[kunchalasireesha]

Description

Implements: HGN Questionnaire Dashboard – Create a Permanent Questionnaire Link with Access Restrictions.

Adds a permanent, reusable questionnaire link, https://highestgood.com/questionnaire, that administrators can share with every eligible person. The link becomes active for a person once they have been set up and invited through the HGN Dropbox process. Anyone else sees a message explaining that the questionnaire isn't available to them yet. People who aren't logged in are sent to login, then back to the questionnaire.

Related PRS (if any):

This frontend PR is related to the OneCommunityGlobal/HGNRest#2428 backend PR.

…

Main changes explained:

• Create src/components/HGNForm/access/QuestionnaireAccessGate.jsx: checks GET /api/hgnform/access and only shows the questionnaire to eligible users. Otherwise it shows a message for each case: not invited, Dropbox access revoked, account inactive, or the check failed. Supports dark mode.
• Create src/components/HGNForm/access/questionnaireLink.js: the permanent link path (/questionnaire) in one place.
• Create src/components/HGNForm/access/CopyQuestionnaireLinkButton.jsx: a "Copy questionnaire link" button for admins.
• Update src/routes.jsx: add the /questionnaire route (redirects eligible users to /hgnform/page1), and protect /hgnform/page1 through page6 with the same check so the pages can't be opened directly.
• Update AccessManagementModal.jsx: show "Copy questionnaire link" on the Dropbox row once the user has been invited.
• Update CommunityMembersPage.jsx (HGN Help dashboard): add the "Copy questionnaire link" button.
• Update FollowupQuestions.jsx: show an error toast when a submission is refused (403) instead of failing silently.
• Update src/utils/URL.js: add HGN_FORM_ACCESS.
• Add tests: QuestionnaireAccessGate.test.jsx, CopyQuestionnaireLinkButton.test.jsx.

How to test:

Check out this branch and the backend PR branch.
2. Run npm install and npm run start:local to run this PR locally.
3. Clear site data/cache.
4. Log in as an admin. Open a volunteer's profile → Access Management. Confirm "Copy questionnaire link" only appears on the Dropbox row after the Dropbox invite is sent. Click it and check that <site>/questionnaire was copied.
5. Go to HGN Help → Community Members (/hgnhelp/community) and confirm the copy button is there.
6. Log in as the invited volunteer and open /questionnaire → it redirects to the questionnaire's first page. Complete and submit the form.
7. Log in as a volunteer who was not invited and open /questionnaire and /hgnform/page3 → both show the "not available" message.
8. Revoke the volunteer's Dropbox access → /questionnaire now shows the "access revoked" message.
9. Log out and open /questionnaire → after login you land back on the questionnaire.
10. Verify the message page and buttons in dark mode.

Screenshots or videos of changes:

Screen.Recording.2026-10-24.at.12.33.34.PM.mov

Screen.Recording.2026-10-24.at.12.40.22.PM.mov

revoke.step.mp4

Note:

Requires the backend PR (GET /api/hgnform/access) to be merged/deployed first.

• Owners can always open the questionnaire to preview it.
• Onboarding documentation should now point to https://highestgood.com/questionnaire. Steps are in the backend PR's docs/HGN_QUESTIONNAIRE_LINK.md.

[netlify]

✅ Deploy Preview for highestgoodnetwork-dev ready!

Name	Link
🔨 Latest commit	db18b4e
🔍 Latest deploy log	https://app.netlify.com/projects/highestgoodnetwork-dev/deploys/6aed4978969efa81b2d9d0b5
😎 Deploy Preview	https://deploy-preview-5702--highestgoodnetwork-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[ssb1506]

How I verified

Tested the PR #5702 frontend changes locally. Reviewed the questionnaire access gate implementation and tested the Community Members page, Access Management modal, and non-invited user access restriction.

Verified working

• Community Members page displays the Copy questionnaire link button.
• Clicking the button successfully copies the questionnaire link and displays a success notification.
• Access Management modal displays Dropbox access status and invitation controls.
• Non-invited users see the questionnaire access restriction message on /questionnaire.

Issues found

1. Dropbox invitation fails with HTTP 400.

• Attempted to invite a volunteer through the Access Management modal.
• The request returned Dropbox API error: Response failed with a 400 code.
• The invitation was unsuccessful, and the user's Dropbox status remained No Access.

2. Potential stale authorization status due to caching.

• QuestionnaireAccessGate.jsx stores eligible user IDs in a module-level Set.
• Subsequent access checks are skipped for users already present in the cache.
• If Dropbox access is revoked after a user has been marked eligible, the cached status could prevent a fresh access check.

Additional verification

• Non-invited user restriction on /questionnaire: Verified working.
• Login redirect: Tested; encountered an unexpected redirect to /dashboard/questionnaire with a 404.
• Invited-user questionnaire access and submission: Blocked by the invitation failure.

[iAbhi001]

Tested locally at commit 79ee96a alongside backend PR #2428 as an Admin and Volunteer. The newly added test suites pass cleanly. The "Copy questionnaire link" button functions properly on both /hgnhelp/community and the Access Management modal. Uninvited users are cleanly intercepted by QuestionnaireAccessGate across /questionnaire and direct page routes (/hgnform/page1-page6), and dark mode renders with proper contrast. Approving.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kunchalasireesha]

Thanks for testing!
Stale access: fixed. Access is re-checked each time a questionnaire page or the link opens, so a revocation applies on the next page opened. Submissions are also enforced by the backend.
Login redirect: fixed. /questionnaire now survives login. I couldn't find what produces /dashboard/questionnaire in the code, so please retest and tell me if you still see it.
Dropbox 400: this error comes from Dropbox's API, and the PR doesn't change the invite request itself. Could you check DROPBOX_CLIENT_ID, DROPBOX_CLIENT_SECRET and DROPBOX_REFRESH_TOKEN in your .env, and try a real email address instead of e@e.com? If the backend log shows Dropbox's error details, please share them.