build: release v6.72.0

[wanlingt]

New

• feat: dashboard infobox message for e2ee #6647
• fix: prevent saving empty product items #6646
• feat: ui review changes #6637
• feat: enable ownership transfer of all forms with a single action #6087
• feat: storage submission validation with encryption shift endpoint #6595
• feat: add formId for deprecatedCheck logs #6641
• feat: upgrade sgid sdk #6584
• build: merge release v6.71.0 into develop #6636
• build: release v6.71.0 #6635

Dependencies

• fix(deps): bump zod from 3.22.1 to 3.22.2 in /shared #6643

Dev-Dependencies

Tests

feat: dashboard infobox message for e2ee #6647

@wanlingt

• Check that the dashboard infobox has been updated with the right copy.

fix: prevent saving empty product items #6646

@foochifa

Regression

• On admin view, deleting product items removes the deleted product
• On admin view, deleting payment component removes the payment component
  • On responder view, the form should not have payment component

Feature Test

• On admin view, SaveButton is not interactive if there are no ProductItems
• On admin view, the final ProductItem cannot be deleted (As discussed with @KenLSM this will be fixed in a future PR)

feat: ui review changes #6637

@foochifa

Admin individual response page

• Observe that mouse-over on badge doesn't trigger any on-hover visual changes
• Observe that mouse-over tooltip will show payout information above the tooltip

Admin response table
On payment forms

• Observe that only headers have currency symbols

On non-payment forms

• Observe that payment headers are not rendered

Variable payment preview
Create and build page

• Observe that input hint is shown when paymentMax is not populated

feat: enable ownership transfer of all forms with a single action [#6087] (#6087)

@LinHuiqing

• Log into the FormSG dashboard. Check that the following forms exist
  - Form A: Another admin (can use your email address with + as a suffix, for example wanling+@open.gov.sg) has been added as a collaborator with 'read' permissions
  - Form B: That other admin (wanling+@open.gov.sg) is not a collaborator
• Click your avatar on the top right and click "Transfer All Forms". A modal should appear
• Transfer all forms to the email of that other existing admin
• In your dashboard, you should still see all the forms you were an owner of. Check the form permission list of a random form, you should now be an editor instead of an owner.
• Log in as the other admin (wanling+@open.gov.sg). You should see all the forms that were transferred to you.
• Check the permission list of the following forms:
  - Forms A and B: you should be an 'Owner' of both forms

feat: storage submission validation with encryption shift endpoint #6595

@wanlingt

To check that existing email submission validation works:

• Create a email mode form with logic and switch off captcha.
• Go to the respondent form and open the network tab before making a submission on the form.
• Copy and save the corresponding curl request for the email submission made.
• Make an invalid edit to the email submission curl request:
  • Add an invalid value to a field before any logic. It should throw an appropriate validation error.
  • Add a value to a field that is hidden by logic. It should throw a validation error saying that the you're trying to submit with a value on a hidden field.
• To the previous request, edit it such that the field previously hidden by logic will be shown. The submission should now succeed.

To check that new endpoint is still able to make valid submissions:

• Duplicate the form to create the exact same form, but in storage mode. Make sure captcha is off.
• Make the following edits to the curl request previously saved:
  • formId should be updated to the storage mode form's
  • update endpoint to be /submissions/storage
  • Add "version":1 to the response body
• Perform the curl request. The request should return an error saying "This endpoint has not been enabled for this form."
• Go to the form's document on the DB and add a "encryptionBoundaryShift" set to true.
• Perform the curl request. Check for the following:
  • The response should say "Form submission successful."
  • The submission should show up in the form's results page.

To check that submission validation for new endpoint works:

• Modify the curl request with invalid submissions.
  • Add an invalid value to a field before any logic. It should throw an appropriate validation error.
  • Add a value to a field that is hidden by logic. It should throw a validation error saying that the you're trying to submit with a value on a hidden field.
• To the previous request, edit it such that the field previously hidden by logic will be shown. The submission should now succeed.

Regression tests:

• Submit a response on an email mode form. You should receive the corresponding email for the submission.
• Submit a response on a storage mode form. You should see that the corresponding submission entry should show up on the admin results page.
• Go to an email mode form's preview page. Make a submission. The app should not crash and you should receive a corresponding email for the submission.

feat: upgrade sgid sdk #6584

@LinHuiqing

• Created unit tests for test paths where code_verifier cookie is missing.
• Updated existing test cases based on the breaking changes.
• Manually tested against sgID's staging environment:
• Log in to FormSG via the /ogp-login route. This should work correctly.
• Create and submit a form with SGID authentication. This should work correctly.
• Create and submit a form with SGID MyInfo. This should work correctly.

Deploy Notes

New environment variables:

• SGID_HOSTNAME in docker-compose.yml : updated accordingly to Mockpass' changes. No changes required for staging/prod env vars.

New dependencies:

• @opengovsg/sgid-client : Bumped from ^1.0.4 to v2.0.0.
• mockpass: Bumped from v3.1.3 to v4.0.4.

[foochifa]

Ohh so if i delete the payment field on a form that previous have payments, the payment headers will still disappear in the reconciliation dashboard, eventhough the responses have payment details in them

I think it's non-blocking, but do you think we should display the headers based on whether there is a response with payment rather than if payment field is enabled? @KenLSM