[kunchalasireesha]

Description

Implements: HGN Questionnaire Dashboard – Create a Permanent Questionnaire Link with Access Restrictions.

The frontend adds a permanent, reusable link to the HGN questionnaire (/questionnaire). This PR adds the backend check behind that link: the questionnaire is only available to people who were set up and invited through the HGN Dropbox process (User Profile → Access Management → Dropbox → Invite). The same check now applies when the questionnaire is submitted, so the restriction cannot be bypassed by calling the API directly.

Related PRS (if any):

This backend PR is related to the frontend PR.
To test this backend PR you need to checkout the #XXX frontend PR.
…

Main changes explained:

• Create src/helpers/questionnaireAccessHelper.js: decides whether a user can open the questionnaire. Eligible means an active user whose applicationAccess record has app: 'dropbox' with status: 'invited', the record the existing Dropbox invite already writes. Owners are always allowed, so they can preview the form.
• Update src/controllers/hgnFormResponseController.js:
  • Add getAccess, which returns { eligible, reason } for the logged-in user. reason is one of NOT_LOGGED_IN, USER_NOT_FOUND, INACTIVE, NOT_INVITED or ACCESS_REVOKED.
  • submitFormResponse now returns 403 if the user is not eligible, or if a non-Owner submits a response with someone else's user_id.
• Update src/routes/hgnFormResponseRouter.js: add GET /api/hgnform/access.
• Add src/helpers/questionnaireAccessHelper.spec.js and update hgnFormResponseController.test.js (new tests for access, the 403 cases, and the new endpoint).
• Add docs/HGN_QUESTIONNAIRE_LINK.md: onboarding steps and the permanent link, for the onboarding documentation.
  …

How to test:

1. Check out this branch and the frontend PR branch.
2. Run npm install and npm run dev here; start the frontend.
3. Clear site data/cache.
4. Log in as a volunteer who has not been invited to Dropbox and call GET /api/hgnform/access → expect { "eligible": false, "reason": "NOT_INVITED" }.
5. As an admin, open that user's profile → Access Management → Dropbox → Invite.
6. Log in as the user again → GET /api/hgnform/access returns { "eligible": true, ... }.
7. Submit the questionnaire → 201. Revoke the user's Dropbox access → submitting returns 403.
8. Log in as an Owner → eligible: true with no Dropbox invite.
9. Run npx jest src/helpers/questionnaireAccessHelper.spec.js src/controllers/hgnFormResponseController.test.js.

Screenshots or videos of changes:

See the frontend PR OneCommunityGlobal/HighestGoodNetworkApp#5702
for screen recordings

Note:

No schema changes. The check reads the existing applicationAccess collection.

• Please merge/deploy this before the frontend PR, which calls the new /api/hgnform/access endpoint.
• docs/ is in .gitignore, so the doc file was force-added (same as docs/BADGE_ASSIGN_API.md).
• Owner bypass is controlled by BYPASS_ROLES in the helper, in case reviewers prefer no exceptions.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
98.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud