2e/form-manage-form.cy.js
@@ -202,6 +202,7 @@ describe('Form Designer', () => {
       //Delete form after test run
       cy.get('.mdi-delete').click();
       cy.get('[data-test="continue-btn-continue"]').click();
+      cy.get('#logoutButton > .v-btn__content > span').click();
 
 
 
diff --git a/tests/functional/cypress/e2e/form-simple-form-publish.cy.js b/tests/functional/cypress/e2e/form-simple-form-publish.cy.js
index 0eb43f789..269bcf60e 100644
--- a/tests/functional/cypress/e2e/form-simple-form-publish.cy.js
+++ b/tests/functional/cypress/e2e/form-simple-form-publish.cy.js
@@ -105,6 +105,7 @@ describe('Form Designer', () => {
       //cy.get('.mdi-delete').click();
       cy.get(':nth-child(5) > .v-btn > .v-btn__content > .mdi-delete').click();
       cy.get('[data-test="continue-btn-continue"]').click();
+      cy.get('#logoutButton > .v-btn__content > span').click();
    
 
     });
diff --git a/tests/functional/cypress/e2e/form-team-management.cy.js b/tests/functional/cypress/e2e/form-team-management.cy.js
index 93e2be68c..8575e261b 100644
--- a/tests/functional/cypress/e2e/form-team-management.cy.js
+++ b/tests/functional/cypress/e2e/form-team-management.cy.js
@@ -176,6 +176,7 @@ describe('Form Designer', () => {
     //Delete form after test run
       cy.get('.mdi-delete').click();
       cy.get('[data-test="continue-btn-continue"]').click();
+      cy.get('#logoutButton > .v-btn__content > span').click();
     })
     
   });