build: release v6.71.0

[wanlingt]

New

• feat: platform api v1 - get and update webhook settings #6608
• fix: remove space from receipt link email #6634
• feat: display payment products on individual response page and csv download #6629
• fix: default payment type to products #6633
• fix: skip qty validation when multiqty is disabled #6624
• feat: add logging to capture DNS resolution error #6631
• chore: reduce toast duration to 4s #6630
• fix: product item button check for payment is not enabled #6625
• build: merge v6.70.0 into develop #6627
• feat: add datafix script to convert payment_fields_snapshot from an array to an object #6628
• • fix(deps): bump libphonenumber-js from 1.10.38 to 1.10.39 in /shared (fix(deps): bump libphonenumber-js from 1.10.38 to 1.10.39 in /shared #6594) #6623

Dependencies

• fix(deps): bump zod from 3.21.4 to 3.22.1 in /shared #6626

Dev-Dependencies

Tests

feat: platform api v1 - get and update webhook settings #6608

@LinHuiqing

POST /api/public/v1/admin/forms/:formId/webhooksettings to retrieve webhook settings

curl --request POST \
  --url https://staging.form.gov.sg/api/public/v1/admin/forms/:formId/settings \
  --header 'Authorization: Bearer test_v1_APITOKENHERE' \
  --header 'Content-Type: application/json' \
  --data '{"userEmail": "adminOfFormId"}'

• Test that API call works - the webhook settings retrieved should be what's in the DB. The userEmail provided should be an admin of the formId in the URL
• Use an invalid API token. You should get a 401 Unauthorised - Invalid API Key message
• Use a user email that is a FormSG user, but isn't the admin of the form ID provided. You should get a 403 Forbidden message
• Use an invalid form ID. You should get a 404 not found error
• Use an invalid request body e.g. misspell userEmail to useEmail. You should get a 400 Bad Request validation error

PATCH /api/public/v1/admin/forms/:formId/webhooksettings to update webhook settings

curl --request PATCH \
  --url https://staging.form.gov.sg/api/public/v1/admin/forms/:formId/settings \
  --header 'Authorization: Bearer test_v1_APITOKENHERE' \
  --header 'Content-Type: application/json' \
  --data '{"userEmail": "adminOfFormId",
"webhook": {
		"url":"https://www.webhookUrl.com",
	"isRetryEnabled": true
}}'

• Test that API call successfully updates the webhook settings. The userEmail provided should be an admin of the formId in the URL
• Use an invalid API token. You should get a 401 Unauthorised - Invalid API Key message
• Use a user email that is a FormSG user, but isn't the admin of the form ID provided. You should get a 403 Forbidden message
• Use an invalid form ID. You should get a 404 not found error
• Use an invalid request body e.g. misspell userEmail to useEmail. You should get a 400 Bad Request validation error
• Use an invalid URL for the webhook (i.e. https://random.site.ugh). An error should be thrown and the webhook settings should not be updated.

fix: remove space from receipt link email #6634

@wanlingt

• Make payment on a form. Check that the email received does not have a space behind the link for "here".

feat: display payment products on individual response page and csv download #6629

@foochifa

• Submit a payment with payment by products (radio version). Once submitted, ensure that the product can be seen on the individual response page and CSV download.
• Submit a payment with payment by products (checkbox version). Once submitted, ensure that the product can be seen on the individual response page and CSV download.
• Submit a payment with payment by products (checkbox version with multiple quantity). Once submitted, ensure that the product can be seen on the individual response page and CSV download.
• Regression: ensure that the product listing is - for older fixed payments on both of the individual response page and CSV download.

fix: default payment type to products #6633

@wanlingt

• Create a new payment field
• Delete the payment field
• Go to create tab payment, the default payment type should be products (and you should not see the fixed payment option)

fix: skip qty validation when multiqty is disabled #6624

@wanlingt

Quantity below max payment amount (200k)

• Save button should be enabled when amount is 20k, and toggle disabled
• Enable toggle and set max quantity as 9
• Save button remains enabled
• Saving items succeeds and is reflected on payment input panel with amount as $20000.00

Quantity at max payment amount (200k)

• Save button should be enabled when amount is 20k, and toggle disabled
• Enable toggle and set max quantity as 10
• Save button remains enabled
• Saving items succeeds and is reflected on payment input panel with amount as $20000.00

Quantity above max payment amount (200k)

• Save button should be enabled when amount is 20k, and toggle disabled
• Enable toggle and set max quantity as 11
• Save button is now disabled
• Saving button should not be interactable
• Disable toggle
• Saving button is now enabled
• Saving items succeeds and is reflected on payment input panel with amount as $20000.00

Regression

• Add new products
• Enabling toggle doesn't crash the modal
  • Shows error Please enter a valid payment amount
• Disabling toggle doesn't crash the modal
  • Continue to show error Please enter a valid payment amount

feat: add logging to capture DNS resolution error #6631

@foochifa

• Update a storage mode form with a webhook url that will fail DNS resolution
• Submit a form
• Check that error records appear in CloudWatch for the following query:
  fields @timestamp, @message, @logStream, @log
| filter message like 'Webhook URL failed validation' and meta.action like 'validateWebhookUrl'

chore: reduce toast duration to 4s #6630

@justynoh

• do any action that results in a toast (Create/delete form, create/update/delete fields)
• check that the toast duration is ~4s

fix: product item button check for payment is not enabled #6625

@justynoh

Buttons are disabled and non-interactable

• As an admin, create a product payment form with at least 1 product
• Disconnect stripe account
• Observe that the buttons on PaymentInputPanel are now faded out (disabled variant)
• Buttons are also not interactable, it doesn't open modal or gets deleted

feat: add datafix script to convert payment_fields_snapshot from an array to an object #6628

Before running the DB script:

• Load the payment summary page of a payment where its payment_fields_snapshot is an array. The product/service name should be missing.
  After running the DB script:
• Load the payment summary page of the same payment. The product/service name should now be populated with the same name that's in the proof of payment.

Deploy Notes

New scripts:

• convert-payment-fields-snapshot-to-object.js : This script adds the payment_fields_snapshot field to the payments collection and sets the field as the form document's payment_field for all existing documents.

New environment variables:

• PLATFORM_API_RATE_LIMIT: Per-minute, per-IP, per-instance request limit for platform APIs

[LinHuiqing]

all tests are done! :)

[LinHuiqing]

2 comments on #6608:

• Seems a bit strange to me that the API for retrieving webhook details is a POST request instead of a GET request, is this intentional?
• For the PATCH request, we can add 1 more test! (edit: added the test for this PR's description)
  • Use an invalid URL for the webhook (i.e. https://random.site.ugh). An error should be thrown and the webhook settings should not be updated.

[foochifa]

On pt1 I think it's because we have to include the user email right? And its unsafe to use a param or to put it as part of the url path. I think previously @timotheeg and I had a discussion about this when checking for duplicate payments based on email

Maybe relevant

[LinHuiqing]

On pt1 I think it's because we have to include the user email right? And its unsafe to use a param or to put it as part of the url path. I think previously @timotheeg and I had a discussion about this when checking for duplicate payments based on email

Maybe relevant

Oo cool, TIL. Thanks @foochifa!

[wanlingt]

@LinHuiqing thanks for adding the test!! and great question! yes to what @foochifa said