build: release v6.141.0

[KenLSM]

New

• build: merge release v6.140.0 to develop #7591
• feat: support nric whitelisting #7534
• fix: add nonce to script-src directive #7578
• chore: remove unused props #7585
• feat(admin-form): implement drag and drop functionality #7372
• fix: settings page resets position glitch #7582
• chore: move label to tab #7581
• build: release v6.140.0 #7580

Dependencies

• fix(deps): bump type-fest from 4.23.0 to 4.24.0 in /shared #7583

Dev-Dependencies

• chore(deps-dev): bump @babel/preset-env from 7.22.5 to 7.25.3 #7586

Tests

feat: support nric whitelisting #7534

TC1: Admin can upload a valid whitelisted NRIC list

@KenLSM

• Create a new storage mode form
• Go to settings -> singpass -> enable singpass settings and set to any singpass mode
• Click on the 'download a sample csv file'
• Modify the 3 sample nric in the csv to 'S9812379B', 'F1612351W', 'S9912370B' and '53342803C'
• Upload the csv file
• Set the form to public mode
• Respond to the form using only the 'S9812379B' mockpass login 2 times, make sure it is allowed for multiple submissions
• Try to respond to the form using any NRIC/FIN not in the whitelist, it should be blocked
• Verify in the admin form results page that the responses for the whitelisted NRIC are received.
• Go back to the singpass settings page, note that the singpass settings should be greyed out due to form is public.
• Try click on delete button of form, it should be disabled.

TC2: Admin can download whitelist settings

• Click on the download button of whitelist setting, a modal should pop up to request secret key.
• Close the modal, it should work
• Press download button again, input secret key and click download
• Verify csv file is downloaded with 'Respondent' header and correct whitelist submitterId entries ie, 'S9812379B', 'S9912370B', 'F1612351W' and '53342803C'.

TC3: Admin can whitelist and use single submission enabled

• Continuing from the form in TC1, set form to private and turn on the limit to single submission toggle in settings -> singpass
• Set form to public
• Try to respond with previous 'S9812379B' mockpass login, it should be disallowed since it has submitted previously.
• Try to submit 'F1612351W' mockpass login, it should be allowed.
• Try to submit for a second time with 'F1612351W' mockpass login, it should be disallowed since it has submitted previously.
• Try to submit with a non whitelisted NRIC, it should be disallowed due to not in whitelist.

TC4: Admin can remove whitelist

• Make form private
• Go back to form singpass settings, click delete button. Verify whitelist file is deleted even after refresh.
• Try to respond with 'F1612351W' mockpass login, it should still be disallowed due to single submission.
• Try to respond with S9912370B, it should be allowed.
• Try to respond with a mockpass login not previously whitelisted, it should be allowed.

TC5: Admin sees appropriate error messages when uploading invalid CSV files

• Clone and modify the csv file from step 1 by removing the respondent header. Upload it to whitelist setting, we should see the respondent header not present error.
• Clone and modify the csv file from step 1 by removing all submitterIds, leaving just the respondents header. Upload it to whitelist setting, we should see the body cannot be empty error.
• Clone and modify the csv file from step 1 by adding duplicate valid submitterIds. Upload it to whitelist setting, we should see the duplicate present error.
• Clone and modify the csv file from step 1 by adding an empty row to middle of the csv file rows. Upload it to whitelist setting, we should see the no empty rows error.
• Clone and modify the csv file from step 1 by adding some invalid submitter id such as 'S1234567A'. Upload it to whitelist setting, we should see the invalid id present error with correct example.
• Upload a csv file that does not have a single column with the header Respondent. we should see a invalid format csv error message

TC6: Admin can input file with empty last row without reject.

• Add an empty last row to the csv from step 1 using notepad/excel etc. Upload it to whitelist setting. It should not be rejected.

TC7: Admin can whitelist for payment form

• Create a new storage mode form with payments connected and payment question.
• Go to settings -> singpass -> enable singpass settings and set to any singpass mode
• Upload the valid csv file from step 1
• Set the form to public mode
• Respond to the form using only the 'S9812379B' mockpass login and make payment, it should be successful
• Respond to form using any mockpass login not in whitelist, it should not allow them to enter the form.
• Verify in the admin form results page that the responses for the whitelisted NRIC are received.

TC8: Admin cannot upload whitelist above 20mb

• upload a whitelist that is >20MB, it should fail

Deploy Notes

New Env:

• DOWNLOAD_FORM_WHITELIST_RATE_LIMIT
• UPLOAD_FORM_WHITELIST_RATE_LIMIT

New dependencies:

• tweetnacl: installed on frontend. used for invoking /shared directory decryption method.
• papaparse: installed on frontend. used for client csv file processing to string. chosen due to good maintenance effort/docs. fastest parser available with fast mode.
• multer: installed on backend. used for multipart/form-data request body handling for large csv string streaming. express docs recommended package.

New dev dependencies:

• @types/papaparse
• @types/multer