From cd918040946b8ee889b79252885c1aa2d571dd06 Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Mon, 5 Apr 2021 16:33:56 +0800
Subject: [PATCH 01/75] refactor(corppass-ui): make ui changes for corppass
 (#1533)

* refactor(corppass-ui): make ui changes for corppass

- updated copy for ui
- updated minimum necessary user-facing mentions of singpass and corppass to use new casing
- made necessary frontend changes for corporate singpass button
- added tooltip beside corppass option in settings > enable authentication
- updated e2e tests for new changes

* fix(start-page): increase corp login hor. padding
---
 .../settings-form.client.view.html            |  8 +++++++
 .../settings-form.client.directive.js         |  6 +++---
 .../views/activate-form.client.modal.html     |  6 +++---
 .../views/edit-myinfo-field.client.modal.html |  2 +-
 .../forms/base/componentViews/end-page.html   |  2 +-
 .../forms/base/componentViews/start-page.html | 21 ++++++++++++-------
 .../modules/forms/base/css/start-end-page.css | 11 ++++++++++
 src/public/translations/en-SG/landing.json    | 10 ++++-----
 tests/end-to-end/helpers/selectors.js         |  2 +-
 tests/end-to-end/helpers/util.js              |  6 +++---
 10 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/src/public/modules/forms/admin/directiveViews/settings-form.client.view.html b/src/public/modules/forms/admin/directiveViews/settings-form.client.view.html
index f28dc0e3bf..484f484497 100644
--- a/src/public/modules/forms/admin/directiveViews/settings-form.client.view.html
+++ b/src/public/modules/forms/admin/directiveViews/settings-form.client.view.html
@@ -258,6 +258,14 @@
                     class="radiomark"
                     ng-class="tempForm.authType === type.val ? 'blue-border' : ''"
                   ></span>
+                  <i
+                    class="glyphicon glyphicon-question-sign"
+                    uib-tooltip="Corppass no longer has its own login page, and now uses 
+                    Singpass to authenticate corporate users. You will still need a 
+                    separate Corppass e-service ID."
+                    tooltip-trigger="'click mouseenter'"
+                    ng-if="type.val === 'CP'"
+                  ></i>
                 </label>
               </div>
               <div
diff --git a/src/public/modules/forms/admin/directives/settings-form.client.directive.js b/src/public/modules/forms/admin/directives/settings-form.client.directive.js
index 65fd1a322f..b95e2f6944 100644
--- a/src/public/modules/forms/admin/directives/settings-form.client.directive.js
+++ b/src/public/modules/forms/admin/directives/settings-form.client.directive.js
@@ -171,17 +171,17 @@ function settingsFormDirective(
           },
           {
             val: 'SP',
-            name: 'SingPass',
+            name: 'Singpass',
             isEnabledInStorageMode: true,
           },
           {
             val: 'MyInfo',
-            name: 'SingPass (MyInfo)',
+            name: 'Singpass (MyInfo)',
             isEnabledInStorageMode: false,
           },
           {
             val: 'CP',
-            name: 'CorpPass',
+            name: 'Singpass (Corporate)',
             isEnabledInStorageMode: true,
           },
         ]
diff --git a/src/public/modules/forms/admin/views/activate-form.client.modal.html b/src/public/modules/forms/admin/views/activate-form.client.modal.html
index 48f46ec494..966c5799ac 100644
--- a/src/public/modules/forms/admin/views/activate-form.client.modal.html
+++ b/src/public/modules/forms/admin/views/activate-form.client.modal.html
@@ -27,13 +27,13 @@
           <div class="field-description">
             <span ng-if="vm.esrvcIdError.errorCode">
               {{ (['SP', 'MyInfo'].includes(vm.esrvcIdError.authType) ?
-              'SingPass' : 'CorpPass') + ' returns the error code ' }}
+              'Singpass' : 'Corppass') + ' returns the error code ' }}
               <b>{{vm.esrvcIdError.errorCode}}</b>
               {{' for the e-service ID ' }} <b>{{vm.esrvcIdError.esrvcId}}</b>
             </span>
             <span ng-if="!vm.esrvcIdError.errorCode">
               {{ 'Could not connect to ' + (vm.esrvcIdError.authType === 'CP' ?
-              'CorpPass' : 'SingPass') + ' to check the e-service id '}}
+              'Corppass' : 'Singpass') + ' to check the e-service id '}}
               <b>{{vm.esrvcIdError.esrvcId}}</b>
             </span>
           </div>
@@ -48,7 +48,7 @@
         </div>
         <!-- Since CorpPass eservice id cannot be validated, remind user to check-->
         <div ng-if="vm.esrvcIdSuccess.authType === 'CP'">
-          <div class="field-title">This form uses CorpPass.</div>
+          <div class="field-title">This form uses Corppass.</div>
           <div class="field-description">
             Please make sure <b>{{vm.esrvcIdSuccess.esrvcId}}</b> is the correct
             e-service ID
diff --git a/src/public/modules/forms/admin/views/edit-myinfo-field.client.modal.html b/src/public/modules/forms/admin/views/edit-myinfo-field.client.modal.html
index 9103031dc9..81ad773f58 100644
--- a/src/public/modules/forms/admin/views/edit-myinfo-field.client.modal.html
+++ b/src/public/modules/forms/admin/views/edit-myinfo-field.client.modal.html
@@ -56,7 +56,7 @@ <h2 class="modal-title">
             <a
               translate-attr="{ href: 'LINKS.SINGPASS_ELIGIBILITY_FAQ' }"
               target="_blank"
-              >SingPass</a
+              >Singpass</a
             >
           </div>
         </div>
diff --git a/src/public/modules/forms/base/componentViews/end-page.html b/src/public/modules/forms/base/componentViews/end-page.html
index bc07a2d3a1..858e4b7669 100644
--- a/src/public/modules/forms/base/componentViews/end-page.html
+++ b/src/public/modules/forms/base/componentViews/end-page.html
@@ -12,7 +12,7 @@ <h2 id="end-page-title">{{ vm.title }}</h2>
         <p ng-bind-html="vm.paragraph | linky:'_blank'"></p>
       </div>
       <div class="end-page-follow-up" ng-if="vm.authType === 'MyInfo'">
-        <p>You will be automatically logged out of SingPass.</p>
+        <p>You will be automatically logged out of Singpass.</p>
       </div>
 
       <div id="end-page-btn-link">
diff --git a/src/public/modules/forms/base/componentViews/start-page.html b/src/public/modules/forms/base/componentViews/start-page.html
index c0561049e1..5753ce9f09 100644
--- a/src/public/modules/forms/base/componentViews/start-page.html
+++ b/src/public/modules/forms/base/componentViews/start-page.html
@@ -54,20 +54,20 @@ <h1>{{ vm.formTitle }}</h1>
             ng-if="['SP', 'MyInfo'].includes(vm.authType) && !vm.userName && !vm.isTemplate"
             ng-disabled="vm.isAdminPreview"
           >
-            <span>Log in with SingPass</span>
+            <span>Login with Singpass</span>
             <span class="hidden-xs">
               <i class="bx bx-log-in"></i>
             </span>
           </button>
           <button
             type="button"
-            class="start-page-btn {{ vm.colorTheme }}-font"
+            class="start-page-btn {{ vm.colorTheme }}-font start-page-multiline-btn"
             ng-click="vm.formLogin({ authType: 'CP', rememberMe: false })"
             ng-if="vm.authType==='CP' && !vm.userName && !vm.isTemplate"
             ng-disabled="vm.isAdminPreview"
           >
-            <span>Log in with CorpPass</span>
-            <span class="hidden-xs">
+            <span>Login with Singpass (Corporate)</span>
+            <span class="hidden-xs start-page-multiline-btn-decorator">
               <i class="bx bx-log-in"></i>
             </span>
           </button>
@@ -100,14 +100,21 @@ <h1>{{ vm.formTitle }}</h1>
               ng-if="['SP', 'MyInfo'].includes(vm.authType)"
               class="form-locked-msg padded-view"
             >
-              Login with SingPass to access this form. Your SingPass ID will be
+              Login with Singpass to access this form. Your Singpass ID will be
               included with your form submission.
             </div>
             <div ng-if="vm.authType==='CP'" class="form-locked-msg padded-view">
-              Login with CorpPass to access this form. Your Entity ID and
-              CorpPass ID will be included with your form submission.
+              Corporate entity login is required for this form. Your Singpass ID
+              and corporate Entity ID will be included with your form
+              submission.
             </div>
           </div>
+          <div
+            ng-if="vm.authType==='CP' && (vm.userName || vm.isTemplate)"
+            class="form-locked-msg padded-view"
+          >
+            <div>Logged in as corporate user</div>
+          </div>
           <label
             class="remember-me-btn"
             ng-if="(vm.authType==='SP') && !vm.userName && !vm.isTemplate"
diff --git a/src/public/modules/forms/base/css/start-end-page.css b/src/public/modules/forms/base/css/start-end-page.css
index bc68a5abf4..0a88293f13 100644
--- a/src/public/modules/forms/base/css/start-end-page.css
+++ b/src/public/modules/forms/base/css/start-end-page.css
@@ -255,6 +255,17 @@
   width: 100%;
 }
 
+#start-page-main-container .start-page-multiline-btn {
+  height: auto;
+  max-width: max-content;
+  padding: 17px 30px;
+}
+
+#start-page-main-container .start-page-multiline-btn-decorator {
+  display: flex;
+  align-items: center;
+}
+
 #start-page-main-container .start-page-btn {
   margin: 39px auto 0 auto;
 }
diff --git a/src/public/translations/en-SG/landing.json b/src/public/translations/en-SG/landing.json
index 6966362367..7f3cb32fc2 100644
--- a/src/public/translations/en-SG/landing.json
+++ b/src/public/translations/en-SG/landing.json
@@ -63,16 +63,16 @@
     "SUBSECTION_3": {
       "HEADER": "Integrated with government systems",
       "POINT_1": {
-        "TITLE": "SingPass",
-        "TEXT": "With the push of a button you can authenticate citizens filling in your form with SingPass Login"
+        "TITLE": "Singpass",
+        "TEXT": "With the push of a button you can authenticate citizens filling in your form with Singpass Login"
       },
       "POINT_2": {
-        "TITLE": "CorpPass",
-        "TEXT": "With the push of a button you can enable CorpPass Login on your form to authenticate companies"
+        "TITLE": "Corppass",
+        "TEXT": "With the push of a button you can enable Corppass Login on your form to authenticate companies"
       },
       "POINT_3": {
         "TITLE": "MyInfo",
-        "TEXT": "Select which MyInfo fields you want to collect. These fields will be pre-filled once citizens log in through SingPass"
+        "TEXT": "Select which MyInfo fields you want to collect. These fields will be pre-filled once citizens log in through Singpass"
       }
     }
   },
diff --git a/tests/end-to-end/helpers/selectors.js b/tests/end-to-end/helpers/selectors.js
index 352d7e6612..f008290de7 100644
--- a/tests/end-to-end/helpers/selectors.js
+++ b/tests/end-to-end/helpers/selectors.js
@@ -192,7 +192,7 @@ const formPage = {
   },
   submitBtn: Selector('#form-submit button'),
   spcpLoginBtn: Selector('#start-page-btn-container button span').withText(
-    'LOG IN',
+    'LOGIN',
   ),
   spcpLogoutBtn: Selector('#start-page-btn-container button span').withText(
     'LOG OUT',
diff --git a/tests/end-to-end/helpers/util.js b/tests/end-to-end/helpers/util.js
index 8131390a22..130769596e 100644
--- a/tests/end-to-end/helpers/util.js
+++ b/tests/end-to-end/helpers/util.js
@@ -1131,7 +1131,7 @@ const expectSpcpLogin = async (t, authType, authData) => {
     case 'MyInfo':
       await t
         .expect(formPage.spcpLoginBtn.textContent)
-        .contains(`Log in with SingPass`)
+        .contains(`Login with Singpass`)
         .click(formPage.spcpLoginBtn)
         .click(mockpass.loginBtn)
         .click(mockpass.nricDropdownBtn)
@@ -1143,7 +1143,7 @@ const expectSpcpLogin = async (t, authType, authData) => {
     case 'SP':
       await t
         .expect(formPage.spcpLoginBtn.textContent)
-        .contains(`Log in with SingPass`)
+        .contains(`Login with Singpass`)
         .click(formPage.spcpLoginBtn)
         .click(mockpass.loginBtn)
         .click(mockpass.nricDropdownBtn)
@@ -1154,7 +1154,7 @@ const expectSpcpLogin = async (t, authType, authData) => {
     case 'CP':
       await t
         .expect(formPage.spcpLoginBtn.textContent)
-        .contains(`Log in with CorpPass`)
+        .contains(`Login with Singpass (Corporate)`)
         .click(formPage.spcpLoginBtn)
         .click(mockpass.loginBtn)
         .click(mockpass.nricDropdownBtn)

From b854bb1ef479cfc040c19990e5590242f03b0df5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 17:23:36 +0000
Subject: [PATCH 02/75] fix(deps): bump @opengovsg/spcp-auth-client from 1.4.4
 to 1.4.5 (#1555)

Bumps [@opengovsg/spcp-auth-client](https://github.com/opengovsg/spcp-auth-client) from 1.4.4 to 1.4.5.
- [Release notes](https://github.com/opengovsg/spcp-auth-client/releases)
- [Commits](https://github.com/opengovsg/spcp-auth-client/compare/v1.4.4...v1.4.5)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index bfbdff1a51..63f962ef5f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4371,9 +4371,9 @@
       "integrity": "sha512-YqR6GIsum9K7Cg6wOTxwJnKP+KDOxbZ9dnQE2/M47vP0ynXyTadvwflGBukzJ/MhzrS2R6buNhFjFnVJRXJinw=="
     },
     "@opengovsg/spcp-auth-client": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/@opengovsg/spcp-auth-client/-/spcp-auth-client-1.4.4.tgz",
-      "integrity": "sha512-GVLZphx2/9W36ZZ7nNmb/Zu/QxQbUYDC1oY0NB19IBfzlOV7FR6foqRn/6F2o9zMtC5r13nhHvxC78Vz5eMDow==",
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@opengovsg/spcp-auth-client/-/spcp-auth-client-1.4.5.tgz",
+      "integrity": "sha512-bvSNTW+2CL6gAprXSoEtkFv/9mFp6dwm0iCb9Ns56BBXy0+O/lUKI2jXZ7rBnVwXOCYtlEWB9BIqJmMLJKeOzA==",
       "requires": {
         "base-64": "^1.0.0",
         "jsonwebtoken": "^8.3.0",
diff --git a/package.json b/package.json
index 48a4d8f487..b6b6d09415 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,7 @@
     "@opengovsg/formsg-sdk": "^0.8.4-beta.0",
     "@opengovsg/myinfo-gov-client": "=4.0.0-beta.0",
     "@opengovsg/ng-file-upload": "^12.2.15",
-    "@opengovsg/spcp-auth-client": "^1.4.4",
+    "@opengovsg/spcp-auth-client": "^1.4.5",
     "@sentry/browser": "^6.2.5",
     "@sentry/integrations": "^6.2.5",
     "@stablelib/base64": "^1.0.0",

From feeea94a5b086921466c8d9b56949f120173aba4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 17:30:56 +0000
Subject: [PATCH 03/75] chore(deps-dev): bump @typescript-eslint/eslint-plugin
 (#1556)

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 4.20.0 to 4.21.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.21.0/packages/eslint-plugin)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 56 +++++++++++++++++++++++------------------------
 package.json      |  2 +-
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 63f962ef5f..b2d29fdabb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5159,13 +5159,13 @@
       }
     },
     "@typescript-eslint/eslint-plugin": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.20.0.tgz",
-      "integrity": "sha512-sw+3HO5aehYqn5w177z2D82ZQlqHCwcKSMboueo7oE4KU9QiC0SAgfS/D4z9xXvpTc8Bt41Raa9fBR8T2tIhoQ==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.21.0.tgz",
+      "integrity": "sha512-FPUyCPKZbVGexmbCFI3EQHzCZdy2/5f+jv6k2EDljGdXSRc0cKvbndd2nHZkSLqCNOPk0jB6lGzwIkglXcYVsQ==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/experimental-utils": "4.20.0",
-        "@typescript-eslint/scope-manager": "4.20.0",
+        "@typescript-eslint/experimental-utils": "4.21.0",
+        "@typescript-eslint/scope-manager": "4.21.0",
         "debug": "^4.1.1",
         "functional-red-black-tree": "^1.0.1",
         "lodash": "^4.17.15",
@@ -5175,43 +5175,43 @@
       },
       "dependencies": {
         "@typescript-eslint/experimental-utils": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.20.0.tgz",
-          "integrity": "sha512-sQNlf6rjLq2yB5lELl3gOE7OuoA/6IVXJUJ+Vs7emrQMva14CkOwyQwD7CW+TkmOJ4Q/YGmoDLmbfFrpGmbKng==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.21.0.tgz",
+          "integrity": "sha512-cEbgosW/tUFvKmkg3cU7LBoZhvUs+ZPVM9alb25XvR0dal4qHL3SiUqHNrzoWSxaXA9gsifrYrS1xdDV6w/gIA==",
           "dev": true,
           "requires": {
             "@types/json-schema": "^7.0.3",
-            "@typescript-eslint/scope-manager": "4.20.0",
-            "@typescript-eslint/types": "4.20.0",
-            "@typescript-eslint/typescript-estree": "4.20.0",
+            "@typescript-eslint/scope-manager": "4.21.0",
+            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/typescript-estree": "4.21.0",
             "eslint-scope": "^5.0.0",
             "eslint-utils": "^2.0.0"
           }
         },
         "@typescript-eslint/scope-manager": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.20.0.tgz",
-          "integrity": "sha512-/zm6WR6iclD5HhGpcwl/GOYDTzrTHmvf8LLLkwKqqPKG6+KZt/CfSgPCiybshmck66M2L5fWSF/MKNuCwtKQSQ==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.21.0.tgz",
+          "integrity": "sha512-kfOjF0w1Ix7+a5T1knOw00f7uAP9Gx44+OEsNQi0PvvTPLYeXJlsCJ4tYnDj5PQEYfpcgOH5yBlw7K+UEI9Agw==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
-            "@typescript-eslint/visitor-keys": "4.20.0"
+            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/visitor-keys": "4.21.0"
           }
         },
         "@typescript-eslint/types": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.20.0.tgz",
-          "integrity": "sha512-cYY+1PIjei1nk49JAPnH1VEnu7OYdWRdJhYI5wiKOUMhLTG1qsx5cQxCUTuwWCmQoyriadz3Ni8HZmGSofeC+w==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.21.0.tgz",
+          "integrity": "sha512-+OQaupjGVVc8iXbt6M1oZMwyKQNehAfLYJJ3SdvnofK2qcjfor9pEM62rVjBknhowTkh+2HF+/KdRAc/wGBN2w==",
           "dev": true
         },
         "@typescript-eslint/typescript-estree": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.20.0.tgz",
-          "integrity": "sha512-Knpp0reOd4ZsyoEJdW8i/sK3mtZ47Ls7ZHvD8WVABNx5Xnn7KhenMTRGegoyMTx6TiXlOVgMz9r0pDgXTEEIHA==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.21.0.tgz",
+          "integrity": "sha512-ZD3M7yLaVGVYLw4nkkoGKumb7Rog7QID9YOWobFDMQKNl+vPxqVIW/uDk+MDeGc+OHcoG2nJ2HphwiPNajKw3w==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
-            "@typescript-eslint/visitor-keys": "4.20.0",
+            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/visitor-keys": "4.21.0",
             "debug": "^4.1.1",
             "globby": "^11.0.1",
             "is-glob": "^4.0.1",
@@ -5220,12 +5220,12 @@
           }
         },
         "@typescript-eslint/visitor-keys": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.20.0.tgz",
-          "integrity": "sha512-NXKRM3oOVQL8yNFDNCZuieRIwZ5UtjNLYtmMx2PacEAGmbaEYtGgVHUHVyZvU/0rYZcizdrWjDo+WBtRPSgq+A==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.21.0.tgz",
+          "integrity": "sha512-dH22dROWGi5Z6p+Igc8bLVLmwy7vEe8r+8c+raPQU0LxgogPUrRAtRGtvBWmlr9waTu3n+QLt/qrS/hWzk1x5w==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
+            "@typescript-eslint/types": "4.21.0",
             "eslint-visitor-keys": "^2.0.0"
           }
         },
diff --git a/package.json b/package.json
index b6b6d09415..d9c08cef85 100644
--- a/package.json
+++ b/package.json
@@ -192,7 +192,7 @@
     "@types/uid-generator": "^2.0.2",
     "@types/uuid": "^8.3.0",
     "@types/validator": "^13.1.3",
-    "@typescript-eslint/eslint-plugin": "^4.20.0",
+    "@typescript-eslint/eslint-plugin": "^4.21.0",
     "@typescript-eslint/parser": "^4.20.0",
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",

From 569d6ae9072b301a5c014aae96e12f4db743fcf8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 17:42:12 +0000
Subject: [PATCH 04/75] chore(deps-dev): bump @types/mongodb from 3.6.10 to
 3.6.12 (#1557)

Bumps [@types/mongodb](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/mongodb) from 3.6.10 to 3.6.12.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/mongodb)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b2d29fdabb..a1f7b81271 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4930,9 +4930,9 @@
       "dev": true
     },
     "@types/mongodb": {
-      "version": "3.6.10",
-      "resolved": "https://registry.npmjs.org/@types/mongodb/-/mongodb-3.6.10.tgz",
-      "integrity": "sha512-BkwAHFiZSSWdTIqbUVGmgvIsiXXjqAketeK7Izy7oSs6G3N8Bn993tK9eq6QEovQDx6OQ2FGP2KWDDxBzdlJ6Q==",
+      "version": "3.6.12",
+      "resolved": "https://registry.npmjs.org/@types/mongodb/-/mongodb-3.6.12.tgz",
+      "integrity": "sha512-49aEzQD5VdHPxyd5dRyQdqEveAg9LanwrH8RQipnMuulwzKmODXIZRp0umtxi1eBUfEusRkoy8AVOMr+kVuFog==",
       "requires": {
         "@types/bson": "*",
         "@types/node": "*"
diff --git a/package.json b/package.json
index d9c08cef85..ab02a3f0c7 100644
--- a/package.json
+++ b/package.json
@@ -179,7 +179,7 @@
     "@types/ip": "^1.1.0",
     "@types/jest": "^26.0.22",
     "@types/json-stringify-safe": "^5.0.0",
-    "@types/mongodb": "^3.6.10",
+    "@types/mongodb": "^3.6.12",
     "@types/mongodb-uri": "^0.9.0",
     "@types/node": "^14.14.37",
     "@types/nodemailer": "^6.4.1",

From dc893b82cc697dcc25ca087d06ab99988e73dd76 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 17:58:36 +0000
Subject: [PATCH 05/75] chore(deps-dev): bump eslint-plugin-jest from 24.3.3 to
 24.3.4 (#1559)

Bumps [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) from 24.3.3 to 24.3.4.
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jest-community/eslint-plugin-jest/compare/v24.3.3...v24.3.4)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 52 +++++++++++++++++++++++------------------------
 package.json      |  2 +-
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a1f7b81271..9d7e13533f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5271,15 +5271,15 @@
       }
     },
     "@typescript-eslint/experimental-utils": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.20.0.tgz",
-      "integrity": "sha512-sQNlf6rjLq2yB5lELl3gOE7OuoA/6IVXJUJ+Vs7emrQMva14CkOwyQwD7CW+TkmOJ4Q/YGmoDLmbfFrpGmbKng==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.21.0.tgz",
+      "integrity": "sha512-cEbgosW/tUFvKmkg3cU7LBoZhvUs+ZPVM9alb25XvR0dal4qHL3SiUqHNrzoWSxaXA9gsifrYrS1xdDV6w/gIA==",
       "dev": true,
       "requires": {
         "@types/json-schema": "^7.0.3",
-        "@typescript-eslint/scope-manager": "4.20.0",
-        "@typescript-eslint/types": "4.20.0",
-        "@typescript-eslint/typescript-estree": "4.20.0",
+        "@typescript-eslint/scope-manager": "4.21.0",
+        "@typescript-eslint/types": "4.21.0",
+        "@typescript-eslint/typescript-estree": "4.21.0",
         "eslint-scope": "^5.0.0",
         "eslint-utils": "^2.0.0"
       }
@@ -5379,29 +5379,29 @@
       }
     },
     "@typescript-eslint/scope-manager": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.20.0.tgz",
-      "integrity": "sha512-/zm6WR6iclD5HhGpcwl/GOYDTzrTHmvf8LLLkwKqqPKG6+KZt/CfSgPCiybshmck66M2L5fWSF/MKNuCwtKQSQ==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.21.0.tgz",
+      "integrity": "sha512-kfOjF0w1Ix7+a5T1knOw00f7uAP9Gx44+OEsNQi0PvvTPLYeXJlsCJ4tYnDj5PQEYfpcgOH5yBlw7K+UEI9Agw==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/types": "4.20.0",
-        "@typescript-eslint/visitor-keys": "4.20.0"
+        "@typescript-eslint/types": "4.21.0",
+        "@typescript-eslint/visitor-keys": "4.21.0"
       }
     },
     "@typescript-eslint/types": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.20.0.tgz",
-      "integrity": "sha512-cYY+1PIjei1nk49JAPnH1VEnu7OYdWRdJhYI5wiKOUMhLTG1qsx5cQxCUTuwWCmQoyriadz3Ni8HZmGSofeC+w==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.21.0.tgz",
+      "integrity": "sha512-+OQaupjGVVc8iXbt6M1oZMwyKQNehAfLYJJ3SdvnofK2qcjfor9pEM62rVjBknhowTkh+2HF+/KdRAc/wGBN2w==",
       "dev": true
     },
     "@typescript-eslint/typescript-estree": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.20.0.tgz",
-      "integrity": "sha512-Knpp0reOd4ZsyoEJdW8i/sK3mtZ47Ls7ZHvD8WVABNx5Xnn7KhenMTRGegoyMTx6TiXlOVgMz9r0pDgXTEEIHA==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.21.0.tgz",
+      "integrity": "sha512-ZD3M7yLaVGVYLw4nkkoGKumb7Rog7QID9YOWobFDMQKNl+vPxqVIW/uDk+MDeGc+OHcoG2nJ2HphwiPNajKw3w==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/types": "4.20.0",
-        "@typescript-eslint/visitor-keys": "4.20.0",
+        "@typescript-eslint/types": "4.21.0",
+        "@typescript-eslint/visitor-keys": "4.21.0",
         "debug": "^4.1.1",
         "globby": "^11.0.1",
         "is-glob": "^4.0.1",
@@ -5445,12 +5445,12 @@
       }
     },
     "@typescript-eslint/visitor-keys": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.20.0.tgz",
-      "integrity": "sha512-NXKRM3oOVQL8yNFDNCZuieRIwZ5UtjNLYtmMx2PacEAGmbaEYtGgVHUHVyZvU/0rYZcizdrWjDo+WBtRPSgq+A==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.21.0.tgz",
+      "integrity": "sha512-dH22dROWGi5Z6p+Igc8bLVLmwy7vEe8r+8c+raPQU0LxgogPUrRAtRGtvBWmlr9waTu3n+QLt/qrS/hWzk1x5w==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/types": "4.20.0",
+        "@typescript-eslint/types": "4.21.0",
         "eslint-visitor-keys": "^2.0.0"
       },
       "dependencies": {
@@ -10835,9 +10835,9 @@
       }
     },
     "eslint-plugin-jest": {
-      "version": "24.3.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-24.3.3.tgz",
-      "integrity": "sha512-IQ9tLHyKEyBw1BM3IE13WxOXQm03h/7dy1KFknUVkoY2N2+Hw7lb/3YFz/4jwcrxXt2+KhA/GoiK7jt8aK19ww==",
+      "version": "24.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-24.3.4.tgz",
+      "integrity": "sha512-3n5oY1+fictanuFkTWPwSlehugBTAgwLnYLFsCllzE3Pl1BwywHl5fL0HFxmMjoQY8xhUDk8uAWc3S4JOHGh3A==",
       "dev": true,
       "requires": {
         "@typescript-eslint/experimental-utils": "^4.0.1"
diff --git a/package.json b/package.json
index ab02a3f0c7..f62e3f4418 100644
--- a/package.json
+++ b/package.json
@@ -209,7 +209,7 @@
     "eslint-config-prettier": "^8.1.0",
     "eslint-plugin-angular": "^4.0.1",
     "eslint-plugin-import": "^2.22.1",
-    "eslint-plugin-jest": "^24.3.3",
+    "eslint-plugin-jest": "^24.3.4",
     "eslint-plugin-prettier": "^3.3.1",
     "eslint-plugin-simple-import-sort": "^7.0.0",
     "eslint-plugin-typesafe": "^0.5.2",

From d16c11673a17334e6e0265832b2547ccf82748c7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 18:04:46 +0000
Subject: [PATCH 06/75] chore(deps-dev): bump ngrok from 4.0.0 to 4.0.1 (#1560)

Bumps [ngrok](https://github.com/bubenshchykov/ngrok) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/bubenshchykov/ngrok/releases)
- [Changelog](https://github.com/bubenshchykov/ngrok/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bubenshchykov/ngrok/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 9d7e13533f..4169e31fba 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17696,9 +17696,9 @@
       }
     },
     "ngrok": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/ngrok/-/ngrok-4.0.0.tgz",
-      "integrity": "sha512-fECZeX/gSHnk+Re+ycIK0SDKeTV0G86mxc6n2hbqMNwqmxYqh0lfInjZG+QhsPyAOWiIsAteydP/jFPF/WIWCA==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/ngrok/-/ngrok-4.0.1.tgz",
+      "integrity": "sha512-1RDEaP6urGt8dVzZ68mlf1799VXucJ3bEcNDOSwWoGUjgXS7MxMw+ngyw/2H/O+EMk1Fj1+Md2Au595rB4lG5w==",
       "dev": true,
       "requires": {
         "@types/node": "^8.10.50",
diff --git a/package.json b/package.json
index f62e3f4418..fc4d38c835 100644
--- a/package.json
+++ b/package.json
@@ -231,7 +231,7 @@
     "mockdate": "^3.0.5",
     "mockingoose": "^2.13.2",
     "mongodb-memory-server-core": "^6.9.6",
-    "ngrok": "^4.0.0",
+    "ngrok": "^4.0.1",
     "optimize-css-assets-webpack-plugin": "^5.0.1",
     "prettier": "^2.2.1",
     "proxyquire": "^2.1.3",

From bf4f55db6dfe9e1deb1b7dde944e3b457368c2cd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Apr 2021 18:17:05 +0000
Subject: [PATCH 07/75] chore(deps-dev): bump @typescript-eslint/parser from
 4.20.0 to 4.21.0 (#1558)

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.20.0 to 4.21.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.21.0/packages/parser)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 46 +++++++++++++++++++++++-----------------------
 package.json      |  2 +-
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4169e31fba..ce33163399 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5285,41 +5285,41 @@
       }
     },
     "@typescript-eslint/parser": {
-      "version": "4.20.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.20.0.tgz",
-      "integrity": "sha512-m6vDtgL9EABdjMtKVw5rr6DdeMCH3OA1vFb0dAyuZSa3e5yw1YRzlwFnm9knma9Lz6b2GPvoNSa8vOXrqsaglA==",
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.21.0.tgz",
+      "integrity": "sha512-eyNf7QmE5O/l1smaQgN0Lj2M/1jOuNg2NrBm1dqqQN0sVngTLyw8tdCbih96ixlhbF1oINoN8fDCyEH9SjLeIA==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/scope-manager": "4.20.0",
-        "@typescript-eslint/types": "4.20.0",
-        "@typescript-eslint/typescript-estree": "4.20.0",
+        "@typescript-eslint/scope-manager": "4.21.0",
+        "@typescript-eslint/types": "4.21.0",
+        "@typescript-eslint/typescript-estree": "4.21.0",
         "debug": "^4.1.1"
       },
       "dependencies": {
         "@typescript-eslint/scope-manager": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.20.0.tgz",
-          "integrity": "sha512-/zm6WR6iclD5HhGpcwl/GOYDTzrTHmvf8LLLkwKqqPKG6+KZt/CfSgPCiybshmck66M2L5fWSF/MKNuCwtKQSQ==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.21.0.tgz",
+          "integrity": "sha512-kfOjF0w1Ix7+a5T1knOw00f7uAP9Gx44+OEsNQi0PvvTPLYeXJlsCJ4tYnDj5PQEYfpcgOH5yBlw7K+UEI9Agw==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
-            "@typescript-eslint/visitor-keys": "4.20.0"
+            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/visitor-keys": "4.21.0"
           }
         },
         "@typescript-eslint/types": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.20.0.tgz",
-          "integrity": "sha512-cYY+1PIjei1nk49JAPnH1VEnu7OYdWRdJhYI5wiKOUMhLTG1qsx5cQxCUTuwWCmQoyriadz3Ni8HZmGSofeC+w==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.21.0.tgz",
+          "integrity": "sha512-+OQaupjGVVc8iXbt6M1oZMwyKQNehAfLYJJ3SdvnofK2qcjfor9pEM62rVjBknhowTkh+2HF+/KdRAc/wGBN2w==",
           "dev": true
         },
         "@typescript-eslint/typescript-estree": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.20.0.tgz",
-          "integrity": "sha512-Knpp0reOd4ZsyoEJdW8i/sK3mtZ47Ls7ZHvD8WVABNx5Xnn7KhenMTRGegoyMTx6TiXlOVgMz9r0pDgXTEEIHA==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.21.0.tgz",
+          "integrity": "sha512-ZD3M7yLaVGVYLw4nkkoGKumb7Rog7QID9YOWobFDMQKNl+vPxqVIW/uDk+MDeGc+OHcoG2nJ2HphwiPNajKw3w==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
-            "@typescript-eslint/visitor-keys": "4.20.0",
+            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/visitor-keys": "4.21.0",
             "debug": "^4.1.1",
             "globby": "^11.0.1",
             "is-glob": "^4.0.1",
@@ -5328,12 +5328,12 @@
           }
         },
         "@typescript-eslint/visitor-keys": {
-          "version": "4.20.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.20.0.tgz",
-          "integrity": "sha512-NXKRM3oOVQL8yNFDNCZuieRIwZ5UtjNLYtmMx2PacEAGmbaEYtGgVHUHVyZvU/0rYZcizdrWjDo+WBtRPSgq+A==",
+          "version": "4.21.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.21.0.tgz",
+          "integrity": "sha512-dH22dROWGi5Z6p+Igc8bLVLmwy7vEe8r+8c+raPQU0LxgogPUrRAtRGtvBWmlr9waTu3n+QLt/qrS/hWzk1x5w==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.20.0",
+            "@typescript-eslint/types": "4.21.0",
             "eslint-visitor-keys": "^2.0.0"
           }
         },
diff --git a/package.json b/package.json
index fc4d38c835..73be391b0f 100644
--- a/package.json
+++ b/package.json
@@ -193,7 +193,7 @@
     "@types/uuid": "^8.3.0",
     "@types/validator": "^13.1.3",
     "@typescript-eslint/eslint-plugin": "^4.21.0",
-    "@typescript-eslint/parser": "^4.20.0",
+    "@typescript-eslint/parser": "^4.21.0",
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",
     "babel-loader": "^8.2.2",

From 33c00137e19275b741f7dccec4b59981a369ce4b Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Tue, 6 Apr 2021 11:02:20 +0800
Subject: [PATCH 08/75] chore: add createReqMeta to verification module logging
 (#1562)

---
 src/app/modules/verification/verification.controller.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/app/modules/verification/verification.controller.ts b/src/app/modules/verification/verification.controller.ts
index 6b069e8ab6..a829d760b7 100644
--- a/src/app/modules/verification/verification.controller.ts
+++ b/src/app/modules/verification/verification.controller.ts
@@ -6,6 +6,7 @@ import { SALT_ROUNDS } from '../../../shared/util/verification'
 import { PublicTransaction } from '../../../types'
 import { ErrorDto } from '../../../types/api'
 import { generateOtpWithHash } from '../../utils/otp'
+import { createReqMeta } from '../../utils/request'
 
 import { VerificationFactory } from './verification.factory'
 import { Transaction } from './verification.types'
@@ -30,6 +31,7 @@ export const handleCreateTransaction: RequestHandler<
   const logMeta = {
     action: 'handleCreateTransaction',
     formId,
+    ...createReqMeta(req),
   }
   return VerificationFactory.createTransaction(formId)
     .map((transaction) => {
@@ -66,6 +68,7 @@ export const handleGetTransactionMetadata: RequestHandler<
   const logMeta = {
     action: 'handleGetTransactionMetadata',
     transactionId,
+    ...createReqMeta(req),
   }
   return VerificationFactory.getTransactionMetadata(transactionId)
     .map((publicTransaction) =>
@@ -99,6 +102,7 @@ export const handleResetField: RequestHandler<
     action: 'handleResetField',
     transactionId,
     fieldId,
+    ...createReqMeta(req),
   }
   return VerificationFactory.resetFieldForTransaction(transactionId, fieldId)
     .map(() => res.sendStatus(StatusCodes.OK))
@@ -130,6 +134,7 @@ export const handleGetOtp: RequestHandler<
     action: 'handleGetOtp',
     transactionId,
     fieldId,
+    ...createReqMeta(req),
   }
   return generateOtpWithHash(logMeta, SALT_ROUNDS)
     .andThen(({ otp, hashedOtp }) =>
@@ -171,6 +176,7 @@ export const handleVerifyOtp: RequestHandler<
     action: 'handleVerifyOtp',
     transactionId,
     fieldId,
+    ...createReqMeta(req),
   }
   return VerificationFactory.verifyOtp(transactionId, fieldId, otp)
     .map((signedData) => res.status(StatusCodes.OK).json(signedData))

From ae0fb75cdf6b4df39730f285d1009f4f3a315a36 Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Tue, 6 Apr 2021 11:04:05 +0800
Subject: [PATCH 09/75] ref(auth-api): duplicate auth endpoints to new /api/v3
 router (#1551)

* refactor(auth-api): duplicate auth endpoints to new /api/v3 router

- duplicate auth endpoint functionality and update endpoints
- update v3 router to use new endpoints
- update frontend api calls to use new endpoints

* test(auth-api): duplicate integration tests for new endpoint
---
 .../api/v3/auth/__tests__/auth.routes.spec.ts | 564 ++++++++++++++++++
 src/app/routes/api/v3/auth/auth.routes.ts     |  95 +++
 src/app/routes/api/v3/auth/index.ts           |   1 +
 src/app/routes/api/v3/v3.routes.ts            |   2 +
 .../users/services/auth.client.service.js     |   8 +-
 5 files changed, 666 insertions(+), 4 deletions(-)
 create mode 100644 src/app/routes/api/v3/auth/__tests__/auth.routes.spec.ts
 create mode 100644 src/app/routes/api/v3/auth/auth.routes.ts
 create mode 100644 src/app/routes/api/v3/auth/index.ts

diff --git a/src/app/routes/api/v3/auth/__tests__/auth.routes.spec.ts b/src/app/routes/api/v3/auth/__tests__/auth.routes.spec.ts
new file mode 100644
index 0000000000..d69a1d18f7
--- /dev/null
+++ b/src/app/routes/api/v3/auth/__tests__/auth.routes.spec.ts
@@ -0,0 +1,564 @@
+import { pick } from 'lodash'
+import { errAsync, okAsync } from 'neverthrow'
+import supertest, { Session } from 'supertest-session'
+import validator from 'validator'
+
+import MailService from 'src/app/services/mail/mail.service'
+import { HashingError } from 'src/app/utils/hash'
+import * as OtpUtils from 'src/app/utils/otp'
+import { IAgencySchema } from 'src/types'
+
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
+import * as AuthService from '../../../../../modules/auth/auth.service'
+import { DatabaseError } from '../../../../../modules/core/core.errors'
+import * as UserService from '../../../../../modules/user/user.service'
+import { MailSendError } from '../../../../../services/mail/mail.errors'
+import { AuthRouter } from '../auth.routes'
+
+const app = setupApp('/auth', AuthRouter)
+
+describe('auth.routes', () => {
+  let request: Session
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(() => {
+    request = supertest(app)
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('POST /auth/email/validate', () => {
+    it('should return 400 when body.email is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/auth/email/validate')
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'email' } }),
+      )
+    })
+
+    it('should return 400 when body.email is invalid', async () => {
+      // Arrange
+      const invalidEmail = 'not an email'
+
+      // Act
+      const response = await request
+        .post('/auth/email/validate')
+        .send({ email: invalidEmail })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'email', message: 'Please enter a valid email' },
+        }),
+      )
+    })
+
+    it('should return 401 when domain of body.email does not exist in Agency collection', async () => {
+      // Arrange
+      const validEmailWithInvalidDomain = 'test@example.com'
+
+      // Act
+      const response = await request
+        .post('/auth/email/validate')
+        .send({ email: validEmailWithInvalidDomain })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual(
+        'This is not a whitelisted public service email domain. Please log in with your official government or government-linked email address.',
+      )
+    })
+
+    it('should return 200 when domain of body.email exists in Agency collection', async () => {
+      // Arrange
+      // Insert agency
+      const validDomain = 'example.com'
+      const validEmail = `test@${validDomain}`
+      await dbHandler.insertAgency({ mailDomain: validDomain })
+
+      // Act
+      const response = await request
+        .post('/auth/email/validate')
+        .send({ email: validEmail })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.text).toEqual('OK')
+    })
+
+    it('should return 500 when validating domain returns a database error', async () => {
+      // Arrange
+      // Insert agency
+      const validDomain = 'example.com'
+      const validEmail = `test@${validDomain}`
+      const mockErrorString = 'Unable to validate email domain.'
+      await dbHandler.insertAgency({ mailDomain: validDomain })
+
+      const getAgencySpy = jest
+        .spyOn(AuthService, 'validateEmailDomain')
+        .mockReturnValueOnce(errAsync(new DatabaseError(mockErrorString)))
+
+      // Act
+      const response = await request
+        .post('/auth/email/validate')
+        .send({ email: validEmail })
+
+      // Assert
+      expect(getAgencySpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual(mockErrorString)
+    })
+  })
+
+  describe('POST /auth/otp/generate', () => {
+    const VALID_DOMAIN = 'example.com'
+    const VALID_EMAIL = `test@${VALID_DOMAIN}`
+    const INVALID_DOMAIN = 'example.org'
+
+    beforeEach(async () => dbHandler.insertAgency({ mailDomain: VALID_DOMAIN }))
+
+    it('should return 400 when body.email is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/auth/otp/generate')
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'email' } }),
+      )
+    })
+
+    it('should return 400 when body.email is invalid', async () => {
+      // Arrange
+      const invalidEmail = 'not an email'
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: invalidEmail })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'email', message: 'Please enter a valid email' },
+        }),
+      )
+    })
+
+    it('should return 401 when domain of body.email does not exist in Agency collection', async () => {
+      // Arrange
+      const validEmailWithInvalidDomain = `test@${INVALID_DOMAIN}`
+      expect(validator.isEmail(validEmailWithInvalidDomain)).toEqual(true)
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: validEmailWithInvalidDomain })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({
+        message:
+          'This is not a whitelisted public service email domain. Please log in with your official government or government-linked email address.',
+      })
+    })
+
+    it('should return 500 when error occurs whilst creating OTP', async () => {
+      // Arrange
+      const createLoginOtpSpy = jest
+        .spyOn(AuthService, 'createLoginOtp')
+        .mockReturnValueOnce(errAsync(new HashingError()))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: VALID_EMAIL })
+
+      // Assert
+      expect(createLoginOtpSpy).toHaveBeenCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Failed to send login OTP. Please try again later and if the problem persists, contact us.',
+      })
+    })
+
+    it('should return 500 when error occurs whilst sending login OTP', async () => {
+      // Arrange
+      const sendLoginOtpSpy = jest
+        .spyOn(MailService, 'sendLoginOtp')
+        .mockReturnValueOnce(errAsync(new MailSendError('some error')))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: VALID_EMAIL })
+
+      // Assert
+      expect(sendLoginOtpSpy).toHaveBeenCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Failed to send login OTP. Please try again later and if the problem persists, contact us.',
+      })
+    })
+
+    it('should return 500 when validating domain returns a database error', async () => {
+      // Arrange
+      const getAgencySpy = jest
+        .spyOn(AuthService, 'validateEmailDomain')
+        .mockReturnValueOnce(errAsync(new DatabaseError()))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: VALID_EMAIL })
+
+      // Assert
+      expect(getAgencySpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Failed to send login OTP. Please try again later and if the problem persists, contact us.',
+      })
+    })
+
+    it('should return 200 when otp is sent successfully', async () => {
+      // Arrange
+      const sendLoginOtpSpy = jest
+        .spyOn(MailService, 'sendLoginOtp')
+        .mockReturnValueOnce(okAsync(true))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/generate')
+        .send({ email: VALID_EMAIL })
+
+      // Assert
+      expect(sendLoginOtpSpy).toHaveBeenCalled()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(`OTP sent to ${VALID_EMAIL}`)
+    })
+  })
+
+  describe('POST /auth/otp/verify', () => {
+    const MOCK_VALID_OTP = '123456'
+    const VALID_DOMAIN = 'example.com'
+    const VALID_EMAIL = `test@${VALID_DOMAIN}`
+    const INVALID_DOMAIN = 'example.org'
+
+    let defaultAgency: IAgencySchema
+
+    beforeEach(async () => {
+      defaultAgency = await dbHandler.insertAgency({
+        mailDomain: VALID_DOMAIN,
+      })
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValue(MOCK_VALID_OTP)
+    })
+
+    it('should return 400 when body.email is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/auth/otp/verify').send({
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'email' } }),
+      )
+    })
+
+    it('should return 400 when body.otp is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/auth/otp/verify').send({
+        email: VALID_EMAIL,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'otp' } }),
+      )
+    })
+
+    it('should return 400 when body.email is invalid', async () => {
+      // Arrange
+      const invalidEmail = 'not an email'
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: invalidEmail, otp: MOCK_VALID_OTP })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'email', message: 'Please enter a valid email' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.otp is less than 6 digits', async () => {
+      // Act
+      const response = await request.post('/auth/otp/verify').send({
+        email: VALID_EMAIL,
+        otp: '12345',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'otp', message: 'Please enter a valid otp' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.otp is 6 characters but does not consist purely of digits', async () => {
+      // Act
+      const response = await request.post('/auth/otp/verify').send({
+        email: VALID_EMAIL,
+        otp: '123abc',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'otp', message: 'Please enter a valid otp' },
+        }),
+      )
+    })
+
+    it('should return 401 when domain of body.email does not exist in Agency collection', async () => {
+      // Arrange
+      const validEmailWithInvalidDomain = `test@${INVALID_DOMAIN}`
+      expect(validator.isEmail(validEmailWithInvalidDomain)).toEqual(true)
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: validEmailWithInvalidDomain, otp: MOCK_VALID_OTP })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual(
+        'This is not a whitelisted public service email domain. Please log in with your official government or government-linked email address.',
+      )
+    })
+
+    it('should return 500 when validating domain returns a database error', async () => {
+      // Arrange
+      const getAgencySpy = jest
+        .spyOn(AuthService, 'validateEmailDomain')
+        .mockReturnValueOnce(errAsync(new DatabaseError()))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: MOCK_VALID_OTP })
+
+      // Assert
+      expect(getAgencySpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual('Something went wrong. Please try again.')
+    })
+
+    it('should return 422 when hash does not exist for body.otp', async () => {
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: MOCK_VALID_OTP })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual(
+        expect.stringContaining(
+          'OTP has expired. Please request for a new OTP.',
+        ),
+      )
+    })
+
+    it('should return 422 when body.otp is invalid', async () => {
+      // Arrange
+      const invalidOtp = '654321'
+      // Request for OTP so the hash exists.
+      await requestForOtp(VALID_EMAIL)
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: invalidOtp })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual('OTP is invalid. Please try again.')
+    })
+
+    it('should return 422 when invalid body.otp has been attempted too many times', async () => {
+      // Arrange
+      const invalidOtp = '654321'
+      // Request for OTP so the hash exists.
+      await requestForOtp(VALID_EMAIL)
+
+      // Act
+      // Attempt invalid OTP for MAX_OTP_ATTEMPTS.
+      const verifyPromises = []
+      for (let i = 0; i < AuthService.MAX_OTP_ATTEMPTS; i++) {
+        verifyPromises.push(
+          request
+            .post('/auth/otp/verify')
+            .send({ email: VALID_EMAIL, otp: invalidOtp }),
+        )
+      }
+      const results = (await Promise.all(verifyPromises)).map((resolve) =>
+        pick(resolve, ['status', 'body']),
+      )
+      // Should be all invalid OTP responses.
+      expect(results).toEqual(
+        Array(AuthService.MAX_OTP_ATTEMPTS).fill({
+          status: 422,
+          body: 'OTP is invalid. Please try again.',
+        }),
+      )
+
+      // Act again, this time with a valid OTP.
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: MOCK_VALID_OTP })
+
+      // Assert
+      // Should still reject with max OTP attempts error.
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual(
+        'You have hit the max number of attempts. Please request for a new OTP.',
+      )
+    })
+
+    it('should return 200 with user object when body.otp is a valid OTP', async () => {
+      // Arrange
+      // Request for OTP so the hash exists.
+      await requestForOtp(VALID_EMAIL)
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: MOCK_VALID_OTP })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Body should be an user object.
+      expect(response.body).toMatchObject({
+        // Required since that's how the data is sent out from the application.
+        agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+        _id: expect.any(String),
+        created: expect.any(String),
+        email: VALID_EMAIL,
+      })
+      // Should have session cookie returned.
+      const sessionCookie = request.cookies.find(
+        (cookie) => cookie.name === 'connect.sid',
+      )
+      expect(sessionCookie).toBeDefined()
+    })
+
+    it('should return 500 when upserting user document fails', async () => {
+      // Arrange
+      // Request for OTP so the hash exists.
+      await requestForOtp(VALID_EMAIL)
+
+      // Mock error returned when creating user
+      const upsertSpy = jest
+        .spyOn(UserService, 'retrieveUser')
+        .mockReturnValueOnce(errAsync(new DatabaseError('some error')))
+
+      // Act
+      const response = await request
+        .post('/auth/otp/verify')
+        .send({ email: VALID_EMAIL, otp: MOCK_VALID_OTP })
+
+      // Assert
+      // Should have reached this spy.
+      expect(upsertSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual(
+        expect.stringContaining('Failed to process OTP.'),
+      )
+    })
+  })
+
+  describe('GET /auth/logout', () => {
+    const MOCK_VALID_OTP = '123456'
+    const VALID_DOMAIN = 'example.com'
+    const VALID_EMAIL = `test@${VALID_DOMAIN}`
+
+    beforeEach(async () => {
+      await dbHandler.insertAgency({
+        mailDomain: VALID_DOMAIN,
+      })
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValue(MOCK_VALID_OTP)
+    })
+
+    it('should return 200 and clear cookies when signout is successful', async () => {
+      // Act
+      // Sign in user
+      await signInUser(VALID_EMAIL, MOCK_VALID_OTP)
+
+      // Arrange
+      const response = await request.get('/auth/logout')
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ message: 'Sign out successful' })
+      // connect.sid should now be empty.
+      expect(response.header['set-cookie'][0]).toEqual(
+        expect.stringContaining('connect.sid=;'),
+      )
+    })
+
+    it('should return 200 even when user has not signed in before', async () => {
+      // Note that no log in calls have been made with request yet.
+      // Act
+      const response = await request.get('/auth/logout')
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ message: 'Sign out successful' })
+    })
+  })
+
+  // Helper functions
+  const requestForOtp = async (email: string) => {
+    // Set that so no real mail is sent.
+    jest.spyOn(MailService, 'sendLoginOtp').mockReturnValue(okAsync(true))
+
+    const response = await request.post('/auth/otp/generate').send({ email })
+    expect(response.body).toEqual(`OTP sent to ${email}`)
+  }
+
+  const signInUser = async (email: string, otp: string) => {
+    await requestForOtp(email)
+    const response = await request.post('/auth/otp/verify').send({ email, otp })
+
+    // Assert
+    // Should have session cookie returned.
+    const sessionCookie = request.cookies.find(
+      (cookie) => cookie.name === 'connect.sid',
+    )
+    expect(sessionCookie).toBeDefined()
+    return response.body
+  }
+})
diff --git a/src/app/routes/api/v3/auth/auth.routes.ts b/src/app/routes/api/v3/auth/auth.routes.ts
new file mode 100644
index 0000000000..b931d9d6fb
--- /dev/null
+++ b/src/app/routes/api/v3/auth/auth.routes.ts
@@ -0,0 +1,95 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import { rateLimitConfig } from '../../../../../config/config'
+import * as AuthController from '../../../../modules/auth/auth.controller'
+import { limitRate } from '../../../../utils/limit-rate'
+
+export const AuthRouter = Router()
+/**
+ * Check if email domain is a valid agency
+ * @route POST /auth/email/validate
+ * @group admin
+ * @param body.email the user's email to validate domain for
+ * @return 200 when email domain is valid
+ * @return 401 when email domain is invalid
+ */
+AuthRouter.post(
+  '/email/validate',
+  celebrate({
+    [Segments.BODY]: Joi.object().keys({
+      email: Joi.string()
+        .required()
+        .email()
+        .message('Please enter a valid email'),
+    }),
+  }),
+  AuthController.handleCheckUser,
+)
+
+/**
+ * Send a one-time password (OTP) to the specified email address
+ * as part of the login procedure.
+ * @route POST /auth/otp/generate
+ * @group admin
+ * @param body.email the user's email to validate domain for
+ * @produces application/json
+ * @consumes application/json
+ * @return 200 when OTP has been been successfully sent
+ * @return 401 when email domain is invalid
+ * @return 500 when FormSG was unable to generate the OTP, or create/send the email that delivers the OTP to the user's email address
+ */
+AuthRouter.post(
+  '/otp/generate',
+  limitRate({ max: rateLimitConfig.sendAuthOtp }),
+  celebrate({
+    [Segments.BODY]: Joi.object().keys({
+      email: Joi.string()
+        .required()
+        .email()
+        .message('Please enter a valid email'),
+    }),
+  }),
+  AuthController.handleLoginSendOtp,
+)
+
+/**
+ * Verify the one-time password (OTP) for the specified email address
+ * as part of the login procedure.
+ * @route POST /auth/otp/verify
+ * @group admin
+ * @param body.email the user's email
+ * @param body.otp the otp to verify
+ * @headers 200.set-cookie contains the session cookie upon login
+ * @returns 200 when user has successfully logged in, with session cookie set
+ * @returns 401 when the email domain is invalid
+ * @returns 422 when the OTP is invalid
+ * @returns 500 when error occurred whilst verifying the OTP
+ */
+AuthRouter.post(
+  '/otp/verify',
+  celebrate({
+    [Segments.BODY]: Joi.object().keys({
+      email: Joi.string()
+        .required()
+        .email()
+        .message('Please enter a valid email'),
+      otp: Joi.string()
+        .required()
+        .regex(/^\d{6}$/)
+        .message('Please enter a valid otp'),
+    }),
+  }),
+  AuthController.handleLoginVerifyOtp,
+)
+
+/**
+ * Sign the user out of the session by clearing the relevant session cookie
+ * @route GET /auth/logout
+ * @group admin
+ * @headers 200.clear-cookie clears cookie upon signout
+ * @returns 200 when user has signed out successfully
+ * @returns 400 when the request does not contain a session
+ * @returns 500 when the session fails to be destroyed
+ */
+AuthRouter.get('/logout', AuthController.handleSignout)
diff --git a/src/app/routes/api/v3/auth/index.ts b/src/app/routes/api/v3/auth/index.ts
new file mode 100644
index 0000000000..b035f15671
--- /dev/null
+++ b/src/app/routes/api/v3/auth/index.ts
@@ -0,0 +1 @@
+export { AuthRouter } from './auth.routes'
diff --git a/src/app/routes/api/v3/v3.routes.ts b/src/app/routes/api/v3/v3.routes.ts
index 8bd36bdd9e..e4a2061fe9 100644
--- a/src/app/routes/api/v3/v3.routes.ts
+++ b/src/app/routes/api/v3/v3.routes.ts
@@ -1,7 +1,9 @@
 import { Router } from 'express'
 
 import { AdminRouter } from './admin'
+import { AuthRouter } from './auth'
 
 export const V3Router = Router()
 
 V3Router.use('/admin', AdminRouter)
+V3Router.use('/auth', AuthRouter)
diff --git a/src/public/modules/users/services/auth.client.service.js b/src/public/modules/users/services/auth.client.service.js
index 9be1957080..78e7703c46 100644
--- a/src/public/modules/users/services/auth.client.service.js
+++ b/src/public/modules/users/services/auth.client.service.js
@@ -69,7 +69,7 @@ function Auth($q, $http, $state, $window) {
 
   function checkUser(credentials) {
     let deferred = $q.defer()
-    $http.post('/auth/checkuser', credentials).then(
+    $http.post('/api/v3/auth/email/validate', credentials).then(
       function (response) {
         deferred.resolve(response.data)
       },
@@ -82,7 +82,7 @@ function Auth($q, $http, $state, $window) {
 
   function sendOtp(credentials) {
     let deferred = $q.defer()
-    $http.post('/auth/sendotp', credentials).then(
+    $http.post('/api/v3/auth/otp/generate', credentials).then(
       function (response) {
         deferred.resolve(response.data)
       },
@@ -95,7 +95,7 @@ function Auth($q, $http, $state, $window) {
 
   function verifyOtp(credentials) {
     let deferred = $q.defer()
-    $http.post('/auth/verifyotp', credentials).then(
+    $http.post('/api/v3/auth/otp/verify', credentials).then(
       function (response) {
         setUser(response.data)
         deferred.resolve()
@@ -108,7 +108,7 @@ function Auth($q, $http, $state, $window) {
   }
 
   function signOut() {
-    $http.get('/auth/signout').then(
+    $http.get('/api/v3/auth/logout').then(
       function () {
         $window.localStorage.removeItem('user')
         // Clear contact banner on logout

From 6d276bfcebacc51f617fab2224469251654b4bad Mon Sep 17 00:00:00 2001
From: Snyk bot <snyk-bot@snyk.io>
Date: Tue, 6 Apr 2021 06:20:16 +0300
Subject: [PATCH 10/75] [Snyk] Security upgrade mongoose from 5.11.10 to 5.12.3
 (#1538)

* fix: package.json & package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MQUERY-1089718

* refactor(mongoose): rework type defs

* refactor(models): rework form.server.model for mongoose

- recast FormSchema as FormDocumentSchema so that we can
  register methods specific to the handling of IFormDocument
- declare Schema.Types.DocumentArrayWithLooseDiscriminator
  so that we can more easily register our sub-schema

TODO - submit a patch to mongoose to loosen the type def for
`DocumentArray.discriminator()`

Co-authored-by: LoneRifle <LoneRifle@users.noreply.github.com>
---
 package-lock.json                             | 28 ++++++++--------
 package.json                                  |  2 +-
 .../models/admin_verification.server.model.ts |  5 ++-
 src/app/models/form.server.model.ts           | 28 ++++++++--------
 .../form_statistics_total.server.model.ts     |  5 ++-
 src/app/models/login.server.model.ts          |  6 ++--
 src/app/models/submission.server.model.ts     | 13 +++++---
 src/app/models/token.server.model.ts          |  2 +-
 src/app/models/user.server.model.ts           |  5 +--
 src/app/modules/bounce/bounce.model.ts        |  2 +-
 src/app/modules/myinfo/myinfo_hash.model.ts   |  2 +-
 .../modules/submission/submission.service.ts  |  4 +--
 .../verification/verification.model.ts        |  5 ++-
 .../services/sms/sms_count.server.model.ts    |  2 +-
 src/types/vendor/mongoose.d.ts                | 33 +++++++++++++++++++
 15 files changed, 95 insertions(+), 47 deletions(-)
 create mode 100644 src/types/vendor/mongoose.d.ts

diff --git a/package-lock.json b/package-lock.json
index ce33163399..d5ea0aacb1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17433,17 +17433,17 @@
       "integrity": "sha1-D3ca0W9IOuZfQoeWlCjp+8SqYYE="
     },
     "mongoose": {
-      "version": "5.11.10",
-      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.11.10.tgz",
-      "integrity": "sha512-daE2L6VW7WNywv7tL2KUkBViWvODbzr50Of1kJpIbzW3w3N5/TYcgSmhCsEDWfYGQXbun2rdd7+sOdsEC8zQSQ==",
+      "version": "5.12.3",
+      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.12.3.tgz",
+      "integrity": "sha512-frsSR9yeldaRpSUeTegXCSB0Tu5UGq8sHuHBuEV31Jk3COyxlKFQPL7UsdMhxPUCmk74FpOYSmNwxhWBEqgzQg==",
       "requires": {
         "@types/mongodb": "^3.5.27",
         "bson": "^1.1.4",
         "kareem": "2.3.2",
-        "mongodb": "3.6.3",
+        "mongodb": "3.6.5",
         "mongoose-legacy-pluralize": "1.0.2",
         "mpath": "0.8.3",
-        "mquery": "3.2.3",
+        "mquery": "3.2.5",
         "ms": "2.1.2",
         "regexp-clone": "1.0.0",
         "safe-buffer": "5.2.1",
@@ -17452,14 +17452,14 @@
       },
       "dependencies": {
         "bson": {
-          "version": "1.1.5",
-          "resolved": "https://registry.npmjs.org/bson/-/bson-1.1.5.tgz",
-          "integrity": "sha512-kDuEzldR21lHciPQAIulLs1LZlCXdLziXI6Mb/TDkwXhb//UORJNPXgcRs2CuO4H0DcMkpfT3/ySsP3unoZjBg=="
+          "version": "1.1.6",
+          "resolved": "https://registry.npmjs.org/bson/-/bson-1.1.6.tgz",
+          "integrity": "sha512-EvVNVeGo4tHxwi8L6bPj3y3itEvStdwvvlojVxxbyYfoaxJ6keLgrTuKdyfEAszFK+H3olzBuafE0yoh0D1gdg=="
         },
         "mongodb": {
-          "version": "3.6.3",
-          "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-3.6.3.tgz",
-          "integrity": "sha512-rOZuR0QkodZiM+UbQE5kDsJykBqWi0CL4Ec2i1nrGrUI3KO11r6Fbxskqmq3JK2NH7aW4dcccBuUujAP0ERl5w==",
+          "version": "3.6.5",
+          "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-3.6.5.tgz",
+          "integrity": "sha512-mQlYKw1iGbvJJejcPuyTaytq0xxlYbIoVDm2FODR+OHxyEiMR021vc32bTvamgBjCswsD54XIRwhg3yBaWqJjg==",
           "requires": {
             "bl": "^2.2.1",
             "bson": "^1.1.4",
@@ -17543,9 +17543,9 @@
       "integrity": "sha512-eb9rRvhDltXVNL6Fxd2zM9D4vKBxjVVQNLNijlj7uoXUy19zNDsIif5zR+pWmPCWNKwAtqyo4JveQm4nfD5+eA=="
     },
     "mquery": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/mquery/-/mquery-3.2.3.tgz",
-      "integrity": "sha512-cIfbP4TyMYX+SkaQ2MntD+F2XbqaBHUYWk3j+kqdDztPWok3tgyssOZxMHMtzbV1w9DaSlvEea0Iocuro41A4g==",
+      "version": "3.2.5",
+      "resolved": "https://registry.npmjs.org/mquery/-/mquery-3.2.5.tgz",
+      "integrity": "sha512-VjOKHHgU84wij7IUoZzFRU07IAxd5kWJaDmyUzQlbjHjyoeK5TNeeo8ZsFDtTYnSgpW6n/nMNIHvE3u8Lbrf4A==",
       "requires": {
         "bluebird": "3.5.1",
         "debug": "3.1.0",
diff --git a/package.json b/package.json
index 73be391b0f..2b861f686d 100644
--- a/package.json
+++ b/package.json
@@ -125,7 +125,7 @@
     "lodash": "^4.17.21",
     "moment-timezone": "0.5.33",
     "mongodb-uri": "^0.9.7",
-    "mongoose": "^5.11.10",
+    "mongoose": "^5.12.3",
     "multiparty": ">=4.2.2",
     "neverthrow": "^4.2.1",
     "ng-infinite-scroll": "^1.3.0",
diff --git a/src/app/models/admin_verification.server.model.ts b/src/app/models/admin_verification.server.model.ts
index cbce56da2c..3f5d675999 100644
--- a/src/app/models/admin_verification.server.model.ts
+++ b/src/app/models/admin_verification.server.model.ts
@@ -12,7 +12,10 @@ import { USER_SCHEMA_ID } from './user.server.model'
 
 export const ADMIN_VERIFICATION_SCHEMA_ID = 'AdminVerification'
 
-const AdminVerificationSchema = new Schema<IAdminVerificationSchema>(
+const AdminVerificationSchema = new Schema<
+  IAdminVerificationSchema,
+  IAdminVerificationModel
+>(
   {
     admin: {
       type: Schema.Types.ObjectId,
diff --git a/src/app/models/form.server.model.ts b/src/app/models/form.server.model.ts
index aa8b879aed..460cb5765b 100644
--- a/src/app/models/form.server.model.ts
+++ b/src/app/models/form.server.model.ts
@@ -131,7 +131,7 @@ const EncryptedFormSchema = new Schema<IEncryptedFormSchema>({
   },
 })
 
-const EmailFormSchema = new Schema<IEmailFormSchema>({
+const EmailFormSchema = new Schema<IEmailFormSchema, IEmailFormModel>({
   emails: {
     type: [
       {
@@ -159,7 +159,7 @@ const compileFormModel = (db: Mongoose): IFormModel => {
   const User = getUserModel(db)
 
   // Schema
-  const FormSchema = new Schema<IFormSchema>(
+  const FormSchema = new Schema<IFormSchema, IFormModel>(
     {
       title: {
         type: String,
@@ -342,7 +342,7 @@ const compileFormModel = (db: Mongoose): IFormModel => {
   // Add discriminators for the various field types.
   const FormFieldPath = FormSchema.path(
     'form_fields',
-  ) as Schema.Types.DocumentArray
+  ) as Schema.Types.DocumentArrayWithLooseDiscriminator
 
   const TableFieldSchema = createTableFieldSchema()
 
@@ -376,7 +376,7 @@ const compileFormModel = (db: Mongoose): IFormModel => {
   FormFieldPath.discriminator(BasicField.Table, TableFieldSchema)
   const TableColumnPath = TableFieldSchema.path(
     'columns',
-  ) as Schema.Types.DocumentArray
+  ) as Schema.Types.DocumentArrayWithLooseDiscriminator
   TableColumnPath.discriminator(
     BasicField.ShortText,
     createShortTextFieldSchema(),
@@ -389,13 +389,13 @@ const compileFormModel = (db: Mongoose): IFormModel => {
   // Discriminator defines all possible values of startPage.logo
   const StartPageLogoPath = FormSchema.path(
     'startPage.logo',
-  ) as Schema.Types.DocumentArray
+  ) as Schema.Types.DocumentArrayWithLooseDiscriminator
   StartPageLogoPath.discriminator(FormLogoState.Custom, CustomFormLogoSchema)
 
   // Discriminator defines different logic types
   const FormLogicPath = FormSchema.path(
     'form_logics',
-  ) as Schema.Types.DocumentArray
+  ) as Schema.Types.DocumentArrayWithLooseDiscriminator
 
   FormLogicPath.discriminator(LogicType.ShowFields, ShowFieldsLogicSchema)
   FormLogicPath.discriminator(LogicType.PreventSubmit, PreventSubmitLogicSchema)
@@ -458,12 +458,6 @@ const compileFormModel = (db: Mongoose): IFormModel => {
     }
   }
 
-  FormSchema.methods.getSettings = function (
-    this: IFormDocument,
-  ): FormSettings {
-    return pick(this, FORM_SETTING_FIELDS)
-  }
-
   // Archives form.
   FormSchema.methods.archive = function (this: IFormSchema) {
     // Return instantly when form is already archived.
@@ -475,8 +469,16 @@ const compileFormModel = (db: Mongoose): IFormModel => {
     return this.save()
   }
 
+  const FormDocumentSchema = (FormSchema as unknown) as Schema<IFormDocument>
+
+  FormDocumentSchema.methods.getSettings = function (
+    this: IFormDocument,
+  ): FormSettings {
+    return pick(this, FORM_SETTING_FIELDS)
+  }
+
   // Transfer ownership of the form to another user
-  FormSchema.methods.transferOwner = async function (
+  FormDocumentSchema.methods.transferOwner = async function (
     this: IFormDocument,
     currentOwner: IUserSchema,
     newOwner: IUserSchema,
diff --git a/src/app/models/form_statistics_total.server.model.ts b/src/app/models/form_statistics_total.server.model.ts
index 573c61effb..212eaec6b7 100644
--- a/src/app/models/form_statistics_total.server.model.ts
+++ b/src/app/models/form_statistics_total.server.model.ts
@@ -12,7 +12,10 @@ const FORM_STATS_TOTAL_SCHEMA_ID = 'FormStatisticsTotal'
 const FORM_STATS_COLLECTION_NAME = 'formStatisticsTotal'
 
 const compileFormStatisticsTotalModel = (db: Mongoose) => {
-  const FormStatisticsTotalSchema = new Schema<IFormStatisticsTotalSchema>(
+  const FormStatisticsTotalSchema = new Schema<
+    IFormStatisticsTotalSchema,
+    IFormStatisticsTotalModel
+  >(
     {
       formId: {
         type: Schema.Types.ObjectId,
diff --git a/src/app/models/login.server.model.ts b/src/app/models/login.server.model.ts
index c0a2b1f8b5..b39a4b812b 100644
--- a/src/app/models/login.server.model.ts
+++ b/src/app/models/login.server.model.ts
@@ -14,7 +14,7 @@ import { USER_SCHEMA_ID } from './user.server.model'
 
 export const LOGIN_SCHEMA_ID = 'Login'
 
-const LoginSchema = new Schema<ILoginSchema>(
+const LoginSchema = new Schema<ILoginSchema, ILoginModel>(
   {
     admin: {
       type: Schema.Types.ObjectId,
@@ -133,7 +133,7 @@ LoginSchema.statics.aggregateLoginStats = function (
 }
 
 const compileLoginModel = (db: Mongoose) =>
-  db.model<ILoginSchema>(LOGIN_SCHEMA_ID, LoginSchema) as ILoginModel
+  db.model<ILoginSchema, ILoginModel>(LOGIN_SCHEMA_ID, LoginSchema)
 
 /**
  * Retrieves the Login model on the given Mongoose instance. If the model is
@@ -143,7 +143,7 @@ const compileLoginModel = (db: Mongoose) =>
  */
 const getLoginModel = (db: Mongoose): ILoginModel => {
   try {
-    return db.model(LOGIN_SCHEMA_ID) as ILoginModel
+    return db.model<ILoginSchema, ILoginModel>(LOGIN_SCHEMA_ID)
   } catch {
     return compileLoginModel(db)
   }
diff --git a/src/app/models/submission.server.model.ts b/src/app/models/submission.server.model.ts
index f27c02e9fb..0bf1b1b2d9 100644
--- a/src/app/models/submission.server.model.ts
+++ b/src/app/models/submission.server.model.ts
@@ -25,7 +25,7 @@ import { FORM_SCHEMA_ID } from './form.server.model'
 
 export const SUBMISSION_SCHEMA_ID = 'Submission'
 
-const SubmissionSchema = new Schema<ISubmissionSchema>(
+const SubmissionSchema = new Schema<ISubmissionSchema, ISubmissionModel>(
   {
     form: {
       type: Schema.Types.ObjectId,
@@ -143,7 +143,10 @@ const webhookResponseSchema = new Schema<IWebhookResponseSchema>(
   },
 )
 
-const EncryptSubmissionSchema = new Schema<IEncryptedSubmissionSchema>({
+const EncryptSubmissionSchema = new Schema<
+  IEncryptedSubmissionSchema,
+  IEncryptSubmissionModel
+>({
   encryptedContent: {
     type: String,
     trim: true,
@@ -347,15 +350,15 @@ const compileSubmissionModel = (db: Mongoose): ISubmissionModel => {
   const Submission = db.model('Submission', SubmissionSchema)
   Submission.discriminator(SubmissionType.Email, EmailSubmissionSchema)
   Submission.discriminator(SubmissionType.Encrypt, EncryptSubmissionSchema)
-  return db.model<ISubmissionSchema>(
+  return db.model<ISubmissionSchema, ISubmissionModel>(
     SUBMISSION_SCHEMA_ID,
     SubmissionSchema,
-  ) as ISubmissionModel
+  )
 }
 
 const getSubmissionModel = (db: Mongoose): ISubmissionModel => {
   try {
-    return db.model(SUBMISSION_SCHEMA_ID) as ISubmissionModel
+    return db.model<ISubmissionSchema, ISubmissionModel>(SUBMISSION_SCHEMA_ID)
   } catch {
     return compileSubmissionModel(db)
   }
diff --git a/src/app/models/token.server.model.ts b/src/app/models/token.server.model.ts
index f4d2538956..c07699a2b5 100644
--- a/src/app/models/token.server.model.ts
+++ b/src/app/models/token.server.model.ts
@@ -4,7 +4,7 @@ import { IToken, ITokenModel, ITokenSchema } from '../../types'
 
 export const TOKEN_SCHEMA_ID = 'Token'
 
-const TokenSchema = new Schema<ITokenSchema>({
+const TokenSchema = new Schema<ITokenSchema, ITokenModel>({
   email: {
     type: String,
     required: true,
diff --git a/src/app/models/user.server.model.ts b/src/app/models/user.server.model.ts
index f0fbfc20eb..84c334b4e7 100644
--- a/src/app/models/user.server.model.ts
+++ b/src/app/models/user.server.model.ts
@@ -18,7 +18,7 @@ export const USER_SCHEMA_ID = 'User'
 const compileUserModel = (db: Mongoose) => {
   const Agency = getAgencyModel(db)
 
-  const UserSchema: Schema<IUserSchema> = new Schema(
+  const UserSchema: Schema<IUserSchema, IUserModel> = new Schema(
     {
       email: {
         type: String,
@@ -59,7 +59,8 @@ const compileUserModel = (db: Mongoose) => {
             if (!phoneNumber) return false
             return phoneNumber.isValid()
           },
-          message: (props) => `${props.value} is not a valid mobile number`,
+          message: (props: { value: string }) =>
+            `${props.value} is not a valid mobile number`,
         },
       },
       lastAccessed: Date,
diff --git a/src/app/modules/bounce/bounce.model.ts b/src/app/modules/bounce/bounce.model.ts
index 8f1d9934d0..de7d7f4d47 100644
--- a/src/app/modules/bounce/bounce.model.ts
+++ b/src/app/modules/bounce/bounce.model.ts
@@ -23,7 +23,7 @@ export interface IBounceModel extends Model<IBounceSchema> {
   ) => IBounceSchema
 }
 
-const BounceSchema = new Schema<IBounceSchema>({
+const BounceSchema = new Schema<IBounceSchema, IBounceModel>({
   formId: {
     type: Schema.Types.ObjectId,
     ref: FORM_SCHEMA_ID,
diff --git a/src/app/modules/myinfo/myinfo_hash.model.ts b/src/app/modules/myinfo/myinfo_hash.model.ts
index bf53a7e406..03f95905f9 100644
--- a/src/app/modules/myinfo/myinfo_hash.model.ts
+++ b/src/app/modules/myinfo/myinfo_hash.model.ts
@@ -7,7 +7,7 @@ import { FORM_SCHEMA_ID } from '../../models/form.server.model'
 
 export const MYINFO_HASH_SCHEMA_ID = 'MyInfoHash'
 
-const MyInfoHashSchema = new Schema<IMyInfoHashSchema>(
+const MyInfoHashSchema = new Schema<IMyInfoHashSchema, IMyInfoHashModel>(
   {
     // We stored a hashed uinFin using a salt stored as a env var
     // Note: key name not updated to reflect this for backward compatibility purposes
diff --git a/src/app/modules/submission/submission.service.ts b/src/app/modules/submission/submission.service.ts
index 45f7ce5beb..50619491c7 100644
--- a/src/app/modules/submission/submission.service.ts
+++ b/src/app/modules/submission/submission.service.ts
@@ -227,7 +227,7 @@ export const getFormSubmissionsCount = (
  * @returns ok(true) if all emails were sent successfully
  * @returns err(SendEmailConfirmationError) if any email failed to be sent
  */
-export const sendEmailConfirmations = ({
+export const sendEmailConfirmations = <S extends ISubmissionSchema>({
   form,
   submission,
   parsedResponses,
@@ -235,7 +235,7 @@ export const sendEmailConfirmations = ({
   attachments,
 }: {
   form: IPopulatedForm
-  submission: ISubmissionSchema
+  submission: S
   parsedResponses: ProcessedFieldResponse[]
   autoReplyData?: EmailRespondentConfirmationField[]
   attachments?: IAttachmentInfo[]
diff --git a/src/app/modules/verification/verification.model.ts b/src/app/modules/verification/verification.model.ts
index e1be83a247..53d96c3d82 100644
--- a/src/app/modules/verification/verification.model.ts
+++ b/src/app/modules/verification/verification.model.ts
@@ -33,7 +33,10 @@ const VerificationFieldSchema = new Schema<IVerificationFieldSchema>({
 })
 
 const compileVerificationModel = (db: Mongoose): IVerificationModel => {
-  const VerificationSchema = new Schema<IVerificationSchema>({
+  const VerificationSchema = new Schema<
+    IVerificationSchema,
+    IVerificationModel
+  >({
     formId: {
       type: Schema.Types.ObjectId,
       ref: FORM_SCHEMA_ID,
diff --git a/src/app/services/sms/sms_count.server.model.ts b/src/app/services/sms/sms_count.server.model.ts
index ea27658a2f..e7638e2ac8 100644
--- a/src/app/services/sms/sms_count.server.model.ts
+++ b/src/app/services/sms/sms_count.server.model.ts
@@ -83,7 +83,7 @@ const BouncedSubmissionSmsCountSchema = new Schema<IBouncedSubmissionSmsCountSch
 )
 
 const compileSmsCountModel = (db: Mongoose) => {
-  const SmsCountSchema = new Schema<ISmsCountSchema>(
+  const SmsCountSchema = new Schema<ISmsCountSchema, ISmsCountModel>(
     {
       msgSrvcSid: {
         type: String,
diff --git a/src/types/vendor/mongoose.d.ts b/src/types/vendor/mongoose.d.ts
new file mode 100644
index 0000000000..917356050f
--- /dev/null
+++ b/src/types/vendor/mongoose.d.ts
@@ -0,0 +1,33 @@
+/**
+ * Additional type declarations for mongoose to fit our use case,
+ * to accommodate the non-standard but compatible use of types
+ * in schema registration
+ */
+declare module 'mongoose' {
+  namespace Schema {
+    namespace Types {
+      /**
+       * A DocumentArray with a discriminator function that takes in a
+       * type-generic Schema.
+       */
+      class DocumentArrayWithLooseDiscriminator extends DocumentArray {
+        /**
+         * In the built-in type declarations in
+         * version 5.12 of mongoose, discriminator() expects a Schema
+         * (and hence Schema<Document>). This does not work; a Schema
+         * for a subtype of Document is not a Schema for a Document, as
+         * Schema.methods expect to operate on the Schema's document type,
+         * which is not necessarily a Document.
+         *
+         * Address this by overriding the definition and provide a type-generic
+         * Schema argument.
+         */
+        discriminator<T extends Document>(
+          name: string,
+          schema: Schema<T>,
+          tag?: string,
+        ): unknown
+      }
+    }
+  }
+}

From a9dd46fb5f755f682632419a882c636c33038bf6 Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Tue, 6 Apr 2021 15:42:50 +0800
Subject: [PATCH 11/75] refactor(webhook-services): migrate webhook services to
 neverthrow (#1529)

* ref: narrow types for getWebhookView

* ref: move hasProp to utils

* ref: implement service using neverthrow

* ref: implement webhook factory

* ref: delete old middleware factory

* ref: implement new middleware

* ref: use new factory function in controller

* refactor(webhook-service): add tests for webhook services

- moved webhook url validation to new file and updated references
- updated tests for webhook validation

ref #193

* fix(build): removed duplicate type for possible-database-error

* fix(webhook-service): use relative imports

* fix(webhook-factory): fix feature-guard conditional

* test(webhook-service) update webhook tests

* refactor(tests): clean up unit and model tests

* refactor(tests): do further cleaning of tests

* refactor(tests): add missing calledWith checks for mocks

* refactor(submission-model): clean up queries and webhook tests

Co-authored-by: Antariksh <antarikshmahajan@gmail.com>
---
 .../webhook-verified-content.factory.js       |  18 -
 src/app/models/form.server.model.ts           |   2 +-
 src/app/models/submission.server.model.ts     |  13 +
 src/app/modules/myinfo/myinfo.util.ts         |  15 +-
 .../encrypt-submission.controller.ts          |  14 +-
 .../webhook/__tests__/webhook.service.spec.ts | 422 ++++++++++++++++++
 .../__tests__/webhook.validation.spec.ts      |  13 +-
 src/app/modules/webhook/webhook.controller.ts |  33 --
 src/app/modules/webhook/webhook.errors.ts     |  32 +-
 src/app/modules/webhook/webhook.factory.ts    |  29 ++
 src/app/modules/webhook/webhook.service.ts    | 410 ++++++-----------
 src/app/modules/webhook/webhook.types.ts      |   9 +-
 src/app/modules/webhook/webhook.utils.ts      |  71 +--
 src/app/modules/webhook/webhook.validation.ts |  62 +++
 src/app/utils/has-prop.ts                     |  13 +
 src/shared/util/stringify-safe.ts             |   2 +-
 src/types/submission.ts                       |  18 +-
 .../models/submission.server.model.spec.ts    |  87 +++-
 .../modules/webhook/webhook.service.spec.ts   | 236 ----------
 19 files changed, 848 insertions(+), 651 deletions(-)
 delete mode 100644 src/app/factories/webhook-verified-content.factory.js
 create mode 100644 src/app/modules/webhook/__tests__/webhook.service.spec.ts
 rename tests/unit/backend/modules/webhook/webhook.utils.spec.ts => src/app/modules/webhook/__tests__/webhook.validation.spec.ts (83%)
 delete mode 100644 src/app/modules/webhook/webhook.controller.ts
 create mode 100644 src/app/modules/webhook/webhook.factory.ts
 create mode 100644 src/app/modules/webhook/webhook.validation.ts
 create mode 100644 src/app/utils/has-prop.ts
 delete mode 100644 tests/unit/backend/modules/webhook/webhook.service.spec.ts

diff --git a/src/app/factories/webhook-verified-content.factory.js b/src/app/factories/webhook-verified-content.factory.js
deleted file mode 100644
index 924a5a7e70..0000000000
--- a/src/app/factories/webhook-verified-content.factory.js
+++ /dev/null
@@ -1,18 +0,0 @@
-const webhook = require('../modules/webhook/webhook.controller')
-const featureManager = require('../../config/feature-manager').default
-
-const webhookVerifiedContentFactory = ({ isEnabled, props }) => {
-  if (isEnabled && props) {
-    return {
-      post: webhook.post,
-    }
-  } else {
-    return {
-      post: (req, res, next) => next(),
-    }
-  }
-}
-
-module.exports = webhookVerifiedContentFactory(
-  featureManager.get('webhook-verified-content'),
-)
diff --git a/src/app/models/form.server.model.ts b/src/app/models/form.server.model.ts
index 460cb5765b..0638eacbc3 100644
--- a/src/app/models/form.server.model.ts
+++ b/src/app/models/form.server.model.ts
@@ -31,7 +31,7 @@ import { IPopulatedUser, IUserSchema } from '../../types/user'
 import { MB } from '../constants/filesize'
 import { OverrideProps } from '../modules/form/admin-form/admin-form.types'
 import { transformEmails } from '../modules/form/form.utils'
-import { validateWebhookUrl } from '../modules/webhook/webhook.utils'
+import { validateWebhookUrl } from '../modules/webhook/webhook.validation'
 
 import getAgencyModel from './agency.server.model'
 import {
diff --git a/src/app/models/submission.server.model.ts b/src/app/models/submission.server.model.ts
index 0bf1b1b2d9..b8314c5d51 100644
--- a/src/app/models/submission.server.model.ts
+++ b/src/app/models/submission.server.model.ts
@@ -11,6 +11,7 @@ import {
   IEncryptSubmissionModel,
   ISubmissionModel,
   ISubmissionSchema,
+  IWebhookResponse,
   IWebhookResponseSchema,
   MyInfoAttribute,
   SubmissionCursorData,
@@ -188,6 +189,18 @@ EncryptSubmissionSchema.methods.getWebhookView = function (
   }
 }
 
+EncryptSubmissionSchema.statics.addWebhookResponse = function (
+  this: IEncryptSubmissionModel,
+  submissionId: string,
+  webhookResponse: IWebhookResponse,
+): Promise<IEncryptedSubmissionSchema | null> {
+  return this.findByIdAndUpdate(
+    submissionId,
+    { $push: { webhookResponses: webhookResponse } },
+    { new: true, setDefaultsOnInsert: true, runValidators: true },
+  ).exec()
+}
+
 EncryptSubmissionSchema.statics.findSingleMetadata = function (
   this: IEncryptSubmissionModel,
   formId: string,
diff --git a/src/app/modules/myinfo/myinfo.util.ts b/src/app/modules/myinfo/myinfo.util.ts
index cfc4c88814..a77db98b0c 100644
--- a/src/app/modules/myinfo/myinfo.util.ts
+++ b/src/app/modules/myinfo/myinfo.util.ts
@@ -16,6 +16,7 @@ import {
   IPopulatedForm,
   MapRouteError,
 } from '../../../types'
+import { hasProp } from '../../utils/has-prop'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { FormNotFoundError } from '../form/form.errors'
 import {
@@ -303,20 +304,6 @@ export const validateMyInfoForm = (
   return ok(form as IMyInfoForm)
 }
 
-/**
- * Utility to narrow type of an object by determining whether
- * it contains the given property.
- * @param obj Object
- * @param prop Property to check
- */
-export const hasProp = <K extends string>(
-  // eslint-disable-next-line @typescript-eslint/ban-types
-  obj: object | Record<string, unknown>,
-  prop: K,
-): obj is Record<K, unknown> => {
-  return prop in obj
-}
-
 /**
  * Type guard for MyInfo cookie.
  * @param cookie Unknown object
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index f0c2c79729..ff72ee44a6 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -31,7 +31,7 @@ import { mapVerifyMyInfoError } from '../../myinfo/myinfo.util'
 import { SpcpFactory } from '../../spcp/spcp.factory'
 import { getPopulatedUserById } from '../../user/user.service'
 import { VerifiedContentFactory } from '../../verified-content/verified-content.factory'
-import { pushData as webhookPushData } from '../../webhook/webhook.service'
+import { WebhookFactory } from '../../webhook/webhook.factory'
 import {
   getProcessedResponses,
   sendEmailConfirmations,
@@ -365,12 +365,16 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
   })
 
   // Fire webhooks if available
+  // Note that we push data to webhook endpoints on a best effort basis
+  // As such, we should not await on these post requests
   const webhookUrl = form.webhook?.url
-  const submissionWebhookView = submission.getWebhookView()
   if (webhookUrl) {
-    // Note that we push data to webhook endpoints on a best effort basis
-    // As such, we should not await on these post requests
-    void webhookPushData(webhookUrl, submissionWebhookView)
+    void WebhookFactory.sendWebhook(
+      submission,
+      webhookUrl,
+    ).andThen((response) =>
+      WebhookFactory.saveWebhookRecord(submission._id, response),
+    )
   }
 
   // Send Email Confirmations
diff --git a/src/app/modules/webhook/__tests__/webhook.service.spec.ts b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
new file mode 100644
index 0000000000..89d592655b
--- /dev/null
+++ b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
@@ -0,0 +1,422 @@
+import axios, { AxiosError, AxiosRequestConfig, AxiosResponse } from 'axios'
+import { ObjectID } from 'bson'
+import { SubmissionNotFoundError } from 'dist/backend/app/modules/submission/submission.errors'
+import mongoose from 'mongoose'
+import { mocked } from 'ts-jest/utils'
+
+import getFormModel from 'src/app/models/form.server.model'
+import { getEncryptSubmissionModel } from 'src/app/models/submission.server.model'
+import { WebhookValidationError } from 'src/app/modules/webhook/webhook.errors'
+import * as WebhookValidationModule from 'src/app/modules/webhook/webhook.validation'
+import { transformMongoError } from 'src/app/utils/handle-mongo-error'
+import * as HasPropModule from 'src/app/utils/has-prop'
+import formsgSdk from 'src/config/formsg-sdk'
+import {
+  IEncryptedSubmissionSchema,
+  IWebhookResponse,
+  ResponseMode,
+  WebhookView,
+} from 'src/types'
+
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
+import { saveWebhookRecord, sendWebhook } from '../webhook.service'
+
+// define suite-wide mocks
+jest.mock('axios')
+const MockAxios = mocked(axios, true)
+
+jest.mock('src/app/modules/webhook/webhook.validation')
+const MockWebhookValidationModule = mocked(WebhookValidationModule, true)
+
+// define test constants
+const FormModel = getFormModel(mongoose)
+const EncryptSubmissionModel = getEncryptSubmissionModel(mongoose)
+
+const MOCK_WEBHOOK_URL = 'https://form.gov.sg/endpoint'
+const DEFAULT_ERROR_MSG = 'a generic error has occurred'
+const AXIOS_ERROR_MSG = 'an axios error has occurred'
+
+const MOCK_AXIOS_SUCCESS_RESPONSE: AxiosResponse = {
+  data: {
+    result: 'test-result',
+  },
+  status: 200,
+  statusText: 'success',
+  headers: {},
+  config: {},
+}
+const MOCK_AXIOS_FAILURE_RESPONSE: AxiosResponse = {
+  data: {
+    result: 'test-result',
+  },
+  status: 400,
+  statusText: 'failed',
+  headers: {},
+  config: {},
+}
+const MOCK_WEBHOOK_SUCCESS_RESPONSE: Pick<IWebhookResponse, 'response'> = {
+  response: {
+    data: '{"result":"test-result"}',
+    status: 200,
+    statusText: 'success',
+    headers: '{}',
+  },
+}
+const MOCK_WEBHOOK_FAILURE_RESPONSE: Pick<IWebhookResponse, 'response'> = {
+  response: {
+    data: '{"result":"test-result"}',
+    status: 400,
+    statusText: 'failed',
+    headers: '{}',
+  },
+}
+const MOCK_WEBHOOK_DEFAULT_FORMAT_RESPONSE: Pick<
+  IWebhookResponse,
+  'response'
+> = {
+  response: {
+    data: '',
+    status: 0,
+    statusText: '',
+    headers: '',
+  },
+}
+
+describe('webhook.service', () => {
+  beforeAll(async () => await dbHandler.connect())
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  // test variables
+  let testEncryptedSubmission: IEncryptedSubmissionSchema
+  let testConfig: AxiosRequestConfig
+  let testSubmissionWebhookView: WebhookView | null
+  let testSignature: string
+
+  beforeEach(async () => {
+    jest.restoreAllMocks()
+
+    // prepare for form creation workflow
+    const MOCK_ADMIN_OBJ_ID = new ObjectID()
+    const MOCK_EPOCH = 1487076708000
+    const preloaded = await dbHandler.insertFormCollectionReqs({
+      userId: MOCK_ADMIN_OBJ_ID,
+    })
+
+    jest.spyOn(Date, 'now').mockImplementation(() => MOCK_EPOCH)
+
+    // instantiate new form and save
+    const testEncryptedForm = await FormModel.create({
+      title: 'Test Form',
+      admin: preloaded.user._id,
+      responseMode: ResponseMode.Encrypt,
+      publicKey: 'fake-public-key',
+    })
+
+    // initialise encrypted submussion
+    testEncryptedSubmission = await EncryptSubmissionModel.create({
+      form: testEncryptedForm._id,
+      authType: testEncryptedForm.authType,
+      myInfoFields: [],
+      encryptedContent: 'encrypted-content',
+      verifiedContent: 'verified-content',
+      version: 1,
+      webhookResponses: [],
+    })
+
+    // initialise webhook related variables
+    testSubmissionWebhookView = testEncryptedSubmission.getWebhookView()
+
+    testSignature = formsgSdk.webhooks.generateSignature({
+      uri: MOCK_WEBHOOK_URL,
+      submissionId: testEncryptedSubmission._id,
+      formId: testEncryptedForm._id,
+      epoch: MOCK_EPOCH,
+    })
+
+    testConfig = {
+      headers: {
+        'X-FormSG-Signature': `t=${MOCK_EPOCH},s=${testEncryptedSubmission._id},f=${testEncryptedForm._id},v1=${testSignature}`,
+      },
+      maxRedirects: 0,
+    }
+  })
+
+  describe('saveWebhookRecord', () => {
+    it('should return transform mongo error if database update for webhook fails', async () => {
+      // Arrange
+      const mockWebhookResponse = {
+        ...MOCK_WEBHOOK_SUCCESS_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      } as IWebhookResponse
+
+      const mockDBError = new Error(DEFAULT_ERROR_MSG)
+
+      const addWebhookResponseSpy = jest
+        .spyOn(EncryptSubmissionModel, 'addWebhookResponse')
+        .mockRejectedValueOnce(mockDBError)
+
+      // Act
+      const actual = await saveWebhookRecord(
+        testEncryptedSubmission._id,
+        mockWebhookResponse,
+      )
+
+      // Assert
+      const expectedError = transformMongoError(mockDBError)
+
+      expect(addWebhookResponseSpy).toHaveBeenCalledWith(
+        testEncryptedSubmission._id,
+        mockWebhookResponse,
+      )
+      expect(actual._unsafeUnwrapErr()).toEqual(expectedError)
+    })
+
+    it('should return submission not found error if submission id cannot be found in database', async () => {
+      // Arrange
+      const mockWebhookResponse = {
+        ...MOCK_WEBHOOK_SUCCESS_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      } as IWebhookResponse
+
+      // Act
+      const actual = await saveWebhookRecord(
+        new ObjectID(),
+        mockWebhookResponse,
+      )
+
+      // Assert
+      const expectedError = new SubmissionNotFoundError(
+        'Unable to find submission ID to update webhook response',
+      )
+
+      expect(actual._unsafeUnwrapErr()).toEqual(expectedError)
+    })
+
+    it('should return updated submission with new webhook response if the record is successfully saved', async () => {
+      // Arrange
+      const mockWebhookResponse = {
+        _id: testEncryptedSubmission._id,
+        created: testEncryptedSubmission.created,
+        ...MOCK_WEBHOOK_SUCCESS_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      } as IWebhookResponse
+
+      const expectedSubmission = new EncryptSubmissionModel({
+        ...testEncryptedSubmission,
+      })
+      expectedSubmission.webhookResponses = [mockWebhookResponse]
+
+      const addWebhookResponseSpy = jest
+        .spyOn(EncryptSubmissionModel, 'addWebhookResponse')
+        .mockResolvedValue(expectedSubmission)
+
+      // Act
+      const actual = await saveWebhookRecord(
+        testEncryptedSubmission._id,
+        mockWebhookResponse,
+      )
+
+      // Assert
+      expect(addWebhookResponseSpy).toHaveBeenCalledWith(
+        testEncryptedSubmission._id,
+        mockWebhookResponse,
+      )
+      expect(actual._unsafeUnwrap()).toEqual(expectedSubmission)
+    })
+  })
+
+  describe('sendWebhook', () => {
+    it('should return webhook url validation error if webhook url is not valid', async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockRejectedValueOnce(
+        new WebhookValidationError(DEFAULT_ERROR_MSG),
+      )
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedError = new WebhookValidationError(DEFAULT_ERROR_MSG)
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      expect(actual._unsafeUnwrapErr()).toEqual(expectedError)
+    })
+
+    it('should return default webhook url validation error if webhook url is not valid and validate webhook url returns a non webhook url validation error', async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockRejectedValueOnce(
+        new Error(),
+      )
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedError = new WebhookValidationError(
+        'Webhook URL is non-HTTPS or points to private IP',
+      )
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      expect(actual._unsafeUnwrapErr()).toEqual(expectedError)
+    })
+
+    it('should resolve with webhook failed with axios error message if axios post fails due to an axios error', async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockResolvedValueOnce()
+
+      const MOCK_AXIOS_ERROR: AxiosError = {
+        name: '',
+        message: AXIOS_ERROR_MSG,
+        config: {},
+        code: '',
+        response: MOCK_AXIOS_FAILURE_RESPONSE,
+        isAxiosError: true,
+        toJSON: () => jest.fn(),
+      }
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      MockAxios.post.mockRejectedValue(MOCK_AXIOS_ERROR)
+      MockAxios.isAxiosError.mockReturnValue(true)
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedResult = {
+        errorMessage: AXIOS_ERROR_MSG,
+        ...MOCK_WEBHOOK_FAILURE_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      }
+
+      expect(MockAxios.post).toHaveBeenCalledWith(
+        MOCK_WEBHOOK_URL,
+        testSubmissionWebhookView,
+        testConfig,
+      )
+      expect(actual._unsafeUnwrap()).toEqual(expectedResult)
+    })
+
+    it("should resolve with unknown error's error message and default response format if axios post fails due to an unknown error", async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockResolvedValueOnce()
+
+      MockAxios.post.mockRejectedValue(new Error(DEFAULT_ERROR_MSG))
+      MockAxios.isAxiosError.mockReturnValue(false)
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedResult = {
+        errorMessage: DEFAULT_ERROR_MSG,
+        ...MOCK_WEBHOOK_DEFAULT_FORMAT_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      }
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      expect(MockAxios.post).toHaveBeenCalledWith(
+        MOCK_WEBHOOK_URL,
+        testSubmissionWebhookView,
+        testConfig,
+      )
+      expect(actual._unsafeUnwrap()).toEqual(expectedResult)
+    })
+
+    it('should resolve with an empty error message and default response format if axios post fails due to an unknown error which has no message', async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockResolvedValueOnce()
+
+      const mockOriginalError = new Error(DEFAULT_ERROR_MSG)
+
+      MockAxios.post.mockRejectedValue(mockOriginalError)
+      MockAxios.isAxiosError.mockReturnValue(false)
+      const hasPropSpy = jest
+        .spyOn(HasPropModule, 'hasProp')
+        .mockReturnValueOnce(false)
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedResult = {
+        errorMessage: '',
+        ...MOCK_WEBHOOK_DEFAULT_FORMAT_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      }
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      expect(hasPropSpy).toHaveBeenCalledWith(mockOriginalError, 'message')
+      expect(MockAxios.post).toHaveBeenCalledWith(
+        MOCK_WEBHOOK_URL,
+        testSubmissionWebhookView,
+        testConfig,
+      )
+      expect(actual._unsafeUnwrap()).toEqual(expectedResult)
+    })
+
+    it('should resolve without error message if axios post succeeds', async () => {
+      // Arrange
+      MockWebhookValidationModule.validateWebhookUrl.mockResolvedValueOnce()
+
+      MockAxios.post.mockResolvedValue(MOCK_AXIOS_SUCCESS_RESPONSE)
+
+      // Act
+      const actual = await sendWebhook(
+        testEncryptedSubmission,
+        MOCK_WEBHOOK_URL,
+      )
+
+      // Assert
+      const expectedResult = {
+        ...MOCK_WEBHOOK_SUCCESS_RESPONSE,
+        signature: testSignature,
+        webhookUrl: MOCK_WEBHOOK_URL,
+      }
+
+      expect(
+        MockWebhookValidationModule.validateWebhookUrl,
+      ).toHaveBeenCalledWith(MOCK_WEBHOOK_URL)
+      expect(MockAxios.post).toHaveBeenCalledWith(
+        MOCK_WEBHOOK_URL,
+        testSubmissionWebhookView,
+        testConfig,
+      )
+      expect(actual._unsafeUnwrap()).toEqual(expectedResult)
+    })
+  })
+})
diff --git a/tests/unit/backend/modules/webhook/webhook.utils.spec.ts b/src/app/modules/webhook/__tests__/webhook.validation.spec.ts
similarity index 83%
rename from tests/unit/backend/modules/webhook/webhook.utils.spec.ts
rename to src/app/modules/webhook/__tests__/webhook.validation.spec.ts
index f93cbbe283..eec2425228 100644
--- a/tests/unit/backend/modules/webhook/webhook.utils.spec.ts
+++ b/src/app/modules/webhook/__tests__/webhook.validation.spec.ts
@@ -2,7 +2,7 @@ import { promises as dns } from 'dns'
 import { mocked } from 'ts-jest/utils'
 
 import { WebhookValidationError } from 'src/app/modules/webhook/webhook.errors'
-import { validateWebhookUrl } from 'src/app/modules/webhook/webhook.utils'
+import { validateWebhookUrl } from 'src/app/modules/webhook/webhook.validation'
 import config from 'src/config/config'
 
 jest.mock('dns', () => ({
@@ -34,7 +34,7 @@ describe('Webhook URL validation', () => {
     )
   })
 
-  it('should reject URLs which do not resolve to any IP', async () => {
+  it('should reject URLs if DNS resolution fails', async () => {
     MockDns.resolve.mockRejectedValueOnce([])
     await expect(validateWebhookUrl(MOCK_WEBHOOK_URL)).rejects.toStrictEqual(
       new WebhookValidationError(
@@ -43,6 +43,15 @@ describe('Webhook URL validation', () => {
     )
   })
 
+  it('should reject URLs which do not resolve to any IPs', async () => {
+    MockDns.resolve.mockResolvedValueOnce([])
+    await expect(validateWebhookUrl(MOCK_WEBHOOK_URL)).rejects.toStrictEqual(
+      new WebhookValidationError(
+        `${MOCK_WEBHOOK_URL} does not resolve to any IP address.`,
+      ),
+    )
+  })
+
   it('should reject URLs which resolve to private IPs', async () => {
     MockDns.resolve.mockResolvedValueOnce(['127.0.0.1'])
     await expect(validateWebhookUrl(MOCK_WEBHOOK_URL)).rejects.toStrictEqual(
diff --git a/src/app/modules/webhook/webhook.controller.ts b/src/app/modules/webhook/webhook.controller.ts
deleted file mode 100644
index 8fc6b9b904..0000000000
--- a/src/app/modules/webhook/webhook.controller.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { NextFunction, Request, Response } from 'express'
-
-import { pushData } from './webhook.service'
-import { WebhookRequestLocals } from './webhook.types'
-
-/**
- * POST submission to a specified URL.  Only works for encrypted submissions.
- * The webhook is fired on a best-effort basis, so the next middleware
- * is always called.
- * @param {Express.Request} req Express request object
- * @param {Object} req.form The form object containing the webhook URL
- * @param {Object} req.submission The submission saved to the database
- * @param {Express.Response} res Express response object
- * @param {function} next Next middleware
- */
-export const post = (
-  req: Request & WebhookRequestLocals,
-  res: Response,
-  next: NextFunction,
-) => {
-  // TODO: Once we move away from the middleware pattern, there should not be a webhook controller
-  // There should only be a webhook service, which is called within the submission controller
-  // This will also remove the need for retrieval of form/submission from req.
-  const { form, submission } = req
-  const webhookUrl = form.webhook?.url
-  const submissionWebhookView = submission.getWebhookView()
-  if (webhookUrl) {
-    // Note that we push data to webhook endpoints on a best effort basis
-    // As such, we should not await on these post requests
-    void pushData(webhookUrl, submissionWebhookView)
-  }
-  return next()
-}
diff --git a/src/app/modules/webhook/webhook.errors.ts b/src/app/modules/webhook/webhook.errors.ts
index e31d8e9035..210f4ff2ce 100644
--- a/src/app/modules/webhook/webhook.errors.ts
+++ b/src/app/modules/webhook/webhook.errors.ts
@@ -1,3 +1,5 @@
+import { AxiosError } from 'axios'
+
 import { ApplicationError } from '../core/core.errors'
 
 /**
@@ -5,7 +7,35 @@ import { ApplicationError } from '../core/core.errors'
  * if the submissionWebhookView is null or the webhookUrl is an invalid URL
  */
 export class WebhookValidationError extends ApplicationError {
-  constructor(message: string) {
+  constructor(message = 'Webhook URL is non-HTTPS or points to private IP') {
+    super(message)
+  }
+}
+
+/**
+ * Webhook returned non-200 status, but error is not instance of AxiosError
+ */
+export class WebhookFailedWithUnknownError extends ApplicationError {
+  meta: {
+    originalError: unknown
+  }
+
+  constructor(error: unknown, message = 'Webhook POST failed') {
+    super(message)
+    this.meta = { originalError: error }
+  }
+}
+
+/**
+ * Webhook returned non-200 status, error is instance of AxiosError
+ */
+export class WebhookFailedWithAxiosError extends ApplicationError {
+  meta: {
+    originalError: AxiosError<unknown>
+  }
+
+  constructor(error: AxiosError<unknown>, message = 'Webhook POST failed') {
     super(message)
+    this.meta = { originalError: error }
   }
 }
diff --git a/src/app/modules/webhook/webhook.factory.ts b/src/app/modules/webhook/webhook.factory.ts
new file mode 100644
index 0000000000..dc974b6011
--- /dev/null
+++ b/src/app/modules/webhook/webhook.factory.ts
@@ -0,0 +1,29 @@
+import { errAsync } from 'neverthrow'
+
+import FeatureManager, {
+  FeatureNames,
+  RegisteredFeature,
+} from '../../../config/feature-manager'
+import { MissingFeatureError } from '../core/core.errors'
+
+import * as WebhookService from './webhook.service'
+
+interface IWebhookFactory {
+  sendWebhook: typeof WebhookService.sendWebhook
+  saveWebhookRecord: typeof WebhookService.saveWebhookRecord
+}
+
+export const createWebhookFactory = ({
+  isEnabled,
+  props,
+}: RegisteredFeature<FeatureNames.WebhookVerifiedContent>): IWebhookFactory => {
+  if (isEnabled && props) return WebhookService
+  const error = new MissingFeatureError(FeatureNames.SpcpMyInfo)
+  return {
+    sendWebhook: () => errAsync(error),
+    saveWebhookRecord: () => errAsync(error),
+  }
+}
+
+const webhookFeature = FeatureManager.get(FeatureNames.WebhookVerifiedContent)
+export const WebhookFactory = createWebhookFactory(webhookFeature)
diff --git a/src/app/modules/webhook/webhook.service.ts b/src/app/modules/webhook/webhook.service.ts
index 947e394e76..682501d96b 100644
--- a/src/app/modules/webhook/webhook.service.ts
+++ b/src/app/modules/webhook/webhook.service.ts
@@ -1,178 +1,32 @@
-import axios, { AxiosError, AxiosResponse } from 'axios'
+import axios from 'axios'
 import { get } from 'lodash'
 import mongoose from 'mongoose'
+import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 
 import formsgSdk from '../../../config/formsg-sdk'
 import { createLoggerWithLabel } from '../../../config/logger'
-// Prevents JSON.stringify error for circular JSONs and BigInts
-import { stringifySafe } from '../../../shared/util/stringify-safe'
 import {
-  IFormSchema,
+  IEncryptedSubmissionSchema,
   ISubmissionSchema,
   IWebhookResponse,
-  WebhookView,
 } from '../../../types'
 import { getEncryptSubmissionModel } from '../../models/submission.server.model'
+import { transformMongoError } from '../../utils/handle-mongo-error'
+import { hasProp } from '../../utils/has-prop'
+import { PossibleDatabaseError } from '../core/core.errors'
+import { SubmissionNotFoundError } from '../submission/submission.errors'
 
-import { WebhookValidationError } from './webhook.errors'
-import { WebhookParams } from './webhook.types'
-import { validateWebhookUrl } from './webhook.utils'
+import {
+  WebhookFailedWithAxiosError,
+  WebhookFailedWithUnknownError,
+  WebhookValidationError,
+} from './webhook.errors'
+import { formatWebhookResponse } from './webhook.utils'
+import { validateWebhookUrl } from './webhook.validation'
 
 const logger = createLoggerWithLabel(module)
 const EncryptSubmission = getEncryptSubmissionModel(mongoose)
 
-/**
- * Logs webhook failure in console and database.
- * @param {error} error Error object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {Object} webhookParams.submissionWebhookView POST body
- * @param {string} webhookParams.submissionId
- * @param {string} webhookParams.formId
- * @param {string} webhookParams.now Epoch for POST header
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const handleWebhookFailure = async (
-  error: Error | AxiosError,
-  webhookParams: WebhookParams,
-): Promise<any> => {
-  logWebhookFailure(error, webhookParams)
-  return updateSubmissionsDb(
-    webhookParams.formId,
-    webhookParams.submissionId,
-    getFailureDbUpdate(error, webhookParams),
-  )
-}
-
-/**
- * Logs webhook success in console and database.
- * @param {response} response Response object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {Object} webhookParams.submissionWebhookView POST body
- * @param {string} webhookParams.submissionId
- * @param {string} webhookParams.formId
- * @param {string} webhookParams.now Epoch for POST header
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const handleWebhookSuccess = async (
-  response: AxiosResponse,
-  webhookParams: WebhookParams,
-): Promise<any> => {
-  logWebhookSuccess(response, webhookParams)
-  return updateSubmissionsDb(
-    webhookParams.formId,
-    webhookParams.submissionId,
-    getSuccessDbUpdate(response, webhookParams),
-  )
-}
-
-/**
- * Sends webhook POST.
- * Note that the arguments are the same as those in webhookParams
- * for handleWebhookSuccess and handleWebhookFailure, just destructured.
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {Object} webhookParams.submissionWebhookView POST body
- * @param {string} webhookParams.submissionId
- * @param {string} webhookParams.formId
- * @param {string} webhookParams.now Epoch for POST header
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const postWebhook = ({
-  webhookUrl,
-  submissionWebhookView,
-  submissionId,
-  formId,
-  now,
-  signature,
-}: WebhookParams): Promise<AxiosResponse> => {
-  return axios.post(webhookUrl, submissionWebhookView, {
-    headers: {
-      'X-FormSG-Signature': formsgSdk.webhooks.constructHeader({
-        epoch: now,
-        submissionId,
-        formId,
-        signature,
-      }),
-    },
-    maxRedirects: 0,
-  })
-}
-
-/**
- * Logging for webhook success
- * @param {response} response Response object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {Object} webhookParams.submissionWebhookView POST body
- * @param {string} webhookParams.submissionId
- * @param {string} webhookParams.formId
- * @param {string} webhookParams.now Epoch for POST header
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const logWebhookSuccess = (
-  response: AxiosResponse,
-  { webhookUrl, submissionId, formId, now, signature }: WebhookParams,
-): void => {
-  const status = get(response, 'status')
-
-  logger.info({
-    message: 'Webhook POST succeeded',
-    meta: {
-      action: 'logWebhookSuccess',
-      status,
-      submissionId,
-      formId,
-      now,
-      webhookUrl,
-      signature,
-    },
-  })
-}
-
-/**
- * Logging for webhook failure
- * @param {error} error Error object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {Object} webhookParams.submissionWebhookView POST body
- * @param {string} webhookParams.submissionId
- * @param {string} webhookParams.formId
- * @param {string} webhookParams.now Epoch for POST header
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const logWebhookFailure = (
-  error: Error | AxiosError,
-  { webhookUrl, submissionId, formId, now, signature }: Partial<WebhookParams>,
-): void => {
-  const logMeta = {
-    action: 'logWebhookFailure',
-    submissionId,
-    formId,
-    now,
-    webhookUrl,
-    signature,
-  }
-
-  if (error instanceof WebhookValidationError) {
-    logger.error({
-      message: 'Webhook not attempted',
-      meta: logMeta,
-      error,
-    })
-  } else {
-    logger.error({
-      message: 'Webhook POST failed',
-      meta: {
-        ...logMeta,
-        status: get(error, 'response.status'),
-      },
-      error,
-    })
-  }
-}
-
 /**
  * Updates the submission in the database with the webhook response
  * @param {ObjectId} formId Form that submission to update belongs to
@@ -183,111 +37,49 @@ const logWebhookFailure = (
  * @param {string} updateObj.headers stringified headers received from webhook endpoint
  * @param {string} updateObj.data stringified data received from webhook endpoint
  */
-const updateSubmissionsDb = async (
-  formId: IFormSchema['_id'],
+export const saveWebhookRecord = (
   submissionId: ISubmissionSchema['_id'],
-  updateObj: IWebhookResponse,
-): Promise<any> => {
-  try {
-    const { nModified } = await EncryptSubmission.updateOne(
-      { _id: submissionId },
-      { $push: { webhookResponses: updateObj } },
-    )
-    if (nModified !== 1) {
-      // Pass on to catch block
-      throw new Error('Submission not found in database.')
-    }
-  } catch (error) {
-    logger.error({
-      message: 'Database update for webhook status failed',
-      meta: {
-        action: 'updateSubmissionsDb',
-        formId,
-        submissionId,
-        updateObj: stringifySafe(updateObj),
-      },
-      error,
-    })
-  }
-}
-
-/**
- * Formats webhook success info into an object to update Submissions collection
- * @param {response} response Response object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const getSuccessDbUpdate = (
-  response: AxiosResponse,
-  { webhookUrl, signature }: Pick<WebhookParams, 'webhookUrl' | 'signature'>,
-): IWebhookResponse => {
-  return { webhookUrl, signature, ...getFormattedResponse(response) }
-}
-
-/**
- * Formats webhook failure info into an object to update Submissions collection
- * @param {error} error Error object returned by axios
- * @param {Object} webhookParams Parameters which fully specify webhook
- * @param {string} webhookParams.webhookUrl URL to POST to
- * @param {string} webhookParams.signature Signature generated by FormSG SDK
- */
-const getFailureDbUpdate = (
-  error: Error | AxiosError,
-  { webhookUrl, signature }: Pick<WebhookParams, 'webhookUrl' | 'signature'>,
-): IWebhookResponse => {
-  const errorMessage = get(error, 'message')
-  const update: IWebhookResponse = {
-    webhookUrl,
-    signature,
-    errorMessage,
-  }
-  if (!(error instanceof WebhookValidationError)) {
-    const { response } = getFormattedResponse(get(error, 'response'))
-    update.response = response
-  }
-  return update
-}
-
-/**
- * Formats a response object for update in the Submissions collection
- * @param {response} response Response object returned by axios
- */
-const getFormattedResponse = (
-  response: AxiosResponse,
-): Pick<IWebhookResponse, 'response'> => {
-  return {
-    response: {
-      status: get(response, 'status'),
-      statusText: get(response, 'statusText'),
-      headers: stringifySafe(get(response, 'headers')),
-      data: stringifySafe(get(response, 'data')),
+  record: IWebhookResponse,
+): ResultAsync<
+  IEncryptedSubmissionSchema,
+  PossibleDatabaseError | SubmissionNotFoundError
+> => {
+  return ResultAsync.fromPromise(
+    EncryptSubmission.addWebhookResponse(submissionId, record),
+    (error) => {
+      logger.error({
+        message: 'Database update for webhook status failed',
+        meta: {
+          action: 'saveWebhookRecord',
+          submissionId,
+          record,
+        },
+        error,
+      })
+      return transformMongoError(error)
     },
-  }
+  ).andThen((updatedSubmission) => {
+    if (!updatedSubmission)
+      return errAsync(
+        new SubmissionNotFoundError(
+          'Unable to find submission ID to update webhook response',
+        ),
+      )
+    return okAsync(updatedSubmission)
+  })
 }
 
-/**
- * Validates webhook url, posts data to it and updates submission document with response
- * @param {string} webhookUrl Endpoint to push data to
- * @param {Object} submissionWebhookView Metadata containing form information and crucial submission data
- */
-export const pushData = async (
-  webhookUrl: WebhookParams['webhookUrl'],
-  submissionWebhookView: WebhookView | null,
-): Promise<any> => {
+export const sendWebhook = (
+  submission: IEncryptedSubmissionSchema,
+  webhookUrl: string,
+): ResultAsync<
+  IWebhookResponse,
+  | WebhookValidationError
+  | WebhookFailedWithAxiosError
+  | WebhookFailedWithUnknownError
+> => {
   const now = Date.now()
-  // Log and return, this should not happen.
-  if (!submissionWebhookView) {
-    logWebhookFailure(
-      new WebhookValidationError('submissionWebhookView was null'),
-      {
-        webhookUrl,
-        now,
-      },
-    )
-    return
-  }
-
+  const submissionWebhookView = submission.getWebhookView()
   const { submissionId, formId } = submissionWebhookView.data
 
   const signature = formsgSdk.webhooks.generateSignature({
@@ -295,22 +87,98 @@ export const pushData = async (
     submissionId,
     formId,
     epoch: now,
-  }) as string
+  })
 
-  const webhookParams = {
-    webhookUrl,
-    submissionWebhookView,
+  const logMeta = {
+    action: 'sendWebhook',
     submissionId,
     formId,
     now,
+    webhookUrl,
     signature,
   }
 
-  try {
-    await validateWebhookUrl(webhookParams.webhookUrl)
-    const response = await postWebhook(webhookParams)
-    return handleWebhookSuccess(response, webhookParams)
-  } catch (error) {
-    return handleWebhookFailure(error, webhookParams)
-  }
+  return ResultAsync.fromPromise(validateWebhookUrl(webhookUrl), (error) => {
+    logger.error({
+      message: 'Webhook URL failed validation',
+      meta: logMeta,
+      error,
+    })
+    return error instanceof WebhookValidationError
+      ? error
+      : new WebhookValidationError()
+  })
+    .andThen(() =>
+      ResultAsync.fromPromise(
+        axios.post<unknown>(webhookUrl, submissionWebhookView, {
+          headers: {
+            'X-FormSG-Signature': formsgSdk.webhooks.constructHeader({
+              epoch: now,
+              submissionId,
+              formId,
+              signature,
+            }),
+          },
+          maxRedirects: 0,
+        }),
+        (error) => {
+          logger.error({
+            message: 'Webhook POST failed',
+            meta: {
+              ...logMeta,
+              isAxiosError: axios.isAxiosError(error),
+              status: get(error, 'response.status'),
+            },
+            error,
+          })
+          if (axios.isAxiosError(error)) {
+            return new WebhookFailedWithAxiosError(error)
+          }
+          return new WebhookFailedWithUnknownError(error)
+        },
+      ),
+    )
+    .map((response) => {
+      // Capture response for logging purposes
+      logger.info({
+        message: 'Webhook POST succeeded',
+        meta: {
+          ...logMeta,
+          status: get(response, 'status'),
+        },
+      })
+      return {
+        signature,
+        webhookUrl,
+        response: formatWebhookResponse(response),
+      }
+    })
+    .orElse((error) => {
+      // Webhook was not posted
+      if (error instanceof WebhookValidationError) return errAsync(error)
+
+      // Webhook was posted but failed
+      if (error instanceof WebhookFailedWithUnknownError) {
+        const originalError = error.meta.originalError
+        const errorMessage = hasProp(originalError, 'message')
+          ? originalError.message
+          : ''
+        return okAsync({
+          signature,
+          webhookUrl,
+          errorMessage,
+          // Not Axios error so no guarantee of having response.
+          // Hence allow formatting function to return default shape.
+          response: formatWebhookResponse(),
+        })
+      }
+
+      const axiosError = error.meta.originalError
+      return okAsync({
+        signature,
+        webhookUrl,
+        errorMessage: axiosError.message,
+        response: formatWebhookResponse(axiosError.response),
+      })
+    })
 }
diff --git a/src/app/modules/webhook/webhook.types.ts b/src/app/modules/webhook/webhook.types.ts
index 4e3a1bb2c6..0a77e16e4d 100644
--- a/src/app/modules/webhook/webhook.types.ts
+++ b/src/app/modules/webhook/webhook.types.ts
@@ -1,10 +1,9 @@
 import {
-  IEncryptedSubmission,
-  IForm,
+  IEncryptedSubmissionSchema,
+  IFormSchema,
   ISubmissionSchema,
   WebhookView,
 } from '../../../types'
-import { IFormSchema } from '../../../types/form'
 
 export interface WebhookParams {
   webhookUrl: string
@@ -16,6 +15,6 @@ export interface WebhookParams {
 }
 
 export interface WebhookRequestLocals {
-  form: IForm
-  submission: IEncryptedSubmission
+  form: IFormSchema
+  submission: IEncryptedSubmissionSchema
 }
diff --git a/src/app/modules/webhook/webhook.utils.ts b/src/app/modules/webhook/webhook.utils.ts
index 5e355927d6..fef9a3a545 100644
--- a/src/app/modules/webhook/webhook.utils.ts
+++ b/src/app/modules/webhook/webhook.utils.ts
@@ -1,62 +1,17 @@
-import { promises as dns } from 'dns'
-import ip from 'ip'
+import { AxiosResponse } from 'axios'
 
-import config from '../../../config/config'
-import { isValidHttpsUrl } from '../../../shared/util/url-validation'
-
-import { WebhookValidationError } from './webhook.errors'
+import { stringifySafe } from '../../../shared/util/stringify-safe'
+import { IWebhookResponse } from '../../../types'
 
 /**
- * Checks that a URL is valid for use in webhooks.
- * @param webhookUrl Webhook URL
- * @returns Resolves if URL is valid, otherwise rejects.
- * @throws {WebhookValidationError} If URL is invalid so webhook should not be attempted.
+ * Formats a response object for update in the Submissions collection
+ * @param {response} response Response object returned by axios
  */
-export const validateWebhookUrl = (webhookUrl: string): Promise<void> => {
-  return new Promise((resolve, reject) => {
-    if (!isValidHttpsUrl(webhookUrl)) {
-      return reject(
-        new WebhookValidationError(`${webhookUrl} is not a valid HTTPS URL.`),
-      )
-    }
-    const webhookUrlParsed = new URL(webhookUrl)
-    const appUrlParsed = new URL(config.app.appUrl)
-    if (webhookUrlParsed.hostname === appUrlParsed.hostname) {
-      return reject(
-        new WebhookValidationError(
-          `You cannot send responses back to ${config.app.appUrl}.`,
-        ),
-      )
-    }
-    dns
-      .resolve(webhookUrlParsed.hostname)
-      .then((addresses) => {
-        if (!addresses.length) {
-          return reject(
-            new WebhookValidationError(
-              `${webhookUrl} does not resolve to any IP address.`,
-            ),
-          )
-        }
-        const privateIps = addresses.filter((addr) => ip.isPrivate(addr))
-        if (privateIps.length) {
-          return reject(
-            new WebhookValidationError(
-              `${webhookUrl} resolves to the following private IPs: ${privateIps.join(
-                ', ',
-              )}`,
-            ),
-          )
-        }
-        return resolve()
-      })
-      .catch(() => {
-        return reject(
-          new WebhookValidationError(
-            `Error encountered during DNS resolution for ${webhookUrl}.` +
-              ` Check that the URL is correct.`,
-          ),
-        )
-      })
-  })
-}
+export const formatWebhookResponse = (
+  response?: AxiosResponse<unknown>,
+): IWebhookResponse['response'] => ({
+  status: response?.status ?? 0,
+  statusText: response?.statusText ?? '',
+  headers: stringifySafe(response?.headers) ?? '',
+  data: stringifySafe(response?.data) ?? '',
+})
diff --git a/src/app/modules/webhook/webhook.validation.ts b/src/app/modules/webhook/webhook.validation.ts
new file mode 100644
index 0000000000..5e355927d6
--- /dev/null
+++ b/src/app/modules/webhook/webhook.validation.ts
@@ -0,0 +1,62 @@
+import { promises as dns } from 'dns'
+import ip from 'ip'
+
+import config from '../../../config/config'
+import { isValidHttpsUrl } from '../../../shared/util/url-validation'
+
+import { WebhookValidationError } from './webhook.errors'
+
+/**
+ * Checks that a URL is valid for use in webhooks.
+ * @param webhookUrl Webhook URL
+ * @returns Resolves if URL is valid, otherwise rejects.
+ * @throws {WebhookValidationError} If URL is invalid so webhook should not be attempted.
+ */
+export const validateWebhookUrl = (webhookUrl: string): Promise<void> => {
+  return new Promise((resolve, reject) => {
+    if (!isValidHttpsUrl(webhookUrl)) {
+      return reject(
+        new WebhookValidationError(`${webhookUrl} is not a valid HTTPS URL.`),
+      )
+    }
+    const webhookUrlParsed = new URL(webhookUrl)
+    const appUrlParsed = new URL(config.app.appUrl)
+    if (webhookUrlParsed.hostname === appUrlParsed.hostname) {
+      return reject(
+        new WebhookValidationError(
+          `You cannot send responses back to ${config.app.appUrl}.`,
+        ),
+      )
+    }
+    dns
+      .resolve(webhookUrlParsed.hostname)
+      .then((addresses) => {
+        if (!addresses.length) {
+          return reject(
+            new WebhookValidationError(
+              `${webhookUrl} does not resolve to any IP address.`,
+            ),
+          )
+        }
+        const privateIps = addresses.filter((addr) => ip.isPrivate(addr))
+        if (privateIps.length) {
+          return reject(
+            new WebhookValidationError(
+              `${webhookUrl} resolves to the following private IPs: ${privateIps.join(
+                ', ',
+              )}`,
+            ),
+          )
+        }
+        return resolve()
+      })
+      .catch(() => {
+        return reject(
+          new WebhookValidationError(
+            `Error encountered during DNS resolution for ${webhookUrl}.` +
+              ` Check that the URL is correct.`,
+          ),
+        )
+      })
+  })
+}
diff --git a/src/app/utils/has-prop.ts b/src/app/utils/has-prop.ts
new file mode 100644
index 0000000000..afddfda0f6
--- /dev/null
+++ b/src/app/utils/has-prop.ts
@@ -0,0 +1,13 @@
+/**
+ * Utility to narrow type of an object by determining whether
+ * it contains the given property.
+ * @param obj Object
+ * @param prop Property to check
+ */
+
+export const hasProp = <K extends string>(
+  obj: unknown,
+  prop: K,
+): obj is Record<K, unknown> => {
+  return typeof obj === 'object' && obj !== null && prop in obj
+}
diff --git a/src/shared/util/stringify-safe.ts b/src/shared/util/stringify-safe.ts
index 131c7a1163..c343ab04f7 100644
--- a/src/shared/util/stringify-safe.ts
+++ b/src/shared/util/stringify-safe.ts
@@ -17,7 +17,7 @@ import stringify from 'json-stringify-safe'
  * JSON.stringify.
  * @param obj the object to be stringified
  */
-export const stringifySafe = (obj: any): string => {
+export const stringifySafe = (obj: any): string | undefined => {
   const bigIntReplacer = (_key: any, value: any): any => {
     // eslint-disable-next-line valid-typeof
     return typeof value === 'bigint' ? Number(value) : value
diff --git a/src/types/submission.ts b/src/types/submission.ts
index 306577bf53..0edf9d46d0 100644
--- a/src/types/submission.ts
+++ b/src/types/submission.ts
@@ -58,9 +58,7 @@ export interface WebhookView {
   data: WebhookData
 }
 
-export interface ISubmissionSchema extends ISubmission, Document {
-  getWebhookView(): WebhookView | null
-}
+export interface ISubmissionSchema extends ISubmission, Document {}
 
 export type FindFormsWithSubsAboveResult = {
   _id: IFormSchema['_id']
@@ -83,7 +81,7 @@ export interface IEmailSubmission extends ISubmission {
   version: never
   attachmentMetadata: never
   webhookResponses: never
-  getWebhookView(): WebhookView | null
+  getWebhookView(): null
 }
 
 export type IEmailSubmissionSchema = IEmailSubmission & ISubmissionSchema
@@ -98,7 +96,7 @@ export interface IEncryptedSubmission extends ISubmission {
   version: number
   attachmentMetadata?: Map<string, string>
   webhookResponses?: IWebhookResponse[]
-  getWebhookView(): WebhookView | null
+  getWebhookView(): WebhookView
 }
 
 export type IEncryptedSubmissionSchema = IEncryptedSubmission &
@@ -179,6 +177,16 @@ export type IEncryptSubmissionModel = Model<IEncryptedSubmissionSchema> &
       formId: string,
       submissionId: string,
     ): Promise<SubmissionData | null>
+
+    /**
+     * Adds a record of a webhook response to a submission
+     * @param submissionId ID of submission to update
+     * @param webhookResponse Response data to push
+     */
+    addWebhookResponse(
+      submissionId: string,
+      webhookResponse: IWebhookResponse,
+    ): Promise<IEncryptedSubmissionSchema | null>
   }
 
 export interface IWebhookResponseSchema extends IWebhookResponse, Document {}
diff --git a/tests/unit/backend/models/submission.server.model.spec.ts b/tests/unit/backend/models/submission.server.model.spec.ts
index 0de2776b9a..666fa26042 100644
--- a/tests/unit/backend/models/submission.server.model.spec.ts
+++ b/tests/unit/backend/models/submission.server.model.spec.ts
@@ -2,16 +2,20 @@ import { ObjectID } from 'bson'
 import { times } from 'lodash'
 import mongoose from 'mongoose'
 
-import getSubmissionModel from 'src/app/models/submission.server.model'
+import getSubmissionModel, {
+  getEncryptSubmissionModel,
+} from 'src/app/models/submission.server.model'
 
 import {
   AuthType,
   ISubmissionSchema,
+  IWebhookResponse,
   SubmissionType,
 } from '../../../../src/types'
 import dbHandler from '../helpers/jest-db'
 
 const Submission = getSubmissionModel(mongoose)
+const EncryptedSubmission = getEncryptSubmissionModel(mongoose)
 
 // TODO: Add more tests for the rest of the submission schema.
 describe('Submission Model', () => {
@@ -151,5 +155,86 @@ describe('Submission Model', () => {
         expect(actualWebhookView).toBeNull()
       })
     })
+
+    describe('addWebhookResponse', () => {
+      it('should return updated submission with webhook response when submission ID is valid', async () => {
+        // Arrange
+        const formId = new ObjectID()
+        const submission = await EncryptedSubmission.create({
+          submissionType: SubmissionType.Encrypt,
+          form: formId,
+          encryptedContent: MOCK_ENCRYPTED_CONTENT,
+          version: 1,
+          authType: AuthType.NIL,
+          myInfoFields: [],
+          recipientEmails: [],
+          responseHash: 'hash',
+          responseSalt: 'salt',
+          hasBounced: false,
+        })
+
+        const webhookResponse = new Object({
+          _id: submission._id,
+          created: submission.created,
+          signature: 'some signature',
+          webhookUrl: 'https://form.gov.sg/endpoint',
+          response: {
+            data: '{"result":"test-result"}',
+            status: 200,
+            statusText: 'success',
+            headers: '{}',
+          },
+        }) as IWebhookResponse
+
+        // Act
+        const actualSubmission = await EncryptedSubmission.addWebhookResponse(
+          submission._id,
+          webhookResponse,
+        )
+        const webhookResponses = actualSubmission!.toObject().webhookResponses!
+
+        // Assert
+        expect(webhookResponses[0].signature).toEqual(webhookResponse.signature)
+        expect(webhookResponses[0].webhookUrl).toEqual(
+          webhookResponse.webhookUrl,
+        )
+        expect(webhookResponses[0].response).toEqual(webhookResponse.response)
+      })
+
+      it('should return null when submission id is invalid', async () => {
+        // Arrange
+        const formId = new ObjectID()
+        const submission = await EncryptedSubmission.create({
+          submissionType: SubmissionType.Encrypt,
+          form: formId,
+          encryptedContent: MOCK_ENCRYPTED_CONTENT,
+          version: 1,
+          authType: AuthType.NIL,
+          myInfoFields: [],
+          recipientEmails: [],
+          responseHash: 'hash',
+          responseSalt: 'salt',
+          hasBounced: false,
+        })
+
+        const webhookResponse = {
+          _id: submission._id,
+          created: submission.created,
+          signature: 'some signature',
+          webhookUrl: 'https://form.gov.sg/endpoint',
+        } as IWebhookResponse
+
+        const invalidSubmissionId = new ObjectID().toHexString()
+
+        // Act
+        const actualSubmission = await EncryptedSubmission.addWebhookResponse(
+          invalidSubmissionId,
+          webhookResponse,
+        )
+
+        // Assert
+        expect(actualSubmission).toBeNull()
+      })
+    })
   })
 })
diff --git a/tests/unit/backend/modules/webhook/webhook.service.spec.ts b/tests/unit/backend/modules/webhook/webhook.service.spec.ts
deleted file mode 100644
index d5d7486784..0000000000
--- a/tests/unit/backend/modules/webhook/webhook.service.spec.ts
+++ /dev/null
@@ -1,236 +0,0 @@
-import axios, { AxiosError, AxiosRequestConfig, AxiosResponse } from 'axios'
-import { ObjectID } from 'bson'
-import mongoose from 'mongoose'
-import { mocked } from 'ts-jest/utils'
-
-import getFormModel from 'src/app/models/form.server.model'
-import { getEncryptSubmissionModel } from 'src/app/models/submission.server.model'
-import { WebhookValidationError } from 'src/app/modules/webhook/webhook.errors'
-import { pushData } from 'src/app/modules/webhook/webhook.service'
-import { validateWebhookUrl } from 'src/app/modules/webhook/webhook.utils'
-import formsgSdk from 'src/config/formsg-sdk'
-import {
-  IEncryptedSubmissionSchema,
-  IWebhookResponse,
-  ResponseMode,
-  WebhookView,
-} from 'src/types'
-
-import dbHandler from 'tests/unit/backend/helpers/jest-db'
-
-const Form = getFormModel(mongoose)
-const EncryptSubmission = getEncryptSubmissionModel(mongoose)
-
-// Define constants
-const MOCK_ADMIN_OBJ_ID = new ObjectID()
-const MOCK_WEBHOOK_URL = 'https://form.gov.sg/endpoint'
-const ERROR_MSG = 'test-message'
-const MOCK_SUCCESS_RESPONSE: AxiosResponse = {
-  data: {
-    result: 'test-result',
-  },
-  status: 200,
-  statusText: 'success',
-  headers: {},
-  config: {},
-}
-const MOCK_FAILURE_RESPONSE: AxiosResponse = {
-  data: {
-    result: 'test-result',
-  },
-  status: 400,
-  statusText: 'failed',
-  headers: {},
-  config: {},
-}
-const MOCK_STRINGIFIED_SUCCESS_RESPONSE: Pick<IWebhookResponse, 'response'> = {
-  response: {
-    data: '{"result":"test-result"}',
-    status: 200,
-    statusText: 'success',
-    headers: '{}',
-  },
-}
-const MOCK_STRINGIFIED_FAILURE_RESPONSE: Pick<IWebhookResponse, 'response'> = {
-  response: {
-    data: `{"result":"test-result"}`,
-    status: 400,
-    statusText: 'failed',
-    headers: '{}',
-  },
-}
-const MOCK_EPOCH = 1487076708000
-
-// Set up mocks
-jest.mock('axios')
-const mockAxios = mocked(axios, true)
-jest.mock('src/app/modules/webhook/webhook.utils')
-const mockValidateWebhookUrl = mocked(validateWebhookUrl, true)
-jest.spyOn(Date, 'now').mockImplementation(() => MOCK_EPOCH)
-
-describe('WebhooksService', () => {
-  beforeAll(async () => await dbHandler.connect())
-  afterEach(async () => {
-    await dbHandler.clearDatabase()
-  })
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  let testEncryptSubmission: IEncryptedSubmissionSchema
-  let testConfig: AxiosRequestConfig
-  let testSubmissionWebhookView: WebhookView | null
-  let testSignature: string
-
-  beforeEach(async () => {
-    const preloaded = await dbHandler.insertFormCollectionReqs({
-      userId: MOCK_ADMIN_OBJ_ID,
-    })
-    const testEncryptForm = new Form({
-      title: 'Test Form',
-      admin: preloaded.user._id,
-      responseMode: ResponseMode.Encrypt,
-      publicKey: 'fake-public-key',
-    })
-    await testEncryptForm.save()
-
-    testEncryptSubmission = new EncryptSubmission({
-      form: testEncryptForm._id,
-      authType: testEncryptForm.authType,
-      myInfoFields: [],
-      encryptedContent: 'encrypted-content',
-      verifiedContent: 'verified-content',
-      version: 1,
-    })
-    await testEncryptSubmission.save()
-
-    testSubmissionWebhookView = testEncryptSubmission.getWebhookView()
-
-    testSignature = formsgSdk.webhooks.generateSignature({
-      uri: MOCK_WEBHOOK_URL,
-      submissionId: testEncryptSubmission._id,
-      formId: testEncryptForm._id,
-      epoch: MOCK_EPOCH,
-    }) as string
-
-    testConfig = {
-      headers: {
-        'X-FormSG-Signature': `t=${MOCK_EPOCH},s=${testEncryptSubmission._id},f=${testEncryptForm._id},v1=${testSignature}`,
-      },
-      maxRedirects: 0,
-    }
-  })
-
-  describe('postWebhook', () => {
-    it('should not make post request if submissionWebhookView is null', async () => {
-      // Act
-      await pushData(MOCK_WEBHOOK_URL, null)
-
-      // Assert
-      expect(mockAxios.post).toHaveBeenCalledTimes(0)
-    })
-
-    it('should update submission document with successful webhook response if post succeeds', async () => {
-      // Arrange
-      mockAxios.post.mockImplementationOnce((url, data, config) => {
-        expect(url).toEqual(MOCK_WEBHOOK_URL)
-        expect(data).toEqual(testSubmissionWebhookView)
-        expect(config).toEqual(testConfig)
-        return Promise.resolve(MOCK_SUCCESS_RESPONSE)
-      })
-      mockValidateWebhookUrl.mockImplementationOnce((url) => {
-        expect(url).toEqual(MOCK_WEBHOOK_URL)
-        return Promise.resolve()
-      })
-
-      // Act
-      await pushData(MOCK_WEBHOOK_URL, testSubmissionWebhookView)
-
-      // Assert
-      const submission = await EncryptSubmission.findById(
-        testEncryptSubmission._id,
-      )
-      expect(submission?.webhookResponses![0]).toEqual(
-        expect.objectContaining({
-          webhookUrl: MOCK_WEBHOOK_URL,
-          signature: testSignature,
-          response: expect.objectContaining(
-            MOCK_STRINGIFIED_SUCCESS_RESPONSE.response,
-          ),
-        }),
-      )
-    })
-
-    it('should update submission document with failed webhook response if validation fails', async () => {
-      // Arrange
-      mockValidateWebhookUrl.mockImplementationOnce((url) => {
-        expect(url).toEqual(MOCK_WEBHOOK_URL)
-        return Promise.reject(new WebhookValidationError(ERROR_MSG))
-      })
-
-      // Act
-      await pushData(MOCK_WEBHOOK_URL, testSubmissionWebhookView)
-
-      // Assert
-      const submission = await EncryptSubmission.findById(
-        testEncryptSubmission._id,
-      )
-      expect(submission?.webhookResponses![0]).toEqual(
-        expect.objectContaining({
-          webhookUrl: MOCK_WEBHOOK_URL,
-          signature: testSignature,
-          errorMessage: ERROR_MSG,
-        }),
-      )
-    })
-
-    it('should update submission document with failed webhook response if post fails', async () => {
-      // Arrange
-      class MockAxiosError extends Error {
-        isAxiosError: boolean
-        toJSON: () => {}
-        config: Record<string, unknown>
-        response: AxiosResponse
-        constructor(msg: string, response: AxiosResponse) {
-          super(msg)
-          this.isAxiosError = false
-          this.response = response
-          this.toJSON = () => {
-            return {}
-          }
-          this.config = {}
-        }
-      }
-      const mockAxiosError: AxiosError = new MockAxiosError(
-        ERROR_MSG,
-        MOCK_FAILURE_RESPONSE,
-      )
-      mockAxios.post.mockImplementationOnce((url, data, config) => {
-        expect(url).toEqual(MOCK_WEBHOOK_URL)
-        expect(data).toEqual(testSubmissionWebhookView)
-        expect(config).toEqual(testConfig)
-        return Promise.reject(mockAxiosError)
-      })
-      mockValidateWebhookUrl.mockImplementationOnce((url) => {
-        expect(url).toEqual(MOCK_WEBHOOK_URL)
-        return Promise.resolve()
-      })
-
-      // Act
-      await pushData(MOCK_WEBHOOK_URL, testSubmissionWebhookView)
-
-      // Assert
-      const submission = await EncryptSubmission.findById(
-        testEncryptSubmission._id,
-      )
-      expect(submission?.webhookResponses![0]).toEqual(
-        expect.objectContaining({
-          webhookUrl: MOCK_WEBHOOK_URL,
-          signature: testSignature,
-          errorMessage: ERROR_MSG,
-          response: expect.objectContaining(
-            MOCK_STRINGIFIED_FAILURE_RESPONSE.response,
-          ),
-        }),
-      )
-    })
-  })
-})

From afcabbbb245681c0c63445c3f20bb934f1874fc2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 6 Apr 2021 17:29:07 +0000
Subject: [PATCH 12/75] chore(deps-dev): bump concurrently from 6.0.0 to 6.0.1
 (#1568)

Bumps [concurrently](https://github.com/kimmobrunfeldt/concurrently) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/kimmobrunfeldt/concurrently/releases)
- [Commits](https://github.com/kimmobrunfeldt/concurrently/compare/v6.0.0...v6.0.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 30 +++++++++++++++---------------
 package.json      |  2 +-
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 63dd73cd2a..e922b24064 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8140,9 +8140,9 @@
       }
     },
     "concurrently": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-6.0.0.tgz",
-      "integrity": "sha512-Ik9Igqnef2ONLjN2o/OVx1Ow5tymVvvEwQeYCQdD/oV+CN9oWhxLk7ibcBdOtv0UzBqHCEKRwbKceYoTK8t3fQ==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-6.0.1.tgz",
+      "integrity": "sha512-YCF/Wf31a910hXu7eGN9/SyHKD/usw3Shw4IPYuqIsxxC39v92engYlIlOs/zXnBJtX/6aVuhgzfhZeGJkhU4w==",
       "dev": true,
       "requires": {
         "chalk": "^4.1.0",
@@ -8231,9 +8231,9 @@
           "dev": true
         },
         "string-width": {
-          "version": "4.2.0",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.0.tgz",
-          "integrity": "sha512-zUz5JD+tgqtuDjMhwIg5uFVV3dtqZ9yQJlZVfq4I01/K5Paj5UHj7VyrQOJvzawSVlKpObApbfD0Ed6yJc+1eg==",
+          "version": "4.2.2",
+          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
+          "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
           "dev": true,
           "requires": {
             "emoji-regex": "^8.0.0",
@@ -8271,9 +8271,9 @@
           }
         },
         "y18n": {
-          "version": "5.0.5",
-          "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.5.tgz",
-          "integrity": "sha512-hsRUr4FFrvhhRH12wOdfs38Gy7k2FFzB9qgN9v3aLykRq0dRcdcpz5C9FxdS2NuhOrI/628b/KSTJ3rwHysYSg==",
+          "version": "5.0.6",
+          "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.6.tgz",
+          "integrity": "sha512-PlVX4Y0lDTN6E2V4ES2tEdyvXkeKzxa8c/vo0pxPr/TqbztddTP0yn7zZylIyiAuxerqj0Q5GhpJ1YJCP8LaZQ==",
           "dev": true
         },
         "yargs": {
@@ -8292,9 +8292,9 @@
           }
         },
         "yargs-parser": {
-          "version": "20.2.5",
-          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.5.tgz",
-          "integrity": "sha512-jYRGS3zWy20NtDtK2kBgo/TlAoy5YUuhD9/LZ7z7W4j1Fdw2cqD0xEEclf8fxc8xjD6X5Qr+qQQwCEsP8iRiYg==",
+          "version": "20.2.7",
+          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.7.tgz",
+          "integrity": "sha512-FiNkvbeHzB/syOjIUxFDCnhSfzAL8R5vs40MgLFBorXACCOAEaWu0gRZl14vG8MR9AOJIZbmkjhusqBYZ3HTHw==",
           "dev": true
         }
       }
@@ -20590,9 +20590,9 @@
       }
     },
     "rxjs": {
-      "version": "6.6.3",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.3.tgz",
-      "integrity": "sha512-trsQc+xYYXZ3urjOiJOuCOa5N3jAZ3eiSpQB5hIT8zGlL2QfnHLJ2r7GMkBGuIausdJN1OneaI6gQlsqNHHmZQ==",
+      "version": "6.6.7",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
+      "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
       "dev": true,
       "requires": {
         "tslib": "^1.9.0"
diff --git a/package.json b/package.json
index 29ecad5b0d..d2652615c1 100644
--- a/package.json
+++ b/package.json
@@ -197,7 +197,7 @@
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",
     "babel-loader": "^8.2.2",
-    "concurrently": "^6.0.0",
+    "concurrently": "^6.0.1",
     "copy-webpack-plugin": "^6.0.2",
     "core-js": "^3.9.1",
     "coveralls": "^3.1.0",

From 02d283ee96c0e91bdb5acc210d83d31b52c973e5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 6 Apr 2021 17:34:38 +0000
Subject: [PATCH 13/75] fix(deps): bump libphonenumber-js from 1.9.14 to 1.9.16
 (#1569)

Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.9.14 to 1.9.16.
- [Release notes](https://gitlab.com/catamphetamine/libphonenumber-js/tags)
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.9.14...v1.9.16)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e922b24064..e9560313be 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15775,9 +15775,9 @@
       }
     },
     "libphonenumber-js": {
-      "version": "1.9.14",
-      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.9.14.tgz",
-      "integrity": "sha512-lQEHej1NQwKwmn89ixSfvj+m7Gm6AsafuxU1BMsS22VUizQPnamVslA2d5wsHHaaXOExAvlcYjUF1C7ieTzoCg=="
+      "version": "1.9.16",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.9.16.tgz",
+      "integrity": "sha512-PaHT7nTtnejZ0HHekAaA0olv6BUTKZGtKM4SCQS0yE3XjFuVo/tjePMHUAr32FKwIZfyPky1ExMUuaiBAUmV6w=="
     },
     "lie": {
       "version": "3.3.0",
diff --git a/package.json b/package.json
index d2652615c1..7fa48285d1 100644
--- a/package.json
+++ b/package.json
@@ -121,7 +121,7 @@
     "json-stringify-safe": "^5.0.1",
     "jszip": "^3.6.0",
     "jwt-decode": "^3.1.2",
-    "libphonenumber-js": "^1.9.14",
+    "libphonenumber-js": "^1.9.16",
     "lodash": "^4.17.21",
     "moment-timezone": "0.5.33",
     "mongodb-uri": "^0.9.7",

From 4b6600b3a56c0b14be8b0db02ac51cf8c5e489b8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 6 Apr 2021 17:46:54 +0000
Subject: [PATCH 14/75] fix(deps): bump aws-sdk from 2.879.0 to 2.880.0 (#1570)

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.879.0 to 2.880.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.879.0...v2.880.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e9560313be..48c76ee8a2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6246,9 +6246,9 @@
       "integrity": "sha512-24q5Rh3bno7ldoyCq99d6hpnLI+PAMocdeVaaGt/5BTQMprvDwQToHfNnruqN11odCHZZIQbRBw+nZo1lTCH9g=="
     },
     "aws-sdk": {
-      "version": "2.879.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.879.0.tgz",
-      "integrity": "sha512-HRfjGwST1U9AvCJFAyqpAJwbjFR4LqUyEUk77qdJpdYHL9pGPHdnEfGRkBkPn36xcC7Em6gVvFveVoEihbQUyQ==",
+      "version": "2.880.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.880.0.tgz",
+      "integrity": "sha512-/dBk3ejw22ED2edzGfmJB83KXDA4wLIw5Hb+2YMhly+gOWecvevy0tML2+YN/cmxyTy+wT0E0sM7fm1v7kmHtw==",
       "requires": {
         "buffer": "4.9.2",
         "events": "1.1.1",
diff --git a/package.json b/package.json
index 7fa48285d1..626ef3574c 100644
--- a/package.json
+++ b/package.json
@@ -84,7 +84,7 @@
     "angular-ui-bootstrap": "~2.5.6",
     "angular-ui-router": "~1.0.29",
     "aws-info": "^1.2.0",
-    "aws-sdk": "^2.879.0",
+    "aws-sdk": "^2.880.0",
     "axios": "^0.21.1",
     "bcrypt": "^5.0.1",
     "bluebird": "^3.5.2",

From 67eb96b6448cdb7455ee69014d1a2c869324f3d7 Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Wed, 7 Apr 2021 11:02:05 +0800
Subject: [PATCH 15/75] refactor(user-api): duplicate user endpoints to new
 /api/v3 router (#1553)

* refactor(user-api): duplicate user endpoints to new /api/v3 router

- duplicate user endpoint functionality and update endpoints
- duplicated integration tests for new endpoint
- update v3 router to use new endpoints
- update frontend api calls to use new endpoints

* fix(auth-client-service): add missing /

* fix(v3-routes): fix import order
---
 src/app/modules/user/user.controller.ts       |   4 +-
 .../api/v3/user/__tests__/user.routes.spec.ts | 539 ++++++++++++++++++
 src/app/routes/api/v3/user/index.ts           |   1 +
 src/app/routes/api/v3/user/user.routes.ts     |  67 +++
 src/app/routes/api/v3/v3.routes.ts            |   2 +
 ...-contact-number-modal.client.controller.js |   4 +-
 .../users/services/auth.client.service.js     |   2 +-
 7 files changed, 614 insertions(+), 5 deletions(-)
 create mode 100644 src/app/routes/api/v3/user/__tests__/user.routes.spec.ts
 create mode 100644 src/app/routes/api/v3/user/index.ts
 create mode 100644 src/app/routes/api/v3/user/user.routes.ts

diff --git a/src/app/modules/user/user.controller.ts b/src/app/modules/user/user.controller.ts
index ca1e7120b9..2e32d23057 100644
--- a/src/app/modules/user/user.controller.ts
+++ b/src/app/modules/user/user.controller.ts
@@ -20,7 +20,7 @@ const logger = createLoggerWithLabel(module)
 
 /**
  * Generates an OTP and sends the OTP to the given contact in request body.
- * @route POST /contact/sendotp
+ * @route POST /contact/otp/generate
  * @returns 200 if OTP was successfully sent
  * @returns 401 if user id does not match current session user or if user is not currently logged in
  * @returns 422 on OTP creation or SMS send failure
@@ -95,7 +95,7 @@ export const handleContactSendOtp: RequestHandler<
 /**
  * Verifies given OTP with the hashed OTP data, and updates the user's contact
  * number if the hash matches.
- * @route POST /contact/verifyotp
+ * @route POST /contact/otp/verify
  * @returns 200 when user contact update success
  * @returns 401 if user id does not match current session user or if user is not currently logged in
  * @returns 422 when OTP is invalid
diff --git a/src/app/routes/api/v3/user/__tests__/user.routes.spec.ts b/src/app/routes/api/v3/user/__tests__/user.routes.spec.ts
new file mode 100644
index 0000000000..3cd8bcec6d
--- /dev/null
+++ b/src/app/routes/api/v3/user/__tests__/user.routes.spec.ts
@@ -0,0 +1,539 @@
+import { ObjectId } from 'bson-ext'
+import { pick } from 'lodash'
+import mongoose from 'mongoose'
+import { errAsync, okAsync } from 'neverthrow'
+import supertest, { Session } from 'supertest-session'
+
+import getUserModel from 'src/app/models/user.server.model'
+import { SmsSendError } from 'src/app/services/sms/sms.errors'
+import * as SmsService from 'src/app/services/sms/sms.service'
+import * as OtpUtils from 'src/app/utils/otp'
+import { IAgencySchema, IUserSchema } from 'src/types'
+
+import { createAuthedSession } from 'tests/integration/helpers/express-auth'
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
+import { DatabaseError } from '../../../../../modules/core/core.errors'
+import * as UserService from '../../../../../modules/user/user.service'
+import UserRouter from '../user.routes'
+
+const UserModel = getUserModel(mongoose)
+
+const app = setupApp('/user', UserRouter, {
+  setupWithAuth: true,
+})
+
+describe('user.routes', () => {
+  const VALID_DOMAIN = 'example.com'
+  const VALID_MAILNAME = 'test'
+  const VALID_EMAIL = `${VALID_MAILNAME}@${VALID_DOMAIN}`
+  const USER_ID = new ObjectId()
+  // Obtained from Twilio's
+  // https://www.twilio.com/blog/2018/04/twilio-test-credentials-magic-numbers.html
+  const VALID_CONTACT = '+15005550006'
+
+  let request: Session
+  let defaultAgency: IAgencySchema
+  let defaultUser: IUserSchema
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+    const { user, agency } = await dbHandler.insertFormCollectionReqs({
+      mailDomain: VALID_DOMAIN,
+      mailName: VALID_MAILNAME,
+      userId: USER_ID,
+    })
+    defaultUser = user
+    defaultAgency = agency
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('GET /user', () => {
+    it('should return 200 with current logged in user if session user is valid', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.get('/user')
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Response should contain user object.
+      expect(response.body).toEqual(
+        expect.objectContaining({
+          ...JSON.parse(JSON.stringify(defaultUser.toObject())),
+          // Should be object since agency key should be populated.
+          agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+        }),
+      )
+    })
+
+    it('should return 401 if user id does not exist in session', async () => {
+      // Act
+      const response = await request.get('/user')
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({
+        message: 'User is unauthorized.',
+      })
+    })
+
+    it('should return 500 when retrieving user returns a database error', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(VALID_EMAIL, request)
+
+      const mockErrorString = 'Database goes boom'
+      // Mock database error from service call.
+      const retrieveUserSpy = jest
+        .spyOn(UserService, 'getPopulatedUserById')
+        .mockReturnValueOnce(errAsync(new DatabaseError(mockErrorString)))
+
+      // Act
+      const response = await session.get('/user')
+
+      // Assert
+      expect(retrieveUserSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({ message: mockErrorString })
+    })
+  })
+
+  describe('POST /user/contact/otp/generate', () => {
+    it('should return 200 when otp is sent successfully', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      const sendSmsOtpSpy = jest
+        .spyOn(SmsService, 'sendAdminContactOtp')
+        .mockReturnValueOnce(okAsync(true))
+
+      // Act
+      const response = await session.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(sendSmsOtpSpy).toHaveBeenCalled()
+      expect(response.status).toEqual(200)
+      expect(response.text).toEqual('OK')
+    })
+
+    it('should return 400 when body.contact is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/user/contact/otp/generate').send({
+        userId: defaultUser.email,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'contact' } }),
+      )
+    })
+
+    it('should return 400 when body.userId is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'userId' } }),
+      )
+    })
+
+    it('should return 401 when body.userId does not match current session userId', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      const invalidUserId = new ObjectId()
+
+      // Act
+      const response = await session.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: invalidUserId,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual('User is unauthorized.')
+    })
+
+    it('should return 401 when user is not currently logged in', async () => {
+      // Act
+      // POSTing without first logging in.
+      const response = await request.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual('User is unauthorized.')
+    })
+
+    it('should return 422 when userId cannot be found in the database', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await session.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual('User not found')
+    })
+
+    it('should return 422 when OTP fails to be sent', async () => {
+      // Arrange
+      const mockErrorString = 'mock sms send error! oh no'
+      const session = await createAuthedSession(defaultUser.email, request)
+      const sendSmsOtpSpy = jest
+        .spyOn(SmsService, 'sendAdminContactOtp')
+        .mockReturnValueOnce(errAsync(new SmsSendError(mockErrorString)))
+
+      // Act
+      const response = await session.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(sendSmsOtpSpy).toHaveBeenCalled()
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual(mockErrorString)
+    })
+
+    it('should return 500 when creating an OTP returns a database error', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      const mockErrorString = 'Big database oof'
+      const createOtpSpy = jest
+        .spyOn(UserService, 'createContactOtp')
+        .mockReturnValueOnce(errAsync(new DatabaseError(mockErrorString)))
+
+      // Act
+      const response = await session.post('/user/contact/otp/generate').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(createOtpSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual(mockErrorString)
+    })
+  })
+
+  describe('POST /user/contact/otp/verify', () => {
+    const MOCK_VALID_OTP = '123456'
+
+    beforeEach(async () => {
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValue(MOCK_VALID_OTP)
+    })
+
+    it('should return 200 with updated user when verification is successful', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      // Default user should not have any contact number yet.
+      expect(defaultUser.contact).not.toBeDefined()
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: MOCK_VALID_OTP,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Body should be an user object.
+      expect(response.body).toEqual({
+        ...JSON.parse(JSON.stringify(defaultUser.toObject())),
+        agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+        // This time with the new contact number.
+        contact: VALID_CONTACT,
+        // Dynamic date strings to be returned.
+        updatedAt: expect.any(String),
+        lastAccessed: expect.any(String),
+      })
+    })
+
+    it('should return 400 when body.contact is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/user/contact/otp/verify').send({
+        userId: defaultUser.email,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'contact' } }),
+      )
+    })
+
+    it('should return 400 when body.userId is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'userId' } }),
+      )
+    })
+
+    it('should return 400 when body.otp is not provided as a param', async () => {
+      // Act
+      const response = await request.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'otp' } }),
+      )
+    })
+
+    it('should return 401 when body.userId does not match current session userId', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      const invalidUserId = new ObjectId()
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: MOCK_VALID_OTP,
+        userId: invalidUserId,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual('User is unauthorized.')
+    })
+
+    it('should return 401 when user is not currently logged in', async () => {
+      // Act
+      // POSTing without first logging in.
+      const response = await request.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: MOCK_VALID_OTP,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual('User is unauthorized.')
+    })
+
+    it('should return 401 when hashes does not exist for current contact', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: MOCK_VALID_OTP,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual(
+        'OTP has expired. Please request for a new OTP.',
+      )
+    })
+
+    it('should return 401 when given otp does not match hashed otp', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        otp: '999999',
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual('OTP is invalid. Please try again.')
+    })
+
+    it('should return 401 when given contact does not match hashed contact', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      const invalidContact = '999'
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: invalidContact,
+        otp: MOCK_VALID_OTP,
+        userId: defaultUser._id,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual(
+        'Contact number given does not match the number the OTP is sent to. Please try again with the correct contact number.',
+      )
+    })
+
+    it('should return 401 when otp has been attempted too many times', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      const invalidOtp = '999999'
+
+      // Act
+      // Attempt invalid OTP for MAX_OTP_ATTEMPTS.
+      const verifyPromises = []
+      for (let i = 0; i < UserService.MAX_OTP_ATTEMPTS; i++) {
+        verifyPromises.push(
+          session.post('/user/contact/otp/verify').send({
+            contact: VALID_CONTACT,
+            otp: invalidOtp,
+            userId: defaultUser._id,
+          }),
+        )
+      }
+      const results = (await Promise.all(verifyPromises)).map((resolve) =>
+        pick(resolve, ['status', 'body']),
+      )
+      // Should be all invalid OTP responses.
+      expect(results).toEqual(
+        Array(UserService.MAX_OTP_ATTEMPTS).fill({
+          status: 401,
+          body: 'OTP is invalid. Please try again.',
+        }),
+      )
+
+      // Act again, this time with a valid OTP.
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      // Should still reject with max OTP attempts error.
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual(
+        'You have hit the max number of attempts. Please request for a new OTP.',
+      )
+    })
+
+    it('should return 422 when user cannot be found in the database', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual('User not found')
+    })
+
+    it('should return 500 when database errors occurs whilst verifying otp', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      const mockErrorString = 'Database pewpew'
+
+      const incrementSpy = jest
+        .spyOn(UserService, 'verifyContactOtp')
+        .mockReturnValueOnce(errAsync(new DatabaseError(mockErrorString)))
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(incrementSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual(mockErrorString)
+    })
+
+    it('should return 500 when database errors occurs whilst updating contact', async () => {
+      // Arrange
+      const session = await createAuthedSession(defaultUser.email, request)
+      await requestForContactOtp(defaultUser, VALID_CONTACT, session)
+      const mockErrorString = 'Database pewpew'
+
+      const uodateSpy = jest
+        .spyOn(UserService, 'updateUserContact')
+        .mockReturnValueOnce(errAsync(new DatabaseError(mockErrorString)))
+
+      // Act
+      const response = await session.post('/user/contact/otp/verify').send({
+        contact: VALID_CONTACT,
+        userId: defaultUser._id,
+        otp: MOCK_VALID_OTP,
+      })
+
+      // Assert
+      expect(uodateSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual(mockErrorString)
+    })
+  })
+})
+
+// Helper methods
+const requestForContactOtp = async (
+  user: IUserSchema,
+  contact: string,
+  authedSession: Session,
+) => {
+  // Set that so no real mail is sent.
+  const sendSmsOtpSpy = jest
+    .spyOn(SmsService, 'sendAdminContactOtp')
+    .mockReturnValueOnce(okAsync(true))
+
+  // Act
+  const response = await authedSession.post('/user/contact/otp/generate').send({
+    userId: user._id,
+    contact,
+  })
+
+  // Assert
+  expect(sendSmsOtpSpy).toHaveBeenCalled()
+  expect(response.status).toEqual(200)
+  expect(response.text).toEqual('OK')
+}
diff --git a/src/app/routes/api/v3/user/index.ts b/src/app/routes/api/v3/user/index.ts
new file mode 100644
index 0000000000..7d436ca496
--- /dev/null
+++ b/src/app/routes/api/v3/user/index.ts
@@ -0,0 +1 @@
+export { UserRouter } from './user.routes'
diff --git a/src/app/routes/api/v3/user/user.routes.ts b/src/app/routes/api/v3/user/user.routes.ts
new file mode 100644
index 0000000000..d08165f93c
--- /dev/null
+++ b/src/app/routes/api/v3/user/user.routes.ts
@@ -0,0 +1,67 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import * as UserController from '../../../../modules/user/user.controller'
+
+export const UserRouter = Router()
+
+// * / main route
+
+/**
+ * Retrieves and returns the session user from the database.
+ * @route GET /
+ * @returns 200 with the retrieved user if session user is valid
+ * @returns 401 if user id does not exist in session
+ * @returns 500 when user cannot be found or database errors occurs
+ */
+UserRouter.get('/', UserController.handleFetchUser)
+
+// * /contact subroute
+
+/**
+ * Send a contact verification one-time password (OTP) to the specified contact
+ * number as part of the contact verification process
+ * @route POST /user/contact/otp/generate
+ * @param body.contact the contact number to send otp to
+ * @param body.userId the id of the user
+ * @returns 200 if OTP was successfully sent
+ * @returns 422 on OTP creation or SMS send failure, or if the user cannot be found
+ * @returns 500 on application or database errors
+ */
+UserRouter.post(
+  '/contact/otp/generate',
+  celebrate({
+    [Segments.BODY]: Joi.object().keys({
+      contact: Joi.string().required(),
+      userId: Joi.string().required(),
+    }),
+  }),
+  UserController.handleContactSendOtp,
+)
+
+/**
+ * Verify the contact verification one-time password (OTP) for the user as part
+ * of the contact verification process
+ * @route POST /user/contact/otp/verify
+ * @param body.userId the user's id to verify
+ * @param body.otp the otp to verify
+ * @param body.contact the contact of the user to check stored match
+ * @returns 200 when user contact update success
+ * @returns 422 when OTP is invalid
+ * @returns 500 when OTP is malformed or for unknown errors
+ */
+UserRouter.post(
+  '/contact/otp/verify',
+  celebrate({
+    [Segments.BODY]: Joi.object().keys({
+      userId: Joi.string().required(),
+      otp: Joi.string()
+        .required()
+        .regex(/^\d{6}$/),
+      contact: Joi.string().required(),
+    }),
+  }),
+  UserController.handleContactVerifyOtp,
+)
+
+export default UserRouter
diff --git a/src/app/routes/api/v3/v3.routes.ts b/src/app/routes/api/v3/v3.routes.ts
index e4a2061fe9..1349a2ed96 100644
--- a/src/app/routes/api/v3/v3.routes.ts
+++ b/src/app/routes/api/v3/v3.routes.ts
@@ -2,8 +2,10 @@ import { Router } from 'express'
 
 import { AdminRouter } from './admin'
 import { AuthRouter } from './auth'
+import { UserRouter } from './user'
 
 export const V3Router = Router()
 
 V3Router.use('/admin', AdminRouter)
+V3Router.use('/user', UserRouter)
 V3Router.use('/auth', AuthRouter)
diff --git a/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js b/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
index 51a0bb4543..60b0b48ee9 100644
--- a/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
+++ b/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
@@ -97,7 +97,7 @@ function EditContactNumberModalController(
     $scope.otpForm.otp.$setPristine()
     $scope.otpForm.otp.$setUntouched()
     $http
-      .post('/user/contact/sendotp', {
+      .post('/api/v3/user/otp/generate', {
         contact: vm.contact.number,
         userId: vm.user._id,
       })
@@ -126,7 +126,7 @@ function EditContactNumberModalController(
     vm.otp.isFetching = true
     // Check with backend if the otp is correct
     $http
-      .post('/user/contact/verifyotp', {
+      .post('/api/v3/user/otp/verify', {
         contact: vm.contact.number,
         otp: vm.otp.value,
         userId: vm.user._id,
diff --git a/src/public/modules/users/services/auth.client.service.js b/src/public/modules/users/services/auth.client.service.js
index 78e7703c46..2ca5083b7d 100644
--- a/src/public/modules/users/services/auth.client.service.js
+++ b/src/public/modules/users/services/auth.client.service.js
@@ -56,7 +56,7 @@ function Auth($q, $http, $state, $window) {
 
   function refreshUser() {
     return $http
-      .get('/user')
+      .get('/api/v3/user')
       .then(({ data }) => {
         setUser(data)
         return data

From 1c6bc68911734ef16edf472d5c9b13d8140db7a1 Mon Sep 17 00:00:00 2001
From: Frank Chen <frankchn@gmail.com>
Date: Tue, 6 Apr 2021 21:14:57 -0700
Subject: [PATCH 16/75] refactor: Refactor attachment upload into a service
 (#1547)

* refactor: Refactor attachment upload into a service

* Make changes based on mantariksh@'s comments

* Add formId to logging metadata for attachment uploading

* remove extraneous space
---
 src/app/modules/core/core.errors.ts           |  9 +++
 .../encrypt-submission.controller.ts          | 73 +++++-------------
 .../encrypt-submission.service.ts             | 77 ++++++++++++++++++-
 .../encrypt-submission.types.ts               |  2 +
 .../encrypt-submission.utils.ts               |  7 ++
 5 files changed, 114 insertions(+), 54 deletions(-)

diff --git a/src/app/modules/core/core.errors.ts b/src/app/modules/core/core.errors.ts
index 938f340feb..95282fd36e 100644
--- a/src/app/modules/core/core.errors.ts
+++ b/src/app/modules/core/core.errors.ts
@@ -73,3 +73,12 @@ export class MissingFeatureError extends ApplicationError {
     )
   }
 }
+
+/**
+ * Error thrown when attachment upload fails
+ */
+export class AttachmentUploadError extends ApplicationError {
+  constructor(message = 'Error while uploading encrypted attachments to S3') {
+    super(message)
+  }
+}
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index ff72ee44a6..0efe0da7c7 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -1,4 +1,3 @@
-import crypto from 'crypto'
 import { RequestHandler } from 'express'
 import { Query } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
@@ -6,7 +5,6 @@ import JSONStream from 'JSONStream'
 import mongoose from 'mongoose'
 import { SetOptional } from 'type-fest'
 
-import { aws as AwsConfig } from '../../../../config/config'
 import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   AuthType,
@@ -14,7 +12,6 @@ import {
   ResWithHashedFields,
   ResWithUinFin,
   SubmissionMetadataList,
-  WithParsedResponses,
 } from '../../../../types'
 import { ErrorDto } from '../../../../types/api'
 import { getEncryptSubmissionModel } from '../../../models/submission.server.model'
@@ -45,6 +42,7 @@ import {
   getSubmissionMetadataList,
   transformAttachmentMetasToSignedUrls,
   transformAttachmentMetaStream,
+  uploadAttachments,
 } from './encrypt-submission.service'
 import { EncryptSubmissionBody } from './encrypt-submission.types'
 import {
@@ -167,12 +165,6 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
     })
   }
   const processedResponses = processedResponsesResult.value
-  // eslint-disable-next-line @typescript-eslint/no-extra-semi
-  ;(req.body as WithParsedResponses<
-    typeof req.body
-  >).parsedResponses = processedResponses
-  // Prevent downstream functions from using responses by deleting it.
-  // TODO(#1104): We want to remove the mutability of state that comes with delete.
   delete (req.body as SetOptional<EncryptSubmissionBody, 'responses'>).responses
 
   // Checks if user is SPCP-authenticated before allowing submission
@@ -214,7 +206,7 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
       uinFin,
       formId,
     ).andThen((hashes) =>
-      MyInfoFactory.checkMyInfoHashes(req.body.parsedResponses, hashes),
+      MyInfoFactory.checkMyInfoHashes(processedResponses, hashes),
     )
     if (myinfoResult.isErr()) {
       logger.error({
@@ -279,35 +271,26 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
   }
 
   // Save Responses to Database
-  // TODO(frankchn): Extract S3 upload functionality to a service
   const formData = req.body.encryptedContent
-  const attachmentData = req.body.attachments || {}
   const { verified } = res.locals
-  const attachmentMetadata = new Map()
-  const attachmentUploadPromises = []
-
-  // Object.keys(attachmentData[fieldId].encryptedFile) [ 'submissionPublicKey', 'nonce', 'binary' ]
-  for (const fieldId in attachmentData) {
-    const individualAttachment = JSON.stringify(attachmentData[fieldId])
-
-    const hashStr = crypto
-      .createHash('sha256')
-      .update(individualAttachment)
-      .digest('hex')
-
-    const uploadKey =
-      form._id + '/' + crypto.randomBytes(20).toString('hex') + '/' + hashStr
-
-    attachmentMetadata.set(fieldId, uploadKey)
-    attachmentUploadPromises.push(
-      AwsConfig.s3
-        .upload({
-          Bucket: AwsConfig.attachmentS3Bucket,
-          Key: uploadKey,
-          Body: Buffer.from(individualAttachment),
-        })
-        .promise(),
+  let attachmentMetadata = new Map<string, string>()
+
+  if (req.body.attachments) {
+    const attachmentUploadResult = await uploadAttachments(
+      form._id,
+      req.body.attachments,
     )
+
+    if (attachmentUploadResult.isErr()) {
+      const { statusCode, errorMessage } = mapRouteError(
+        attachmentUploadResult.error,
+      )
+      return res.status(statusCode).json({
+        message: errorMessage,
+      })
+    } else {
+      attachmentMetadata = attachmentUploadResult.value
+    }
   }
 
   const submission = new EncryptSubmission({
@@ -320,22 +303,6 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
     version: req.body.version,
   })
 
-  try {
-    await Promise.all(attachmentUploadPromises)
-  } catch (err) {
-    logger.error({
-      message: 'Attachment upload error',
-      meta: logMeta,
-      error: err,
-    })
-    return res.status(StatusCodes.BAD_REQUEST).json({
-      message:
-        'Could not send submission. For assistance, please contact the person who asked you to fill in this form.',
-      submissionId: submission._id,
-      spcpSubmissionFailure: false,
-    })
-  }
-
   let savedSubmission
   try {
     savedSubmission = await submission.save()
@@ -385,7 +352,7 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
 
   return sendEmailConfirmations({
     form,
-    parsedResponses: req.body.parsedResponses,
+    parsedResponses: processedResponses,
     submission: savedSubmission,
   }).mapErr((error) => {
     logger.error({
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
index 84f6f18ab7..583317314f 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
@@ -1,4 +1,6 @@
+import { ManagedUpload } from 'aws-sdk/clients/s3'
 import Bluebird from 'bluebird'
+import crypto from 'crypto'
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 import { Transform } from 'stream'
@@ -17,7 +19,11 @@ import {
 import { getEncryptSubmissionModel } from '../../../models/submission.server.model'
 import { isMalformedDate } from '../../../utils/date'
 import { getMongoErrorMessage } from '../../../utils/handle-mongo-error'
-import { DatabaseError, MalformedParametersError } from '../../core/core.errors'
+import {
+  AttachmentUploadError,
+  DatabaseError,
+  MalformedParametersError,
+} from '../../core/core.errors'
 import { CreatePresignedUrlError } from '../../form/admin-form/admin-form.errors'
 import { isFormEncryptMode } from '../../form/form.utils'
 import {
@@ -25,9 +31,78 @@ import {
   SubmissionNotFoundError,
 } from '../submission.errors'
 
+import { AttachmentMetadata } from './encrypt-submission.types'
+
 const logger = createLoggerWithLabel(module)
 const EncryptSubmissionModel = getEncryptSubmissionModel(mongoose)
 
+type AttachmentReducerData = {
+  attachmentMetadata: AttachmentMetadata // type alias for Map<string, string>
+  attachmentUploadPromises: Promise<ManagedUpload.SendData>[]
+}
+
+/**
+ * Uploads a set of submissions to S3 and returns a map of attachment IDs to S3 object keys
+ *
+ * @param formId the id of the form to upload attachments for
+ * @param attachmentData Attachment blob data from the client (including the attachment)
+ *
+ * @returns ok(AttachmentMetadata) A map of field id to the s3 key of the uploaded attachment
+ * @returns err(AttachmentUploadError) if the upload has failed
+ */
+export const uploadAttachments = (
+  formId: string,
+  attachmentData: Record<string, unknown>,
+): ResultAsync<AttachmentMetadata, AttachmentUploadError> => {
+  const { attachmentMetadata, attachmentUploadPromises } = Object.keys(
+    attachmentData,
+  ).reduce<AttachmentReducerData>(
+    (accumulator: AttachmentReducerData, fieldId: string) => {
+      const individualAttachment = JSON.stringify(attachmentData[fieldId])
+
+      const hashStr = crypto
+        .createHash('sha256')
+        .update(individualAttachment)
+        .digest('hex')
+
+      const uploadKey =
+        formId + '/' + crypto.randomBytes(20).toString('hex') + '/' + hashStr
+
+      accumulator.attachmentMetadata.set(fieldId, uploadKey)
+      accumulator.attachmentUploadPromises.push(
+        AwsConfig.s3
+          .upload({
+            Bucket: AwsConfig.attachmentS3Bucket,
+            Key: uploadKey,
+            Body: Buffer.from(individualAttachment),
+          })
+          .promise(),
+      )
+
+      return accumulator
+    },
+    {
+      attachmentMetadata: new Map<string, string>(),
+      attachmentUploadPromises: [],
+    },
+  )
+
+  return ResultAsync.fromPromise(
+    Promise.all(attachmentUploadPromises),
+    (error) => {
+      logger.error({
+        message: 'S3 attachment upload error',
+        meta: {
+          action: 'uploadAttachments',
+          formId,
+        },
+        error,
+      })
+      return new AttachmentUploadError()
+    },
+  ).map(() => attachmentMetadata)
+}
+
 /**
  * Returns a cursor to the stream of the submissions of the given form id.
  *
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
index 5a9211de86..ed468f7232 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
@@ -34,3 +34,5 @@ export type EncryptSubmissionBodyAfterProcess = {
 export type WithAttachmentsData<T> = T & { attachmentData: Attachments }
 
 export type WithFormData<T> = T & { formData: string }
+
+export type AttachmentMetadata = Map<string, string>
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
index 8dfb731cb9..12c5fbc189 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
@@ -10,6 +10,7 @@ import {
   VerifyCaptchaError,
 } from '../../../services/captcha/captcha.errors'
 import {
+  AttachmentUploadError,
   DatabaseConflictError,
   DatabaseError,
   DatabasePayloadSizeError,
@@ -54,6 +55,12 @@ export const mapRouteError: MapRouteError = (
   coreErrorMessage = 'Sorry, something went wrong. Please try again.',
 ) => {
   switch (error.constructor) {
+    case AttachmentUploadError:
+      return {
+        statusCode: StatusCodes.BAD_REQUEST,
+        errorMessage:
+          'Could not upload attachments for submission. For assistance, please contact the person who asked you to fill in this form.',
+      }
     case MissingFeatureError:
     case CreateRedirectUrlError:
       return {

From 324a5101e22d4a2c5d08c4e9663a601adeec2833 Mon Sep 17 00:00:00 2001
From: seaerchin <44049504+seaerchin@users.noreply.github.com>
Date: Wed, 7 Apr 2021 17:22:59 +0800
Subject: [PATCH 17/75] refactor: migrate admin-console client service to ts
 (#1531)

* feat(public/services/billingservice): added billing service

* feat(public/services/exampleservice): added example service

* test(public/services/billingservice): adds tests for getBillingInfo

* test(public/services/exampleservice): adds tests for getSingleExampleForm and getExampleForms

* refactor(billingservice): added dto types to fe/be and type annnotation on get for fe

* style(public/exampleservice): added curly braces; added type annotation on methods

* refactor(examples): adds dto to params and updated fe file naming to fit be

* test(examplesservice): updated tests to use new dto shape

* refactor(billing): updated billing fe/be to use dto

* test(billingservice): updated tests to use dto for params

* refactor(examples-list/controller): updated to use ExamplesService

* refactor(billing/client/controller): replaced AdminService  with new BillingService

* refactor(forms/client/routes): replaced AdminConsole with ExamplesService

* chore(main.js): deletes old admin-console.client.service

* test(billingservice): updated test blocks

* test(exampleservice): updated test blocks

* style(types/billing): imported LoginStatistic rather than redefining
---
 .../__tests__/billing.controller.spec.ts      |  4 +-
 .../billing/__tests__/billing.routes.spec.ts  |  4 +-
 src/app/modules/billing/billing.controller.ts | 11 +--
 .../modules/examples/examples.controller.ts   | 20 ++--
 src/public/main.js                            |  1 -
 .../forms/config/forms.client.routes.js       | 10 +-
 .../controllers/billing.client.controller.js  | 21 ++---
 .../examples-list.client.controller.js        | 20 ++--
 .../services/admin-console.client.service.js  | 68 --------------
 src/public/services/BillingService.ts         | 21 +++++
 src/public/services/ExamplesService.ts        | 42 +++++++++
 .../services/__tests__/BillingService.test.ts | 52 +++++++++++
 .../__tests__/ExamplesService.test.ts         | 91 +++++++++++++++++++
 src/types/api/billing.ts                      | 12 +++
 src/types/api/examples.ts                     | 20 ++++
 src/types/api/index.ts                        |  2 +
 16 files changed, 291 insertions(+), 108 deletions(-)
 delete mode 100644 src/public/modules/users/services/admin-console.client.service.js
 create mode 100644 src/public/services/BillingService.ts
 create mode 100644 src/public/services/ExamplesService.ts
 create mode 100644 src/public/services/__tests__/BillingService.test.ts
 create mode 100644 src/public/services/__tests__/ExamplesService.test.ts
 create mode 100644 src/types/api/billing.ts
 create mode 100644 src/types/api/examples.ts

diff --git a/src/app/modules/billing/__tests__/billing.controller.spec.ts b/src/app/modules/billing/__tests__/billing.controller.spec.ts
index 374c936c7b..6b421a3de1 100644
--- a/src/app/modules/billing/__tests__/billing.controller.spec.ts
+++ b/src/app/modules/billing/__tests__/billing.controller.spec.ts
@@ -92,7 +92,9 @@ describe('billing.controller', () => {
         ...EXPECTED_SERVICE_CALL_ARGS,
       )
       expect(mockRes.status).toBeCalledWith(500)
-      expect(mockRes.json).toBeCalledWith('Error in retrieving billing records')
+      expect(mockRes.json).toBeCalledWith({
+        message: 'Error in retrieving billing records',
+      })
     })
   })
 })
diff --git a/src/app/modules/billing/__tests__/billing.routes.spec.ts b/src/app/modules/billing/__tests__/billing.routes.spec.ts
index 3dfa904ba7..5bc76cde85 100644
--- a/src/app/modules/billing/__tests__/billing.routes.spec.ts
+++ b/src/app/modules/billing/__tests__/billing.routes.spec.ts
@@ -206,7 +206,9 @@ describe('billing.routes', () => {
       // Assert
       expect(retrieveStatsSpy).toBeCalled()
       expect(response.status).toEqual(500)
-      expect(response.body).toEqual('Error in retrieving billing records')
+      expect(response.body).toEqual({
+        message: 'Error in retrieving billing records',
+      })
     })
   })
 })
diff --git a/src/app/modules/billing/billing.controller.ts b/src/app/modules/billing/billing.controller.ts
index 09d0032c34..77d9e6fb3b 100644
--- a/src/app/modules/billing/billing.controller.ts
+++ b/src/app/modules/billing/billing.controller.ts
@@ -4,6 +4,7 @@ import { StatusCodes } from 'http-status-codes'
 import moment from 'moment-timezone'
 
 import { createLoggerWithLabel } from '../../../config/logger'
+import { BillingInfoDto, BillingQueryDto, ErrorDto } from '../../../types/api'
 import { createReqMeta } from '../../utils/request'
 
 import { BillingFactory } from './billing.factory'
@@ -20,13 +21,9 @@ const logger = createLoggerWithLabel(module)
  */
 export const handleGetBillInfo: RequestHandler<
   ParamsDictionary,
+  ErrorDto | BillingInfoDto,
   unknown,
-  unknown,
-  {
-    esrvcId: string
-    yr: string
-    mth: string
-  }
+  BillingQueryDto
 > = async (req, res) => {
   const { esrvcId, mth, yr } = req.query
   const authedUser = (req.session as Express.AuthedSession).user
@@ -54,7 +51,7 @@ export const handleGetBillInfo: RequestHandler<
     })
     return res
       .status(StatusCodes.INTERNAL_SERVER_ERROR)
-      .json('Error in retrieving billing records')
+      .json({ message: 'Error in retrieving billing records' })
   }
 
   // Retrieved login stats successfully.
diff --git a/src/app/modules/examples/examples.controller.ts b/src/app/modules/examples/examples.controller.ts
index 0de411868e..df080efa23 100644
--- a/src/app/modules/examples/examples.controller.ts
+++ b/src/app/modules/examples/examples.controller.ts
@@ -3,10 +3,15 @@ import { ParamsDictionary, Query } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
 import { createLoggerWithLabel } from '../../../config/logger'
+import {
+  ErrorDto,
+  ExampleFormsQueryDto,
+  ExampleFormsResult,
+  ExampleSingleFormResult,
+} from '../../../types/api'
 import { createReqMeta } from '../../utils/request'
 
 import { ExamplesFactory } from './examples.factory'
-import { ExamplesQueryParams } from './examples.types'
 import { mapRouteError } from './examples.utils'
 
 const logger = createLoggerWithLabel(module)
@@ -14,15 +19,16 @@ const logger = createLoggerWithLabel(module)
 /**
  * Handler for GET /examples endpoint.
  * @security session
+ * @param exampleFormsQuery The search terms to find forms for
  * @returns 200 with an array of forms to be listed on the examples page
  * @returns 401 when user does not exist in session
  * @returns 500 when error occurs whilst querying the database
  */
 export const handleGetExamples: RequestHandler<
   ParamsDictionary,
+  ErrorDto | ExampleFormsResult,
   unknown,
-  unknown,
-  Query & ExamplesQueryParams
+  Query & ExampleFormsQueryDto
 > = (req, res) => {
   return ExamplesFactory.getExampleForms(req.query)
     .map((result) => res.status(StatusCodes.OK).json(result))
@@ -44,14 +50,16 @@ export const handleGetExamples: RequestHandler<
 /**
  * Handler for GET /examples/:formId endpoint.
  * @security session
+ * @param formId The id of the example form
  * @returns 200 with the retrieved form example
  * @returns 401 when user does not exist in session
  * @returns 404 when the form with given formId does not exist in the database
  * @returns 500 when error occurs whilst querying the database
  */
-export const handleGetExampleByFormId: RequestHandler<{
-  formId: string
-}> = (req, res) => {
+export const handleGetExampleByFormId: RequestHandler<
+  { formId: string },
+  ExampleSingleFormResult | ErrorDto
+> = (req, res) => {
   const { formId } = req.params
 
   return ExamplesFactory.getSingleExampleForm(formId)
diff --git a/src/public/main.js b/src/public/main.js
index 1871c9ff2a..1bdfeacf96 100644
--- a/src/public/main.js
+++ b/src/public/main.js
@@ -283,7 +283,6 @@ require('./modules/users/config/users.client.routes.js')
 
 // User services
 require('./modules/users/services/auth.client.service.js')
-require('./modules/users/services/admin-console.client.service.js')
 
 // User controllers
 require('./modules/users/controllers/authentication.client.controller.js')
diff --git a/src/public/modules/forms/config/forms.client.routes.js b/src/public/modules/forms/config/forms.client.routes.js
index edfc03eaac..5f5467c213 100644
--- a/src/public/modules/forms/config/forms.client.routes.js
+++ b/src/public/modules/forms/config/forms.client.routes.js
@@ -1,5 +1,7 @@
 'use strict'
 
+const ExamplesService = require('../../../services/ExamplesService')
+
 // Setting up route
 angular.module('forms').config([
   '$stateProvider',
@@ -72,22 +74,22 @@ angular.module('forms').config([
         url: '/{formId:[0-9a-fA-F]{24}}/use-template',
         templateUrl: 'modules/users/views/examples.client.view.html',
         resolve: {
-          AdminConsole: 'AdminConsole',
           Auth: 'Auth',
           FormErrorService: 'FormErrorService',
           // If the user is logged in, this field will contain the form data of the provided formId,
           // otherwise it will only contain the formId itself.
           FormData: [
-            'AdminConsole',
+            '$q',
             'Auth',
             'FormErrorService',
             '$stateParams',
-            function (AdminConsole, Auth, FormErrorService, $stateParams) {
+            function ($q, Auth, FormErrorService, $stateParams) {
               if (!Auth.getUser()) {
                 return $stateParams.formId
               }
 
-              return AdminConsole.getSingleExampleForm($stateParams.formId)
+              return $q
+                .when(ExamplesService.getSingleExampleForm($stateParams.formId))
                 .then(function (response) {
                   response.form.isTemplate = true
                   return response.form
diff --git a/src/public/modules/users/controllers/billing.client.controller.js b/src/public/modules/users/controllers/billing.client.controller.js
index fa1d7aaf1e..48388f2115 100644
--- a/src/public/modules/users/controllers/billing.client.controller.js
+++ b/src/public/modules/users/controllers/billing.client.controller.js
@@ -1,25 +1,20 @@
 'use strict'
 
 const CsvGenerator = require('../../forms/helpers/CsvGenerator')
+const BillingService = require('../../../services/BillingService')
 
 angular
   .module('users')
   .controller('BillingController', [
+    '$q',
     '$state',
     '$timeout',
-    'AdminConsole',
     'Auth',
     'NgTableParams',
     BillingController,
   ])
 
-function BillingController(
-  $state,
-  $timeout,
-  AdminConsole,
-  Auth,
-  NgTableParams,
-) {
+function BillingController($q, $state, $timeout, Auth, NgTableParams) {
   const vm = this
 
   vm.user = Auth.getUser()
@@ -102,10 +97,12 @@ function BillingController(
     esrvcId = esrvcId || vm.esrvcId
     vm.loading = true
     vm.searchError = false
-    AdminConsole.getBillingInfo(
-      vm.selectedTimePeriod.yr,
-      vm.selectedTimePeriod.mth,
-      esrvcId,
+    $q.when(
+      BillingService.getBillingInfo({
+        yr: vm.selectedTimePeriod.yr,
+        mth: vm.selectedTimePeriod.mth,
+        esrvcId,
+      }),
     ).then(
       function (response) {
         // Remove loader
diff --git a/src/public/modules/users/controllers/examples-list.client.controller.js b/src/public/modules/users/controllers/examples-list.client.controller.js
index ee9918975a..c1a6c6047c 100644
--- a/src/public/modules/users/controllers/examples-list.client.controller.js
+++ b/src/public/modules/users/controllers/examples-list.client.controller.js
@@ -1,10 +1,12 @@
 'use strict'
 
+const ExamplesService = require('../../../services/ExamplesService')
+
 const PAGE_SIZE = 16
 
 angular.module('users').controller('ExamplesController', [
+  '$q',
   '$scope',
-  'AdminConsole',
   'Auth',
   'GTag',
   '$state',
@@ -17,8 +19,8 @@ angular.module('users').controller('ExamplesController', [
 ])
 
 function ExamplesController(
+  $q,
   $scope,
-  AdminConsole,
   Auth,
   GTag,
   $state,
@@ -129,12 +131,14 @@ function ExamplesController(
     const shouldGetTotalNumResults = pageNo === 0 && searchTerm !== ''
 
     // Get next page of forms and add to ui
-    AdminConsole.getExampleForms({
-      pageNo,
-      searchTerm,
-      agency,
-      shouldGetTotalNumResults,
-    }).then(
+    $q.when(
+      ExamplesService.getExampleForms({
+        pageNo,
+        searchTerm,
+        agency,
+        shouldGetTotalNumResults,
+      }),
+    ).then(
       function (response) {
         /* Form Properties
             ------------------
diff --git a/src/public/modules/users/services/admin-console.client.service.js b/src/public/modules/users/services/admin-console.client.service.js
deleted file mode 100644
index c50aa97418..0000000000
--- a/src/public/modules/users/services/admin-console.client.service.js
+++ /dev/null
@@ -1,68 +0,0 @@
-angular.module('users').factory('AdminConsole', ['$q', '$http', AdminConsole])
-
-function AdminConsole($q, $http) {
-  return {
-    getBillingInfo: function (yr, mth, esrvcId) {
-      let deferred = $q.defer()
-      $http({
-        url: '/billing',
-        method: 'GET',
-        params: { yr, mth, esrvcId },
-      }).then(
-        function (response) {
-          deferred.resolve(response.data)
-        },
-        function () {
-          deferred.reject('Billing information could not be obtained.')
-        },
-      )
-      return deferred.promise
-    },
-    /**
-     * Retrieve example forms for listing
-     */
-    getExampleForms: function ({
-      pageNo,
-      searchTerm,
-      agency,
-      shouldGetTotalNumResults,
-    }) {
-      let deferred = $q.defer()
-      $http({
-        url: '/examples',
-        method: 'GET',
-        params: { pageNo, searchTerm, agency, shouldGetTotalNumResults },
-        headers: { 'If-Modified-Since': '0' },
-        // disable IE ajax request caching (so search requests don't get cached)
-      }).then(
-        function (response) {
-          deferred.resolve(response.data)
-        },
-        function (error) {
-          deferred.reject(error)
-        },
-      )
-      return deferred.promise
-    },
-    /**
-     * Retrieve a single form for examples
-     */
-    getSingleExampleForm: function (formId) {
-      let deferred = $q.defer()
-      $http({
-        url: `/examples/${formId}`,
-        method: 'GET',
-        headers: { 'If-Modified-Since': '0' },
-        // disable IE ajax request caching (so search requests don't get cached)
-      }).then(
-        function (response) {
-          deferred.resolve(response.data)
-        },
-        function (error) {
-          deferred.reject(error)
-        },
-      )
-      return deferred.promise
-    },
-  }
-}
diff --git a/src/public/services/BillingService.ts b/src/public/services/BillingService.ts
new file mode 100644
index 0000000000..1a77743300
--- /dev/null
+++ b/src/public/services/BillingService.ts
@@ -0,0 +1,21 @@
+import axios from 'axios'
+
+import { BillingInfoDto, BillingQueryDto } from '../../types/api/billing'
+
+// Exported for testing
+export const BILLING_ENDPOINT = '/billing'
+
+/**
+ * Gets the billing information for the given month and year
+ * @param billingQueryParams The formId and the specific month to get the information for
+ * @returns Promise<BillingResult> The billing statistics of the given month
+ */
+export const getBillingInfo = (
+  billingQueryParams: BillingQueryDto,
+): Promise<BillingInfoDto> => {
+  return axios
+    .get<BillingInfoDto>(BILLING_ENDPOINT, {
+      params: billingQueryParams,
+    })
+    .then(({ data }) => data)
+}
diff --git a/src/public/services/ExamplesService.ts b/src/public/services/ExamplesService.ts
new file mode 100644
index 0000000000..0575cdc711
--- /dev/null
+++ b/src/public/services/ExamplesService.ts
@@ -0,0 +1,42 @@
+import axios from 'axios'
+
+import {
+  ExampleFormsQueryDto,
+  ExampleFormsResult,
+  ExampleSingleFormResult,
+} from '../../types/api'
+
+export const EXAMPLES_ENDPOINT = '/examples'
+
+/**
+ * Gets example forms that matches the specified parameters for listing
+ * @param exampleFormsSearchParams The search terms to query the backend for
+ * @returns The list of retrieved examples if `shouldGetTotalNumResults` is false
+ * @returns The list of retrieved examples with the total results if `shouldGetTotalNumResults` is true
+ */
+export const getExampleForms = (
+  exampleFormsSearchParams: ExampleFormsQueryDto,
+): Promise<ExampleFormsResult> => {
+  return axios
+    .get<ExampleFormsResult>(EXAMPLES_ENDPOINT, {
+      params: exampleFormsSearchParams,
+      // disable IE ajax request caching (so search requests don't get cached)
+      headers: { 'If-Modified-Since': '0' },
+    })
+    .then(({ data }) => data)
+}
+/**
+ * Gets a single form for examples
+ * @param formId The id of the form to search for
+ * @returns The information of the example form
+ */
+export const getSingleExampleForm = (
+  formId: string,
+): Promise<ExampleSingleFormResult> => {
+  return axios
+    .get<ExampleSingleFormResult>(`${EXAMPLES_ENDPOINT}/${formId}`, {
+      // disable IE ajax request caching (so search requests don't get cached)
+      headers: { 'If-Modified-Since': '0' },
+    })
+    .then(({ data }) => data)
+}
diff --git a/src/public/services/__tests__/BillingService.test.ts b/src/public/services/__tests__/BillingService.test.ts
new file mode 100644
index 0000000000..8aa0bb7473
--- /dev/null
+++ b/src/public/services/__tests__/BillingService.test.ts
@@ -0,0 +1,52 @@
+import MockAxios from 'jest-mock-axios'
+
+import * as BillingService from '../BillingService'
+
+jest.mock('axios', () => MockAxios)
+
+describe('BillingService', () => {
+  describe('getBillingInfo', () => {
+    const MOCK_DATA = {
+      adminEmail: 'Big Mock',
+      formName: 'Mock Form',
+      total: 0,
+      formId: 'Mock',
+      authType: 'NIL',
+    }
+    const MOCK_PARAMS = { yr: '2020', mth: '12', esrvcId: 'mock' }
+    it('should return the billing information when the GET request succeeds', async () => {
+      // Arrange
+      MockAxios.get.mockResolvedValueOnce({ data: MOCK_DATA })
+
+      // Act
+      const actual = await BillingService.getBillingInfo(MOCK_PARAMS)
+
+      // Assert
+      expect(MockAxios.get).toHaveBeenCalledWith(
+        BillingService.BILLING_ENDPOINT,
+        {
+          params: MOCK_PARAMS,
+        },
+      )
+      expect(actual).toEqual(MOCK_DATA)
+    })
+
+    it('should reject with the provided error message when the GET request fails', async () => {
+      // Arrange
+      const expected = new Error('Mock Error')
+      MockAxios.get.mockRejectedValueOnce(expected)
+
+      // Act
+      const actualPromise = BillingService.getBillingInfo(MOCK_PARAMS)
+
+      // Assert
+      await expect(actualPromise).rejects.toEqual(expected)
+      expect(MockAxios.get).toHaveBeenCalledWith(
+        BillingService.BILLING_ENDPOINT,
+        {
+          params: MOCK_PARAMS,
+        },
+      )
+    })
+  })
+})
diff --git a/src/public/services/__tests__/ExamplesService.test.ts b/src/public/services/__tests__/ExamplesService.test.ts
new file mode 100644
index 0000000000..b50f0edcc5
--- /dev/null
+++ b/src/public/services/__tests__/ExamplesService.test.ts
@@ -0,0 +1,91 @@
+import MockAxios from 'jest-mock-axios'
+
+import * as ExamplesService from '../ExamplesService'
+
+jest.mock('axios', () => MockAxios)
+
+describe('ExamplesService', () => {
+  afterEach(() => jest.clearAllMocks())
+  describe('getExampleForms', () => {
+    const MOCK_PARAMS = {
+      pageNo: 1,
+      searchTerm: 'mock',
+      agency: 'Mock Gov',
+      shouldGetTotalNumResults: false,
+    }
+    const MOCK_HEADERS = { 'If-Modified-Since': '0' }
+    it('should return example forms data when the GET request succeeds', async () => {
+      // Arrange
+      const expected = {}
+      MockAxios.get.mockResolvedValueOnce({ data: {} })
+
+      // Act
+      const actual = await ExamplesService.getExampleForms(MOCK_PARAMS)
+
+      // Assert
+      expect(MockAxios.get).toHaveBeenCalledWith(
+        ExamplesService.EXAMPLES_ENDPOINT,
+        {
+          params: MOCK_PARAMS,
+          headers: MOCK_HEADERS,
+        },
+      )
+      expect(actual).toEqual(expected)
+    })
+
+    it('should reject with the provided error message when the GET request fails', async () => {
+      // Arrange
+      const expected = new Error('Mock Error')
+      MockAxios.get.mockRejectedValueOnce(expected)
+
+      // Act
+      const actualPromise = ExamplesService.getExampleForms(MOCK_PARAMS)
+
+      // Assert
+      await expect(actualPromise).rejects.toEqual(expected)
+      expect(MockAxios.get).toHaveBeenCalledWith(
+        ExamplesService.EXAMPLES_ENDPOINT,
+        {
+          params: MOCK_PARAMS,
+          headers: MOCK_HEADERS,
+        },
+      )
+    })
+  })
+
+  describe('getSingleExampleForm', () => {
+    const MOCK_FORM_ID = 'MOCK'
+    const MOCK_HEADERS = { 'If-Modified-Since': '0' }
+    it('should return example single form data when the GET request succeeds', async () => {
+      // Arrange
+      const expected = {}
+      const expectedMockEndpoint = `${ExamplesService.EXAMPLES_ENDPOINT}/${MOCK_FORM_ID}`
+      MockAxios.get.mockResolvedValueOnce({ data: {} })
+
+      // Act
+      const actual = await ExamplesService.getSingleExampleForm(MOCK_FORM_ID)
+
+      // Assert
+      expect(MockAxios.get).toHaveBeenCalledWith(expectedMockEndpoint, {
+        headers: MOCK_HEADERS,
+      })
+      expect(actual).toEqual(expected)
+    })
+
+    it('should reject with the provided error message when the GET request fails', async () => {
+      // Arrange
+      const expected = new Error('Mock Error')
+      const expectedMockEndpoint = `${ExamplesService.EXAMPLES_ENDPOINT}/${MOCK_FORM_ID}`
+      MockAxios.get.mockRejectedValueOnce(expected)
+
+      // Act
+      const actualPromise = ExamplesService.getSingleExampleForm(MOCK_FORM_ID)
+
+      // Assert
+      await expect(actualPromise).rejects.toEqual(expected)
+      expect(MockAxios.get).toHaveBeenCalledWith(expectedMockEndpoint, {
+        headers: MOCK_HEADERS,
+      })
+    })
+  })
+})
diff --git a/src/types/api/billing.ts b/src/types/api/billing.ts
new file mode 100644
index 0000000000..60e3f03fcb
--- /dev/null
+++ b/src/types/api/billing.ts
@@ -0,0 +1,12 @@
+import { LoginStatistic } from '../../types'
+
+// yr: The year to get the billing information for
+// mth: The month to get the billing information for
+// esrvcId: The id of the form
+export type BillingQueryDto = {
+  esrvcId: string
+  yr: string
+  mth: string
+}
+
+export type BillingInfoDto = { loginStats: LoginStatistic[] }
diff --git a/src/types/api/examples.ts b/src/types/api/examples.ts
new file mode 100644
index 0000000000..7cda15f7b1
--- /dev/null
+++ b/src/types/api/examples.ts
@@ -0,0 +1,20 @@
+import {
+  QueryPageResult,
+  QueryPageResultWithTotal,
+  SingleFormResult,
+} from '../../app/modules/examples/examples.types'
+
+// pageNo: The page to render
+// searchTerm: The term to search on
+// agency: The agency to search on - this can be all agencies or the user's agency
+// shouldGetTotalNumResults: Whether to return all the results or not
+export type ExampleFormsQueryDto = {
+  pageNo: number
+  searchTerm?: string
+  agency?: string
+  shouldGetTotalNumResults?: boolean
+}
+
+export type ExampleFormsResult = QueryPageResult | QueryPageResultWithTotal
+// NOTE: Renaming for clarity that this type refers to an example
+export type ExampleSingleFormResult = SingleFormResult
diff --git a/src/types/api/index.ts b/src/types/api/index.ts
index 977a0c0c32..20d19312a1 100644
--- a/src/types/api/index.ts
+++ b/src/types/api/index.ts
@@ -1,2 +1,4 @@
 export * from './core'
 export * from './form'
+export * from './billing'
+export * from './examples'

From 9f99776254b2272dd52b458e82eb4f06bcc03bc3 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Wed, 7 Apr 2021 18:08:33 +0800
Subject: [PATCH 18/75] fix(test): use app import instead of dist import
 (#1576)

---
 src/app/modules/webhook/__tests__/webhook.service.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app/modules/webhook/__tests__/webhook.service.spec.ts b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
index 89d592655b..a1b74c5952 100644
--- a/src/app/modules/webhook/__tests__/webhook.service.spec.ts
+++ b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
@@ -1,6 +1,5 @@
 import axios, { AxiosError, AxiosRequestConfig, AxiosResponse } from 'axios'
 import { ObjectID } from 'bson'
-import { SubmissionNotFoundError } from 'dist/backend/app/modules/submission/submission.errors'
 import mongoose from 'mongoose'
 import { mocked } from 'ts-jest/utils'
 
@@ -20,6 +19,7 @@ import {
 
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
+import { SubmissionNotFoundError } from '../../submission/submission.errors'
 import { saveWebhookRecord, sendWebhook } from '../webhook.service'
 
 // define suite-wide mocks

From 3defb138225f8c3025b65afc49df2ebdd1bffb50 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Wed, 7 Apr 2021 18:09:08 +0800
Subject: [PATCH 19/75] fix: convert bigint to string, not number to avoid
 losing fidelity (#1577)

also converted tests to Typescript tests
---
 src/shared/util/stringify-safe.ts             |  8 +++-----
 ...fy-safe.spec.js => stringify-safe.spec.ts} | 19 +++++++++++--------
 2 files changed, 14 insertions(+), 13 deletions(-)
 rename tests/unit/backend/utils/{stringify-safe.spec.js => stringify-safe.spec.ts} (76%)

diff --git a/src/shared/util/stringify-safe.ts b/src/shared/util/stringify-safe.ts
index c343ab04f7..d08ef50bd6 100644
--- a/src/shared/util/stringify-safe.ts
+++ b/src/shared/util/stringify-safe.ts
@@ -18,9 +18,7 @@ import stringify from 'json-stringify-safe'
  * @param obj the object to be stringified
  */
 export const stringifySafe = (obj: any): string | undefined => {
-  const bigIntReplacer = (_key: any, value: any): any => {
-    // eslint-disable-next-line valid-typeof
-    return typeof value === 'bigint' ? Number(value) : value
-  }
-  return stringify(obj, bigIntReplacer)
+  return stringify(obj, (_key, value) =>
+    typeof value === 'bigint' ? value.toString() : value,
+  )
 }
diff --git a/tests/unit/backend/utils/stringify-safe.spec.js b/tests/unit/backend/utils/stringify-safe.spec.ts
similarity index 76%
rename from tests/unit/backend/utils/stringify-safe.spec.js
rename to tests/unit/backend/utils/stringify-safe.spec.ts
index 4d7a06da2a..fba269da57 100644
--- a/tests/unit/backend/utils/stringify-safe.spec.js
+++ b/tests/unit/backend/utils/stringify-safe.spec.ts
@@ -1,14 +1,11 @@
-/* global BigInt */
+import { cloneDeep } from 'lodash'
 
-const {
-  stringifySafe,
-} = require('../../../../dist/backend/shared/util/stringify-safe')
-const { cloneDeep } = require('lodash')
+import { stringifySafe } from 'src/shared/util/stringify-safe'
 
 // Tests that the stringifySafe function works as expected, i.e. correctly
 // deals with circular references and BigInt.
 describe('Safe stringify function', () => {
-  let json, expected
+  let json: Record<string, any>, expected: Record<string, any>
   beforeEach(() => {
     json = {
       complicated: {
@@ -48,9 +45,15 @@ describe('Safe stringify function', () => {
 
     expect(stringifySafe(json)).toEqual(JSON.stringify(expected))
   })
-  it('should convert BigInt to Number', () => {
-    expected.bigInt = 10
+  it('should convert BigInt of < Number.MAX_SAFE_INTEGER to string', () => {
+    expected.bigInt = '10'
     json.bigInt = BigInt(10)
     expect(stringifySafe(json)).toEqual(JSON.stringify(expected))
   })
+
+  it('should convert BigInt of > Number.MAX_SAFE_INTEGER to string', () => {
+    expected.bigInt = '9007199254740995'
+    json.bigInt = BigInt('9007199254740995')
+    expect(stringifySafe(json)).toEqual(JSON.stringify(expected))
+  })
 })

From 2fb08470564a9e6c1460778f3c5fbfdb4bd98c9b Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Wed, 7 Apr 2021 18:44:13 +0800
Subject: [PATCH 20/75] ref: migrate (most) /adminform endpoints to TypeScript,
 add integration tests (#1567)

---
 package-lock.json                             |   40 +-
 package.json                                  |    1 +
 .../auth/__tests__/auth.routes.spec.ts        |    3 +-
 .../__tests__/admin-form.routes.spec.ts       | 4621 +++++++++++++++++
 .../form/admin-form/admin-form.controller.ts  |   42 +-
 .../form/admin-form/admin-form.routes.ts      |  497 ++
 .../encrypt-submission.controller.ts          |    1 +
 .../user/__tests__/user.routes.spec.ts        |    9 +-
 src/app/routes/admin-forms.server.routes.js   |  501 +-
 src/app/utils/__mocks__/limit-rate.ts         |    6 +
 src/loaders/express/index.ts                  |    2 +
 tests/integration/helpers/express-auth.ts     |   13 +
 tests/integration/helpers/express-setup.ts    |   10 +-
 tests/unit/backend/helpers/serialize-data.ts  |    3 +
 tsconfig.build.json                           |    1 +
 15 files changed, 5205 insertions(+), 545 deletions(-)
 create mode 100644 src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
 create mode 100644 src/app/modules/form/admin-form/admin-form.routes.ts
 create mode 100644 src/app/utils/__mocks__/limit-rate.ts
 create mode 100644 tests/unit/backend/helpers/serialize-data.ts

diff --git a/package-lock.json b/package-lock.json
index 48c76ee8a2..8ea585172d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4169,6 +4169,14 @@
         }
       }
     },
+    "@joi/date": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@joi/date/-/date-2.1.0.tgz",
+      "integrity": "sha512-2zN5m0LgxZp/cynHGbzEImVmFIa+n+IOb/Nlw5LX/PLJneeCwG1NbiGw7MvPjsAKUGQK8z31Nn6V6lEN+4fZhg==",
+      "requires": {
+        "moment": "2.x.x"
+      }
+    },
     "@mapbox/node-pre-gyp": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-1.0.0.tgz",
@@ -9973,26 +9981,18 @@
       "dev": true
     },
     "elliptic": {
-      "version": "6.5.3",
-      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.3.tgz",
-      "integrity": "sha512-IMqzv5wNQf+E6aHeIqATs0tOLeOTwj1QKbRcS3jBbYkl5oLAserA8yJTT7/VyHUYG91PRmPyeQDObKLPpeS4dw==",
+      "version": "6.5.4",
+      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz",
+      "integrity": "sha512-iLhC6ULemrljPZb+QutR5TQGB+pdW6KGD5RSegS+8sorOZT+rdQFbsQFJgvN3eRqNALqJer4oQ16YvJHlU8hzQ==",
       "dev": true,
       "requires": {
-        "bn.js": "^4.4.0",
-        "brorand": "^1.0.1",
+        "bn.js": "^4.11.9",
+        "brorand": "^1.1.0",
         "hash.js": "^1.0.0",
-        "hmac-drbg": "^1.0.0",
-        "inherits": "^2.0.1",
-        "minimalistic-assert": "^1.0.0",
-        "minimalistic-crypto-utils": "^1.0.0"
-      },
-      "dependencies": {
-        "bn.js": {
-          "version": "4.11.9",
-          "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.11.9.tgz",
-          "integrity": "sha512-E6QoYqCKZfgatHTdHzs1RRKP7ip4vvm+EyRUeE2RF0NblwVvb0p6jSVeNTOFxPn26QXN2o6SMfNxKp6kU8zQaw==",
-          "dev": true
-        }
+        "hmac-drbg": "^1.0.1",
+        "inherits": "^2.0.4",
+        "minimalistic-assert": "^1.0.1",
+        "minimalistic-crypto-utils": "^1.0.1"
       }
     },
     "emittery": {
@@ -25885,9 +25885,9 @@
       "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="
     },
     "y18n": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz",
-      "integrity": "sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.1.tgz",
+      "integrity": "sha512-wNcy4NvjMYL8gogWWYAO7ZFWFfHcbdbE57tZO8e4cbpj8tfUcwrwqSl3ad8HxpYWCdXcJUCeKKZS62Av1affwQ==",
       "dev": true
     },
     "yallist": {
diff --git a/package.json b/package.json
index 626ef3574c..850c399991 100644
--- a/package.json
+++ b/package.json
@@ -57,6 +57,7 @@
   },
   "dependencies": {
     "@babel/runtime": "^7.13.10",
+    "@joi/date": "^2.1.0",
     "@opengovsg/angular-daterangepicker-webpack": "^1.1.5",
     "@opengovsg/angular-legacy-sortablejs-maintained": "^1.0.0",
     "@opengovsg/angular-recaptcha-fallback": "^5.0.0",
diff --git a/src/app/modules/auth/__tests__/auth.routes.spec.ts b/src/app/modules/auth/__tests__/auth.routes.spec.ts
index 14bead75c4..66d44b6430 100644
--- a/src/app/modules/auth/__tests__/auth.routes.spec.ts
+++ b/src/app/modules/auth/__tests__/auth.routes.spec.ts
@@ -11,6 +11,7 @@ import { IAgencySchema } from 'src/types'
 import { setupApp } from 'tests/integration/helpers/express-setup'
 import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
+import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
 
 import { MailSendError } from '../../../services/mail/mail.errors'
 import { DatabaseError } from '../../core/core.errors'
@@ -463,7 +464,7 @@ describe('auth.routes', () => {
       // Body should be an user object.
       expect(response.body).toMatchObject({
         // Required since that's how the data is sent out from the application.
-        agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+        agency: jsonParseStringify(defaultAgency.toObject()),
         _id: expect.any(String),
         created: expect.any(String),
         email: VALID_EMAIL,
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
new file mode 100644
index 0000000000..cc51e48fc6
--- /dev/null
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -0,0 +1,4621 @@
+/* eslint-disable @typescript-eslint/ban-ts-comment */
+import { ObjectId } from 'bson-ext'
+import { format, subDays } from 'date-fns'
+import { cloneDeep, take, times } from 'lodash'
+import mongoose from 'mongoose'
+import { errAsync, okAsync } from 'neverthrow'
+import SparkMD5 from 'spark-md5'
+import supertest, { Session } from 'supertest-session'
+
+import getFormModel, {
+  getEmailFormModel,
+  getEncryptedFormModel,
+} from 'src/app/models/form.server.model'
+import getFormFeedbackModel from 'src/app/models/form_feedback.server.model'
+import getSubmissionModel, {
+  getEncryptSubmissionModel,
+} from 'src/app/models/submission.server.model'
+import getUserModel from 'src/app/models/user.server.model'
+import * as AuthService from 'src/app/modules/auth/auth.service'
+import {
+  DatabaseError,
+  DatabasePayloadSizeError,
+} from 'src/app/modules/core/core.errors'
+import { saveSubmissionMetadata } from 'src/app/modules/submission/email-submission/email-submission.service'
+import { SubmissionHash } from 'src/app/modules/submission/email-submission/email-submission.types'
+import { aws } from 'src/config/config'
+import { EditFieldActions, VALID_UPLOAD_FILE_TYPES } from 'src/shared/constants'
+import {
+  BasicField,
+  IFormDocument,
+  IPopulatedEmailForm,
+  IPopulatedForm,
+  IUserSchema,
+  ResponseMode,
+  Status,
+  SubmissionCursorData,
+  SubmissionType,
+} from 'src/types'
+
+import {
+  createAuthedSession,
+  logoutSession,
+} from 'tests/integration/helpers/express-auth'
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
+import { generateDefaultField } from 'tests/unit/backend/helpers/generate-form-data'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
+
+import { insertFormFeedback } from '../../public-form/public-form.service'
+import { AdminFormsRouter } from '../admin-form.routes'
+import * as AdminFormService from '../admin-form.service'
+
+// Prevent rate limiting.
+jest.mock('src/app/utils/limit-rate')
+
+const UserModel = getUserModel(mongoose)
+const FormModel = getFormModel(mongoose)
+const EmailFormModel = getEmailFormModel(mongoose)
+const EncryptFormModel = getEncryptedFormModel(mongoose)
+const FormFeedbackModel = getFormFeedbackModel(mongoose)
+const SubmissionModel = getSubmissionModel(mongoose)
+const EncryptSubmissionModel = getEncryptSubmissionModel(mongoose)
+
+const app = setupApp(undefined, AdminFormsRouter, {
+  setupWithAuth: true,
+})
+
+describe('admin-form.routes', () => {
+  let request: Session
+  let defaultUser: IUserSchema
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+    const { user } = await dbHandler.insertFormCollectionReqs()
+    // Default all requests to come from authenticated user.
+    request = await createAuthedSession(user.email, request)
+    defaultUser = user
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('GET /adminform', () => {
+    it('should return 200 with empty array when user has no forms', async () => {
+      // Act
+      const response = await request.get('/adminform')
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual([])
+    })
+
+    it('should return 200 with a list of forms managed by the user', async () => {
+      // Arrange
+      // Create separate user
+      const collabUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'collab-user',
+          shortName: 'collabUser',
+        })
+      ).user
+
+      const ownForm = await EmailFormModel.create({
+        title: 'Own form',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      const collabForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: collabUser._id,
+        permissionList: [{ email: defaultUser.email }],
+      })
+      // Create already archived form, should not be fetched even though
+      // owner is defaultUser
+      await EmailFormModel.create({
+        title: 'Archived form',
+        emails: defaultUser.email,
+        admin: defaultUser._id,
+        status: Status.Archived,
+      })
+      // Create form that user is not collaborator/admin of. Should not be
+      // fetched.
+      await EncryptFormModel.create({
+        title: 'Does not matter',
+        publicKey: 'abracadabra',
+        admin: collabUser._id,
+        // No permissions for anyone else.
+      })
+
+      // Act
+      const response = await request.get('/adminform')
+
+      // Assert
+      // Should only receive ownForm and collabForm
+      const expected = await FormModel.find({
+        _id: {
+          $in: [ownForm._id, collabForm._id],
+        },
+      })
+        .select('_id title admin lastModified status responseMode')
+        .sort('-lastModified')
+        .populate({
+          path: 'admin',
+          populate: {
+            path: 'agency',
+          },
+        })
+        .lean()
+      expect(response.body).toEqual(jsonParseStringify(expected))
+      expect(response.status).toEqual(200)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get('/adminform')
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 422 when user of given id cannot be found in the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get('/adminform')
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database errors occur', async () => {
+      // Arrange
+      // Mock database error.
+      jest
+        .spyOn(FormModel, 'getMetaByUserIdOrEmail')
+        .mockRejectedValueOnce(new Error('something went wrong'))
+
+      // Act
+      const response = await request.get('/adminform')
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('POST /adminform', () => {
+    it('should return 200 with newly created email mode form', async () => {
+      // Arrange
+      const createEmailParams = {
+        form: {
+          emails: defaultUser.email,
+          responseMode: 'email',
+          title: 'email mode form test',
+          // Extra keys should be fine.
+          someExtraKey: 'extra value that will be ignored.',
+        },
+      }
+
+      // Act
+      const response = await request.post('/adminform').send(createEmailParams)
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(
+        expect.objectContaining({
+          admin: String(defaultUser._id),
+          emails: [defaultUser.email],
+          responseMode: ResponseMode.Email,
+          status: Status.Private,
+          title: createEmailParams.form.title,
+          form_fields: [],
+          form_logics: [],
+        }),
+      )
+    })
+
+    it('should return 200 with newly created storage mode form', async () => {
+      // Arrange
+      const createStorageParams = {
+        form: {
+          responseMode: 'encrypt',
+          title: 'storage mode form test',
+          publicKey: 'some random public key',
+        },
+      }
+
+      // Act
+      const response = await request
+        .post('/adminform')
+        .send(createStorageParams)
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(
+        expect.objectContaining({
+          admin: String(defaultUser._id),
+          publicKey: createStorageParams.form.publicKey,
+          responseMode: ResponseMode.Encrypt,
+          status: Status.Private,
+          title: createStorageParams.form.title,
+          form_fields: [],
+          form_logics: [],
+        }),
+      )
+    })
+
+    it('should return 400 when body.form.publicKey is missing', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          responseMode: 'encrypt',
+          title: 'storage mode form test',
+          // Missing publicKey value.
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'form.publicKey' } }),
+      )
+    })
+
+    it('should return 400 when body.form.responseMode is missing', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          // responseMode missing.
+          title: 'storage mode form test',
+          emails: 'some@example.com',
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'form.responseMode' } }),
+      )
+    })
+
+    it('should return 400 when body.form.title is missing', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          // title is missing.
+          responseMode: ResponseMode.Email,
+          emails: 'some@example.com',
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'form.title' } }),
+      )
+    })
+
+    it('should return 400 when body.form.emails is missing when creating an email form', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          // body.emails missing.
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'form.emails' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.form.emails is an empty string when creating an email form', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          emails: '',
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'form.emails',
+            message: '"form.emails" is not allowed to be empty',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.form.emails is an empty array when creating an email form', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          emails: [],
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'form.emails',
+            message: '"form.emails" must contain at least 1 items',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.form.publicKey is missing when creating a storage mode form', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          title: 'new storage mode form',
+          responseMode: ResponseMode.Encrypt,
+          // publicKey missing.
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'form.publicKey',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.form.publicKey is an empty string when creating a storage mode form', async () => {
+      // Act
+      const response = await request.post('/adminform').send({
+        form: {
+          title: 'new storage mode form',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: '',
+        },
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'form.publicKey',
+            message: '"form.publicKey" contains an invalid value',
+          },
+        }),
+      )
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.post('/adminform').send('does not matter')
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 413 when a payload for created form exceeds the size limit', async () => {
+      // Arrange
+      const createStorageParams = {
+        form: {
+          responseMode: 'encrypt',
+          title: 'storage mode form test',
+          publicKey: 'some random public key',
+        },
+      }
+
+      const payloadSizeError = new DatabasePayloadSizeError(
+        'Creating a real > 16MB file in tests did not seem like a good idea',
+      )
+      jest
+        .spyOn(AdminFormService, 'createForm')
+        .mockReturnValueOnce(errAsync(payloadSizeError))
+
+      // Act
+      const response = await request
+        .post('/adminform')
+        .send(createStorageParams)
+
+      // Assert
+      expect(response.status).toEqual(413)
+      expect(response.body).toEqual({ message: payloadSizeError.message })
+    })
+
+    it('should return 422 when user cannot be found in the database', async () => {
+      // Arrange
+      const createEmailParams = {
+        form: {
+          emails: defaultUser.email,
+          responseMode: 'email',
+          title: 'email mode form test',
+        },
+      }
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.post('/adminform').send(createEmailParams)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 422 when form creation results in a database validation error', async () => {
+      // Arrange
+      const emailParamsWithInvalidDomain = {
+        form: {
+          emails: defaultUser.email,
+          responseMode: 'email',
+          title: 'email mode form test should fail',
+          permissionList: [{ email: 'invalidEmailDomain@example.com' }],
+        },
+      }
+
+      // Act
+      const response = await request
+        .post('/adminform')
+        .send(emailParamsWithInvalidDomain)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({
+        message:
+          'Error: [Failed to update collaborators list.]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+
+    it('should return 500 when database error occurs whilst creating a form', async () => {
+      // Arrange
+      const createStorageParams = {
+        form: {
+          responseMode: 'encrypt',
+          title: 'storage mode form test',
+          publicKey: 'some random public key',
+        },
+      }
+
+      const databaseError = new DatabaseError('something went wrong')
+      jest
+        .spyOn(AdminFormService, 'createForm')
+        .mockReturnValueOnce(errAsync(databaseError))
+
+      // Act
+      const response = await request
+        .post('/adminform')
+        .send(createStorageParams)
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: databaseError.message,
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform', () => {
+    it('should return 200 with retrieved form when user is admin', async () => {
+      // Arrange
+      const ownForm = await EmailFormModel.create({
+        title: 'Own form',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(`/${ownForm._id}/adminform`)
+
+      // Assert
+      const expected = await FormModel.findById(ownForm._id)
+        .populate({
+          path: 'admin',
+          populate: {
+            path: 'agency',
+          },
+        })
+        .lean()
+      expect(response.status).toEqual(200)
+      expect(response.body).not.toBeNull()
+      expect(response.body).toEqual({
+        form: jsonParseStringify(expected),
+      })
+    })
+
+    it('should return 200 with retrieved form when user has read permissions', async () => {
+      // Arrange
+      // Create separate user
+      const collabUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'collab-user',
+          shortName: 'collabUser',
+        })
+      ).user
+
+      const collabForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: collabUser._id,
+        permissionList: [{ email: defaultUser.email, write: false }],
+      })
+
+      // Act
+      const response = await request.get(`/${collabForm._id}/adminform`)
+
+      // Assert
+      const expected = await FormModel.findById(collabForm._id)
+        .populate({
+          path: 'admin',
+          populate: {
+            path: 'agency',
+          },
+        })
+        .lean()
+      expect(response.status).toEqual(200)
+      expect(response.body).not.toBeNull()
+      expect(response.body).toEqual({
+        form: jsonParseStringify(expected),
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(`/${new ObjectId()}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(`/${inaccessibleForm._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request.get(`/${invalidFormId}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to retrieve is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(`/${archivedForm._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(`/${new ObjectId()}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form', async () => {
+      // Arrange
+      jest
+        .spyOn(FormModel, 'getFullFormById')
+        .mockRejectedValueOnce(new Error('some error'))
+
+      // Act
+      const response = await request.get(`/${new ObjectId()}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('PUT /:formId/adminform', () => {
+    // Skipping tests for these as the endpoints will be migrated soon.
+    it.todo('test for every single update, reorder, duplicate, etc form fields')
+
+    it('should return 200 with updated form when body.form.editFormField is provided', async () => {
+      // Arrange
+      const formToUpdate = (await EmailFormModel.create({
+        title: 'Form to update',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        form_fields: [generateDefaultField(BasicField.Date)],
+      })) as IPopulatedForm
+
+      const updatedDescription = 'some new description'
+
+      // Act
+      const response = await request
+        .put(`/${formToUpdate._id}/adminform`)
+        .send({
+          form: {
+            editFormField: {
+              action: { name: EditFieldActions.Update },
+              field: {
+                ...formToUpdate.form_fields[0].toObject(),
+                description: updatedDescription,
+              },
+            },
+          },
+        })
+
+      // Assert
+      const expected = await EmailFormModel.findById(formToUpdate._id)
+        .populate({
+          path: 'admin',
+          populate: {
+            path: 'agency',
+          },
+        })
+        .lean()
+      expect(response.status).toEqual(200)
+      expect(expected?.form_fields![0].description).toEqual(updatedDescription)
+      expect(expected?.__v).toEqual(1)
+      expect(response.body).toEqual(jsonParseStringify(expected))
+    })
+
+    it('should return 400 when form has invalid updates to be performed', async () => {
+      // Arrange
+      const formToUpdate = (await EmailFormModel.create({
+        title: 'Form to update',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        form_fields: [generateDefaultField(BasicField.Date)],
+      })) as IPopulatedForm
+      // Delete field
+      const clonedForm = cloneDeep(formToUpdate)
+      clonedForm.form_fields = []
+      await clonedForm.save()
+
+      // Act
+      const response = await request
+        .put(`/${formToUpdate._id}/adminform`)
+        .send({
+          form: {
+            editFormField: {
+              action: { name: EditFieldActions.Update },
+              field: {
+                ...formToUpdate.form_fields[0].toObject(),
+                description: 'some new description',
+              },
+            },
+          },
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Field to be updated does not exist',
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      const formToUpdate = await EmailFormModel.create({
+        title: 'Form to update',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .put(`/${formToUpdate._id}/adminform`)
+        .send({
+          form: { permissionList: [{ email: 'test@example.com' }] },
+        })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have permissions to update form', async () => {
+      // Arrange
+      // Create separate user
+      const collabUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'collab-user',
+          shortName: 'collabUser',
+        })
+      ).user
+      const randomForm = await EncryptFormModel.create({
+        title: 'form that user has no write access to',
+        admin: collabUser._id,
+        publicKey: 'some random key',
+        // Current user only has read access.
+        permissionList: [{ email: defaultUser.email }],
+      })
+
+      // Act
+      const response = await request.put(`/${randomForm._id}/adminform`).send({
+        form: { permissionList: [{ email: 'test@example.com' }] },
+      })
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: `User ${defaultUser.email} not authorized to perform write operation on Form ${randomForm._id} with title: ${randomForm.title}.`,
+      })
+    })
+
+    it('should return 404 when form to update cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId()
+
+      // Act
+      const response = await request.put(`/${invalidFormId}/adminform`).send({
+        form: { permissionList: [{ email: 'test@example.com' }] },
+      })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      // Create archived form.
+      const archivedForm = await EmailFormModel.create({
+        title: 'Form already archived',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        status: Status.Archived,
+      })
+
+      // Act
+      const response = await request
+        .put(`/${archivedForm._id}/adminform`)
+        .send({
+          form: { permissionList: [{ email: 'test@example.com' }] },
+        })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be found in the database', async () => {
+      // Arrange
+      const formToArchive = await EmailFormModel.create({
+        title: 'Form to archive',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .put(`/${formToArchive._id}/adminform`)
+        .send({
+          form: { permissionList: [{ email: 'test@example.com' }] },
+        })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst updating form', async () => {
+      // Arrange
+      const formToUpdate = (await EmailFormModel.create({
+        title: 'Form to update',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedForm
+      formToUpdate.save = jest
+        .fn()
+        .mockRejectedValue(new Error('something happened'))
+
+      jest
+        .spyOn(AuthService, 'getFormAfterPermissionChecks')
+        .mockReturnValue(okAsync(formToUpdate))
+
+      // Act
+      const response = await request
+        .put(`/${formToUpdate._id}/adminform`)
+        .send({
+          form: { permissionList: [{ email: 'test@example.com' }] },
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Error: [something happened]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+  })
+
+  describe('DELETE /:formId/adminform', () => {
+    it('should return 200 with success message when form is successfully archived', async () => {
+      // Arrange
+      const formToArchive = await EmailFormModel.create({
+        title: 'Form to archive',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      expect(formToArchive.status).toEqual(Status.Private)
+
+      // Act
+      const response = await request.delete(`/${formToArchive._id}/adminform`)
+
+      // Assert
+      const form = await EmailFormModel.findById(formToArchive._id)
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+      expect(form?.status).toEqual(Status.Archived)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+      const formToArchive = await EmailFormModel.create({
+        title: 'Form to archive',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.delete(`/${formToArchive._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have permissions to archive form', async () => {
+      // Arrange
+      // Create separate user
+      const collabUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'collab-user',
+          shortName: 'collabUser',
+        })
+      ).user
+      const randomForm = await EncryptFormModel.create({
+        title: 'form that user has no delete access to',
+        admin: collabUser._id,
+        publicKey: 'some random key',
+        // Current user only has write access but not admin.
+        permissionList: [{ email: defaultUser.email, write: true }],
+      })
+
+      // Act
+      const response = await request.delete(`/${randomForm._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: `User ${defaultUser.email} not authorized to perform delete operation on Form ${randomForm._id} with title: ${randomForm.title}.`,
+      })
+    })
+
+    it('should return 404 when form to archive cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId()
+
+      // Act
+      const response = await request.delete(`/${invalidFormId}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      // Create archived form.
+      const archivedForm = await EmailFormModel.create({
+        title: 'Form already archived',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        status: Status.Archived,
+      })
+
+      // Act
+      const response = await request.delete(`/${archivedForm._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be found in the database', async () => {
+      // Arrange
+      const formToArchive = await EmailFormModel.create({
+        title: 'Form to archive',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.delete(`/${formToArchive._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst archiving form', async () => {
+      // Arrange
+      const formToArchive = await EmailFormModel.create({
+        title: 'Form to archive',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      // Mock database error during archival.
+      jest
+        .spyOn(AdminFormService, 'archiveForm')
+        .mockReturnValueOnce(errAsync(new DatabaseError()))
+
+      // Act
+      const response = await request.delete(`/${formToArchive._id}/adminform`)
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('POST /:formId/adminform', () => {
+    it('should return 200 with the duplicated form dashboard view', async () => {
+      // Arrange
+      // Create form.
+      const formToDupe = await EmailFormModel.create({
+        title: 'Original form title',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      const dupeParams = {
+        responseMode: ResponseMode.Encrypt,
+        title: 'new duplicated form title',
+        publicKey: 'some public key',
+      }
+
+      // Act
+      const response = await request
+        .post(`/${formToDupe._id}/adminform`)
+        .send(dupeParams)
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(
+        expect.objectContaining({
+          _id: expect.any(String),
+          admin: expect.objectContaining({
+            _id: String(defaultUser._id),
+          }),
+          responseMode: dupeParams.responseMode,
+          title: dupeParams.title,
+          status: Status.Private,
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is missing when duplicating to an email form', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'new email form',
+        responseMode: ResponseMode.Email,
+        // body.emails missing.
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'emails' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is an empty string when duplicating to an email form', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'new email form',
+        responseMode: ResponseMode.Email,
+        emails: '',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'emails',
+            message: '"emails" is not allowed to be empty',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is an empty array when duplicating to an email form', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'new email form',
+        responseMode: ResponseMode.Email,
+        emails: [],
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'emails',
+            message: '"emails" must contain at least 1 items',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.publicKey is missing when duplicating to a storage mode form', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'new storage mode form',
+        responseMode: ResponseMode.Encrypt,
+        // publicKey missing.
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'publicKey',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.publicKey is an empty string when duplicating to a storage mode form', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'new storage mode form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: '',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'publicKey',
+            message: '"publicKey" contains an invalid value',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.title is missing', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        // title is missing.
+        responseMode: ResponseMode.Email,
+        emails: 'test@example.com',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'title' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.responseMode is missing', async () => {
+      // Arrange
+      const formToDupe = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+      })
+
+      // Act
+      const response = await request.post(`/${formToDupe._id}/adminform`).send({
+        title: 'something',
+        // responseMode missing.
+        emails: 'test@example.com',
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'responseMode' },
+        }),
+      )
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+      // Create form.
+      const formToDupe = await EmailFormModel.create({
+        title: 'Original form title',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${formToDupe._id}/adminform`)
+        .send('does not matter')
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      // Create separate user
+      const someUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const randomForm = await EncryptFormModel.create({
+        title: 'form that user has no delete access to',
+        admin: someUser._id,
+        publicKey: 'some random key',
+        // Current user has no access to this form,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.post(`/${randomForm._id}/adminform`).send({
+        responseMode: ResponseMode.Encrypt,
+        title: 'new duplicated form title',
+        publicKey: 'some public key',
+      })
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: `User ${defaultUser.email} not authorized to perform read operation on Form ${randomForm._id} with title: ${randomForm.title}.`,
+      })
+    })
+
+    it('should return 404 when form to duplicate cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId()
+
+      // Act
+      const response = await request.post(`/${invalidFormId}/adminform`).send({
+        responseMode: ResponseMode.Encrypt,
+        title: 'new duplicated form title',
+        publicKey: 'some public key',
+      })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      // Create archived form.
+      const archivedForm = await EmailFormModel.create({
+        title: 'Form already archived',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        status: Status.Archived,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${archivedForm._id}/adminform`)
+        .send({
+          responseMode: ResponseMode.Email,
+          emails: 'anyrandomEmail@example.com',
+          title: 'cool new title',
+        })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be found in the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.post(`/${new ObjectId()}/adminform`).send({
+        responseMode: ResponseMode.Encrypt,
+        title: 'does not matter',
+        publicKey: 'some public key',
+      })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst duplicating form', async () => {
+      // Arrange
+      // Create form.
+      const formToDupe = await EmailFormModel.create({
+        title: 'Original form title',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Force validation error that will be returned as database error
+      // TODO(#614): Return transformMongoError instead of DatabaseError for better mongoose error handling.
+      const invalidEmailDupeParams = {
+        responseMode: ResponseMode.Email,
+        emails: 'notAnEmail, should return error',
+        title: 'cool new title',
+      }
+
+      // Act
+      const response = await request
+        .post(`/${formToDupe._id}/adminform`)
+        .send(invalidEmailDupeParams)
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'Please provide valid email addresses',
+        ),
+      })
+    })
+  })
+
+  describe('POST /:formId/adminform/transfer-owner', () => {
+    it('should return 200 with updated form and owner transferred', async () => {
+      // Arrange
+      const formToTransfer = await EmailFormModel.create({
+        title: 'Original form title',
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      const newOwner = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'new-owner',
+          shortName: 'newOwner',
+        })
+      ).user
+
+      // Act
+      const response = await request
+        .post(`/${formToTransfer._id}/adminform/transfer-owner`)
+        .send({
+          email: newOwner.email,
+        })
+
+      // Assert
+      const expected = {
+        form: expect.objectContaining({
+          _id: String(formToTransfer._id),
+          // Admin should be new owner.
+          admin: expect.objectContaining({
+            _id: String(newOwner._id),
+          }),
+          // Original owner should still have write permissions.
+          permissionList: [
+            expect.objectContaining({
+              email: defaultUser.email,
+              write: true,
+            }),
+          ],
+        }),
+      }
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expected)
+    })
+
+    it('should return 400 when body.email is missing', async () => {
+      // Arrange
+      const someFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .post(`/${someFormId}/adminform/transfer-owner`)
+        // Missing email.
+        .send({})
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'email' } }),
+      )
+    })
+
+    it('should return 400 when body.email is an invalid email', async () => {
+      // Arrange
+      const someFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .post(`/${someFormId}/adminform/transfer-owner`)
+        .send({ email: 'not an email' })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'email', message: 'Please enter a valid email' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.email contains multiple emails', async () => {
+      // Arrange
+      const someFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .post(`/${someFormId}/adminform/transfer-owner`)
+        .send({ email: 'first@example.com,second@example.com' })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'email', message: 'Please enter a valid email' },
+        }),
+      )
+    })
+
+    it('should return 400 when the new owner is not in the database', async () => {
+      // Arrange
+      const emailNotInDb = 'notInDb@example.com'
+      const formToTransfer = await EncryptFormModel.create({
+        title: 'Original form title',
+        admin: defaultUser._id,
+        publicKey: 'some public key',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${formToTransfer._id}/adminform/transfer-owner`)
+        .send({ email: emailNotInDb })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: `${emailNotInDb} must have logged in once before being added as Owner`,
+      })
+    })
+
+    it('should return 400 when the new owner is already the current owner', async () => {
+      // Arrange
+      const formToTransfer = await EncryptFormModel.create({
+        title: 'Original form title',
+        admin: defaultUser._id,
+        publicKey: 'some public key',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${formToTransfer._id}/adminform/transfer-owner`)
+        .send({ email: defaultUser.email })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'You are already the owner of this form',
+      })
+    })
+
+    it('should return 403 when current user is not the owner of the form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const yetAnotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'anotheranother-user',
+          shortName: 'someOtherUser',
+        })
+      ).user
+      const notOwnerForm = await EmailFormModel.create({
+        title: 'Original form title',
+        emails: [anotherUser.email],
+        admin: anotherUser._id,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${notOwnerForm._id}/adminform/transfer-owner`)
+        .send({ email: yetAnotherUser.email })
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform delete operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to transfer cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+
+      // Act
+      const response = await request
+        .post(`/${invalidFormId}/adminform/transfer-owner`)
+        .send({ email: anotherUser.email })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({
+        message: 'Form not found',
+      })
+    })
+
+    it('should return 410 when the form to transfer is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'Original form title',
+        admin: defaultUser._id,
+        publicKey: 'some public key',
+        // Already deleted.
+        status: Status.Archived,
+      })
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+
+      // Act
+      const response = await request
+        .post(`/${archivedForm._id}/adminform/transfer-owner`)
+        .send({ email: anotherUser.email })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when the user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const formToTransfer = await EncryptFormModel.create({
+        title: 'Original form title',
+        admin: defaultUser._id,
+        publicKey: 'some public key',
+      })
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .post(`/${formToTransfer._id}/adminform/transfer-owner`)
+        .send({ email: anotherUser.email })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+
+  describe('GET /:formId/adminform/template', () => {
+    it("should return 200 with target form's public view", async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Create public form
+      const publicForm = await FormModel.create({
+        title: 'some public form',
+        status: Status.Public,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        form_fields: [
+          generateDefaultField(BasicField.Date),
+          generateDefaultField(BasicField.Nric),
+        ],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${publicForm._id}/adminform/template`,
+      )
+
+      // Assert
+      const populatedForm = await publicForm
+        .populate({ path: 'admin', populate: { path: 'agency' } })
+        .execPopulate()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        form: jsonParseStringify(populatedForm.getPublicView()),
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/template`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when the target form is private', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Create private form
+      const privateForm = await FormModel.create({
+        title: 'some private form',
+        status: Status.Private,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        form_fields: [generateDefaultField(BasicField.Nric)],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${privateForm._id}/adminform/template`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        formTitle: privateForm.title,
+        isPageFound: true,
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 404 when the form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/template`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when the form is already archived', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const archivedForm = await FormModel.create({
+        title: 'some archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        form_fields: [generateDefaultField(BasicField.Nric)],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/template`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been deleted' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form', async () => {
+      // Arrange
+      const formToRetrieve = await FormModel.create({
+        title: 'some form',
+        status: Status.Public,
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+        form_fields: [generateDefaultField(BasicField.Nric)],
+      })
+      // Mock database error.
+      jest
+        .spyOn(FormModel, 'getFullFormById')
+        .mockRejectedValueOnce(new Error('something went wrong'))
+
+      // Act
+      const response = await request.get(
+        `/${formToRetrieve._id}/adminform/template`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('POST /:formId/adminform/copy', () => {
+    let formToCopy: IFormDocument
+    let anotherUser: IUserSchema
+
+    beforeEach(async () => {
+      anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      formToCopy = (await EncryptFormModel.create({
+        title: 'some form',
+        admin: anotherUser._id,
+        publicKey: 'some random key',
+        // Must be public to copy
+        status: Status.Public,
+      })) as IFormDocument
+    })
+
+    it('should return 200 with duplicated form dashboard view when copying to an email mode form', async () => {
+      // Act
+      const bodyParams = {
+        title: 'some title',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+      }
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send(bodyParams)
+
+      // Assert
+      const expected = expect.objectContaining({
+        _id: expect.any(String),
+        admin: expect.objectContaining({
+          _id: defaultUser.id,
+        }),
+        title: bodyParams.title,
+        responseMode: bodyParams.responseMode,
+      })
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expected)
+    })
+
+    it('should return 200 with duplicated form dashboard view when copying to a storage mode form', async () => {
+      // Act
+      const bodyParams = {
+        title: 'some other title',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+      }
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send(bodyParams)
+
+      // Assert
+      const expected = expect.objectContaining({
+        _id: expect.any(String),
+        admin: expect.objectContaining({
+          _id: defaultUser.id,
+        }),
+        title: bodyParams.title,
+        responseMode: bodyParams.responseMode,
+      })
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expected)
+    })
+
+    it('should return 400 when body.responseMode is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'some title',
+          // body.responseMode is missing
+          emails: [defaultUser.email],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'responseMode' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.responseMode is invalid', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'some title',
+          responseMode: 'some rubbish',
+          emails: [defaultUser.email],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'responseMode',
+            message: `"responseMode" must be one of [${Object.values(
+              ResponseMode,
+            ).join(', ')}]`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.title is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          // body.title missing
+          responseMode: ResponseMode.Email,
+          emails: [defaultUser.email],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'title' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is missing when copying to an email form', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          // body.emails missing.
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'emails' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is an empty string when copying to an email form', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          emails: '',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'emails',
+            message: '"emails" is not allowed to be empty',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.emails is an empty array when copying to an email form', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'new email form',
+          responseMode: ResponseMode.Email,
+          emails: [],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'emails',
+            message: '"emails" must contain at least 1 items',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.publicKey is missing when copying to a storage mode form', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'new storage mode form',
+          responseMode: ResponseMode.Encrypt,
+          // publicKey missing.
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'publicKey',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.publicKey is an empty string when copying to a storage mode form', async () => {
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'new storage mode form',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: '',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'publicKey',
+            message: '"publicKey" contains an invalid value',
+          },
+        }),
+      )
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.post(`/${new ObjectId()}/adminform/copy`)
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when form to copy is private', async () => {
+      // Arrange
+      const bodyParams = {
+        title: 'some title',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+      }
+      // Create private form
+      const privateForm = await FormModel.create({
+        title: 'some private form',
+        status: Status.Private,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        form_fields: [generateDefaultField(BasicField.Nric)],
+      })
+
+      // Act
+      const response = await request
+        .post(`/${privateForm._id}/adminform/copy`)
+        .send(bodyParams)
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: 'Form must be public to be copied',
+      })
+    })
+
+    it('should return 404 when the form cannot be found', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/copy`)
+        .send({
+          title: 'some new title',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: 'booyeah',
+        })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({
+        message: 'Form not found',
+      })
+    })
+
+    it('should return 410 when the form to copy is archived', async () => {
+      // Arrange
+      // Create archived form.
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: anotherUser._id,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${archivedForm._id}/adminform/copy`)
+        .send({
+          title: 'some new title',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: 'booyeah',
+        })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({
+        message: 'Form has been deleted',
+      })
+    })
+
+    it('should return 422 when the user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'some new title',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: 'booyeah',
+        })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst copying form', async () => {
+      // Arrange
+      // Mock database error.
+      const mockErrorString = 'something went wrong'
+      jest
+        .spyOn(FormModel, 'create')
+        // @ts-ignore
+        .mockRejectedValueOnce(new Error(mockErrorString))
+
+      // Act
+      const response = await request
+        .post(`/${formToCopy._id}/adminform/copy`)
+        .send({
+          title: 'some new title',
+          responseMode: ResponseMode.Encrypt,
+          publicKey: 'booyeah',
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: `Error: [${mockErrorString}]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.`,
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/preview', () => {
+    it("should return 200 with own form's public form view even when private", async () => {
+      // Arrange
+      const formToPreview = await EncryptFormModel.create({
+        title: 'some form',
+        admin: defaultUser._id,
+        publicKey: 'some random key',
+        // Private status.
+        status: Status.Private,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${formToPreview._id}/adminform/preview`,
+      )
+
+      // Assert
+      const expectedForm = (
+        await formToPreview
+          .populate({
+            path: 'admin',
+            populate: {
+              path: 'agency',
+            },
+          })
+          .execPopulate()
+      ).getPublicView()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        form: jsonParseStringify(expectedForm),
+      })
+    })
+
+    it("should return 200 with collaborator's form's public form view", async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const collabFormToPreview = await EmailFormModel.create({
+        title: 'some form',
+        admin: anotherUser._id,
+        emails: [anotherUser.email],
+        // Only read permissions.
+        permissionList: [{ email: defaultUser.email }],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${collabFormToPreview._id}/adminform/preview`,
+      )
+
+      // Assert
+      const expectedForm = (
+        await collabFormToPreview
+          .populate({
+            path: 'admin',
+            populate: {
+              path: 'agency',
+            },
+          })
+          .execPopulate()
+      ).getPublicView()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ form: jsonParseStringify(expectedForm) })
+    })
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      const unauthedForm = await EmailFormModel.create({
+        title: 'some form',
+        admin: anotherUser._id,
+        emails: [anotherUser.email],
+        // defaultUser does not have read permissions.
+      })
+
+      // Act
+      const response = await request.get(
+        `/${unauthedForm._id}/adminform/preview`,
+      )
+
+      // Arrange
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to preview cannot be found', async () => {
+      // Act
+      const response = await request.get(`/${new ObjectId()}/adminform/preview`)
+
+      // Arrange
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({
+        message: 'Form not found',
+      })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/preview`,
+      )
+
+      // Arrange
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({
+        message: 'Form has been archived',
+      })
+    })
+
+    it('should return 422 when user in session cannot be found in the database', async () => {
+      // Arrange
+      const formToPreview = await EmailFormModel.create({
+        title: 'some other form',
+        admin: defaultUser._id,
+        status: Status.Public,
+        emails: [defaultUser.email],
+      })
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${formToPreview._id}/adminform/preview`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({
+        message: 'User not found',
+      })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form to preview', async () => {
+      // Arrange
+      const formToPreview = await EmailFormModel.create({
+        title: 'some other form',
+        admin: defaultUser._id,
+        status: Status.Public,
+        emails: [defaultUser.email],
+      })
+      // Mock database error.
+      jest
+        .spyOn(FormModel, 'getFullFormById')
+        .mockRejectedValueOnce(new Error('something went wrong'))
+
+      // Act
+      const response = await request.get(
+        `/${formToPreview._id}/adminform/preview`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/feedback', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with empty feedback meta when no feedback exists', async () => {
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        count: 0,
+        feedback: [],
+      })
+    })
+
+    it('should return 200 with form feedback meta when feedback exists', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      const expected = {
+        average: (
+          formFeedbacks.reduce((a, b) => a + b.rating, 0) / formFeedbacks.length
+        ).toFixed(2),
+        count: formFeedbacks.length,
+        feedback: [
+          expect.objectContaining({
+            comment: formFeedbacks[0].comment,
+            rating: formFeedbacks[0].rating,
+            date: expect.any(String),
+            dateShort: expect.any(String),
+            timestamp: expect.any(Number),
+            index: 1,
+          }),
+          expect.objectContaining({
+            comment: formFeedbacks[1].comment,
+            rating: formFeedbacks[1].rating,
+            date: expect.any(String),
+            dateShort: expect.any(String),
+            timestamp: expect.any(Number),
+            index: 2,
+          }),
+        ],
+      }
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expected)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${inaccessibleForm._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form feedback', async () => {
+      // Arrange
+      // Mock database error
+      // @ts-ignore
+      jest.spyOn(FormFeedbackModel, 'find').mockImplementationOnce(() => ({
+        sort: jest.fn().mockReturnThis(),
+        exec: jest
+          .fn()
+          .mockRejectedValueOnce(new Error('something went wrong')),
+      }))
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Error: [something went wrong]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/feedback/count', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with 0 count when no feedback exists', async () => {
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with feedback count when feedback exists', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(formFeedbacks.length)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${inaccessibleForm._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form feedback', async () => {
+      // Arrange
+      // Mock database error
+      // @ts-ignore
+      jest.spyOn(FormFeedbackModel, 'countDocuments').mockReturnValueOnce({
+        exec: jest
+          .fn()
+          .mockRejectedValueOnce(new Error('something went wrong')),
+      })
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Error: [something went wrong]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/feedback/download', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with feedback stream when feedbacks exist', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request
+        .get(`/${formForFeedback._id}/adminform/feedback/download`)
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => {
+            cb(null, JSON.parse(buffer))
+          })
+        })
+
+      // Assert
+      const expected = await FormFeedbackModel.find({
+        formId: formForFeedback._id,
+      }).exec()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(jsonParseStringify(expected))
+    })
+
+    it('should return 200 with empty stream when feedbacks do not exist', async () => {
+      // Act
+      const response = await request
+        .get(`/${formForFeedback._id}/adminform/feedback/download`)
+        .buffer()
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual([])
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${inaccessibleForm._id}/adminform/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${formForFeedback._id}/adminform/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+
+  describe('GET /:formId/adminform/submissions', () => {
+    let defaultForm: IFormDocument
+
+    beforeEach(async () => {
+      defaultForm = (await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'any public key',
+        admin: defaultUser._id,
+      })) as IFormDocument
+    })
+
+    it('should return 200 with encrypted submission data of queried submissionId (without attachments)', async () => {
+      // Arrange
+      const expectedSubmissionParams = {
+        encryptedContent: 'any encrypted content',
+        verifiedContent: 'any verified content',
+      }
+      const submission = await createSubmission({
+        form: defaultForm,
+        ...expectedSubmissionParams,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(submission._id),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        attachmentMetadata: {},
+        content: expectedSubmissionParams.encryptedContent,
+        refNo: String(submission._id),
+        submissionTime: expect.any(String),
+        verified: expectedSubmissionParams.verifiedContent,
+      })
+    })
+
+    it('should return 200 with encrypted submission data of queried submissionId (with attachments)', async () => {
+      // Arrange
+      const expectedSubmissionParams = {
+        encryptedContent: 'any encrypted content',
+        verifiedContent: 'any verified content',
+        attachmentMetadata: new Map([
+          ['fieldId1', 'some.attachment.url'],
+          ['fieldId2', 'some.other.attachment.url'],
+        ]),
+      }
+      const submission = await createSubmission({
+        form: defaultForm,
+        ...expectedSubmissionParams,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(submission._id),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        attachmentMetadata: {
+          fieldId1: expect.stringContaining(
+            expectedSubmissionParams.attachmentMetadata.get('fieldId1') ?? 'no',
+          ),
+          fieldId2: expect.stringContaining(
+            expectedSubmissionParams.attachmentMetadata.get('fieldId2') ?? 'no',
+          ),
+        },
+        content: expectedSubmissionParams.encryptedContent,
+        refNo: String(submission._id),
+        submissionTime: expect.any(String),
+        verified: expectedSubmissionParams.verifiedContent,
+      })
+    })
+
+    it('should return 400 when form of given formId is not an encrypt mode form', async () => {
+      // Arrange
+      const emailForm = await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${emailForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Attempted to submit encrypt form to email endpoint',
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request
+        .get(`/${inaccessibleForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when submission cannot be found', async () => {
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({
+        message: 'Unable to find encrypted submission from database',
+      })
+    })
+
+    it('should return 404 when form to retrieve submission for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .get(`/${invalidFormId}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to retrieve submission for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${archivedForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .get(`/${new ObjectId()}/adminform/submissions`)
+        .query({
+          submissionId: String(new ObjectId()),
+        })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving submission', async () => {
+      // Arrange
+      jest
+        .spyOn(EncryptSubmissionModel, 'findEncryptedSubmissionById')
+        .mockRejectedValueOnce(new Error('ohno'))
+      const submission = await createSubmission({
+        form: defaultForm,
+        encryptedContent: 'any encrypted content',
+        verifiedContent: 'any verified content',
+      })
+
+      // Act
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(submission._id),
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: expect.stringContaining('ohno'),
+      })
+    })
+
+    it('should return 500 when error occurs whilst creating presigned attachment urls', async () => {
+      // Arrange
+      // Mock error.
+      jest
+        .spyOn(aws.s3, 'getSignedUrlPromise')
+        .mockRejectedValueOnce(new Error('something went wrong'))
+
+      const submission = await createSubmission({
+        form: defaultForm,
+        encryptedContent: 'any encrypted content',
+        verifiedContent: 'any verified content',
+        attachmentMetadata: new Map([
+          ['fieldId1', 'some.attachment.url'],
+          ['fieldId2', 'some.other.attachment.url'],
+        ]),
+      })
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions`)
+        .query({
+          submissionId: String(submission._id),
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Failed to create attachment URL',
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/submissions/count', () => {
+    it('should return 200 with 0 count when email mode form has no submissions', async () => {
+      // Arrange
+      const newForm = await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${newForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with 0 count when storage mode form has no submissions', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${newForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with form submission counts for email mode forms', async () => {
+      // Arrange
+      const expectedSubmissionCount = 5
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+
+      // Act
+      const response = await request.get(
+        `/${newForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expectedSubmissionCount)
+    })
+
+    it('should return 200 with form submission counts for storage mode forms', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+      await Promise.all(
+        times(expectedSubmissionCount, (count) => {
+          return SubmissionModel.create({
+            submissionType: SubmissionType.Encrypt,
+            form: newForm._id,
+            authType: newForm.authType,
+            myInfoFields: newForm.getUniqueMyInfoAttrs(),
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map(),
+            version: 1,
+          })
+        }),
+      )
+
+      // Act
+      const response = await request.get(
+        `/${newForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expectedSubmissionCount)
+    })
+
+    it('should return 200 with counts of submissions made between given start and end dates.', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      const results = await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+      // Update first submission to be 5 days ago.
+      const now = new Date()
+      const firstSubmission = results[0]._unsafeUnwrap()
+      firstSubmission.created = subDays(now, 5)
+      await firstSubmission.save()
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: format(subDays(now, 6), 'yyyy-MM-dd'),
+          endDate: format(subDays(now, 3), 'yyyy-MM-dd'),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(1)
+    })
+
+    it('should return 400 when query.startDate is missing when query.endDate is provided', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          endDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message:
+              '"endDate" date references "ref:startDate" which must have a valid date format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is missing when query.startDate is provided', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: '',
+            message:
+              '"value" contains [startDate] without its required peers [endDate]',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.startDate is malformed', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: 'not a date',
+          endDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'startDate',
+            message: '"startDate" must be in YYYY-MM-DD format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is malformed', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+          // Wrong format
+          endDate: '04-06-1993',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message: '"endDate" must be in YYYY-MM-DD format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is before query.startDate', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+          endDate: '2020-01-01',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message: '"endDate" must be greater than "ref:startDate"',
+          },
+        }),
+      )
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${inaccessibleForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to retrieve submission counts for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request.get(
+        `/${invalidFormId}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to retrieve submission counts for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst counting submissions', async () => {
+      // Arrange
+      const form = await EmailFormModel.create({
+        title: 'normal form',
+        status: Status.Private,
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      // @ts-ignore
+      jest.spyOn(SubmissionModel, 'countDocuments').mockReturnValueOnce({
+        exec: jest.fn().mockRejectedValueOnce(new Error('some error')),
+      })
+
+      // Act
+      const response = await request.get(
+        `/${form._id}/adminform/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/submissions/metadata', () => {
+    let defaultForm: IFormDocument
+
+    beforeEach(async () => {
+      defaultForm = (await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'any public key',
+        admin: defaultUser._id,
+      })) as IFormDocument
+    })
+
+    it('should return 200 with empty results if no metadata exists', async () => {
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 1,
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ count: 0, metadata: [] })
+    })
+
+    it('should return 200 with requested page of metadata when metadata exists', async () => {
+      // Arrange
+      // Create 11 submissions
+      const submissions = (
+        await Promise.all(
+          times(11, (count) =>
+            createSubmission({
+              form: defaultForm,
+              encryptedContent: `any encrypted content ${count}`,
+              verifiedContent: `any verified content ${count}`,
+            }),
+          ),
+        )
+      )
+        // @ts-ignore
+        .sort((a, b) => b.created! - a.created!)
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 1,
+        })
+
+      // Assert
+      // Take first 10 submissions
+      const expected = take(submissions, 10).map((s, index) => ({
+        number: 11 - index,
+        refNo: String(s._id),
+        submissionTime: expect.any(String),
+      }))
+      expect(response.status).toEqual(200)
+      // Should be 11, but only return metadata of last 10 submissions due to page size.
+      expect(response.body).toEqual({
+        count: 11,
+        metadata: expected,
+      })
+    })
+
+    it('should return 200 with empty results if query.page does not have metadata', async () => {
+      // Arrange
+      // Create single submission
+      await createSubmission({
+        form: defaultForm,
+        encryptedContent: `any encrypted content`,
+        verifiedContent: `any verified content`,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          // Page 2 should have no submissions
+          page: 2,
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Single submission count, but no metadata returned
+      expect(response.body).toEqual({
+        count: 1,
+        metadata: [],
+      })
+    })
+
+    it('should return 200 with metadata of single submissionId when query.submissionId is provided', async () => {
+      // Arrange
+      // Create 3 submissions
+      const submissions = await Promise.all(
+        times(3, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+          }),
+        ),
+      )
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          submissionId: String(submissions[1]._id),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Only return the single submission id's metadata
+      expect(response.body).toEqual({
+        count: 1,
+        metadata: [
+          {
+            number: 1,
+            refNo: String(submissions[1]._id),
+            submissionTime: expect.any(String),
+          },
+        ],
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request
+        .get(`/${inaccessibleForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to retrieve submission metadata for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .get(`/${invalidFormId}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to retrieve submission metadata for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/${archivedForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .get(`/${new ObjectId()}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving submission metadata list', async () => {
+      // Arrange
+      jest
+        .spyOn(EncryptSubmissionModel, 'findAllMetadataByFormId')
+        .mockRejectedValueOnce(new Error('ohno'))
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          page: 10,
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: expect.stringContaining('ohno'),
+      })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving single submission metadata', async () => {
+      // Arrange
+      jest
+        .spyOn(EncryptSubmissionModel, 'findSingleMetadata')
+        .mockRejectedValueOnce(new Error('ohno'))
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/metadata`)
+        .query({
+          submissionId: new ObjectId().toHexString(),
+        })
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: expect.stringContaining('ohno'),
+      })
+    })
+  })
+
+  describe('GET /:formId/adminform/submissions/download', () => {
+    let defaultForm: IFormDocument
+
+    beforeEach(async () => {
+      defaultForm = (await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'any public key',
+        admin: defaultUser._id,
+      })) as IFormDocument
+    })
+
+    it('should return 200 with stream of encrypted responses without attachment URLs when query.downloadAttachments is false', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(11, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/download`)
+        .query({ downloadAttachments: false })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to not have attachment metadata.
+            attachmentMetadata: {},
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 200 with stream of encrypted responses with attachment URLs when query.downloadAttachments is true', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(5, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/download`)
+        .query({ downloadAttachments: true })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to also have attachment metadata.
+            attachmentMetadata: s.attachmentMetadata,
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+        .map((s) => ({
+          ...s,
+          // Require second map due to stringify stage prior to this.
+          attachmentMetadata: {
+            fieldId1: expect.stringContaining(s.attachmentMetadata['fieldId1']),
+            fieldId2: expect.stringContaining(s.attachmentMetadata['fieldId2']),
+          },
+        }))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 200 with stream of encrypted responses between given query.startDate and query.endDate', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(5, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+      // Set 2 submissions to be submitted 3-4 days ago.
+      const now = new Date()
+      submissions[2].created = subDays(now, 3)
+      submissions[4].created = subDays(now, 4)
+      await submissions[2].save()
+      await submissions[4].save()
+      const expectedSubmissionIds = [
+        String(submissions[2]._id),
+        String(submissions[4]._id),
+      ]
+
+      // Act
+      const response = await request
+        .get(`/${defaultForm._id}/adminform/submissions/download`)
+        .query({
+          startDate: format(subDays(now, 4), 'yyyy-MM-dd'),
+          endDate: format(subDays(now, 3), 'yyyy-MM-dd'),
+        })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to not have attachment metadata since query is false.
+            attachmentMetadata: {},
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .filter((s) => expectedSubmissionIds.includes(s._id))
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 400 when form of given formId is not an encrypt mode form', async () => {
+      // Arrange
+      const emailForm = await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${emailForm._id}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Attempted to submit encrypt form to email endpoint',
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/${defaultForm._id}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/${inaccessibleForm._id}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to download submissions for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request.get(
+        `/${invalidFormId}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to download submissions for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/${archivedForm._id}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/${new ObjectId()}/adminform/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+
+  describe('POST /:formId/adminform/images', () => {
+    const DEFAULT_POST_PARAMS = {
+      fileId: 'some file id',
+      fileMd5Hash: SparkMD5.hash('test file name'),
+      fileType: VALID_UPLOAD_FILE_TYPES[0],
+    }
+
+    it('should return 200 with presigned POST URL object', async () => {
+      // Arrange
+      const form = await EncryptFormModel.create({
+        title: 'form',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${form._id}/adminform/images`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Should equal mocked result.
+      expect(response.body).toEqual({
+        url: expect.any(String),
+        fields: expect.objectContaining({
+          'Content-MD5': DEFAULT_POST_PARAMS.fileMd5Hash,
+          'Content-Type': DEFAULT_POST_PARAMS.fileType,
+          key: DEFAULT_POST_PARAMS.fileId,
+          // Should have correct permissions.
+          acl: 'public-read',
+          bucket: expect.any(String),
+        }),
+      })
+    })
+
+    it('should return 400 when body.fileId is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          // missing fileId.
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: VALID_UPLOAD_FILE_TYPES[0],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileId' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileId is an empty string', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          fileId: '',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: VALID_UPLOAD_FILE_TYPES[1],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileId',
+            message: '"fileId" is not allowed to be empty',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileType is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          // Missing fileType.
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileType' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileType is invalid', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: 'some random type',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileType',
+            message: `"fileType" must be one of [${VALID_UPLOAD_FILE_TYPES.join(
+              ', ',
+            )}]`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileMd5Hash is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          fileId: 'some id',
+          // Missing fileMd5Hash
+          fileType: VALID_UPLOAD_FILE_TYPES[2],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileMd5Hash' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileMd5Hash is not a base64 string', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: 'rubbish hash',
+          fileType: VALID_UPLOAD_FILE_TYPES[2],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileMd5Hash',
+            message: '"fileMd5Hash" must be a valid base64 string',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when creating presigned POST URL object errors', async () => {
+      // Arrange
+      // Mock error.
+      jest
+        .spyOn(aws.s3, 'createPresignedPost')
+        // @ts-ignore
+        .mockImplementationOnce((_opts, cb) =>
+          cb(new Error('something went wrong')),
+        )
+      const form = await EncryptFormModel.create({
+        title: 'form',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${form._id}/adminform/images`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Error occurred whilst uploading file',
+      })
+    })
+
+    it('should return 404 when form to upload image to cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .post(`/${invalidFormId}/adminform/images`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to upload image to is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${archivedForm._id}/adminform/images`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/images`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+
+  describe('POST /:formId/adminform/logos', () => {
+    const DEFAULT_POST_PARAMS = {
+      fileId: 'some other file id',
+      fileMd5Hash: SparkMD5.hash('test file name again'),
+      fileType: VALID_UPLOAD_FILE_TYPES[2],
+    }
+
+    it('should return 200 with presigned POST URL object', async () => {
+      // Arrange
+      const form = await EncryptFormModel.create({
+        title: 'form',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${form._id}/adminform/logos`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(200)
+      // Should equal mocked result.
+      expect(response.body).toEqual({
+        url: expect.any(String),
+        fields: expect.objectContaining({
+          'Content-MD5': DEFAULT_POST_PARAMS.fileMd5Hash,
+          'Content-Type': DEFAULT_POST_PARAMS.fileType,
+          key: DEFAULT_POST_PARAMS.fileId,
+          // Should have correct permissions.
+          acl: 'public-read',
+          bucket: expect.any(String),
+        }),
+      })
+    })
+
+    it('should return 400 when body.fileId is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          // missing fileId.
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: VALID_UPLOAD_FILE_TYPES[0],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileId' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileId is an empty string', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          fileId: '',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: VALID_UPLOAD_FILE_TYPES[1],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileId',
+            message: '"fileId" is not allowed to be empty',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileType is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          // Missing fileType.
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileType' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileType is invalid', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: SparkMD5.hash('test file name'),
+          fileType: 'some random type',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileType',
+            message: `"fileType" must be one of [${VALID_UPLOAD_FILE_TYPES.join(
+              ', ',
+            )}]`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileMd5Hash is missing', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          fileId: 'some id',
+          // Missing fileMd5Hash
+          fileType: VALID_UPLOAD_FILE_TYPES[2],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: { key: 'fileMd5Hash' },
+        }),
+      )
+    })
+
+    it('should return 400 when body.fileMd5Hash is not a base64 string', async () => {
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send({
+          fileId: 'some id',
+          fileMd5Hash: 'rubbish hash',
+          fileType: VALID_UPLOAD_FILE_TYPES[2],
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'fileMd5Hash',
+            message: '"fileMd5Hash" must be a valid base64 string',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when creating presigned POST URL object errors', async () => {
+      // Arrange
+      // Mock error.
+      jest
+        .spyOn(aws.s3, 'createPresignedPost')
+        // @ts-ignore
+        .mockImplementationOnce((_opts, cb) =>
+          cb(new Error('something went wrong')),
+        )
+      const form = await EncryptFormModel.create({
+        title: 'form',
+        admin: defaultUser._id,
+        publicKey: 'does not matter again',
+      })
+
+      // Act
+      const response = await request
+        .post(`/${form._id}/adminform/logos`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Error occurred whilst uploading file',
+      })
+    })
+
+    it('should return 404 when form to upload logo to cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request
+        .post(`/${invalidFormId}/adminform/logos`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to upload logo to is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .post(`/${archivedForm._id}/adminform/logos`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request
+        .post(`/${new ObjectId()}/adminform/logos`)
+        .send(DEFAULT_POST_PARAMS)
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+})
+
+// Helper utils
+const createSubmission = ({
+  form,
+  encryptedContent,
+  verifiedContent,
+  attachmentMetadata,
+}: {
+  form: IFormDocument
+  encryptedContent: string
+  attachmentMetadata?: Map<string, string>
+  verifiedContent?: string
+}) => {
+  return SubmissionModel.create({
+    submissionType: SubmissionType.Encrypt,
+    form: form._id,
+    authType: form.authType,
+    myInfoFields: form.getUniqueMyInfoAttrs(),
+    attachmentMetadata,
+    encryptedContent,
+    verifiedContent,
+    version: 1,
+  })
+}
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index ae9d28738d..319204363d 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -59,24 +59,21 @@ const logger = createLoggerWithLabel(module)
  */
 export const handleListDashboardForms: RequestHandler = async (req, res) => {
   const authedUserId = (req.session as Express.AuthedSession).user._id
-  const dashboardResult = await getDashboardForms(authedUserId)
 
-  if (dashboardResult.isErr()) {
-    const { error } = dashboardResult
-    logger.error({
-      message: 'Error listing dashboard forms',
-      meta: {
-        action: 'handleListDashboardForms',
-        userId: authedUserId,
-      },
-      error,
+  return getDashboardForms(authedUserId)
+    .map((dashboardView) => res.json(dashboardView))
+    .mapErr((error) => {
+      logger.error({
+        message: 'Error listing dashboard forms',
+        meta: {
+          action: 'handleListDashboardForms',
+          userId: authedUserId,
+        },
+        error,
+      })
+      const { errorMessage, statusCode } = mapRouteError(error)
+      return res.status(statusCode).json({ message: errorMessage })
     })
-    const { errorMessage, statusCode } = mapRouteError(error)
-    return res.status(statusCode).json({ message: errorMessage })
-  }
-
-  // Success.
-  return res.json(dashboardResult.value)
 }
 
 /**
@@ -675,6 +672,16 @@ export const handleDuplicateAdminForm: RequestHandler<
   )
 }
 
+/**
+ * Handler for GET /:formId/adminform/template
+ * @security session
+ *
+ * @returns 200 with target form's public view
+ * @returns 403 when the target form is private
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 500 when database error occurs
+ */
 export const handleGetTemplateForm: RequestHandler<{ formId: string }> = (
   req,
   res,
@@ -785,9 +792,10 @@ export const handleCopyTemplateForm: RequestHandler<
  * @security session
  *
  * @returns 200 with updated form with transferred owners
+ * @returns 400 when new owner is not in the database yet
+ * @returns 400 when new owner is already current owner
  * @returns 403 when user is not the current owner of the form
  * @returns 404 when form cannot be found
- * @returns 409 when new owner is not in the database yet, or if new owner is current owner
  * @returns 410 when form is archived
  * @returns 422 when user in session cannot be retrieved from the database
  * @returns 500 when database error occurs
diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
new file mode 100644
index 0000000000..934d559a9f
--- /dev/null
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -0,0 +1,497 @@
+/**
+ * Old routes that has not been migrated to their new /api/v3/ root endpoints.
+ */
+
+import JoiDate from '@joi/date'
+import { celebrate, Joi as BaseJoi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import { VALID_UPLOAD_FILE_TYPES } from '../../../../shared/constants'
+import { IForm, ResponseMode } from '../../../../types'
+import { withUserAuthentication } from '../../auth/auth.middlewares'
+import * as EncryptSubmissionController from '../../submission/encrypt-submission/encrypt-submission.controller'
+
+import * as AdminFormController from './admin-form.controller'
+import { DuplicateFormBody } from './admin-form.types'
+
+export const AdminFormsRouter = Router()
+
+const Joi = BaseJoi.extend(JoiDate) as typeof BaseJoi
+
+// Validators
+const createFormValidator = celebrate({
+  [Segments.BODY]: {
+    form: Joi.object<Omit<IForm, 'admin'>>()
+      .keys({
+        // Require valid responsesMode field.
+        responseMode: Joi.string()
+          .valid(...Object.values(ResponseMode))
+          .required(),
+        // Require title field.
+        title: Joi.string().min(4).max(200).required(),
+        // Require emails string (for backwards compatibility) or string
+        // array if form to be created in Email mode.
+        emails: Joi.alternatives()
+          .try(Joi.array().items(Joi.string()).min(1), Joi.string())
+          .when('responseMode', {
+            is: ResponseMode.Email,
+            then: Joi.required(),
+          }),
+        // Require publicKey field if form to be created in Storage mode.
+        publicKey: Joi.string()
+          .allow('')
+          .when('responseMode', {
+            is: ResponseMode.Encrypt,
+            then: Joi.string().required().disallow(''),
+          }),
+      })
+      .required()
+      // Allow other form schema keys to be passed for form creation.
+      .unknown(true),
+  },
+})
+
+const duplicateFormValidator = celebrate({
+  [Segments.BODY]: Joi.object<DuplicateFormBody>({
+    // Require valid responsesMode field.
+    responseMode: Joi.string()
+      .valid(...Object.values(ResponseMode))
+      .required(),
+    // Require title field.
+    title: Joi.string().min(4).max(200).required(),
+    // Require emails string (for backwards compatibility) or string array
+    // if form to be duplicated in Email mode.
+    emails: Joi.alternatives()
+      .try(Joi.array().items(Joi.string()).min(1), Joi.string())
+      .when('responseMode', {
+        is: ResponseMode.Email,
+        then: Joi.required(),
+      }),
+    // Require publicKey field if form to be duplicated in Storage mode.
+    publicKey: Joi.string()
+      .allow('')
+      .when('responseMode', {
+        is: ResponseMode.Encrypt,
+        then: Joi.string().required().disallow(''),
+      }),
+  }),
+})
+
+const fileUploadValidator = celebrate({
+  [Segments.BODY]: {
+    fileId: Joi.string().required(),
+    fileMd5Hash: Joi.string().base64().required(),
+    fileType: Joi.string()
+      .valid(...VALID_UPLOAD_FILE_TYPES)
+      .required(),
+  },
+})
+
+AdminFormsRouter.route('/adminform')
+  // All HTTP methods of route protected with authentication.
+  .all(withUserAuthentication)
+  /**
+   * List the forms managed by the user
+   * @route GET /adminform
+   * @security session
+   *
+   * @returns 200 with a list of forms managed by the user
+   * @returns 401 when user is not logged in
+   * @returns 422 when user of given id cannnot be found in the database
+   * @returns 500 when database errors occur
+   */
+  .get(AdminFormController.handleListDashboardForms)
+  /**
+   * Create a new form
+   * @route POST /adminform
+   * @security session
+   *
+   * @returns 200 with newly created form
+   * @returns 400 when Joi validation fails
+   * @returns 401 when user does not exist in session
+   * @returns 409 when a database conflict error occurs
+   * @returns 413 when payload for created form exceeds size limit
+   * @returns 422 when user of given id cannnot be found in the database
+   * @returns 422 when form parameters are invalid
+   * @returns 500 when database error occurs
+   */
+  .post(createFormValidator, AdminFormController.handleCreateForm)
+
+AdminFormsRouter.route('/:formId([a-fA-F0-9]{24})/adminform')
+  // All HTTP methods of route protected with authentication.
+  .all(withUserAuthentication)
+  /**
+   * Return the specified form to the user.
+   * @route GET /:formId/adminform
+   * @security session
+   *
+   * @returns 200 with retrieved form with formId if user has read permissions
+   * @returns 401 when user does not exist in session
+   * @returns 403 when user does not have permissions to access form
+   * @returns 404 when form cannot be found
+   * @returns 410 when form is archived
+   * @returns 422 when user in session cannot be retrieved from the database
+   * @returns 500 when database error occurs
+   */
+  .get(AdminFormController.handleGetAdminForm)
+  /**
+   * Update the specified form.
+   * @route PUT /:formId/adminform
+   * @security session
+   *
+   * @returns 200 with updated form
+   * @returns 400 when form field has invalid updates to be performed
+   * @returns 401 when user does not exist in session
+   * @returns 403 when current user does not have permissions to update form
+   * @returns 404 when form to update cannot be found
+   * @returns 409 when saving updated form incurs a conflict in the database
+   * @returns 410 when form to update is archived
+   * @returns 413 when updated form is too large to be saved in the database
+   * @returns 422 when an invalid update is attempted on the form
+   * @returns 422 when user in session cannot be retrieved from the database
+   * @returns 500 when database error occurs
+   */
+  .put(AdminFormController.handleUpdateForm)
+  /**
+   * Archive the specified form.
+   * @route DELETE /:formId/adminform
+   * @security session
+   *
+   * @returns 200 with success message when successfully archived
+   * @returns 401 when user does not exist in session
+   * @returns 403 when user does not have permissions to archive form
+   * @returns 404 when form cannot be found
+   * @returns 410 when form is already archived
+   * @returns 422 when user in session cannot be retrieved from the database
+   * @returns 500 when database error occurs
+   */
+  .delete(AdminFormController.handleArchiveForm)
+  /**
+   * Duplicate the specified form.
+   * @route POST /:formId/adminform
+   * @security session
+   *
+   * @returns 200 with the duplicate form dashboard view
+   * @returns 400 when Joi validation fails
+   * @returns 401 when user does not exist in session
+   * @returns 403 when user does not have permissions to access form
+   * @returns 404 when form cannot be found
+   * @returns 410 when form is archived
+   * @returns 422 when user in session cannot be retrieved from the database
+   * @returns 500 when database error occurs
+   */
+  .post(duplicateFormValidator, AdminFormController.handleDuplicateAdminForm)
+
+/**
+ * Transfer form ownership to another user
+ * @route POST /:formId/adminform/transfer-owner
+ * @security session
+ *
+ * @returns 200 with updated form with transferred owners
+ * @returns 400 when Joi validation fails
+ * @returns 400 when new owner is not in the database yet
+ * @returns 400 when new owner is already current owner
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user is not the current owner of the form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.post(
+  '/:formId([a-fA-F0-9]{24})/adminform/transfer-owner',
+  withUserAuthentication,
+  celebrate({
+    [Segments.BODY]: {
+      email: Joi.string()
+        .required()
+        .email({
+          minDomainSegments: 2, // Number of segments required for the domain
+          tlds: { allow: true }, // TLD (top level domain) validation
+          multiple: false, // Disallow multiple emails
+        })
+        .message('Please enter a valid email'),
+    },
+  }),
+  AdminFormController.handleTransferFormOwnership,
+)
+
+/**
+ * Return the template form to the user.
+ * Only allows for public forms, for any logged in user.
+ * @route GET /:formId/adminform/template
+ * @security session
+ *
+ * @returns 200 with target form's public view
+ * @returns 401 when user does not exist in session
+ * @returns 403 when the target form is private
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/template',
+  withUserAuthentication,
+  AdminFormController.handleGetTemplateForm,
+)
+
+/**
+ * Duplicate a specified form and return that form to the user.
+ * @route GET /:formId/adminform/copy
+ * @security session
+ *
+ * @returns 200 with the duplicate form dashboard view
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when form is private
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.post(
+  '/:formId([a-fA-F0-9]{24})/adminform/copy',
+  withUserAuthentication,
+  duplicateFormValidator,
+  AdminFormController.handleCopyTemplateForm,
+)
+
+/**
+ * Return the preview form to the user.
+ * Allows for both public and private forms, only for users with at least read permission.
+ * @route GET /:formId/adminform/preview
+ * @security session
+ *
+ * @returns 200 with target form's public view
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/preview',
+  withUserAuthentication,
+  AdminFormController.handlePreviewAdminForm,
+)
+
+/**
+ * Retrieve feedback for a public form
+ * @route GET /:formId/adminform/feedback
+ * @security session
+ *
+ * @returns 200 with feedback response
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/feedback',
+  withUserAuthentication,
+  AdminFormController.handleGetFormFeedbacks,
+)
+
+/**
+ * Count the number of feedback for a form
+ * @route GET /{formId}/adminform/feedback/count
+ * @security session
+ *
+ * @returns 200 with feedback counts of given form
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/feedback/count',
+  withUserAuthentication,
+  AdminFormController.handleCountFormFeedback,
+)
+
+/**
+ * Stream download all feedback for a form
+ * @route GET /{formId}/adminform/feedback/download
+ * @security session
+ *
+ * @returns 200 with feedback stream
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database or stream error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/feedback/download',
+  withUserAuthentication,
+  AdminFormController.handleStreamFormFeedback,
+)
+
+/**
+ * Retrieve actual response for a storage mode form
+ * @route GET /:formId/adminform/submissions
+ * @security session
+ *
+ * @returns 200 with encrypted submission data response
+ * @returns 400 when form is not an encrypt mode form
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have read permissions for form
+ * @returns 404 when submissionId cannot be found in the database
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when any errors occurs in database query or generating signed URL
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/submissions',
+  withUserAuthentication,
+  celebrate({
+    [Segments.QUERY]: {
+      submissionId: Joi.string()
+        .regex(/^[0-9a-fA-F]{24}$/)
+        .required(),
+    },
+  }),
+  EncryptSubmissionController.handleGetEncryptedResponse,
+)
+
+/**
+ * Count the number of submissions for a public form
+ * @route GET /:formId/adminform/submissions/count
+ * @security session
+ *
+ * @returns 200 with submission counts of given form
+ * @returns 400 when query.startDate or query.endDate is malformed
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/submissions/count',
+  withUserAuthentication,
+  celebrate({
+    [Segments.QUERY]: Joi.object()
+      .keys({
+        startDate: Joi.date().format('YYYY-MM-DD').raw(),
+        endDate: Joi.date()
+          .format('YYYY-MM-DD')
+          .greater(Joi.ref('startDate'))
+          .raw(),
+      })
+      .and('startDate', 'endDate'),
+  }),
+  AdminFormController.handleCountFormSubmissions,
+)
+
+/**
+ * Retrieve metadata of responses for a form with encrypted storage
+ * @route GET /:formId/adminform/submissions/metadata
+ * @security session
+ *
+ * @returns 200 with paginated submission metadata when no submissionId is provided
+ * @returns 200 with single submission metadata of submissionId when provided
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/submissions/metadata',
+  withUserAuthentication,
+  celebrate({
+    [Segments.QUERY]: {
+      submissionId: Joi.string().optional(),
+      page: Joi.number().min(1).when('submissionId', {
+        not: Joi.exist(),
+        then: Joi.required(),
+      }),
+    },
+  }),
+  EncryptSubmissionController.handleGetMetadata,
+)
+
+/**
+ * Stream download all encrypted responses for a form
+ * @route GET /:formId/adminform/submissions/download
+ * @security session
+ *
+ * @returns 200 with stream of encrypted responses
+ * @returns 400 if form is not an encrypt mode form
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have read permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 if any errors occurs in stream pipeline or error retrieving form
+ */
+AdminFormsRouter.get(
+  '/:formId([a-fA-F0-9]{24})/adminform/submissions/download',
+  withUserAuthentication,
+  celebrate({
+    [Segments.QUERY]: Joi.object()
+      .keys({
+        startDate: Joi.date().format('YYYY-MM-DD').raw(),
+        endDate: Joi.date()
+          .format('YYYY-MM-DD')
+          .greater(Joi.ref('startDate'))
+          .raw(),
+        downloadAttachments: Joi.boolean().default(false),
+      })
+      .and('startDate', 'endDate'),
+  }),
+  EncryptSubmissionController.handleStreamEncryptedResponses,
+)
+
+/**
+ * Upload images
+ * @route POST /:formId/adminform/images
+ * @security session
+ *
+ * @returns 200 with presigned POST URL object
+ * @returns 400 when error occurs whilst creating presigned POST URL object
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have write permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ */
+AdminFormsRouter.post(
+  '/:formId([a-fA-F0-9]{24})/adminform/images',
+  withUserAuthentication,
+  fileUploadValidator,
+  AdminFormController.handleCreatePresignedPostUrlForImages,
+)
+
+/**
+ * Upload logos
+ * @route POST /:formId/adminform/logos
+ * @security session
+ *
+ * @returns 200 with presigned POST URL object
+ * @returns 400 when error occurs whilst creating presigned POST URL object
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have write permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ */
+AdminFormsRouter.post(
+  '/:formId([a-fA-F0-9]{24})/adminform/logos',
+  withUserAuthentication,
+  fileUploadValidator,
+  AdminFormController.handleCreatePresignedPostUrlForLogos,
+)
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 0efe0da7c7..6f447ccf93 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -493,6 +493,7 @@ export const handleStreamEncryptedResponses: RequestHandler<
 
 /**
  * Handler for GET /:formId/adminform/submissions
+ * @security session
  *
  * @returns 200 with encrypted submission data response
  * @returns 400 when form is not an encrypt mode form
diff --git a/src/app/modules/user/__tests__/user.routes.spec.ts b/src/app/modules/user/__tests__/user.routes.spec.ts
index 2fc22868c2..d63b05527d 100644
--- a/src/app/modules/user/__tests__/user.routes.spec.ts
+++ b/src/app/modules/user/__tests__/user.routes.spec.ts
@@ -14,6 +14,7 @@ import { createAuthedSession } from 'tests/integration/helpers/express-auth'
 import { setupApp } from 'tests/integration/helpers/express-setup'
 import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
+import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
 
 import { DatabaseError } from '../../core/core.errors'
 import UserRouter from '../user.routes'
@@ -69,9 +70,9 @@ describe('user.routes', () => {
       // Response should contain user object.
       expect(response.body).toEqual(
         expect.objectContaining({
-          ...JSON.parse(JSON.stringify(defaultUser.toObject())),
+          ...jsonParseStringify(defaultUser.toObject()),
           // Should be object since agency key should be populated.
-          agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+          agency: jsonParseStringify(defaultAgency.toObject()),
         }),
       )
     })
@@ -266,8 +267,8 @@ describe('user.routes', () => {
       expect(response.status).toEqual(200)
       // Body should be an user object.
       expect(response.body).toEqual({
-        ...JSON.parse(JSON.stringify(defaultUser.toObject())),
-        agency: JSON.parse(JSON.stringify(defaultAgency.toObject())),
+        ...jsonParseStringify(defaultUser.toObject()),
+        agency: jsonParseStringify(defaultAgency.toObject()),
         // This time with the new contact number.
         contact: VALID_CONTACT,
         // Dynamic date strings to be returned.
diff --git a/src/app/routes/admin-forms.server.routes.js b/src/app/routes/admin-forms.server.routes.js
index 8716329c44..b8a6146169 100644
--- a/src/app/routes/admin-forms.server.routes.js
+++ b/src/app/routes/admin-forms.server.routes.js
@@ -12,23 +12,14 @@ const EmailSubmissionsMiddleware = require('../../app/modules/submission/email-s
 const SubmissionsMiddleware = require('../../app/modules/submission/submission.middleware')
 const AdminFormController = require('../modules/form/admin-form/admin-form.controller')
 const { withUserAuthentication } = require('../modules/auth/auth.middlewares')
-const EncryptSubmissionController = require('../modules/submission/encrypt-submission/encrypt-submission.controller')
 const {
   PermissionLevel,
 } = require('../modules/form/admin-form/admin-form.types')
 const EncryptSubmissionMiddleware = require('../modules/submission/encrypt-submission/encrypt-submission.middleware')
 const SpcpController = require('../modules/spcp/spcp.controller')
-const { BasicField, ResponseMode } = require('../../types')
+const { BasicField } = require('../../types')
 const VerifiedContentMiddleware = require('../modules/verified-content/verified-content.middlewares')
 
-const YYYY_MM_DD_REGEX = /([12]\d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01]))/
-
-const emailValOpts = {
-  minDomainSegments: 2, // Number of segments required for the domain
-  tlds: true, // TLD (top level domain) validation
-  multiple: false, // Disallow multiple emails
-}
-
 /**
  * Authenticates logged in user, before retrieving non-archived form
  * and verifying read/write permissions.
@@ -42,336 +33,6 @@ let authActiveForm = (requiredPermission) => [
 ]
 
 module.exports = function (app) {
-  /**
-   * @typedef ErrorMessage
-   * @property {string} message.required - the error message
-   */
-
-  /**
-   * @typedef FormCreateRequest
-   * @property {object} form.required - the form to be created
-   */
-
-  app
-    .route('/adminform')
-    /**
-     * List the forms managed by the user
-     * @route GET /adminform
-     * @group admin - endpoints to manage forms
-     * @produces application/json
-     * @returns {Array.<object>} 200 - the forms managed by the user
-     * @returns {ErrorMessage.model} 400 - error encountered while finding the forms
-     * @security OTP
-     */
-    .get(withUserAuthentication, AdminFormController.handleListDashboardForms)
-    /**
-     * Create a new form in FormSG
-     * @route POST /adminform
-     * @group admin - endpoints to manage forms
-     * @param {FormCreateRequest.model} form.body.required - the form
-     * @produces application/json
-     * @returns {object} 200 - the created form
-     * @returns {ErrorMessage.model} 400 - invalid input
-     * @returns {ErrorMessage.model} 405 - error encountered while creating the form
-     * @security OTP
-     */
-    .post(
-      withUserAuthentication,
-      celebrate({
-        [Segments.BODY]: {
-          form: Joi.object()
-            .keys({
-              // Require valid responsesMode field.
-              responseMode: Joi.string()
-                .valid(...Object.values(ResponseMode))
-                .required(),
-              // Require title field.
-              title: Joi.string().min(4).max(200).required(),
-              // Require emails string (for backwards compatibility) or string
-              // array if form to be created in Email mode.
-              emails: Joi.alternatives()
-                .try(Joi.array().items(Joi.string()), Joi.string())
-                .when('responseMode', {
-                  is: ResponseMode.Email,
-                  then: Joi.required(),
-                }),
-              // Require publicKey field if form to be created in Storage mode.
-              publicKey: Joi.string()
-                .allow('')
-                .when('responseMode', {
-                  is: ResponseMode.Encrypt,
-                  then: Joi.string().required().disallow(''),
-                }),
-            })
-            .required()
-            // Allow other form schema keys to be passed for form creation.
-            .unknown(true),
-        },
-      }),
-      AdminFormController.handleCreateForm,
-    )
-
-  /**
-   * @typedef AdminForm
-   * @property {object} form.required - the form
-   */
-
-  /**
-   * @typedef DuplicateRequest
-   * @property {number} name.required - the number suffix to apply to the duplicated form
-   */
-
-  // Collection of routes that operate on the entire form object
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform')
-    /**
-     * Return the specified form to the user
-     * @route GET /{formId}/adminform
-     * @group admin - endpoints to manage forms
-     * @param {string} formId.path.required - the form id
-     * @produces application/json
-     * @returns {ErrorMessage.model} 400 - invalid formId
-     * @returns {ErrorMessage.model} 401 - user not logged in
-     * @returns {ErrorMessage.model} 403 - user does not have write permission
-     * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-     * @returns {AdminForm.model} 200 - the form
-     * @security OTP
-     */
-    .get(withUserAuthentication, AdminFormController.handleGetAdminForm)
-    /**
-     * Update the specified form
-     * @route PUT /{formId}/adminform
-     * @group admin - endpoints to manage forms
-     * @param {string} formId.path.required - the form id
-     * @produces application/json
-     * @returns {ErrorMessage.model} 400 - invalid formId
-     * @returns {ErrorMessage.model} 401 - user not logged in
-     * @returns {ErrorMessage.model} 403 - user does not have write permission
-     * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-     * @returns {ErrorMessage.model} 405 - error encountered while saving the form
-     * @returns {object} 200 - the updated form
-     * @security OTP
-     */
-    .put(withUserAuthentication, AdminFormController.handleUpdateForm)
-    /**
-     * Archive the specified form
-     * @route DELETE /{formId}/adminform
-     * @group admin - endpoints to manage forms
-     * @param {string} formId.path.required - the form id
-     * @produces application/json
-     * @returns {ErrorMessage.model} 400 - invalid formId
-     * @returns {ErrorMessage.model} 401 - user not logged in
-     * @returns {ErrorMessage.model} 403 - user does not have delete permission
-     * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-     * @returns {ErrorMessage.model} 405 - error encountered while archiving the form
-     * @returns {object} 200 - the archived form
-     * @security OTP
-     */
-    .delete(withUserAuthentication, AdminFormController.handleArchiveForm)
-    /**
-     * Duplicate the specified form
-     * @route POST /{formId}/adminform
-     * @group admin - endpoints to manage forms
-     * @param {string} formId.path.required - the form id
-     * @param {DuplicateRequest.model} name.body.required - the suffix to apply to the duplicated form
-     * @produces application/json
-     * @returns {ErrorMessage.model} 400 - error encountered while retrieving the form
-     * @returns {ErrorMessage.model} 401 - user not logged in
-     * @returns {ErrorMessage.model} 403 - user does not have write permission
-     * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-     * @returns {ErrorMessage.model} 405 - error encountered while duplicating the form
-     * @returns {object} 200 - the duplicated form
-     * @security OTP
-     */
-    .post(
-      withUserAuthentication,
-      celebrate({
-        [Segments.BODY]: {
-          // Require valid responsesMode field.
-          responseMode: Joi.string()
-            .valid(...Object.values(ResponseMode))
-            .required(),
-          // Require title field.
-          title: Joi.string().min(4).max(200).required(),
-          // Require emails string (for backwards compatibility) or string array
-          // if form to be duplicated in Email mode.
-          emails: Joi.alternatives()
-            .try(Joi.array().items(Joi.string()), Joi.string())
-            .when('responseMode', {
-              is: ResponseMode.Email,
-              then: Joi.required(),
-            }),
-          // Require publicKey field if form to be duplicated in Storage mode.
-          publicKey: Joi.string()
-            .allow('')
-            .when('responseMode', {
-              is: ResponseMode.Encrypt,
-              then: Joi.string().required().disallow(''),
-            }),
-        },
-      }),
-      AdminFormController.handleDuplicateAdminForm,
-    )
-
-  /**
-   * Return the template form to the user.
-   * Only allows for public forms, for any logged in user.
-   * @route GET /{formId}/adminform/template
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - invalid formId
-   * @returns {ErrorMessage.model} 401 - user not logged in
-   * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-   * @returns {AdminForm.model} 200 - the form
-   * @security OTP
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform/template')
-    .get(withUserAuthentication, AdminFormController.handleGetTemplateForm)
-
-  /**
-   * Return the preview form to the user.
-   * Allows for both public and private forms, only for users with at least read permission.
-   * This endpoint is also used to retrieve the form object for duplication.
-   * @route GET /{formId}/adminform/preview
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - invalid formId
-   * @returns {ErrorMessage.model} 401 - user not logged in
-   * @returns {ErrorMessage.model} 403 - user does not have at least read permission
-   * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-   * @returns {AdminForm.model} 200 - the form
-   * @security OTP
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform/preview')
-    .get(withUserAuthentication, AdminFormController.handlePreviewAdminForm)
-
-  /**
-   * Duplicate a specified form and return that form to the user.
-   * @route GET /{formId}/adminform/copy
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - invalid formId
-   * @returns {ErrorMessage.model} 401 - user not logged in
-   * @returns {ErrorMessage.model} 404 - form has been archived or form not found
-   * @returns {AdminForm.model} 200 - the form
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/copy').post(
-    withUserAuthentication,
-    celebrate({
-      [Segments.BODY]: {
-        // Require valid responsesMode field.
-        responseMode: Joi.string()
-          .valid(...Object.values(ResponseMode))
-          .required(),
-        // Require title field.
-        title: Joi.string().min(4).max(200).required(),
-        // Require emails string (for backwards compatibility) or string array
-        // if form to be duplicated in Email mode.
-        emails: Joi.alternatives()
-          .try(Joi.array().items(Joi.string()), Joi.string())
-          .when('responseMode', {
-            is: ResponseMode.Email,
-            then: Joi.required(),
-          }),
-        // Require publicKey field if form to be duplicated in Storage mode.
-        publicKey: Joi.string()
-          .allow('')
-          .when('responseMode', {
-            is: ResponseMode.Encrypt,
-            then: Joi.string().required().disallow(''),
-          }),
-      },
-    }),
-    AdminFormController.handleCopyTemplateForm,
-  )
-
-  /**
-   * @typedef FeedbackResponse
-   * @property {number} average.required - the average rating
-   * @property {number} count.required - the total number of feedback received
-   * @property {Array.<Feedback>} feedback.required - all the feedback in an array
-   */
-
-  /**
-   * @typedef Feedback
-   * @property {number} timestamp.required - the time in epoch milliseconds that the feedback was received
-   * @property {number} rating.required - the user's rating of the form
-   * @property {string} comment.required - any comments the user might have
-   * @property {string} date.required - the date the feedback was received, in the moment format `D MMM YYYY`
-   * @property {string} dateShort.required - the date the feedback was received, in the moment format `D MMM`
-   */
-
-  /**
-   * Retrieve feedback for a public form
-   * @route GET /{formId}/adminform/feedback
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - Errors while querying for feedback
-   * @returns {FeedbackResponse.model} 200 - form feedback was saved
-   * @security OTP
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform/feedback')
-    .get(withUserAuthentication, AdminFormController.handleGetFormFeedbacks)
-
-  /**
-   * Count the number of feedback for a form
-   * @route GET /{formId}/adminform/feedback/count
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {Error.model} 400 - Errors while querying for feedback
-   * @returns {number} 200 - the feedback count
-   * @security OTP
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform/feedback/count')
-    .get(withUserAuthentication, AdminFormController.handleCountFormFeedback)
-
-  /**
-   * Stream download all feedback for a form
-   * @route GET /{formId}/adminform/feedback/download
-   * @group forms - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @param {Feedback.model} feedback.body.required - the user's feedback
-   * @produces application/json
-   * @returns {ErrorMessage.model} 500 - Errors while querying for response
-   * @returns {Object} 200 - Response document
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/adminform/feedback/download')
-    .get(withUserAuthentication, AdminFormController.handleStreamFormFeedback)
-
-  /**
-   * Transfer form ownership to another user
-   * @route POST /{formId}/adminform/transfer-owner
-   * @group forms - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @param {string} request.body.email.required - the new owner's email address
-   * @produces application/json
-   * @returns {ErrorMessage.model} 500 - Errors while querying for response
-   * @returns {Object} 200 - Response document
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/transfer-owner').post(
-    withUserAuthentication,
-    celebrate({
-      [Segments.BODY]: {
-        email: Joi.string()
-          .required()
-          .email(emailValOpts)
-          .message('Please enter a valid email'),
-      },
-    }),
-    AdminFormController.handleTransferFormOwnership,
-  )
-
   /**
    * On preview, submit a form response, processing it as an email to be sent to
    * the public servant who created the form. Optionally, email a PDF
@@ -501,164 +162,4 @@ module.exports = function (app) {
     adminForms.passThroughSaveMetadataToDb,
     SubmissionsMiddleware.sendEmailConfirmations,
   )
-
-  /**
-   * Retrieve actual response for a form with encrypted storage
-   * @route GET /{formId}/adminform/submissions
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @param {number} submissionId.query.required - the submission id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - Errors while querying for response
-   * @returns {Object} 200 - Response document
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/submissions').get(
-    withUserAuthentication,
-    celebrate({
-      [Segments.QUERY]: {
-        submissionId: Joi.string()
-          .regex(/^[0-9a-fA-F]{24}$/)
-          .required(),
-      },
-    }),
-    EncryptSubmissionController.handleGetEncryptedResponse,
-  )
-
-  /**
-   * Count the number of submissions for a public form
-   * @route GET /{formId}/adminform/submissions/count
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {Error.model} 400 - Errors while querying for feedback
-   * @returns {number} 200 - the submission count
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/submissions/count').get(
-    withUserAuthentication,
-    celebrate({
-      [Segments.QUERY]: Joi.object()
-        .keys({
-          // Ensure YYYY-MM-DD format.
-          startDate: Joi.string().regex(YYYY_MM_DD_REGEX),
-          // Ensure YYYY-MM-DD format.
-          endDate: Joi.string().regex(YYYY_MM_DD_REGEX),
-        })
-        .and('startDate', 'endDate'),
-    }),
-    AdminFormController.handleCountFormSubmissions,
-  )
-
-  /**
-   * @typedef metadataResponse
-   * @property {Array.<metadata>} metadata.required - all the metadata in an array
-   * @property {number} numResults.required - the total number of responses
-   */
-
-  /**
-   * Retrieve metadata of responses for a form with encrypted storage
-   * @route GET /{formId}/adminform/submissions/metadata
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - Errors while querying for response
-   * @returns {metadataResponse.model} 200 - Metadata of responses
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/submissions/metadata').get(
-    withUserAuthentication,
-    celebrate({
-      [Segments.QUERY]: {
-        submissionId: Joi.string().optional(),
-        page: Joi.number().min(1).when('submissionId', {
-          not: Joi.exist(),
-          then: Joi.required(),
-        }),
-      },
-    }),
-    EncryptSubmissionController.handleGetMetadata,
-  )
-
-  /**
-   * Stream download all encrypted responses for a form
-   * @route GET /{formId}/adminform/submissions/download
-   * @group admin - endpoints to manage forms
-   * @param {string} formId.path.required - the form id
-   * @produces application/json
-   * @returns {ErrorMessage.model} 500 - Errors while querying for response
-   * @returns {Object} 200 - Response document
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/submissions/download').get(
-    withUserAuthentication,
-    celebrate({
-      [Segments.QUERY]: Joi.object()
-        .keys({
-          // Ensure YYYY-MM-DD format.
-          startDate: Joi.string().regex(YYYY_MM_DD_REGEX),
-          // Ensure YYYY-MM-DD format.
-          endDate: Joi.string().regex(YYYY_MM_DD_REGEX),
-          downloadAttachments: Joi.boolean().default(false),
-        })
-        .and('startDate', 'endDate'),
-    }),
-    EncryptSubmissionController.handleStreamEncryptedResponses,
-  )
-
-  /**
-   * Upload images
-   * @route POST /{formId}/adminform/images
-   * @group admin - endpoints to manage forms
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - Error while creating presigned post
-   * @returns {Object} 200 - Response document
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/images').post(
-    withUserAuthentication,
-    celebrate({
-      [Segments.BODY]: {
-        fileId: Joi.string()
-          .required()
-          .error(() => 'Please enter a valid file id'),
-        fileMd5Hash: Joi.string()
-          .base64()
-          .required()
-          .error(() => 'Error - your file could not be verified'),
-        fileType: Joi.string()
-          .required()
-          .error(() => 'Error - your file could not be verified'),
-      },
-    }),
-    AdminFormController.handleCreatePresignedPostUrlForImages,
-  )
-
-  /**
-   * Upload logos
-   * @route POST /{formId}/adminform/logos
-   * @group admin - endpoints to manage forms
-   * @produces application/json
-   * @returns {ErrorMessage.model} 400 - Error while creating presigned post
-   * @returns {Object} 200 - Response document
-   * @security OTP
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/adminform/logos').post(
-    withUserAuthentication,
-    celebrate({
-      [Segments.BODY]: {
-        fileId: Joi.string()
-          .required()
-          .error(() => 'Please enter a valid file id'),
-        fileMd5Hash: Joi.string()
-          .base64()
-          .required()
-          .error(() => 'Error - your file could not be verified'),
-        fileType: Joi.string()
-          .required()
-          .error(() => 'Error - your file could not be verified'),
-      },
-    }),
-    AdminFormController.handleCreatePresignedPostUrlForLogos,
-  )
 }
diff --git a/src/app/utils/__mocks__/limit-rate.ts b/src/app/utils/__mocks__/limit-rate.ts
new file mode 100644
index 0000000000..774b2a501f
--- /dev/null
+++ b/src/app/utils/__mocks__/limit-rate.ts
@@ -0,0 +1,6 @@
+import { RequestHandler } from 'express'
+
+// Remove rate limiting in tests.
+export const limitRate = jest
+  .fn()
+  .mockImplementation((): RequestHandler => (req, res, next) => next())
diff --git a/src/loaders/express/index.ts b/src/loaders/express/index.ts
index f19586c9e7..31129db757 100644
--- a/src/loaders/express/index.ts
+++ b/src/loaders/express/index.ts
@@ -13,6 +13,7 @@ import { AuthRouter } from '../../app/modules/auth/auth.routes'
 import { BillingRouter } from '../../app/modules/billing/billing.routes'
 import { BounceRouter } from '../../app/modules/bounce/bounce.routes'
 import { ExamplesRouter } from '../../app/modules/examples/examples.routes'
+import { AdminFormsRouter } from '../../app/modules/form/admin-form/admin-form.routes'
 import { HomeRouter } from '../../app/modules/home/home.routes'
 import { MYINFO_ROUTER_PREFIX } from '../../app/modules/myinfo/myinfo.constants'
 import { MyInfoRouter } from '../../app/modules/myinfo/myinfo.routes'
@@ -163,6 +164,7 @@ const loadExpressApp = async (connection: Connection) => {
   app.use('/corppass/login', CorppassLoginRouter)
   // Use constant for registered routes with MyInfo servers
   app.use(MYINFO_ROUTER_PREFIX, MyInfoRouter)
+  app.use(AdminFormsRouter)
 
   // New routes in preparation for API refactor.
   app.use('/api', ApiRouter)
diff --git a/tests/integration/helpers/express-auth.ts b/tests/integration/helpers/express-auth.ts
index 703f955fe5..9c65cc791f 100644
--- a/tests/integration/helpers/express-auth.ts
+++ b/tests/integration/helpers/express-auth.ts
@@ -54,3 +54,16 @@ export const createAuthedSession = async (
   otpSpy.mockClear()
   return request
 }
+
+export const logoutSession = async (request: Session): Promise<Session> => {
+  const response = await request.get('/auth/signout')
+
+  expect(response.status).toEqual(200)
+
+  const sessionCookie = request.cookies.find(
+    (cookie) => cookie.name === 'connect.sid',
+  )
+  expect(sessionCookie).not.toBeDefined()
+
+  return request
+}
diff --git a/tests/integration/helpers/express-setup.ts b/tests/integration/helpers/express-setup.ts
index 59674596f2..e51319da6a 100644
--- a/tests/integration/helpers/express-setup.ts
+++ b/tests/integration/helpers/express-setup.ts
@@ -28,7 +28,7 @@ const testSessionMiddlewares = () => {
 }
 
 export const setupApp = (
-  route: string,
+  route: string | undefined,
   router: Router,
   options: { showLogs?: boolean; setupWithAuth?: boolean } = {},
 ): Express => {
@@ -45,12 +45,16 @@ export const setupApp = (
     app.use(loggingMiddleware())
   }
 
-  app.use(route, router)
-
   if (options.setupWithAuth) {
     app.use('/auth', AuthRouter)
   }
 
+  if (route) {
+    app.use(route, router)
+  } else {
+    app.use(router)
+  }
+
   app.use(errorHandlerMiddlewares())
 
   return app
diff --git a/tests/unit/backend/helpers/serialize-data.ts b/tests/unit/backend/helpers/serialize-data.ts
new file mode 100644
index 0000000000..06950f933d
--- /dev/null
+++ b/tests/unit/backend/helpers/serialize-data.ts
@@ -0,0 +1,3 @@
+export const jsonParseStringify = (obj: unknown) => {
+  return JSON.parse(JSON.stringify(obj))
+}
diff --git a/tsconfig.build.json b/tsconfig.build.json
index 0d82b575a6..d4e13596f7 100644
--- a/tsconfig.build.json
+++ b/tsconfig.build.json
@@ -6,6 +6,7 @@
     "**/*.spec.ts",
     "**/*.test.ts",
     "**/__tests__/",
+    "**/__mocks__/",
     "src/public/"
   ]
 }

From b709fcfe486705134d529474f88e2a91f02ace68 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 8 Apr 2021 10:22:15 +0800
Subject: [PATCH 21/75] fix: /adminform integration tests being flakey by
 loosening some checks (#1584)

* test: loosen test checks due to non-deterministic mongo query

* test: fix flakiness due to Date

* test: remove invalid comment
---
 .../__tests__/admin-form.routes.spec.ts       | 36 ++++++++++---------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index cc51e48fc6..2bd52a224e 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/ban-ts-comment */
 import { ObjectId } from 'bson-ext'
 import { format, subDays } from 'date-fns'
-import { cloneDeep, take, times } from 'lodash'
+import { cloneDeep, times } from 'lodash'
 import mongoose from 'mongoose'
 import { errAsync, okAsync } from 'neverthrow'
 import SparkMD5 from 'spark-md5'
@@ -3559,19 +3559,16 @@ describe('admin-form.routes', () => {
     it('should return 200 with requested page of metadata when metadata exists', async () => {
       // Arrange
       // Create 11 submissions
-      const submissions = (
-        await Promise.all(
-          times(11, (count) =>
-            createSubmission({
-              form: defaultForm,
-              encryptedContent: `any encrypted content ${count}`,
-              verifiedContent: `any verified content ${count}`,
-            }),
-          ),
-        )
+      const submissions = await Promise.all(
+        times(11, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+          }),
+        ),
       )
-        // @ts-ignore
-        .sort((a, b) => b.created! - a.created!)
+      const createdSubmissionIds = submissions.map((s) => String(s._id))
 
       // Act
       const response = await request
@@ -3581,10 +3578,11 @@ describe('admin-form.routes', () => {
         })
 
       // Assert
-      // Take first 10 submissions
-      const expected = take(submissions, 10).map((s, index) => ({
+      const expected = times(10, (index) => ({
         number: 11 - index,
-        refNo: String(s._id),
+        // Loosen refNo checks due to non-deterministic aggregation query.
+        // Just expect refNo is one of the possible ones.
+        refNo: expect.toBeOneOf(createdSubmissionIds),
         submissionTime: expect.any(String),
       }))
       expect(response.status).toEqual(200)
@@ -3935,6 +3933,7 @@ describe('admin-form.routes', () => {
 
     it('should return 200 with stream of encrypted responses between given query.startDate and query.endDate', async () => {
       // Arrange
+      const now = new Date()
       const submissions = await Promise.all(
         times(5, (count) =>
           createSubmission({
@@ -3945,11 +3944,11 @@ describe('admin-form.routes', () => {
               ['fieldId1', `some.attachment.url.${count}`],
               ['fieldId2', `some.other.attachment.url.${count}`],
             ]),
+            created: now,
           }),
         ),
       )
       // Set 2 submissions to be submitted 3-4 days ago.
-      const now = new Date()
       submissions[2].created = subDays(now, 3)
       submissions[4].created = subDays(now, 4)
       await submissions[2].save()
@@ -4602,11 +4601,13 @@ const createSubmission = ({
   encryptedContent,
   verifiedContent,
   attachmentMetadata,
+  created,
 }: {
   form: IFormDocument
   encryptedContent: string
   attachmentMetadata?: Map<string, string>
   verifiedContent?: string
+  created?: Date
 }) => {
   return SubmissionModel.create({
     submissionType: SubmissionType.Encrypt,
@@ -4616,6 +4617,7 @@ const createSubmission = ({
     attachmentMetadata,
     encryptedContent,
     verifiedContent,
+    created,
     version: 1,
   })
 }

From 98ae6c1cc78b375b3795d2cb5bf74b1325120258 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 Apr 2021 03:06:13 +0000
Subject: [PATCH 22/75] chore(deps-dev): bump testcafe from 1.13.0 to 1.14.0
 (#1580)

Bumps [testcafe](https://github.com/DevExpress/testcafe) from 1.13.0 to 1.14.0.
- [Release notes](https://github.com/DevExpress/testcafe/releases)
- [Changelog](https://github.com/DevExpress/testcafe/blob/master/CHANGELOG.md)
- [Commits](https://github.com/DevExpress/testcafe/compare/v1.13.0...v1.14.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 70 ++++++++++++++++++++++++-----------------------
 package.json      |  2 +-
 2 files changed, 37 insertions(+), 35 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8ea585172d..2e64d96535 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2808,9 +2808,9 @@
           "dev": true
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -2861,9 +2861,9 @@
           "dev": true
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -3408,13 +3408,14 @@
       }
     },
     "@babel/preset-flow": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/preset-flow/-/preset-flow-7.12.13.tgz",
-      "integrity": "sha512-gcEjiwcGHa3bo9idURBp5fmJPcyFPOszPQjztXrOjUE2wWVqc6fIVJPgWPIQksaQ5XZ2HWiRsf2s1fRGVjUtVw==",
+      "version": "7.13.13",
+      "resolved": "https://registry.npmjs.org/@babel/preset-flow/-/preset-flow-7.13.13.tgz",
+      "integrity": "sha512-MDtwtamMifqq3R2mC7l3A3uFalUb3NH5TIBQWjN/epEPlZktcLq4se3J+ivckKrLMGsR7H9LW8+pYuIUN9tsKg==",
       "dev": true,
       "requires": {
-        "@babel/helper-plugin-utils": "^7.12.13",
-        "@babel/plugin-transform-flow-strip-types": "^7.12.13"
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/helper-validator-option": "^7.12.17",
+        "@babel/plugin-transform-flow-strip-types": "^7.13.0"
       },
       "dependencies": {
         "@babel/helper-plugin-utils": {
@@ -3439,15 +3440,16 @@
       }
     },
     "@babel/preset-react": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.12.13.tgz",
-      "integrity": "sha512-TYM0V9z6Abb6dj1K7i5NrEhA13oS5ujUYQYDfqIBXYHOc2c2VkFgc+q9kyssIyUfy4/hEwqrgSlJ/Qgv8zJLsA==",
+      "version": "7.13.13",
+      "resolved": "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.13.13.tgz",
+      "integrity": "sha512-gx+tDLIE06sRjKJkVtpZ/t3mzCDOnPG+ggHZG9lffUbX8+wC739x20YQc9V35Do6ZAxaUc/HhVHIiOzz5MvDmA==",
       "dev": true,
       "requires": {
-        "@babel/helper-plugin-utils": "^7.12.13",
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/helper-validator-option": "^7.12.17",
         "@babel/plugin-transform-react-display-name": "^7.12.13",
-        "@babel/plugin-transform-react-jsx": "^7.12.13",
-        "@babel/plugin-transform-react-jsx-development": "^7.12.12",
+        "@babel/plugin-transform-react-jsx": "^7.13.12",
+        "@babel/plugin-transform-react-jsx-development": "^7.12.17",
         "@babel/plugin-transform-react-pure-annotations": "^7.12.1"
       },
       "dependencies": {
@@ -4926,9 +4928,9 @@
       "dev": true
     },
     "@types/minimatch": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.3.tgz",
-      "integrity": "sha512-tHq6qdbT9U1IRSGf14CL0pUlULksvY9OZ+5eEgl1N7t+OA3tGvNpxJCzuKQlsNgCVwbAs670L1vcVQi8j9HjnA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-1z8k4wzFnNjVK/tlxvrWuK5WMt6mydWWP7+zvH5eFep4oj+UkrfiJTRtjCeBXNpwaA/FYqqtb4/QS4ianFpIRA==",
       "dev": true
     },
     "@types/minimist": {
@@ -22683,9 +22685,9 @@
       }
     },
     "testcafe": {
-      "version": "1.13.0",
-      "resolved": "https://registry.npmjs.org/testcafe/-/testcafe-1.13.0.tgz",
-      "integrity": "sha512-zJt+opIZ+JolTklgqVePBFGSSz6Ld6ySb/7AUUhMwJ+e8ob4P+eMjGjGosgMeCJIPHzDMFDqYfULTANi3CXsKw==",
+      "version": "1.14.0",
+      "resolved": "https://registry.npmjs.org/testcafe/-/testcafe-1.14.0.tgz",
+      "integrity": "sha512-k2Cj7TYtIkraa+te9LB52VeiSWlA68KWm5A6Er37hf01Ke0XtloKLB7OlojJKrcMi/76fEaya6hCXMAHxSiQeA==",
       "dev": true,
       "requires": {
         "@babel/core": "^7.12.1",
@@ -22763,8 +22765,8 @@
         "source-map-support": "^0.5.16",
         "strip-bom": "^2.0.0",
         "testcafe-browser-tools": "2.0.15",
-        "testcafe-hammerhead": "19.5.0",
-        "testcafe-legacy-api": "4.2.5",
+        "testcafe-hammerhead": "21.0.0",
+        "testcafe-legacy-api": "5.0.0",
         "testcafe-reporter-json": "^2.1.0",
         "testcafe-reporter-list": "^2.1.0",
         "testcafe-reporter-minimal": "^2.1.0",
@@ -22799,9 +22801,9 @@
           "dev": true
         },
         "@types/node": {
-          "version": "10.17.55",
-          "resolved": "https://registry.npmjs.org/@types/node/-/node-10.17.55.tgz",
-          "integrity": "sha512-koZJ89uLZufDvToeWO5BrC4CR4OUfHnUz2qoPs/daQH6qq3IN62QFxCTZ+bKaCE0xaoCAJYE4AXre8AbghCrhg==",
+          "version": "10.17.56",
+          "resolved": "https://registry.npmjs.org/@types/node/-/node-10.17.56.tgz",
+          "integrity": "sha512-LuAa6t1t0Bfw4CuSR0UITsm1hP17YL+u82kfHGrHUWdhlBtH7sa7jGY5z7glGaIj/WDYDkRtgGd+KCjCzxBW1w==",
           "dev": true
         },
         "array-union": {
@@ -23437,9 +23439,9 @@
       }
     },
     "testcafe-hammerhead": {
-      "version": "19.5.0",
-      "resolved": "https://registry.npmjs.org/testcafe-hammerhead/-/testcafe-hammerhead-19.5.0.tgz",
-      "integrity": "sha512-KtSPudvokOrLdsYH1kp8wFqG/JY7zg72/soam2ubrgxv13wcNB1szp1YN4rJnJdZgdGvSfeO1hsrPKhi4Ax+Qw==",
+      "version": "21.0.0",
+      "resolved": "https://registry.npmjs.org/testcafe-hammerhead/-/testcafe-hammerhead-21.0.0.tgz",
+      "integrity": "sha512-ctIM2nF93Xgm4jHGbwMtSD1aRJu5d62+jy6T0LrjZcT/312PPWU4a1X2leE4ID9fxDOK+KxAMRuptkZTcR7GUQ==",
       "dev": true,
       "requires": {
         "acorn-hammerhead": "0.4.0",
@@ -23556,9 +23558,9 @@
       }
     },
     "testcafe-legacy-api": {
-      "version": "4.2.5",
-      "resolved": "https://registry.npmjs.org/testcafe-legacy-api/-/testcafe-legacy-api-4.2.5.tgz",
-      "integrity": "sha512-QYCcX+w6NP3SxWnQEHDhODXPncaTl2IwMb2hWK+UxRLEUnoLBoyCj14/+nNINEQ9ogSkFp1zqgeuRcAtIzo+lg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/testcafe-legacy-api/-/testcafe-legacy-api-5.0.0.tgz",
+      "integrity": "sha512-Peb5NJLP7g6HTihMrrGKV7YnGvD6xw4eNPA7Fx44r1GzncuVY/fV1lIL0EQyr8uz0bS5+Hgr0fHSiZ/E4hCjeQ==",
       "dev": true,
       "requires": {
         "async": "0.2.6",
diff --git a/package.json b/package.json
index 850c399991..118da4bbf3 100644
--- a/package.json
+++ b/package.json
@@ -246,7 +246,7 @@
     "supertest": "^6.1.3",
     "supertest-session": "^4.1.0",
     "terser-webpack-plugin": "^1.2.3",
-    "testcafe": "^1.13.0",
+    "testcafe": "^1.14.0",
     "ts-jest": "^26.5.4",
     "ts-loader": "^7.0.5",
     "ts-mock-imports": "^1.3.3",

From b01d60a01ba97e4a00be4719b4832c916086816c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 Apr 2021 03:13:10 +0000
Subject: [PATCH 23/75] fix(deps): bump aws-sdk from 2.880.0 to 2.882.0 (#1585)

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.880.0 to 2.882.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.880.0...v2.882.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 2e64d96535..6ac8a54707 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6256,9 +6256,9 @@
       "integrity": "sha512-24q5Rh3bno7ldoyCq99d6hpnLI+PAMocdeVaaGt/5BTQMprvDwQToHfNnruqN11odCHZZIQbRBw+nZo1lTCH9g=="
     },
     "aws-sdk": {
-      "version": "2.880.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.880.0.tgz",
-      "integrity": "sha512-/dBk3ejw22ED2edzGfmJB83KXDA4wLIw5Hb+2YMhly+gOWecvevy0tML2+YN/cmxyTy+wT0E0sM7fm1v7kmHtw==",
+      "version": "2.882.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.882.0.tgz",
+      "integrity": "sha512-MC1tKQdvIBmSQmyFmS6McGGPrN6yvHmhP0SS0ovx+zF/BbvHPTpi5hIgqPSAkdb8/s0I16QtbwiLQgPT2pf1tA==",
       "requires": {
         "buffer": "4.9.2",
         "events": "1.1.1",
diff --git a/package.json b/package.json
index 118da4bbf3..d60b176cdd 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,7 @@
     "angular-ui-bootstrap": "~2.5.6",
     "angular-ui-router": "~1.0.29",
     "aws-info": "^1.2.0",
-    "aws-sdk": "^2.880.0",
+    "aws-sdk": "^2.882.0",
     "axios": "^0.21.1",
     "bcrypt": "^5.0.1",
     "bluebird": "^3.5.2",

From 76c66d1ced58b2fd2c2516b648f2b8eca3d0706f Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 8 Apr 2021 11:28:49 +0800
Subject: [PATCH 24/75] test: migrate file-validation util tests to TypeScript
 (#1578)

---
 .../backend/utils/file-validation.spec.js     | 112 ------------------
 .../backend/utils/file-validation.spec.ts     | 108 +++++++++++++++++
 2 files changed, 108 insertions(+), 112 deletions(-)
 delete mode 100644 tests/unit/backend/utils/file-validation.spec.js
 create mode 100644 tests/unit/backend/utils/file-validation.spec.ts

diff --git a/tests/unit/backend/utils/file-validation.spec.js b/tests/unit/backend/utils/file-validation.spec.js
deleted file mode 100644
index 7441dd5587..0000000000
--- a/tests/unit/backend/utils/file-validation.spec.js
+++ /dev/null
@@ -1,112 +0,0 @@
-const {
-  getFileExtension,
-  isInvalidFileExtension,
-  getInvalidFileExtensionsInZip,
-} = require('../../../../dist/backend/shared/util/file-validation')
-
-describe('getFileExtension', () => {
-  const tests = [
-    {
-      name: 'handles file name with extension',
-      input: 'image.jpg',
-      expected: '.jpg',
-    },
-    {
-      name: 'handles file name with no extension',
-      input: 'image',
-      expected: '',
-    },
-    {
-      name: 'handles file name with multiple dots',
-      input: 'file.a.txt',
-      expected: '.txt',
-    },
-    {
-      name: 'handles file name with multiple consecutive dots',
-      input: 'file...a.zip',
-      expected: '.zip',
-    },
-  ]
-  tests.forEach((t) => {
-    it(t.name, () => {
-      const actual = getFileExtension(t.input)
-      expect(actual).toEqual(t.expected)
-    })
-  })
-})
-
-describe('isInvalidFileExtension', () => {
-  const tests = [
-    {
-      name: 'should return false when given valid extension',
-      input: '.jpg',
-      expected: false,
-    },
-    {
-      name: 'should return true when given invalid extension',
-      input: '.invalid',
-      expected: true,
-    },
-    {
-      name: 'should return false when given valid extension that is mixed case',
-      input: '.jPG',
-      expected: false,
-    },
-    {
-      name:
-        'should return true when given invalid extension that is mixed case',
-      input: '.InvalId',
-      expected: true,
-    },
-  ]
-  tests.forEach((t) => {
-    it(t.name, () => {
-      const actual = isInvalidFileExtension(t.input)
-      expect(actual).toEqual(t.expected)
-    })
-  })
-})
-
-describe('getInvalidFileExtensionsInZip on server', () => {
-  const fs = require('fs')
-  const tests = [
-    {
-      name: 'should return [] when there is only valid files',
-      file: './tests/unit/backend/resources/onlyvalid.zip',
-      expected: [],
-    },
-    {
-      name: 'should return invalid extensions when there is only invalid ext',
-      file: './tests/unit/backend/resources/onlyinvalid.zip',
-      expected: ['.a', '.abc', '.py'],
-    },
-    {
-      name: 'should return only invalid extensions',
-      file: './tests/unit/backend/resources/invalidandvalid.zip',
-      expected: ['.a', '.oo'],
-    },
-    {
-      name: 'should exclude repeated invalid extensions',
-      file: './tests/unit/backend/resources/repeated.zip',
-      expected: ['.a'],
-    },
-    {
-      name: 'should exclude folders',
-      file: './tests/unit/backend/resources/folder.zip',
-      expected: [],
-    },
-    {
-      name: 'should include invalid extensions in nested zip files',
-      file: './tests/unit/backend/resources/nestedInvalid.zip',
-      expected: ['.a', '.oo'],
-    },
-  ]
-  tests.forEach((t) => {
-    it(t.name, async () => {
-      const fn = getInvalidFileExtensionsInZip('server')
-      const file = fs.readFileSync(t.file, 'binary')
-      const actual = await fn(file)
-      expect(actual).toEqual(t.expected)
-    })
-  })
-})
diff --git a/tests/unit/backend/utils/file-validation.spec.ts b/tests/unit/backend/utils/file-validation.spec.ts
new file mode 100644
index 0000000000..20b51dfed8
--- /dev/null
+++ b/tests/unit/backend/utils/file-validation.spec.ts
@@ -0,0 +1,108 @@
+import fs from 'fs'
+
+import { FilePlatforms } from 'src/shared/constants'
+import {
+  getFileExtension,
+  getInvalidFileExtensionsInZip,
+  isInvalidFileExtension,
+} from 'src/shared/util/file-validation'
+
+describe('File validation utils', () => {
+  describe('getFileExtension', () => {
+    it('should handle file name with extension', () => {
+      const actual = getFileExtension('image.jpg')
+      expect(actual).toEqual('.jpg')
+    })
+
+    it('should handle file name with no extension', async () => {
+      const actual = getFileExtension('image-no-extension')
+      expect(actual).toEqual('')
+    })
+
+    it('should handle file name with multiple periods', async () => {
+      const actual = getFileExtension('file.a.txt')
+      expect(actual).toEqual('.txt')
+    })
+
+    it('should handle file name with consecutive periodsa', async () => {
+      const actual = getFileExtension('file....a.zip')
+      expect(actual).toEqual('.zip')
+    })
+  })
+
+  describe('isInvalidFileExtension', () => {
+    it('should return false when given valid extension', () => {
+      const actual = isInvalidFileExtension('.jpg')
+      expect(actual).toEqual(false)
+    })
+
+    it('should return true when given invalid extension', () => {
+      const actual = isInvalidFileExtension('.invalid')
+      expect(actual).toEqual(true)
+    })
+
+    it('should return false when given valid extension that is mixed case', () => {
+      const actual = isInvalidFileExtension('.jPG')
+      expect(actual).toEqual(false)
+    })
+
+    it('should return true when given invalid extension that is mixed case', () => {
+      const actual = isInvalidFileExtension('.sPoNgEbOb')
+      expect(actual).toEqual(true)
+    })
+  })
+
+  describe('getInvalidFileExtensionsInZip on server', () => {
+    it('should return empty array when there is only valid files', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync(
+        './tests/unit/backend/resources/onlyvalid.zip',
+      )
+      const actual = await fn(file)
+      expect(actual).toEqual([])
+    })
+
+    it('should return invalid extensions when zipped files are all invalid file extensions', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync(
+        './tests/unit/backend/resources/onlyinvalid.zip',
+      )
+      const actual = await fn(file)
+      expect(actual).toEqual(['.a', '.abc', '.py'])
+    })
+
+    it('should return only invalid extensions when zip has some valid file extensions', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync(
+        './tests/unit/backend/resources/invalidandvalid.zip',
+      )
+      const actual = await fn(file)
+      expect(actual).toEqual(['.a', '.oo'])
+    })
+
+    it('should exclude repeated invalid extensions', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync(
+        './tests/unit/backend/resources/repeated.zip',
+      )
+      const actual = await fn(file)
+      expect(actual).toEqual(['.a'])
+    })
+
+    it('should exclude folders', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync('./tests/unit/backend/resources/folder.zip')
+      const actual = await fn(file)
+      expect(actual).toEqual([])
+    })
+
+    it('should include invalid extensions in nested zip files', async () => {
+      const fn = getInvalidFileExtensionsInZip(FilePlatforms.Server)
+      const file = fs.readFileSync(
+        './tests/unit/backend/resources/nestedInvalid.zip',
+      )
+      const actual = await fn(file)
+      expect(actual).toEqual(['.a', '.oo'])
+    })
+  })
+})

From 1b0b7ed989cf594a622f5efdf27742ff1e8da525 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 8 Apr 2021 13:18:43 +0800
Subject: [PATCH 25/75] test: migrate logic.spec from javascript to typescript
 (#1587)

---
 tests/unit/backend/utils/logic.spec.js |  816 -------------------
 tests/unit/backend/utils/logic.spec.ts | 1004 ++++++++++++++++++++++++
 2 files changed, 1004 insertions(+), 816 deletions(-)
 delete mode 100644 tests/unit/backend/utils/logic.spec.js
 create mode 100644 tests/unit/backend/utils/logic.spec.ts

diff --git a/tests/unit/backend/utils/logic.spec.js b/tests/unit/backend/utils/logic.spec.js
deleted file mode 100644
index 45fbde26ef..0000000000
--- a/tests/unit/backend/utils/logic.spec.js
+++ /dev/null
@@ -1,816 +0,0 @@
-const {
-  getVisibleFieldIds,
-  getLogicUnitPreventingSubmit,
-} = require('../../../../dist/backend/shared/util/logic')
-describe('Logic validation', () => {
-  /**
-   * Mock a field
-   * @param {String} fieldId
-   */
-  const makeField = (fieldId) => {
-    return { _id: fieldId }
-  }
-  /**
-   *  Mock a response
-   * @param {String} fieldId field id of the field that this response is meant for
-   * @param {String} answer
-   * @param {Array} [answerArray] array of answers passed in for checkbox and table
-   * @param {Boolean} [isVisible]
-   */
-  const makeResponse = (
-    fieldId,
-    answer,
-    answerArray = null,
-    isVisible = true,
-  ) => {
-    let response = { _id: fieldId, answer, isVisible }
-    if (answerArray) response.answerArray = answerArray
-    return response
-  }
-  describe('visibility for different states', () => {
-    const form = { _id: 'f1' }
-    const conditionField = makeField('001')
-    const logicField = makeField('002')
-    const logicResponse = makeResponse(logicField._id, 'lorem')
-    form.form_fields = [conditionField, logicField]
-    it('should compute the correct visibility for "is equals to"', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is equals to',
-              value: 0,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 0), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 1), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-    it('should compute the correct visibility for "is less than or equal to"', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is less than or equal to',
-              value: 99,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 98), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 99), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 100), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-    it('should compute the correct visibility for "is more than or equal to"', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is more than or equal to',
-              value: 22,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 23), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 22), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 21), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-    it('should compute the correct visibility for "is either"', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'multi-select',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is either',
-              value: ['Option 1', 'Option 2'],
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 'Option 1'), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 'Option 2'), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(conditionField._id, 'Option 3'), logicResponse],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-  })
-  describe('preventing submission for different states', () => {
-    const form = { _id: 'f1' }
-    const conditionField = makeField('001')
-    const logicField = makeField('002')
-    const logicResponse = makeResponse(logicField._id, 'lorem')
-    form.form_fields = [conditionField, logicField]
-    it('should compute that submission should be prevented for "is equals to"', () => {
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is equals to',
-              value: 0,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 0), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 1), logicResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-    it('should compute that submission should be prevented for "is less than or equal to"', () => {
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is less than or equal to',
-              value: 99,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 98), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 99), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 100), logicResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-    it('should compute that submission should be prevented for "is more than or equal to"', () => {
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'number',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is more than or equal to',
-              value: 22,
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 23), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 22), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 21), logicResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-    it('should compute that submission should be prevented for "is either"', () => {
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'multi-select',
-              _id: '58169',
-              field: conditionField._id,
-              state: 'is either',
-              value: ['Option 1', 'Option 2'],
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 'Option 1'), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 'Option 2'), logicResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(conditionField._id, 'Option 3'), logicResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-  })
-  describe('show fields with multiple conditions', () => {
-    const form = { _id: 'f1' }
-    const conditionField1 = makeField('001')
-    const conditionField2 = makeField('002')
-    const logicField = makeField('003')
-    const logicResponse = makeResponse(logicField._id, 'lorem')
-    form.form_fields = [conditionField1, conditionField2, logicField]
-    it('should compute the correct visibility for AND conditions', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          _id: '5df11ee1e6b6e7108a939c8a',
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '9577',
-              field: conditionField1._id,
-              state: 'is equals to',
-              value: 'Yes',
-            },
-            {
-              ifValueType: 'single-select',
-              _id: '45633',
-              field: conditionField2._id,
-              state: 'is equals to',
-              value: 20,
-            },
-          ],
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-    it('should compute the correct visibility for OR conditions', () => {
-      form.form_logics = [
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '9577',
-              field: conditionField1._id,
-              state: 'is equals to',
-              value: 'Yes',
-            },
-          ],
-          _id: '5df11ee1e6b6e7108a939c8a',
-          logicType: 'showFields',
-        },
-        {
-          show: [logicField._id],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '89906',
-              field: conditionField2._id,
-              state: 'is equals to',
-              value: 20,
-            },
-          ],
-          _id: '5df127a2e6b6e7108a939c90',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ).has(logicField._id),
-      ).toBe(false)
-    })
-  })
-  describe('prevent submit with multiple conditions', () => {
-    const form = { _id: 'f1' }
-    const conditionField1 = makeField('001')
-    const conditionField2 = makeField('002')
-    const logicField = makeField('003')
-    const logicResponse = makeResponse(logicField._id, 'lorem')
-    form.form_fields = [conditionField1, conditionField2, logicField]
-    it('should correctly prevent submission for AND conditions', () => {
-      form.form_logics = [
-        {
-          show: [],
-          _id: '5df11ee1e6b6e7108a939c8a',
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '9577',
-              field: conditionField1._id,
-              state: 'is equals to',
-              value: 'Yes',
-            },
-            {
-              ifValueType: 'single-select',
-              _id: '45633',
-              field: conditionField2._id,
-              state: 'is equals to',
-              value: 20,
-            },
-          ],
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toBeUndefined()
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-    it('should correctly prevent submission for OR conditions', () => {
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '9577',
-              field: conditionField1._id,
-              state: 'is equals to',
-              value: 'Yes',
-            },
-          ],
-          _id: '5df11ee1e6b6e7108a939c8a',
-          logicType: 'preventSubmit',
-        },
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '89906',
-              field: conditionField2._id,
-              state: 'is equals to',
-              value: 20,
-            },
-          ],
-          _id: '5df127a2e6b6e7108a939c90',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'Yes'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 20),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toEqual(form.form_logics[1])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [
-            makeResponse(conditionField1._id, 'No'),
-            makeResponse(conditionField2._id, 100),
-            logicResponse,
-          ],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-  })
-  describe('visibility for others value', () => {
-    const form = { _id: 'f1' }
-    const radioButton = {
-      _id: '001',
-      fieldType: 'radiobutton',
-      fieldOptions: ['Option 1', 'Option 2'],
-      othersRadioButton: true,
-    }
-    const textField = { _id: '002', fieldType: 'textfield' }
-    it('should compute the correct visibility for radiobutton Others on clientside', () => {
-      const textFieldResponse = Object.assign({}, textField, {
-        fieldValue: 'lorem',
-      })
-      form.form_fields = [radioButton, textField]
-      form.form_logics = [
-        {
-          show: [textField._id],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '58169',
-              field: radioButton._id,
-              state: 'is equals to',
-              value: 'Others',
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      const fillInRadioButton = (fieldValue) =>
-        Object.assign({}, radioButton, { fieldValue, isVisible: true })
-      expect(
-        getVisibleFieldIds(
-          [fillInRadioButton('radioButtonOthers'), textFieldResponse],
-          form,
-        ).has(textField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [fillInRadioButton('Option 1'), textFieldResponse],
-          form,
-        ).has(textField._id),
-      ).toBe(false)
-    })
-    it('should compute the correct visibility for radiobutton Others on serverside', () => {
-      const textFieldResponse = makeResponse('002', 'lorem')
-      form.form_fields = [radioButton, textField]
-      form.form_logics = [
-        {
-          show: [textField._id],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '58169',
-              field: radioButton._id,
-              state: 'is equals to',
-              value: 'Others',
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'showFields',
-        },
-      ]
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(radioButton._id, 'Others: School'), textFieldResponse],
-          form,
-        ).has(textField._id),
-      ).toBe(true)
-      expect(
-        getVisibleFieldIds(
-          [makeResponse(radioButton._id, 'Option 1'), textFieldResponse],
-          form,
-        ).has(textField._id),
-      ).toBe(false)
-    })
-  })
-  describe('visibility for circular logic', () => {
-    const form = { _id: 'f1' }
-    const field1 = makeField('001')
-    const field2 = makeField('002')
-    const visibleField = makeField('003')
-    form.form_logics = [
-      {
-        show: [field2._id],
-        conditions: [
-          {
-            ifValueType: 'single-select',
-            _id: '9577',
-            field: field1._id,
-            state: 'is equals to',
-            value: 'Yes',
-          },
-        ],
-        _id: '5df11ee1e6b6e7108a939c8a',
-        logicType: 'showFields',
-      },
-      {
-        show: [field1._id],
-        conditions: [
-          {
-            ifValueType: 'single-select',
-            _id: '89906',
-            field: field2._id,
-            state: 'is equals to',
-            value: 'Yes',
-          },
-        ],
-        _id: '5df127a2e6b6e7108a939c90',
-        logicType: 'showFields',
-      },
-    ]
-    it('should compute the correct visibility for circular logic where all fields are hidden', () => {
-      form.form_fields = [field1, field2]
-      for (let field1Response of ['Yes', 'No']) {
-        for (let field2Response of ['Yes', 'No']) {
-          const visibleFieldIds = getVisibleFieldIds(
-            [
-              makeResponse(field1._id, field1Response),
-              makeResponse(field2._id, field2Response),
-            ],
-            form,
-          )
-          expect(visibleFieldIds.has(field1._id)).toBe(false)
-          expect(visibleFieldIds.has(field2._id)).toBe(false)
-        }
-      }
-    })
-    it('should compute the correct visibility for circular logic with a mix of shown and hidden fields', () => {
-      form.form_fields = [field1, field2, visibleField]
-      for (let field1Response of ['Yes', 'No']) {
-        for (let field2Response of ['Yes', 'No']) {
-          const visibleFieldIds = getVisibleFieldIds(
-            [
-              makeResponse(field1._id, field1Response),
-              makeResponse(field2._id, field2Response),
-              makeResponse(visibleField._id, 'Yes'),
-            ],
-            form,
-          )
-          expect(visibleFieldIds.has(field1._id)).toBe(false)
-          expect(visibleFieldIds.has(field2._id)).toBe(false)
-          expect(visibleFieldIds.has(visibleField._id)).toBe(true)
-        }
-      }
-    })
-  })
-  describe('prevent submit for others value', () => {
-    const form = { _id: 'f1' }
-    const radioButton = {
-      _id: '001',
-      fieldType: 'radiobutton',
-      fieldOptions: ['Option 1', 'Option 2'],
-      othersRadioButton: true,
-    }
-    const textField = { _id: '002', fieldType: 'textfield' }
-    it('should correctly prevent submission for radiobutton Others on clientside', () => {
-      const textFieldResponse = Object.assign({}, textField, {
-        fieldValue: 'lorem',
-      })
-      form.form_fields = [radioButton, textField]
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '58169',
-              field: radioButton._id,
-              state: 'is equals to',
-              value: 'Others',
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      const fillInRadioButton = (fieldValue) =>
-        Object.assign({}, radioButton, { fieldValue, isVisible: true })
-      expect(
-        getLogicUnitPreventingSubmit(
-          [fillInRadioButton('radioButtonOthers'), textFieldResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [fillInRadioButton('Option 1'), textFieldResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-    it('should correctly prevent submission for radiobutton Others on serverside', () => {
-      const textFieldResponse = makeResponse('002', 'lorem')
-      form.form_fields = [radioButton, textField]
-      form.form_logics = [
-        {
-          show: [],
-          conditions: [
-            {
-              ifValueType: 'single-select',
-              _id: '58169',
-              field: radioButton._id,
-              state: 'is equals to',
-              value: 'Others',
-            },
-          ],
-          _id: '5db00a15af2ffb29487d4eb1',
-          logicType: 'preventSubmit',
-        },
-      ]
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(radioButton._id, 'Others: School'), textFieldResponse],
-          form,
-        ),
-      ).toEqual(form.form_logics[0])
-      expect(
-        getLogicUnitPreventingSubmit(
-          [makeResponse(radioButton._id, 'Option 1'), textFieldResponse],
-          form,
-        ),
-      ).toBeUndefined()
-    })
-  })
-})
diff --git a/tests/unit/backend/utils/logic.spec.ts b/tests/unit/backend/utils/logic.spec.ts
new file mode 100644
index 0000000000..675ff223f6
--- /dev/null
+++ b/tests/unit/backend/utils/logic.spec.ts
@@ -0,0 +1,1004 @@
+import { ObjectId } from 'bson-ext'
+
+import {
+  getLogicUnitPreventingSubmit,
+  getVisibleFieldIds,
+} from 'src/shared/util/logic'
+import {
+  BasicField,
+  FieldResponse,
+  IFieldSchema,
+  IFormDocument,
+  IPreventSubmitLogicSchema,
+  IRadioFieldSchema,
+  IShortTextFieldSchema,
+  IShowFieldsLogicSchema,
+  LogicConditionState,
+  LogicIfValue,
+  LogicType,
+} from 'src/types'
+
+describe('Logic validation', () => {
+  /** Mock a field's bare essentials */
+  const makeField = (fieldId: string) => ({ _id: fieldId } as IFieldSchema)
+
+  /**
+   *  Mock a response
+   * @param fieldId field id of the field that this response is meant for
+   * @param answer
+   * @param answerArray array of answers passed in for checkbox and table
+   * @param isVisible whether field is visible
+   */
+  const makeResponse = (
+    fieldId: string,
+    answer: string | number,
+    answerArray: string[] | null = null,
+    isVisible = true,
+  ): FieldResponse => {
+    const response: Record<string, any> = { _id: fieldId, answer, isVisible }
+    if (answerArray) {
+      response.answerArray = answerArray
+    }
+    return response as FieldResponse
+  }
+
+  describe('visibility for different states', () => {
+    const CONDITION_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_RESPONSE = makeResponse(LOGIC_FIELD._id, 'lorem')
+    const MOCK_LOGIC_ID = new ObjectId().toHexString()
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = {
+        _id: new ObjectId(),
+        form_fields: [CONDITION_FIELD, LOGIC_FIELD],
+      } as IFormDocument
+    })
+
+    it('should compute the correct visibility for "is equals to"', () => {
+      // Arrange
+      const equalsCondition = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Equal,
+            value: 0,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      form.form_logics = [equalsCondition]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 0), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 1), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+
+    it('should compute the correct visibility for "is less than or equal to"', () => {
+      // Arrange
+      const lteCondition = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Lte,
+            value: 99,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      form.form_logics = [lteCondition]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 98), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 99), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 100), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+
+    it('should compute the correct visibility for "is more than or equal to"', () => {
+      // Arrange
+      const gteCondition = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Gte,
+            value: 22,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+      form.form_logics = [gteCondition]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 23), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 22), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 21), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+
+    it('should compute the correct visibility for "is either"', () => {
+      // Arrange
+      const validOptions = ['Option 1', 'Option 2']
+      const eitherCondition = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.MultiSelect,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Either,
+            value: validOptions,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      form.form_logics = [eitherCondition]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, validOptions[0]), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, validOptions[1]), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(CONDITION_FIELD._id, 'invalid option'), LOGIC_RESPONSE],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+  })
+
+  describe('preventing submission for different states', () => {
+    const CONDITION_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_RESPONSE = makeResponse(LOGIC_FIELD._id, 'lorem')
+    const MOCK_LOGIC_ID = new ObjectId().toHexString()
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = {
+        _id: new ObjectId(),
+        form_fields: [CONDITION_FIELD, LOGIC_FIELD],
+      } as IFormDocument
+    })
+
+    it('should compute that submission should be prevented for "is equals to"', () => {
+      // Arrange
+      const equalCondition = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Equal,
+            value: 0,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: "oh no you don't",
+      } as IPreventSubmitLogicSchema
+
+      form.form_logics = [equalCondition]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 0), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 1), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+
+    it('should compute that submission should be prevented for "is less than or equal to"', () => {
+      // Arrange
+      const lteCondition = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Lte,
+            value: 99,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: "oh no you don't",
+      } as IPreventSubmitLogicSchema
+
+      form.form_logics = [lteCondition]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 98), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 99), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 100), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+
+    it('should compute that submission should be prevented for "is more than or equal to"', () => {
+      // Arrange
+      const gteCondition = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.Number,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Gte,
+            value: 22,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: "oh no you don't",
+      } as IPreventSubmitLogicSchema
+
+      form.form_logics = [gteCondition]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 23), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 22), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 21), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+
+    it('should compute that submission should be prevented for "is either"', () => {
+      // Arrange
+      const validOptions = ['Option 1', 'Option 2']
+      const eitherCondition = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.MultiSelect,
+            _id: '58169',
+            field: CONDITION_FIELD._id,
+            state: LogicConditionState.Either,
+            value: validOptions,
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: "oh no you don't",
+      } as IPreventSubmitLogicSchema
+
+      form.form_logics = [eitherCondition]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, validOptions[0]), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, validOptions[1]), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(CONDITION_FIELD._id, 'Option 3'), LOGIC_RESPONSE],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+  })
+
+  describe('show fields with multiple conditions', () => {
+    const CONDITION_FIELD_1 = makeField(new ObjectId().toHexString())
+    const CONDITION_FIELD_2 = makeField(new ObjectId().toHexString())
+    const LOGIC_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_RESPONSE = makeResponse(LOGIC_FIELD._id, 'lorem')
+    const MOCK_LOGIC_ID_1 = new ObjectId().toHexString()
+    const MOCK_LOGIC_ID_2 = new ObjectId().toHexString()
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = {
+        _id: new ObjectId(),
+        form_fields: [CONDITION_FIELD_1, CONDITION_FIELD_2, LOGIC_FIELD],
+      } as IFormDocument
+    })
+
+    it('should compute the correct visibility for AND conditions', () => {
+      // Arrange
+      const multipleEqualConditions = {
+        show: [LOGIC_FIELD._id],
+        _id: MOCK_LOGIC_ID_1,
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '9577',
+            field: CONDITION_FIELD_1._id,
+            state: LogicConditionState.Equal,
+            value: 'Yes',
+          },
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '45633',
+            field: CONDITION_FIELD_2._id,
+            state: LogicConditionState.Equal,
+            value: 20,
+          },
+        ],
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      form.form_logics = [multipleEqualConditions]
+
+      // Act
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+
+    it('should compute the correct visibility for OR conditions', () => {
+      // Arrange
+      const equalCondition = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '9577',
+            field: CONDITION_FIELD_1._id,
+            state: LogicConditionState.Equal,
+            value: 'Yes',
+          },
+        ],
+        _id: MOCK_LOGIC_ID_1,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      const equalCondition2 = {
+        show: [LOGIC_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '89906',
+            field: CONDITION_FIELD_2._id,
+            state: LogicConditionState.Equal,
+            value: 20,
+          },
+        ],
+        _id: MOCK_LOGIC_ID_2,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      form.form_logics = [equalCondition, equalCondition2]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ).has(LOGIC_FIELD._id),
+      ).toEqual(false)
+    })
+  })
+
+  describe('prevent submit with multiple conditions', () => {
+    const CONDITION_FIELD_1 = makeField(new ObjectId().toHexString())
+    const CONDITION_FIELD_2 = makeField(new ObjectId().toHexString())
+    const LOGIC_FIELD = makeField(new ObjectId().toHexString())
+    const LOGIC_RESPONSE = makeResponse(LOGIC_FIELD._id, 'lorem')
+    const MOCK_LOGIC_ID_1 = new ObjectId().toHexString()
+    const MOCK_LOGIC_ID_2 = new ObjectId().toHexString()
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = {
+        _id: new ObjectId(),
+        form_fields: [CONDITION_FIELD_1, CONDITION_FIELD_2, LOGIC_FIELD],
+      } as IFormDocument
+    })
+
+    it('should correctly prevent submission for AND conditions', () => {
+      // Arrange
+      const multipleEqualConditions = {
+        _id: MOCK_LOGIC_ID_1,
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '9577',
+            field: CONDITION_FIELD_1._id,
+            state: LogicConditionState.Equal,
+            value: 'Yes',
+          },
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '45633',
+            field: CONDITION_FIELD_2._id,
+            state: LogicConditionState.Equal,
+            value: 20,
+          },
+        ],
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: 'orh hor i tell teacher',
+      } as IPreventSubmitLogicSchema
+      form.form_logics = [multipleEqualConditions]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toBeUndefined()
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+
+    it('should correctly prevent submission for OR conditions', () => {
+      // Arrange
+      const equalCondition = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '9577',
+            field: CONDITION_FIELD_1._id,
+            state: LogicConditionState.Equal,
+            value: 'Yes',
+          },
+        ],
+        _id: MOCK_LOGIC_ID_1,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: 'this one cannot',
+      } as IPreventSubmitLogicSchema
+
+      const equalCondition2 = {
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '89906',
+            field: CONDITION_FIELD_2._id,
+            state: LogicConditionState.Equal,
+            value: 20,
+          },
+        ],
+        _id: MOCK_LOGIC_ID_2,
+        logicType: LogicType.PreventSubmit,
+        preventSubmitMessage: 'this one also cannot',
+      } as IPreventSubmitLogicSchema
+
+      form.form_logics = [equalCondition, equalCondition2]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'Yes'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 20),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toEqual(form.form_logics[1])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(CONDITION_FIELD_1._id, 'No'),
+            makeResponse(CONDITION_FIELD_2._id, 100),
+            LOGIC_RESPONSE,
+          ],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+  })
+
+  describe('visibility for others value', () => {
+    const MOCK_LOGIC_ID = new ObjectId().toHexString()
+
+    const MOCK_RADIO_FIELD = {
+      _id: new ObjectId().toHexString(),
+      fieldType: BasicField.Radio,
+      fieldOptions: ['Option 1', 'Option 2'],
+      othersRadioButton: true,
+    } as IRadioFieldSchema
+
+    const MOCK_TEXT_FIELD = {
+      _id: new ObjectId().toHexString(),
+      fieldType: BasicField.ShortText,
+    } as IShortTextFieldSchema
+
+    const fillInRadioButton = (fieldValue: string) =>
+      Object.assign({}, MOCK_RADIO_FIELD, { fieldValue, isVisible: true })
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = {
+        _id: new ObjectId(),
+      } as IFormDocument
+    })
+
+    it('should compute the correct visibility for radiobutton Others on clientside', () => {
+      // Arrange
+      const equalCondition = {
+        show: [MOCK_TEXT_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '58169',
+            field: MOCK_RADIO_FIELD._id,
+            state: LogicConditionState.Equal,
+            value: 'Others',
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      const textFieldResponse = Object.assign({}, MOCK_TEXT_FIELD, {
+        fieldValue: 'lorem',
+      })
+      form.form_fields = [MOCK_RADIO_FIELD, MOCK_TEXT_FIELD]
+      form.form_logics = [equalCondition]
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [fillInRadioButton('radioButtonOthers'), textFieldResponse],
+          form,
+        ).has(MOCK_TEXT_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [fillInRadioButton('Option 1'), textFieldResponse],
+          form,
+        ).has(MOCK_TEXT_FIELD._id),
+      ).toEqual(false)
+    })
+
+    it('should compute the correct visibility for radiobutton Others on serverside', () => {
+      // Arrange
+      const equalCondition = {
+        show: [MOCK_TEXT_FIELD._id],
+        conditions: [
+          {
+            ifValueType: LogicIfValue.SingleSelect,
+            _id: '58169',
+            field: MOCK_RADIO_FIELD._id,
+            state: LogicConditionState.Equal,
+            value: 'Others',
+          },
+        ],
+        _id: MOCK_LOGIC_ID,
+        logicType: LogicType.ShowFields,
+      } as IShowFieldsLogicSchema
+
+      const textFieldResponse = makeResponse(
+        new ObjectId().toHexString(),
+        'lorem',
+      )
+      form.form_fields = [MOCK_RADIO_FIELD, MOCK_TEXT_FIELD]
+      form.form_logics = [equalCondition]
+
+      // Act + Assert
+      expect(
+        getVisibleFieldIds(
+          [
+            makeResponse(MOCK_RADIO_FIELD._id, 'Others: School'),
+            textFieldResponse,
+          ],
+          form,
+        ).has(MOCK_TEXT_FIELD._id),
+      ).toEqual(true)
+
+      expect(
+        getVisibleFieldIds(
+          [makeResponse(MOCK_RADIO_FIELD._id, 'Option 1'), textFieldResponse],
+          form,
+        ).has(MOCK_TEXT_FIELD._id),
+      ).toEqual(false)
+    })
+  })
+
+  describe('visibility for circular logic', () => {
+    const FIELD_1 = makeField(new ObjectId().toHexString())
+    const FIELD_2 = makeField(new ObjectId().toHexString())
+    const VISIBLE_FIELD = makeField(new ObjectId().toHexString())
+    const MOCK_LOGIC_ID_1 = new ObjectId()
+    const MOCK_LOGIC_ID_2 = new ObjectId()
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = ({
+        _id: new ObjectId(),
+        form_logics: [
+          {
+            show: [FIELD_2._id],
+            conditions: [
+              {
+                ifValueType: LogicIfValue.SingleSelect,
+                _id: '9577',
+                field: FIELD_1._id,
+                state: LogicConditionState.Equal,
+                value: 'Yes',
+              },
+            ],
+            _id: MOCK_LOGIC_ID_1,
+            logicType: LogicType.ShowFields,
+          } as IShowFieldsLogicSchema,
+          {
+            show: [FIELD_1._id],
+            conditions: [
+              {
+                ifValueType: LogicIfValue.SingleSelect,
+                _id: '89906',
+                field: FIELD_2._id,
+                state: LogicConditionState.Equal,
+                value: 'Yes',
+              },
+            ],
+            _id: MOCK_LOGIC_ID_2,
+            logicType: LogicType.ShowFields,
+          } as IShowFieldsLogicSchema,
+        ],
+      } as unknown) as IFormDocument
+    })
+
+    it('should compute the correct visibility for circular logic where all fields are hidden', () => {
+      form.form_fields = [FIELD_1, FIELD_2]
+      for (const field1Response of ['Yes', 'No']) {
+        for (const field2Response of ['Yes', 'No']) {
+          const visibleFieldIds = getVisibleFieldIds(
+            [
+              makeResponse(FIELD_1._id, field1Response),
+              makeResponse(FIELD_2._id, field2Response),
+            ],
+            form,
+          )
+          expect(visibleFieldIds.has(FIELD_1._id)).toEqual(false)
+          expect(visibleFieldIds.has(FIELD_2._id)).toEqual(false)
+        }
+      }
+    })
+
+    it('should compute the correct visibility for circular logic with a mix of shown and hidden fields', () => {
+      form.form_fields = [FIELD_1, FIELD_2, VISIBLE_FIELD]
+      for (const field1Response of ['Yes', 'No']) {
+        for (const field2Response of ['Yes', 'No']) {
+          const visibleFieldIds = getVisibleFieldIds(
+            [
+              makeResponse(FIELD_1._id, field1Response),
+              makeResponse(FIELD_2._id, field2Response),
+              makeResponse(VISIBLE_FIELD._id, 'Yes'),
+            ],
+            form,
+          )
+          expect(visibleFieldIds.has(FIELD_1._id)).toEqual(false)
+          expect(visibleFieldIds.has(FIELD_2._id)).toEqual(false)
+          expect(visibleFieldIds.has(VISIBLE_FIELD._id)).toEqual(true)
+        }
+      }
+    })
+  })
+
+  describe('prevent submit for others value', () => {
+    const MOCK_LOGIC_ID = new ObjectId()
+    const MOCK_RADIO_FIELD = {
+      _id: new ObjectId(),
+      fieldType: BasicField.Radio,
+      fieldOptions: ['Option 1', 'Option 2'],
+      othersRadioButton: true,
+    } as IRadioFieldSchema
+    const MOCK_TEXT_FIELD = {
+      _id: new ObjectId(),
+      fieldType: BasicField.ShortText,
+    } as IShortTextFieldSchema
+
+    const fillInRadioButton = (fieldValue: string) =>
+      Object.assign({}, MOCK_RADIO_FIELD, { fieldValue, isVisible: true })
+
+    let form: IFormDocument
+
+    beforeEach(() => {
+      form = { _id: new ObjectId() } as IFormDocument
+    })
+
+    it('should correctly prevent submission for radiobutton Others on clientside', () => {
+      // Arrange
+      const textFieldResponse = Object.assign({}, MOCK_TEXT_FIELD, {
+        fieldValue: 'lorem',
+      })
+      form.form_fields = [MOCK_RADIO_FIELD, MOCK_TEXT_FIELD]
+      form.form_logics = [
+        {
+          conditions: [
+            {
+              ifValueType: LogicIfValue.SingleSelect,
+              _id: '58169',
+              field: MOCK_RADIO_FIELD._id,
+              state: LogicConditionState.Equal,
+              value: 'Others',
+            },
+          ],
+          _id: MOCK_LOGIC_ID,
+          logicType: LogicType.PreventSubmit,
+        } as IPreventSubmitLogicSchema,
+      ]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [fillInRadioButton('radioButtonOthers'), textFieldResponse],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+
+      expect(
+        getLogicUnitPreventingSubmit(
+          [fillInRadioButton('Option 1'), textFieldResponse],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+
+    it('should correctly prevent submission for radiobutton Others on serverside', () => {
+      // Arrange
+      const textFieldResponse = makeResponse(
+        new ObjectId().toHexString(),
+        'lorem',
+      )
+      form.form_fields = [MOCK_RADIO_FIELD, MOCK_TEXT_FIELD]
+      form.form_logics = [
+        {
+          conditions: [
+            {
+              ifValueType: LogicIfValue.SingleSelect,
+              _id: '58169',
+              field: MOCK_RADIO_FIELD._id,
+              state: LogicConditionState.Equal,
+              value: 'Others',
+            },
+          ],
+          _id: MOCK_LOGIC_ID,
+          logicType: LogicType.PreventSubmit,
+        } as IPreventSubmitLogicSchema,
+      ]
+
+      // Act + Assert
+      expect(
+        getLogicUnitPreventingSubmit(
+          [
+            makeResponse(MOCK_RADIO_FIELD._id, 'Others: School'),
+            textFieldResponse,
+          ],
+          form,
+        ),
+      ).toEqual(form.form_logics[0])
+      expect(
+        getLogicUnitPreventingSubmit(
+          [makeResponse(MOCK_RADIO_FIELD._id, 'Option 1'), textFieldResponse],
+          form,
+        ),
+      ).toBeUndefined()
+    })
+  })
+})

From b619f7bb74071654add3bc40548a651cfc2e1e5c Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Thu, 8 Apr 2021 14:35:08 +0800
Subject: [PATCH 26/75] refactor: collapse encrypt preview submission
 middleware (#1554)

---
 .../encrypt-submissions.server.controller.js  | 139 ----
 .../__tests__/admin-form.controller.spec.ts   | 719 +++++++++++++++++-
 .../__tests__/admin-form.routes.spec.ts       | 338 +++++++-
 .../form/admin-form/admin-form.controller.ts  | 148 +++-
 .../form/admin-form/admin-form.routes.ts      |  21 +
 .../encrypt-submission.service.spec.ts        |  47 +-
 .../encrypt-submission.controller.ts          |   5 +-
 .../encrypt-submission.middleware.ts          | 131 ++--
 .../encrypt-submission.service.ts             |  33 +-
 .../encrypt-submission.types.ts               |  39 +-
 .../encrypt-submission.utils.ts               |   2 +
 .../verified-content.middleware.spec.ts       | 200 -----
 .../verified-content.middlewares.ts           |  70 --
 src/app/routes/admin-forms.server.routes.js   |  76 --
 src/app/routes/public-forms.server.routes.js  |  61 +-
 src/types/api/encrypt-submission.ts           |  21 +
 src/types/api/index.ts                        |   1 +
 ...rypt-submissions.server.controller.spec.js | 342 ---------
 .../backend/helpers/generate-form-data.ts     |  15 +-
 19 files changed, 1387 insertions(+), 1021 deletions(-)
 delete mode 100644 src/app/controllers/encrypt-submissions.server.controller.js
 delete mode 100644 src/app/modules/verified-content/__tests__/verified-content.middleware.spec.ts
 delete mode 100644 src/app/modules/verified-content/verified-content.middlewares.ts
 create mode 100644 src/types/api/encrypt-submission.ts
 delete mode 100644 tests/unit/backend/controllers/encrypt-submissions.server.controller.spec.js

diff --git a/src/app/controllers/encrypt-submissions.server.controller.js b/src/app/controllers/encrypt-submissions.server.controller.js
deleted file mode 100644
index 9614791b86..0000000000
--- a/src/app/controllers/encrypt-submissions.server.controller.js
+++ /dev/null
@@ -1,139 +0,0 @@
-'use strict'
-const crypto = require('crypto')
-const { StatusCodes } = require('http-status-codes')
-
-const mongoose = require('mongoose')
-const {
-  getEncryptSubmissionModel,
-} = require('../models/submission.server.model')
-const EncryptSubmission = getEncryptSubmissionModel(mongoose)
-
-const { createReqMeta } = require('../utils/request')
-const logger = require('../../config/logger').createLoggerWithLabel(module)
-const {
-  aws: { attachmentS3Bucket, s3 },
-} = require('../../config/config')
-
-/**
- * @param {Error} err - the Error to report
- * @param {Object} req - Express request object
- * @param {Object} res - Express response object
- * @param {Object} submission - the Mongoose model instance
- * of the submission
- */
-function onEncryptSubmissionFailure(err, req, res, submission) {
-  logger.error({
-    message: 'Encrypt submission error',
-    meta: {
-      action: 'onEncryptSubmissionFailure',
-      ...createReqMeta(req),
-    },
-    error: err,
-  })
-  return res.status(StatusCodes.BAD_REQUEST).json({
-    message:
-      'Could not send submission. For assistance, please contact the person who asked you to fill in this form.',
-    submissionId: submission._id,
-    spcpSubmissionFailure: false,
-  })
-}
-
-/**
- * @typedef AttachmentData
- * @type {Object<string, EncryptedAttachment>} Object with keys as form field IDs
- */
-
-/**
- * @typedef EncryptedAttachment
- * @property {object} encryptedFile
- * @property {string} encryptedFile.submissionPublicKey
- * @property {string} encryptedFile.nonce
- * @property {string} encryptedFile.binary Attachment binary in base64
- *
- */
-
-/**
- * Uploads attachments to S3 and a saves new Submission to the database for encrypted forms.
- * @param {Object} req - Express request object
- * @param {Object} req.form - f
- * @param {Object} req.formData - the submission for the form
- * @param {AttachmentData} req.attachmentData - attachments for the form if any
- * @param {Object} res - Express response object
- * @param {Object} res.locals - Express response containing local variables scoped to the request
- * @param {Object} res.locals.verified - any signed+encrypted verified object from server.
- * @param {Object} next - the next expressjs callback, invoked once attachments
- * are processed
- */
-exports.saveResponseToDb = function (req, res, next) {
-  const { form, formData, attachmentData } = req
-  const logMeta = {
-    action: 'saveResponseToDb',
-    formId: form._id,
-    ...createReqMeta(req),
-  }
-  const { verified } = res.locals
-  let attachmentMetadata = new Map()
-  let attachmentUploadPromises = []
-
-  // Object.keys(attachmentData[fieldId].encryptedFile) [ 'submissionPublicKey', 'nonce', 'binary' ]
-  for (let fieldId in attachmentData) {
-    const individualAttachment = JSON.stringify(attachmentData[fieldId])
-
-    const hashStr = crypto
-      .createHash('sha256')
-      .update(individualAttachment)
-      .digest('hex')
-
-    const uploadKey =
-      form._id + '/' + crypto.randomBytes(20).toString('hex') + '/' + hashStr
-
-    attachmentMetadata.set(fieldId, uploadKey)
-
-    attachmentUploadPromises.push(
-      s3
-        .upload({
-          Bucket: attachmentS3Bucket,
-          Key: uploadKey,
-          Body: Buffer.from(individualAttachment),
-        })
-        .promise()
-        .catch((err) => {
-          logger.error({
-            message: 'Attachment upload error',
-            meta: logMeta,
-            error: err,
-          })
-          return onEncryptSubmissionFailure(err, req, res, submission)
-        }),
-    )
-  }
-
-  const submission = new EncryptSubmission({
-    form: form._id,
-    authType: form.authType,
-    myInfoFields: form.getUniqueMyInfoAttrs(),
-    encryptedContent: formData,
-    verifiedContent: verified,
-    attachmentMetadata,
-    version: req.body.version,
-  })
-
-  Promise.all(attachmentUploadPromises)
-    .then((_) => {
-      return submission.save()
-    })
-    .then((savedSubmission) => {
-      logger.info({
-        message: 'Saved submission to MongoDB',
-        meta: {
-          ...logMeta,
-          submissionId: savedSubmission._id,
-        },
-      })
-      req.submission = savedSubmission
-      return next()
-    })
-    .catch((err) => {
-      return onEncryptSubmissionFailure(err, req, res, submission)
-    })
-}
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
index 0808e5140a..150d700244 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
@@ -1,7 +1,7 @@
 import { PresignedPost } from 'aws-sdk/clients/s3'
 import { ObjectId } from 'bson-ext'
 import { assignIn, cloneDeep, merge } from 'lodash'
-import { errAsync, okAsync } from 'neverthrow'
+import { err, errAsync, ok, okAsync } from 'neverthrow'
 import { PassThrough } from 'stream'
 import { MockedObject } from 'ts-jest/dist/utils/testing'
 import { mocked } from 'ts-jest/utils'
@@ -15,16 +15,27 @@ import {
 } from 'src/app/modules/core/core.errors'
 import * as FeedbackService from 'src/app/modules/feedback/feedback.service'
 import { FeedbackResponse } from 'src/app/modules/feedback/feedback.types'
+import * as EncryptSubmissionService from 'src/app/modules/submission/encrypt-submission/encrypt-submission.service'
+import {
+  ConflictError,
+  InvalidEncodingError,
+  ProcessingError,
+  ResponseModeError,
+  ValidateFieldError,
+} from 'src/app/modules/submission/submission.errors'
 import * as SubmissionService from 'src/app/modules/submission/submission.service'
 import { MissingUserError } from 'src/app/modules/user/user.errors'
+import * as EncryptionUtils from 'src/app/utils/encryption'
 import { EditFieldActions } from 'src/shared/constants'
 import {
   AuthType,
   BasicField,
   FormMetaView,
   FormSettings,
+  IEncryptedSubmissionSchema,
   IForm,
   IFormSchema,
+  IPopulatedEncryptedForm,
   IPopulatedForm,
   IPopulatedUser,
   IUserSchema,
@@ -32,8 +43,13 @@ import {
   ResponseMode,
   Status,
 } from 'src/types'
+import { EncryptSubmissionDto } from 'src/types/api'
 
-import { generateDefaultField } from 'tests/unit/backend/helpers/generate-form-data'
+import {
+  generateDefaultField,
+  generateNewSingleAnswerResponse,
+  generateUnprocessedSingleAnswerResponse,
+} from 'tests/unit/backend/helpers/generate-form-data'
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
 import * as UserService from '../../../user/user.service'
@@ -63,6 +79,12 @@ jest.mock('src/app/modules/feedback/feedback.service')
 const MockFeedbackService = mocked(FeedbackService)
 jest.mock('src/app/modules/submission/submission.service')
 const MockSubmissionService = mocked(SubmissionService)
+jest.mock(
+  'src/app/modules/submission/encrypt-submission/encrypt-submission.service',
+)
+const MockEncryptSubmissionService = mocked(EncryptSubmissionService)
+jest.mock('src/app/utils/encryption')
+const MockEncryptionUtils = mocked(EncryptionUtils)
 jest.mock('../admin-form.service')
 const MockAdminFormService = mocked(AdminFormService)
 jest.mock('../../../user/user.service')
@@ -4784,4 +4806,697 @@ describe('admin-form.controller', () => {
       )
     })
   })
+
+  describe('handleEncryptPreviewSubmission', () => {
+    const MOCK_RESPONSES = [
+      generateUnprocessedSingleAnswerResponse(BasicField.Email),
+    ]
+    const MOCK_PARSED_RESPONSES = [
+      generateNewSingleAnswerResponse(BasicField.Email),
+    ]
+    const MOCK_ENCRYPTED_CONTENT = 'mockEncryptedContent'
+    const MOCK_VERSION = 1
+    const MOCK_SUBMISSION_BODY: EncryptSubmissionDto = {
+      responses: MOCK_RESPONSES,
+      encryptedContent: MOCK_ENCRYPTED_CONTENT,
+      version: MOCK_VERSION,
+      isPreview: false,
+      attachments: {
+        [new ObjectId().toHexString()]: {
+          encryptedFile: {
+            binary: '10101',
+            nonce: 'mockNonce',
+            submissionPublicKey: 'mockPublicKey',
+          },
+        },
+      },
+    }
+    const MOCK_USER_ID = new ObjectId().toHexString()
+    const MOCK_FORM_ID = new ObjectId().toHexString()
+    const MOCK_SUBMISSION_ID = new ObjectId().toHexString()
+    const MOCK_USER = {
+      _id: MOCK_USER_ID,
+      email: 'somerandom@example.com',
+    } as IPopulatedUser
+    const MOCK_FORM = {
+      admin: MOCK_USER,
+      _id: MOCK_FORM_ID,
+      title: 'mock title',
+    } as IPopulatedEncryptedForm
+    const MOCK_SUBMISSION = {
+      _id: MOCK_SUBMISSION_ID,
+      created: new Date(),
+    } as IEncryptedSubmissionSchema
+
+    beforeEach(() => {
+      MockUserService.getPopulatedUserById.mockReturnValue(okAsync(MOCK_USER))
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValue(
+        okAsync(MOCK_FORM),
+      )
+      MockEncryptSubmissionService.checkFormIsEncryptMode.mockReturnValue(
+        ok(MOCK_FORM),
+      )
+      MockEncryptionUtils.checkIsEncryptedEncoding.mockReturnValue(ok(true))
+      MockSubmissionService.getProcessedResponses.mockReturnValue(
+        ok(MOCK_PARSED_RESPONSES),
+      )
+      MockEncryptSubmissionService.createEncryptSubmissionWithoutSave.mockReturnValue(
+        MOCK_SUBMISSION,
+      )
+    })
+
+    it('should call all services correctly when submission is valid', async () => {
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(MockEncryptionUtils.checkIsEncryptedEncoding).toHaveBeenCalledWith(
+        MOCK_ENCRYPTED_CONTENT,
+      )
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).toHaveBeenCalledWith({
+        form: MOCK_FORM,
+        encryptedContent: MOCK_ENCRYPTED_CONTENT,
+        verifiedContent: '',
+        version: MOCK_VERSION,
+      })
+      expect(MockSubmissionService.sendEmailConfirmations).toHaveBeenCalledWith(
+        {
+          form: MOCK_FORM,
+          parsedResponses: MOCK_PARSED_RESPONSES,
+          submission: MOCK_SUBMISSION,
+        },
+      )
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: 'Form submission successful.',
+        submissionId: MOCK_SUBMISSION_ID,
+      })
+    })
+
+    it('should return 500 when generic database error occurs while retrieving user', async () => {
+      MockUserService.getPopulatedUserById.mockReturnValueOnce(
+        errAsync(new DatabaseError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(
+        MockAuthService.getFormAfterPermissionChecks,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(500)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 422 when user is missing', async () => {
+      MockUserService.getPopulatedUserById.mockReturnValueOnce(
+        errAsync(new MissingUserError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(
+        MockAuthService.getFormAfterPermissionChecks,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(422)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 500 when generic database error occurs while retrieving form', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new DatabaseError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(500)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 404 when form is not found', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new FormNotFoundError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(404)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 410 when form has been archived', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new FormDeletedError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(410)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 403 when user does not have read permissions', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new ForbiddenFormError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(403)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when form is not encrypt mode', async () => {
+      MockEncryptSubmissionService.checkFormIsEncryptMode.mockReturnValueOnce(
+        err(new ResponseModeError(ResponseMode.Email, ResponseMode.Encrypt)),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEncryptionUtils.checkIsEncryptedEncoding,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when encrypted content encoding is invalid', async () => {
+      MockEncryptionUtils.checkIsEncryptedEncoding.mockReturnValueOnce(
+        err(new InvalidEncodingError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(MockEncryptionUtils.checkIsEncryptedEncoding).toHaveBeenCalledWith(
+        MOCK_ENCRYPTED_CONTENT,
+      )
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when responses cannot be processed', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ProcessingError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(MockEncryptionUtils.checkIsEncryptedEncoding).toHaveBeenCalledWith(
+        MOCK_ENCRYPTED_CONTENT,
+      )
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 409 when form fields submitted are not updated', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ConflictError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(MockEncryptionUtils.checkIsEncryptedEncoding).toHaveBeenCalledWith(
+        MOCK_ENCRYPTED_CONTENT,
+      )
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(409)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when responses cannot be validated', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ValidateFieldError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEncryptPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEncryptSubmissionService.checkFormIsEncryptMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(MockEncryptionUtils.checkIsEncryptedEncoding).toHaveBeenCalledWith(
+        MOCK_ENCRYPTED_CONTENT,
+      )
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(
+        MockEncryptSubmissionService.createEncryptSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+  })
 })
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index 2bd52a224e..ab72a34bce 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/ban-ts-comment */
 import { ObjectId } from 'bson-ext'
 import { format, subDays } from 'date-fns'
-import { cloneDeep, times } from 'lodash'
+import { cloneDeep, omit, times } from 'lodash'
 import mongoose from 'mongoose'
 import { errAsync, okAsync } from 'neverthrow'
 import SparkMD5 from 'spark-md5'
@@ -28,6 +28,7 @@ import { EditFieldActions, VALID_UPLOAD_FILE_TYPES } from 'src/shared/constants'
 import {
   BasicField,
   IFormDocument,
+  IFormSchema,
   IPopulatedEmailForm,
   IPopulatedForm,
   IUserSchema,
@@ -36,6 +37,7 @@ import {
   SubmissionCursorData,
   SubmissionType,
 } from 'src/types'
+import { EncryptSubmissionDto } from 'src/types/api'
 
 import {
   createAuthedSession,
@@ -43,7 +45,10 @@ import {
 } from 'tests/integration/helpers/express-auth'
 import { setupApp } from 'tests/integration/helpers/express-setup'
 import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
-import { generateDefaultField } from 'tests/unit/backend/helpers/generate-form-data'
+import {
+  generateDefaultField,
+  generateUnprocessedSingleAnswerResponse,
+} from 'tests/unit/backend/helpers/generate-form-data'
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
 import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
 
@@ -84,6 +89,335 @@ describe('admin-form.routes', () => {
   })
   afterAll(async () => await dbHandler.closeDatabase())
 
+  describe('POST /v2/submissions/encrypt/preview/:formId', () => {
+    const MOCK_FIELD_ID = new ObjectId().toHexString()
+    const MOCK_ATTACHMENT_FIELD_ID = new ObjectId().toHexString()
+    const MOCK_RESPONSE = omit(
+      generateUnprocessedSingleAnswerResponse(BasicField.Email, {
+        _id: MOCK_FIELD_ID,
+        answer: 'a@abc.com',
+      }),
+      'question',
+    )
+    const MOCK_ENCRYPTED_CONTENT = `${'a'.repeat(44)};${'a'.repeat(
+      32,
+    )}:${'a'.repeat(4)}`
+    const MOCK_VERSION = 1
+    const MOCK_SUBMISSION_BODY: EncryptSubmissionDto = {
+      responses: [MOCK_RESPONSE],
+      encryptedContent: MOCK_ENCRYPTED_CONTENT,
+      version: MOCK_VERSION,
+      isPreview: false,
+      attachments: {
+        [MOCK_ATTACHMENT_FIELD_ID]: {
+          encryptedFile: {
+            binary: '10101',
+            nonce: 'mockNonce',
+            submissionPublicKey: 'mockPublicKey',
+          },
+        },
+      },
+    }
+    let mockForm: IFormSchema
+
+    beforeEach(async () => {
+      mockForm = await EncryptFormModel.create({
+        title: 'mock form',
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+        form_fields: [
+          generateDefaultField(BasicField.Email, { _id: MOCK_FIELD_ID }),
+        ],
+      })
+    })
+
+    it('should return 200 with submission ID when request is valid', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send(MOCK_SUBMISSION_BODY)
+
+      expect(response.body.message).toBe('Form submission successful.')
+      expect(mongoose.isValidObjectId(response.body.submissionId)).toBe(true)
+      expect(response.status).toBe(200)
+    })
+
+    it('should return 401 when user is not signed in', async () => {
+      await logoutSession(request)
+
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send(MOCK_SUBMISSION_BODY)
+
+      expect(response.status).toBe(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 400 when responses are not provided in body', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send(omit(MOCK_SUBMISSION_BODY, 'responses'))
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ body: { key: 'responses' } }),
+      )
+    })
+
+    it('should return 400 when responses are missing _id field', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          responses: [omit(MOCK_RESPONSE, '_id')],
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'responses.0._id',
+            message: '"responses[0]._id" is required',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when responses are missing answer field', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          responses: [omit(MOCK_RESPONSE, 'answer')],
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'responses.0.answer',
+            message: '"responses[0].answer" is required',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when responses are missing fieldType', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          responses: [omit(MOCK_RESPONSE, 'fieldType')],
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'responses.0.fieldType',
+            message: '"responses[0].fieldType" is required',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when a fieldType is malformed', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          responses: [{ ...MOCK_RESPONSE, fieldType: 'malformed' }],
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'responses.0.fieldType',
+            message: expect.stringContaining(
+              '"responses[0].fieldType" must be one of ',
+            ),
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when encryptedContent is not provided in body', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send(omit(MOCK_SUBMISSION_BODY, 'encryptedContent'))
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'encryptedContent',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when version is not provided in body', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send(omit(MOCK_SUBMISSION_BODY, 'version'))
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'version',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when encryptedContent is malformed', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({ ...MOCK_SUBMISSION_BODY, encryptedContent: 'abc' })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: 'encryptedContent',
+            message: 'Invalid encryptedContent.',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when attachment field ID is malformed', async () => {
+      const invalidKey = 'invalidFieldId'
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          attachments: {
+            [invalidKey]: {
+              encryptedFile: {
+                binary: '10101',
+                nonce: 'mockNonce',
+                submissionPublicKey: 'mockPublicKey',
+              },
+            },
+          },
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: `attachments.${invalidKey}`,
+            message: `"attachments.${invalidKey}" is not allowed`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when attachment is missing encryptedFile key', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          attachments: {
+            [MOCK_ATTACHMENT_FIELD_ID]: {},
+          },
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: `attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile`,
+            message: `"attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile" is required`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when attachment is missing binary', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          attachments: {
+            [MOCK_ATTACHMENT_FIELD_ID]: {
+              encryptedFile: {
+                // binary is missing
+                nonce: 'mockNonce',
+                submissionPublicKey: 'mockPublicKey',
+              },
+            },
+          },
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: `attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.binary`,
+            message: `"attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.binary" is required`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when attachment is missing nonce', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          attachments: {
+            [MOCK_ATTACHMENT_FIELD_ID]: {
+              encryptedFile: {
+                binary: '10101',
+                // nonce is missing
+                submissionPublicKey: 'mockPublicKey',
+              },
+            },
+          },
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: `attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.nonce`,
+            message: `"attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.nonce" is required`,
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when attachment is missing public key', async () => {
+      const response = await request
+        .post(`/v2/submissions/encrypt/preview/${mockForm._id}`)
+        .send({
+          ...MOCK_SUBMISSION_BODY,
+          attachments: {
+            [MOCK_ATTACHMENT_FIELD_ID]: {
+              encryptedFile: {
+                binary: '10101',
+                nonce: 'mockNonce',
+                // missing public key
+              },
+            },
+          },
+        })
+
+      expect(response.status).toBe(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          body: {
+            key: `attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.submissionPublicKey`,
+            message: `"attachments.${MOCK_ATTACHMENT_FIELD_ID}.encryptedFile.submissionPublicKey" is required`,
+          },
+        }),
+      )
+    })
+  })
+
   describe('GET /adminform', () => {
     it('should return 200 with empty array when user has no forms', async () => {
       // Act
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 319204363d..9530af82d6 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -12,7 +12,12 @@ import {
   IPopulatedForm,
   WithForm,
 } from '../../../../types'
-import { ErrorDto, SettingsUpdateDto } from '../../../../types/api'
+import {
+  EncryptSubmissionDto,
+  ErrorDto,
+  SettingsUpdateDto,
+} from '../../../../types/api'
+import { checkIsEncryptedEncoding } from '../../../utils/encryption'
 import { createReqMeta } from '../../../utils/request'
 import * as AuthService from '../../auth/auth.service'
 import {
@@ -22,24 +27,14 @@ import {
   DatabaseValidationError,
 } from '../../core/core.errors'
 import * as FeedbackService from '../../feedback/feedback.service'
+import * as EncryptSubmissionService from '../../submission/encrypt-submission/encrypt-submission.service'
+import { mapRouteError as mapEncryptSubmissionError } from '../../submission/encrypt-submission/encrypt-submission.utils'
 import * as SubmissionService from '../../submission/submission.service'
 import * as UserService from '../../user/user.service'
 import { PrivateFormError } from '../form.errors'
 
 import { EditFieldError } from './admin-form.errors'
-import {
-  archiveForm,
-  createForm,
-  createPresignedPostUrlForImages,
-  createPresignedPostUrlForLogos,
-  duplicateForm,
-  editFormFields,
-  getDashboardForms,
-  getMockSpcpLocals,
-  transferFormOwnership,
-  updateForm,
-  updateFormSettings,
-} from './admin-form.service'
+import * as AdminFormService from './admin-form.service'
 import {
   DuplicateFormBody,
   FormUpdateParams,
@@ -60,7 +55,7 @@ const logger = createLoggerWithLabel(module)
 export const handleListDashboardForms: RequestHandler = async (req, res) => {
   const authedUserId = (req.session as Express.AuthedSession).user._id
 
-  return getDashboardForms(authedUserId)
+  return AdminFormService.getDashboardForms(authedUserId)
     .map((dashboardView) => res.json(dashboardView))
     .mapErr((error) => {
       logger.error({
@@ -209,7 +204,11 @@ export const handleCreatePresignedPostUrlForImages: RequestHandler<
       )
       // Step 3: Has write permissions, generate presigned POST URL.
       .andThen(() =>
-        createPresignedPostUrlForImages({ fileId, fileMd5Hash, fileType }),
+        AdminFormService.createPresignedPostUrlForImages({
+          fileId,
+          fileMd5Hash,
+          fileType,
+        }),
       )
       .map((presignedPostUrl) => res.json(presignedPostUrl))
       .mapErr((error) => {
@@ -265,7 +264,11 @@ export const handleCreatePresignedPostUrlForLogos: RequestHandler<
       )
       // Step 3: Has write permissions, generate presigned POST URL.
       .andThen(() =>
-        createPresignedPostUrlForLogos({ fileId, fileMd5Hash, fileType }),
+        AdminFormService.createPresignedPostUrlForLogos({
+          fileId,
+          fileMd5Hash,
+          fileType,
+        }),
       )
       .map((presignedPostUrl) => res.json(presignedPostUrl))
       .mapErr((error) => {
@@ -368,7 +371,7 @@ export const passThroughSpcp: RequestHandler = (req, res, next) => {
   if ([AuthType.SP, AuthType.CP, AuthType.MyInfo].includes(authType)) {
     res.locals = {
       ...res.locals,
-      ...getMockSpcpLocals(
+      ...AdminFormService.getMockSpcpLocals(
         authType,
         (req as WithForm<typeof req>).form.form_fields,
       ),
@@ -593,7 +596,7 @@ export const handleArchiveForm: RequestHandler<{ formId: string }> = async (
         }),
       )
       // Step 3: Currently logged in user has permissions to archive form.
-      .andThen((formToArchive) => archiveForm(formToArchive))
+      .andThen((formToArchive) => AdminFormService.archiveForm(formToArchive))
       .map(() => res.json({ message: 'Form has been archived' }))
       .mapErr((error) => {
         logger.warn({
@@ -647,7 +650,11 @@ export const handleDuplicateAdminForm: RequestHandler<
         })
           .andThen((originalForm) =>
             // Step 3: Duplicate form.
-            duplicateForm(originalForm, userId, overrideParams),
+            AdminFormService.duplicateForm(
+              originalForm,
+              userId,
+              overrideParams,
+            ),
           )
           // Step 4: Retrieve dashboard view of duplicated form.
           .map((duplicatedForm) => duplicatedForm.getDashboardView(user)),
@@ -755,7 +762,7 @@ export const handleCopyTemplateForm: RequestHandler<
         // Step 2: Check if form is currently public.
         AuthService.getFormIfPublic(formId).andThen((originalForm) =>
           // Step 3: Duplicate form.
-          duplicateForm(originalForm, userId, overrideParams)
+          AdminFormService.duplicateForm(originalForm, userId, overrideParams)
             // Step 4: Retrieve dashboard view of duplicated form.
             .map((duplicatedForm) => duplicatedForm.getDashboardView(user)),
         ),
@@ -822,7 +829,7 @@ export const handleTransferFormOwnership: RequestHandler<
       )
       // Step 3: User has permissions, transfer form ownership.
       .andThen((retrievedForm) =>
-        transferFormOwnership(retrievedForm, newOwnerEmail),
+        AdminFormService.transferFormOwnership(retrievedForm, newOwnerEmail),
       )
       // Success, return updated form.
       .map((updatedPopulatedForm) => res.json({ form: updatedPopulatedForm }))
@@ -867,7 +874,9 @@ export const handleCreateForm: RequestHandler<
     // Step 1: Retrieve currently logged in user.
     UserService.findUserById(sessionUserId)
       // Step 2: Create form with given params and set admin to logged in user.
-      .andThen((user) => createForm({ ...formParams, admin: user._id }))
+      .andThen((user) =>
+        AdminFormService.createForm({ ...formParams, admin: user._id }),
+      )
       .map((createdForm) => res.status(StatusCodes.OK).json(createdForm))
       .mapErr((error) => {
         logger.error({
@@ -933,8 +942,8 @@ export const handleUpdateForm: RequestHandler<
         | DatabaseConflictError
         | DatabasePayloadSizeError
       > = editFormField
-        ? editFormFields(retrievedForm, editFormField)
-        : updateForm(retrievedForm, formUpdateParams)
+        ? AdminFormService.editFormFields(retrievedForm, editFormField)
+        : AdminFormService.updateForm(retrievedForm, formUpdateParams)
 
       return updateFormResult
     })
@@ -991,7 +1000,7 @@ export const handleUpdateSettings: RequestHandler<
       }),
     )
     .andThen((retrievedForm) =>
-      updateFormSettings(retrievedForm, settingsToPatch),
+      AdminFormService.updateFormSettings(retrievedForm, settingsToPatch),
     )
     .map((updatedSettings) => res.status(StatusCodes.OK).json(updatedSettings))
     .mapErr((error) => {
@@ -1010,3 +1019,90 @@ export const handleUpdateSettings: RequestHandler<
       return res.status(statusCode).json({ message: errorMessage })
     })
 }
+
+/**
+ * Handler for POST /v2/submissions/encrypt/preview/:formId.
+ * @security session
+ *
+ * @returns 200 with a mock submission ID
+ * @returns 400 when body is malformed; e.g. invalid plaintext responses or encoding for encrypted content
+ * @returns 403 when current user does not have read permissions to given form
+ * @returns 404 when given form ID does not exist
+ * @returns 410 when given form has been deleted
+ * @returns 500 when database error occurs
+ */
+export const handleEncryptPreviewSubmission: RequestHandler<
+  { formId: string },
+  { message: string; submissionId: string } | ErrorDto,
+  EncryptSubmissionDto
+> = async (req, res) => {
+  const { formId } = req.params
+  const sessionUserId = (req.session as Express.AuthedSession).user._id
+  // No need to process attachments as we don't do anything with them
+  const { encryptedContent, responses, version } = req.body
+  const logMeta = {
+    action: 'handleEncryptPreviewSubmission',
+    formId,
+  }
+
+  const formResult = await UserService.getPopulatedUserById(sessionUserId)
+    .andThen((user) =>
+      // Step 2: Retrieve form with write permission check.
+      AuthService.getFormAfterPermissionChecks({
+        user,
+        formId,
+        level: PermissionLevel.Read,
+      }),
+    )
+    .andThen(EncryptSubmissionService.checkFormIsEncryptMode)
+  if (formResult.isErr()) {
+    logger.error({
+      message: 'Error while retrieving form for preview submission',
+      meta: logMeta,
+      error: formResult.error,
+    })
+    const { errorMessage, statusCode } = mapEncryptSubmissionError(
+      formResult.error,
+    )
+    return res.status(statusCode).json({ message: errorMessage })
+  }
+  const form = formResult.value
+
+  const parsedResponsesResult = checkIsEncryptedEncoding(
+    encryptedContent,
+  ).andThen(() => SubmissionService.getProcessedResponses(form, responses))
+  if (parsedResponsesResult.isErr()) {
+    logger.error({
+      message: 'Error while parsing responses for preview submission',
+      meta: logMeta,
+      error: parsedResponsesResult.error,
+    })
+    const { errorMessage, statusCode } = mapEncryptSubmissionError(
+      parsedResponsesResult.error,
+    )
+    return res.status(statusCode).json({ message: errorMessage })
+  }
+  const parsedResponses = parsedResponsesResult.value
+
+  const submission = EncryptSubmissionService.createEncryptSubmissionWithoutSave(
+    {
+      form,
+      encryptedContent,
+      // Don't bother encrypting and signing mock variables for previews
+      verifiedContent: '',
+      version,
+    },
+  )
+
+  // Don't await on email confirmations
+  void SubmissionService.sendEmailConfirmations({
+    form,
+    parsedResponses,
+    submission,
+  })
+
+  return res.json({
+    message: 'Form submission successful.',
+    submissionId: submission._id,
+  })
+}
diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
index 934d559a9f..99bab1eb59 100644
--- a/src/app/modules/form/admin-form/admin-form.routes.ts
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -10,6 +10,7 @@ import { VALID_UPLOAD_FILE_TYPES } from '../../../../shared/constants'
 import { IForm, ResponseMode } from '../../../../types'
 import { withUserAuthentication } from '../../auth/auth.middlewares'
 import * as EncryptSubmissionController from '../../submission/encrypt-submission/encrypt-submission.controller'
+import * as EncryptSubmissionMiddleware from '../../submission/encrypt-submission/encrypt-submission.middleware'
 
 import * as AdminFormController from './admin-form.controller'
 import { DuplicateFormBody } from './admin-form.types'
@@ -495,3 +496,23 @@ AdminFormsRouter.post(
   fileUploadValidator,
   AdminFormController.handleCreatePresignedPostUrlForLogos,
 )
+
+/**
+ * Submit an encrypt mode form in preview mode
+ * @route POST /v2/submissions/encrypt/preview/:formId([a-fA-F0-9]{24})
+ * @security session
+ *
+ * @returns 200 if submission was valid
+ * @returns 400 when error occurs while processing submission or submission is invalid
+ * @returns 403 when user does not have read permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.post(
+  '/v2/submissions/encrypt/preview/:formId([a-fA-F0-9]{24})',
+  withUserAuthentication,
+  EncryptSubmissionMiddleware.validateEncryptSubmissionParams,
+  AdminFormController.handleEncryptPreviewSubmission,
+)
diff --git a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
index 0ba236987c..65fb082ccf 100644
--- a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
+++ b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
@@ -13,13 +13,17 @@ import { CreatePresignedUrlError } from 'src/app/modules/form/admin-form/admin-f
 import { formatErrorRecoveryMessage } from 'src/app/utils/handle-mongo-error'
 import { aws } from 'src/config/config'
 import {
+  IPopulatedEncryptedForm,
   SubmissionCursorData,
   SubmissionData,
   SubmissionMetadata,
 } from 'src/types'
 
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
 import { SubmissionNotFoundError } from '../../submission.errors'
 import {
+  createEncryptSubmissionWithoutSave,
   getEncryptedSubmissionData,
   getSubmissionCursor,
   getSubmissionMetadata,
@@ -31,7 +35,48 @@ import {
 const EncryptSubmission = getEncryptSubmissionModel(mongoose)
 
 describe('encrypt-submission.service', () => {
-  beforeEach(() => jest.restoreAllMocks())
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('createEncryptSubmissionWithoutSave', () => {
+    const MOCK_FORM = ({
+      admin: new ObjectId(),
+      _id: new ObjectId(),
+      title: 'mock title',
+      getUniqueMyInfoAttrs: () => [],
+      authType: 'NIL',
+    } as unknown) as IPopulatedEncryptedForm
+    const MOCK_ENCRYPTED_CONTENT = 'mockEncryptedContent'
+    const MOCK_VERIFIED_CONTENT = 'mockVerifiedContent'
+    const MOCK_VERSION = 1
+    const MOCK_ATTACHMENT_METADATA = new Map([['a', 'b']])
+
+    it('should create a new submission without saving it to the database', async () => {
+      const result = createEncryptSubmissionWithoutSave({
+        encryptedContent: MOCK_ENCRYPTED_CONTENT,
+        form: MOCK_FORM,
+        version: MOCK_VERSION,
+        attachmentMetadata: MOCK_ATTACHMENT_METADATA,
+        verifiedContent: MOCK_VERIFIED_CONTENT,
+      })
+      const foundInDatabase = await EncryptSubmission.findOne({
+        _id: result._id,
+      })
+
+      expect(result.encryptedContent).toBe(MOCK_ENCRYPTED_CONTENT)
+      expect(result.form).toEqual(MOCK_FORM._id)
+      expect(result.verifiedContent).toEqual(MOCK_VERIFIED_CONTENT)
+      expect(Object.fromEntries(result.attachmentMetadata!)).toEqual(
+        Object.fromEntries(MOCK_ATTACHMENT_METADATA),
+      )
+      expect(result.version).toEqual(MOCK_VERSION)
+      expect(foundInDatabase).toBeNull()
+    })
+  })
 
   describe('getSubmissionCursor', () => {
     it('should return cursor successfully when date range is not provided', async () => {
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 6f447ccf93..c640efbbb0 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -13,7 +13,7 @@ import {
   ResWithUinFin,
   SubmissionMetadataList,
 } from '../../../../types'
-import { ErrorDto } from '../../../../types/api'
+import { EncryptSubmissionDto, ErrorDto } from '../../../../types/api'
 import { getEncryptSubmissionModel } from '../../../models/submission.server.model'
 import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import { checkIsEncryptedEncoding } from '../../../utils/encryption'
@@ -44,7 +44,6 @@ import {
   transformAttachmentMetaStream,
   uploadAttachments,
 } from './encrypt-submission.service'
-import { EncryptSubmissionBody } from './encrypt-submission.types'
 import {
   createEncryptedSubmissionDto,
   mapRouteError,
@@ -165,7 +164,7 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
     })
   }
   const processedResponses = processedResponsesResult.value
-  delete (req.body as SetOptional<EncryptSubmissionBody, 'responses'>).responses
+  delete (req.body as SetOptional<EncryptSubmissionDto, 'responses'>).responses
 
   // Checks if user is SPCP-authenticated before allowing submission
   const { authType } = form
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.middleware.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.middleware.ts
index a7a6483f30..e569d2ad9d 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.middleware.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.middleware.ts
@@ -1,86 +1,53 @@
-import { RequestHandler } from 'express'
-import { SetOptional } from 'type-fest'
+import { celebrate, Joi, Segments } from 'celebrate'
 
-import { createReqMeta } from '../../../../app/utils/request'
-import { createLoggerWithLabel } from '../../../../config/logger'
-import { WithForm, WithParsedResponses } from '../../../../types'
-import { checkIsEncryptedEncoding } from '../../../utils/encryption'
-import { getProcessedResponses } from '../submission.service'
-
-import {
-  EncryptSubmissionBody,
-  EncryptSubmissionBodyAfterProcess,
-  WithAttachmentsData,
-  WithFormData,
-} from './encrypt-submission.types'
-import { mapRouteError } from './encrypt-submission.utils'
-
-const logger = createLoggerWithLabel(module)
+import { BasicField } from '../../../../types'
 
 /**
- * Extracts relevant fields, injects questions, verifies visibility of field and validates answers
- * to produce req.body.parsedResponses
+ * Celebrate middleware for verifying shape of encrypted submission
  */
-
-export const validateAndProcessEncryptSubmission: RequestHandler<
-  { formId: string },
-  unknown,
-  EncryptSubmissionBody
-> = (req, res, next) => {
-  const { form } = req as WithForm<typeof req>
-  const { encryptedContent, responses } = req.body
-
-  // Step 1: Check whether submitted encryption is valid.
-  return (
-    checkIsEncryptedEncoding(encryptedContent)
-      // Step 2: Encryption is valid, process given responses.
-      .andThen(() => getProcessedResponses(form, responses))
-      // If pass, then set parsedResponses and delete responses.
-      .map((processedResponses) => {
-        // eslint-disable-next-line @typescript-eslint/no-extra-semi
-        ;(req.body as WithParsedResponses<
-          typeof req.body
-        >).parsedResponses = processedResponses
-        // Prevent downstream functions from using responses by deleting it.
-        delete (req.body as SetOptional<EncryptSubmissionBody, 'responses'>)
-          .responses
-        return next()
-      })
-      // If error, log and return res error.
-      .mapErr((error) => {
-        logger.error({
-          message:
-            'Error validating and processing encrypt submission responses',
-          meta: {
-            action: 'validateAndProcessEncryptSubmission',
-            ...createReqMeta(req),
-            formId: form._id,
-          },
-          error,
-        })
-
-        const { statusCode, errorMessage } = mapRouteError(error)
-        return res.status(statusCode).json({
-          message: errorMessage,
-        })
-      })
-  )
-}
-
-/**
- * Verify structure of encrypted response
- */
-
-export const prepareEncryptSubmission: RequestHandler<
-  { formId: string },
-  unknown,
-  EncryptSubmissionBodyAfterProcess
-> = (req, res, next) => {
-  // Step 1: Add req.body.encryptedContent to req.formData
-  // eslint-disable-next-line @typescript-eslint/no-extra-semi
-  ;(req as WithFormData<typeof req>).formData = req.body.encryptedContent
-  // Step 2: Add req.body.attachments to req.attachmentData
-  ;(req as WithAttachmentsData<typeof req>).attachmentData =
-    req.body.attachments || {}
-  return next()
-}
+export const validateEncryptSubmissionParams = celebrate({
+  [Segments.BODY]: Joi.object({
+    responses: Joi.array()
+      .items(
+        Joi.object().keys({
+          _id: Joi.string().required(),
+          answer: Joi.string().allow('').required(),
+          fieldType: Joi.string()
+            .required()
+            .valid(...Object.values(BasicField)),
+          signature: Joi.string().allow(''),
+        }),
+      )
+      .required(),
+    encryptedContent: Joi.string()
+      .custom((value, helpers) => {
+        const parts = String(value).split(/;|:/)
+        if (
+          parts.length !== 3 ||
+          parts[0].length !== 44 || // public key
+          parts[1].length !== 32 || // nonce
+          !parts.every((part) => Joi.string().base64().validate(part))
+        ) {
+          return helpers.message({ custom: 'Invalid encryptedContent.' })
+        }
+        return value
+      }, 'encryptedContent')
+      .required(),
+    attachments: Joi.object()
+      .pattern(
+        /^[a-fA-F0-9]{24}$/,
+        Joi.object().keys({
+          encryptedFile: Joi.object()
+            .keys({
+              binary: Joi.string().required(),
+              nonce: Joi.string().required(),
+              submissionPublicKey: Joi.string().required(),
+            })
+            .required(),
+        }),
+      )
+      .optional(),
+    isPreview: Joi.boolean().required(),
+    version: Joi.number().required(),
+  }),
+})
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
index 583317314f..1784312fa9 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
@@ -8,6 +8,7 @@ import { Transform } from 'stream'
 import { aws as AwsConfig } from '../../../../config/config'
 import { createLoggerWithLabel } from '../../../../config/logger'
 import {
+  IEncryptedSubmissionSchema,
   IPopulatedEncryptedForm,
   IPopulatedForm,
   ResponseMode,
@@ -31,7 +32,10 @@ import {
   SubmissionNotFoundError,
 } from '../submission.errors'
 
-import { AttachmentMetadata } from './encrypt-submission.types'
+import {
+  AttachmentMetadata,
+  SaveEncryptSubmissionParams,
+} from './encrypt-submission.types'
 
 const logger = createLoggerWithLabel(module)
 const EncryptSubmissionModel = getEncryptSubmissionModel(mongoose)
@@ -348,3 +352,30 @@ export const checkFormIsEncryptMode = (
     ? ok(form)
     : err(new ResponseModeError(ResponseMode.Encrypt, form.responseMode))
 }
+
+/**
+ * Creates an encrypted submission without saving it to the database.
+ * @param form Document of the form being submitted
+ * @param encryptedContent Encrypted content of submission
+ * @param version Encryption version
+ * @param attachmentMetadata
+ * @param verifiedContent Verified content included in submission, e.g. SingPass ID
+ * @returns Encrypted submission document which has not been saved to database
+ */
+export const createEncryptSubmissionWithoutSave = ({
+  form,
+  encryptedContent,
+  version,
+  attachmentMetadata,
+  verifiedContent,
+}: SaveEncryptSubmissionParams): IEncryptedSubmissionSchema => {
+  return new EncryptSubmissionModel({
+    form: form._id,
+    authType: form.authType,
+    myInfoFields: form.getUniqueMyInfoAttrs(),
+    encryptedContent,
+    verifiedContent,
+    attachmentMetadata,
+    version,
+  })
+}
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
index ed468f7232..cda813af4f 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
@@ -1,38 +1,27 @@
-import { FieldResponse } from 'src/types'
-
+import { IPopulatedEncryptedForm } from '../../../../types'
+import { EncryptedAttachmentsDto } from '../../../../types/api'
 import { ProcessedFieldResponse } from '../submission.types'
 
-export type EncryptSubmissionBody = {
-  responses: FieldResponse[]
-  encryptedContent: string
-  attachments?: {
-    encryptedFile?: {
-      binary: string
-      nonce: string
-      submissionPublicKey: string
-    }
-  }
-  isPreview: boolean
-  version: number
-}
-
-type Attachments = {
-  encryptedFile?: {
-    binary: string
-    nonce: string
-    submissionPublicKey: string
-  }
-}
 export type EncryptSubmissionBodyAfterProcess = {
   encryptedContent: string
-  attachments?: Attachments
+  attachments?: EncryptedAttachmentsDto
   isPreview: boolean
   version: number
   parsedResponses: ProcessedFieldResponse[]
 }
 
-export type WithAttachmentsData<T> = T & { attachmentData: Attachments }
+export type WithAttachmentsData<T> = T & {
+  attachmentData: EncryptedAttachmentsDto
+}
 
 export type WithFormData<T> = T & { formData: string }
 
 export type AttachmentMetadata = Map<string, string>
+
+export type SaveEncryptSubmissionParams = {
+  form: IPopulatedEncryptedForm
+  encryptedContent: string
+  version: number
+  verifiedContent?: string
+  attachmentMetadata?: Map<string, string>
+}
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
index 12c5fbc189..4117ae9edd 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
@@ -4,6 +4,7 @@ import moment from 'moment-timezone'
 import { createLoggerWithLabel } from '../../../../config/logger'
 import { EncryptedSubmissionDto, SubmissionData } from '../../../../types'
 import { MapRouteError } from '../../../../types/routing'
+import { MalformedVerifiedContentError } from '../../../modules/verified-content/verified-content.errors'
 import {
   CaptchaConnectionError,
   MissingCaptchaError,
@@ -80,6 +81,7 @@ export const mapRouteError: MapRouteError = (
     case MissingJwtError:
     case VerifyJwtError:
     case InvalidJwtError:
+    case MalformedVerifiedContentError:
       return {
         statusCode: StatusCodes.UNAUTHORIZED,
         errorMessage:
diff --git a/src/app/modules/verified-content/__tests__/verified-content.middleware.spec.ts b/src/app/modules/verified-content/__tests__/verified-content.middleware.spec.ts
deleted file mode 100644
index ef70329243..0000000000
--- a/src/app/modules/verified-content/__tests__/verified-content.middleware.spec.ts
+++ /dev/null
@@ -1,200 +0,0 @@
-import { err, ok } from 'neverthrow'
-import { mocked } from 'ts-jest/utils'
-
-import { FeatureNames } from 'src/config/feature-manager'
-import { AuthType, ResponseMode } from 'src/types'
-
-import expressHandler from 'tests/unit/backend/helpers/jest-express'
-
-import { MissingFeatureError } from '../../core/core.errors'
-import { MalformedVerifiedContentError } from '../verified-content.errors'
-import { VerifiedContentFactory } from '../verified-content.factory'
-import { encryptVerifiedSpcpFields } from '../verified-content.middlewares'
-import { CpVerifiedContent } from '../verified-content.types'
-
-jest.mock('../verified-content.factory')
-
-const MockedVerifiedContentFactory = mocked(VerifiedContentFactory)
-
-describe('verified-content.middlewares', () => {
-  describe('encryptVerifiedSpcpFields', () => {
-    beforeEach(() => jest.clearAllMocks())
-
-    it('should call next with res.locals.verified assigned on success', async () => {
-      // Arrange
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: {
-          authType: AuthType.SP,
-          responseMode: ResponseMode.Encrypt,
-          publicKey: 'some public key',
-        },
-      })
-      const mockRes = expressHandler.mockResponse({
-        locals: { someKey: 'some mock data' },
-      })
-      const mockVerifiedContent: CpVerifiedContent = {
-        cpUen: 'some uen',
-        cpUid: 'some uid',
-      }
-      const expectedEncryptedContent = 'some encrypted content'
-      const mockNext = jest.fn()
-      MockedVerifiedContentFactory.getVerifiedContent.mockReturnValueOnce(
-        ok(mockVerifiedContent),
-      )
-      MockedVerifiedContentFactory.encryptVerifiedContent.mockReturnValueOnce(
-        ok(expectedEncryptedContent),
-      )
-
-      // Act
-      await encryptVerifiedSpcpFields(mockReq, mockRes, mockNext)
-
-      // Assert
-      expect(mockRes.locals.verified).toEqual(expectedEncryptedContent)
-      expect(mockNext).toBeCalled()
-      expect(
-        MockedVerifiedContentFactory.getVerifiedContent,
-      ).toHaveBeenCalledWith({
-        type: mockReq.form.authType,
-        data: mockRes.locals,
-      })
-      expect(
-        MockedVerifiedContentFactory.encryptVerifiedContent,
-      ).toHaveBeenCalledWith({
-        verifiedContent: mockVerifiedContent,
-        formPublicKey: mockReq.form.publicKey,
-      })
-      expect(mockRes.status).not.toHaveBeenCalled()
-      expect(mockRes.json).not.toHaveBeenCalled()
-    })
-
-    it('should return early if form is not SP/CP enabled', async () => {
-      // Arrange
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: { authType: AuthType.NIL },
-      })
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      // Act
-      await encryptVerifiedSpcpFields(mockReq, mockRes, mockNext)
-
-      // Assert
-      expect(mockNext).toBeCalled()
-      expect(mockRes.status).not.toBeCalled()
-      expect(mockRes.json).not.toBeCalled()
-      // Should not reach this step.
-      expect(
-        MockedVerifiedContentFactory.getVerifiedContent,
-      ).not.toHaveBeenCalled()
-      expect(
-        MockedVerifiedContentFactory.encryptVerifiedContent,
-      ).not.toHaveBeenCalled()
-    })
-
-    it('should return 422 if form is not encrypt mode', async () => {
-      // Arrange
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        // SP form, but email mode form.
-        form: { authType: AuthType.SP, responseMode: ResponseMode.Email },
-      })
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      // Act
-      await encryptVerifiedSpcpFields(mockReq, mockRes, mockNext)
-
-      // Assert
-      expect(mockNext).not.toBeCalled()
-      expect(mockRes.status).toHaveBeenCalledWith(422)
-      expect(mockRes.json).toHaveBeenCalledWith({
-        message:
-          'Unable to encrypt verified SPCP fields on non storage mode forms',
-      })
-      // Should not reach this step.
-      expect(
-        MockedVerifiedContentFactory.getVerifiedContent,
-      ).not.toHaveBeenCalled()
-      expect(
-        MockedVerifiedContentFactory.encryptVerifiedContent,
-      ).not.toHaveBeenCalled()
-    })
-
-    it('should silently passthrough if verified content feature is not activated', async () => {
-      // Arrange
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: { authType: AuthType.SP, responseMode: ResponseMode.Encrypt },
-      })
-      const mockRes = expressHandler.mockResponse({
-        locals: 'some mock data',
-      })
-      const mockNext = jest.fn()
-      MockedVerifiedContentFactory.getVerifiedContent.mockReturnValueOnce(
-        err(new MissingFeatureError(FeatureNames.WebhookVerifiedContent)),
-      )
-
-      // Act
-      await encryptVerifiedSpcpFields(mockReq, mockRes, mockNext)
-
-      // Assert
-      expect(mockNext).toBeCalled()
-      expect(
-        MockedVerifiedContentFactory.getVerifiedContent,
-      ).toHaveBeenCalledWith({
-        type: mockReq.form.authType,
-        data: mockRes.locals,
-      })
-      expect(mockRes.status).not.toHaveBeenCalled()
-      expect(mockRes.json).not.toHaveBeenCalled()
-      expect(
-        MockedVerifiedContentFactory.encryptVerifiedContent,
-      ).not.toHaveBeenCalled()
-    })
-
-    it('should return 400 if verified content is malformed', async () => {
-      // Arrange
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: {
-          authType: AuthType.SP,
-          responseMode: ResponseMode.Encrypt,
-          publicKey: 'some public key',
-        },
-      })
-      const mockRes = expressHandler.mockResponse({
-        locals: 'some mock data',
-      })
-      const mockVerifiedContent: CpVerifiedContent = {
-        cpUen: 'some uen',
-        cpUid: 'some uid',
-      }
-      const mockNext = jest.fn()
-      MockedVerifiedContentFactory.getVerifiedContent.mockReturnValueOnce(
-        ok(mockVerifiedContent),
-      )
-      MockedVerifiedContentFactory.encryptVerifiedContent.mockReturnValueOnce(
-        err(new MalformedVerifiedContentError()),
-      )
-
-      // Act
-      await encryptVerifiedSpcpFields(mockReq, mockRes, mockNext)
-
-      // Assert
-      expect(mockNext).not.toBeCalled()
-      expect(
-        MockedVerifiedContentFactory.getVerifiedContent,
-      ).toHaveBeenCalledWith({
-        type: mockReq.form.authType,
-        data: mockRes.locals,
-      })
-      expect(
-        MockedVerifiedContentFactory.encryptVerifiedContent,
-      ).toHaveBeenCalledWith({
-        verifiedContent: mockVerifiedContent,
-        formPublicKey: mockReq.form.publicKey,
-      })
-      expect(mockRes.status).toHaveBeenCalledWith(400)
-      expect(mockRes.json).toHaveBeenCalledWith({
-        message: 'Invalid data was found. Please submit again.',
-      })
-    })
-  })
-})
diff --git a/src/app/modules/verified-content/verified-content.middlewares.ts b/src/app/modules/verified-content/verified-content.middlewares.ts
deleted file mode 100644
index 393d6d284e..0000000000
--- a/src/app/modules/verified-content/verified-content.middlewares.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import { RequestHandler } from 'express'
-import { StatusCodes } from 'http-status-codes'
-
-import { createLoggerWithLabel } from '../../../config/logger'
-import { AuthType, WithForm } from '../../../types'
-import { createReqMeta } from '../../utils/request'
-import { MissingFeatureError } from '../core/core.errors'
-import { isFormEncryptMode } from '../form/form.utils'
-
-import { VerifiedContentFactory } from './verified-content.factory'
-
-const logger = createLoggerWithLabel(module)
-
-// TODO: Delete this middleware when this step is inlined into the controller.
-export const encryptVerifiedSpcpFields: RequestHandler = (req, res, next) => {
-  const { form } = req as WithForm<typeof req>
-
-  // Early return if this is not a Singpass/Corppass submission.
-  if (form.authType !== AuthType.SP && form.authType !== AuthType.CP) {
-    return next()
-  }
-
-  const logMeta = {
-    action: 'encryptVerifiedSpcpFields',
-    formId: form._id,
-    ...createReqMeta(req),
-  }
-
-  if (!isFormEncryptMode(form)) {
-    logger.error({
-      message: 'encryptVerifiedSpcpFields called on non-encrypt mode form',
-      meta: logMeta,
-    })
-    return res.status(StatusCodes.UNPROCESSABLE_ENTITY).json({
-      message:
-        'Unable to encrypt verified SPCP fields on non storage mode forms',
-    })
-  }
-
-  const encryptVerifiedContentResult = VerifiedContentFactory.getVerifiedContent(
-    { type: form.authType, data: res.locals },
-  ).andThen((verifiedContent) =>
-    VerifiedContentFactory.encryptVerifiedContent({
-      verifiedContent,
-      formPublicKey: form.publicKey,
-    }),
-  )
-
-  if (encryptVerifiedContentResult.isErr()) {
-    const { error } = encryptVerifiedContentResult
-    logger.error({
-      message: 'Unable to encrypt verified content',
-      meta: logMeta,
-      error,
-    })
-
-    // Passthrough if feature is not activated.
-    if (error instanceof MissingFeatureError) {
-      return next()
-    }
-
-    return res
-      .status(StatusCodes.BAD_REQUEST)
-      .json({ message: 'Invalid data was found. Please submit again.' })
-  }
-
-  // No errors, set local variable to the encrypted string.
-  res.locals.verified = encryptVerifiedContentResult.value
-  return next()
-}
diff --git a/src/app/routes/admin-forms.server.routes.js b/src/app/routes/admin-forms.server.routes.js
index b8a6146169..f97c85f1cd 100644
--- a/src/app/routes/admin-forms.server.routes.js
+++ b/src/app/routes/admin-forms.server.routes.js
@@ -15,10 +15,8 @@ const { withUserAuthentication } = require('../modules/auth/auth.middlewares')
 const {
   PermissionLevel,
 } = require('../modules/form/admin-form/admin-form.types')
-const EncryptSubmissionMiddleware = require('../modules/submission/encrypt-submission/encrypt-submission.middleware')
 const SpcpController = require('../modules/spcp/spcp.controller')
 const { BasicField } = require('../../types')
-const VerifiedContentMiddleware = require('../modules/verified-content/verified-content.middlewares')
 
 /**
  * Authenticates logged in user, before retrieving non-archived form
@@ -88,78 +86,4 @@ module.exports = function (app) {
     EmailSubmissionsMiddleware.sendAdminEmail,
     SubmissionsMiddleware.sendEmailConfirmations,
   )
-
-  /**
-   * On preview, submit a form response, and stores the encrypted contents. Optionally, an autoreply
-   * confirming submission is sent back to the user, if an email address
-   * was given. SMS autoreplies for mobile number fields are also sent if feature
-   * is enabled.
-   * Note that preview submissions are not saved to db
-   * Note that spcp session is not verified, neither is myInfo data verified
-   * Note that webhooks are not supported as they require an actual submission document to be created
-   * Note that v2 endpoint accepts requests in content-type json, instead of content-type multi-part
-   * @route POST /v2/submissions/encrypt/preview/{formId}
-   * @group forms - endpoints to serve forms
-   * @param {string} formId.path.required - the form id
-   * @param {Array} response.body.required - contains only the auto-reply fields
-   * @param {string} encryptedContent.body.required - contains the entire encrypted form submission
-   * @consumes multipart/form-data
-   * @produces application/json
-   * @returns {SubmissionResponse.model} 200 - submission made
-   * @returns {SubmissionResponse.model} 400 - submission has bad data and could not be processed
-   * @security OTP
-   */
-  app.route('/v2/submissions/encrypt/preview/:formId([a-fA-F0-9]{24})').post(
-    celebrate({
-      [Segments.BODY]: Joi.object({
-        responses: Joi.array()
-          .items(
-            Joi.object().keys({
-              _id: Joi.string().required(),
-              answer: Joi.string().allow('').required(),
-              fieldType: Joi.string()
-                .required()
-                .valid(...Object.values(BasicField)),
-              signature: Joi.string().allow(''),
-            }),
-          )
-          .required(),
-        encryptedContent: Joi.string()
-          .custom((value, helpers) => {
-            const parts = String(value).split(/;|:/)
-            if (
-              parts.length !== 3 ||
-              parts[0].length !== 44 || // public key
-              parts[1].length !== 32 || // nonce
-              !parts.every((part) => Joi.string().base64().validate(part))
-            ) {
-              return helpers.error('Invalid encryptedContent.')
-            }
-            return value
-          }, 'encryptedContent')
-          .required(),
-        attachments: Joi.object()
-          .pattern(
-            /^[a-fA-F0-9]{24}$/,
-            Joi.object().keys({
-              encryptedFile: Joi.object().keys({
-                binary: Joi.string().required(),
-                nonce: Joi.string().required(),
-                submissionPublicKey: Joi.string().required(),
-              }),
-            }),
-          )
-          .optional(),
-        isPreview: Joi.boolean().required(),
-        version: Joi.number().required(),
-      }),
-    }),
-    authActiveForm(PermissionLevel.Read),
-    EncryptSubmissionMiddleware.validateAndProcessEncryptSubmission,
-    AdminFormController.passThroughSpcp,
-    VerifiedContentMiddleware.encryptVerifiedSpcpFields,
-    EncryptSubmissionMiddleware.prepareEncryptSubmission,
-    adminForms.passThroughSaveMetadataToDb,
-    SubmissionsMiddleware.sendEmailConfirmations,
-  )
 }
diff --git a/src/app/routes/public-forms.server.routes.js b/src/app/routes/public-forms.server.routes.js
index 15b27cd048..2e4bf9cf81 100644
--- a/src/app/routes/public-forms.server.routes.js
+++ b/src/app/routes/public-forms.server.routes.js
@@ -12,8 +12,8 @@ const { limitRate } = require('../utils/limit-rate')
 const { rateLimitConfig } = require('../../config/config')
 const PublicFormController = require('../modules/form/public-form/public-form.controller')
 const SpcpController = require('../modules/spcp/spcp.controller')
-const { BasicField } = require('../../types')
 const EncryptSubmissionController = require('../modules/submission/encrypt-submission/encrypt-submission.controller')
+const EncryptSubmissionMiddleware = require('../modules/submission/encrypt-submission/encrypt-submission.middleware')
 
 module.exports = function (app) {
   /**
@@ -155,54 +155,13 @@ module.exports = function (app) {
    * @returns {SubmissionResponse.model} 200 - submission made
    * @returns {SubmissionResponse.model} 400 - submission has bad data and could not be processed
    */
-  app.route('/v2/submissions/encrypt/:formId([a-fA-F0-9]{24})').post(
-    limitRate({ max: rateLimitConfig.submissions }),
-    CaptchaFactory.validateCaptchaParams,
-    celebrate({
-      body: Joi.object({
-        responses: Joi.array()
-          .items(
-            Joi.object().keys({
-              _id: Joi.string().required(),
-              answer: Joi.string().allow('').required(),
-              fieldType: Joi.string()
-                .required()
-                .valid(...Object.values(BasicField)),
-              signature: Joi.string().allow(''),
-            }),
-          )
-          .required(),
-        encryptedContent: Joi.string()
-          .custom((value, helpers) => {
-            const parts = String(value).split(/;|:/)
-            if (
-              parts.length !== 3 ||
-              parts[0].length !== 44 || // public key
-              parts[1].length !== 32 || // nonce
-              !parts.every((part) => Joi.string().base64().validate(part))
-            ) {
-              return helpers.error('Invalid encryptedContent.')
-            }
-            return value
-          }, 'encryptedContent')
-          .required(),
-        attachments: Joi.object()
-          .pattern(
-            /^[a-fA-F0-9]{24}$/,
-            Joi.object().keys({
-              encryptedFile: Joi.object().keys({
-                binary: Joi.string().required(),
-                nonce: Joi.string().required(),
-                submissionPublicKey: Joi.string().required(),
-              }),
-            }),
-          )
-          .optional(),
-        isPreview: Joi.boolean().required(),
-        version: Joi.number().required(),
-      }),
-    }),
-    forms.formById,
-    EncryptSubmissionController.handleEncryptedSubmission,
-  )
+  app
+    .route('/v2/submissions/encrypt/:formId([a-fA-F0-9]{24})')
+    .post(
+      limitRate({ max: rateLimitConfig.submissions }),
+      CaptchaFactory.validateCaptchaParams,
+      EncryptSubmissionMiddleware.validateEncryptSubmissionParams,
+      forms.formById,
+      EncryptSubmissionController.handleEncryptedSubmission,
+    )
 }
diff --git a/src/types/api/encrypt-submission.ts b/src/types/api/encrypt-submission.ts
new file mode 100644
index 0000000000..c4d2196e5c
--- /dev/null
+++ b/src/types/api/encrypt-submission.ts
@@ -0,0 +1,21 @@
+import { FieldResponse } from '../response'
+
+export type EncryptSubmissionDto = {
+  responses: FieldResponse[]
+  encryptedContent: string
+  attachments?: EncryptedAttachmentsDto
+  isPreview: boolean
+  version: number
+}
+
+export type EncryptedAttachmentsDto = {
+  [fieldId: string]: {
+    encryptedFile:
+      | {
+          binary: string
+          nonce: string
+          submissionPublicKey: string
+        }
+      | undefined
+  }
+}
diff --git a/src/types/api/index.ts b/src/types/api/index.ts
index 20d19312a1..7538f9f35f 100644
--- a/src/types/api/index.ts
+++ b/src/types/api/index.ts
@@ -2,3 +2,4 @@ export * from './core'
 export * from './form'
 export * from './billing'
 export * from './examples'
+export * from './encrypt-submission'
diff --git a/tests/unit/backend/controllers/encrypt-submissions.server.controller.spec.js b/tests/unit/backend/controllers/encrypt-submissions.server.controller.spec.js
deleted file mode 100644
index ec919c6d61..0000000000
--- a/tests/unit/backend/controllers/encrypt-submissions.server.controller.spec.js
+++ /dev/null
@@ -1,342 +0,0 @@
-const { StatusCodes } = require('http-status-codes')
-const mongoose = require('mongoose')
-const express = require('express')
-const request = require('supertest')
-
-const dbHandler = require('../helpers/db-handler')
-const EncryptSubmissionsMiddleware = require('../../../../dist/backend/app/modules/submission/encrypt-submission/encrypt-submission.middleware')
-const VerifiedContentMiddleware = require('../../../../dist/backend/app/modules/verified-content/verified-content.middlewares')
-
-const User = dbHandler.makeModel('user.server.model', 'User')
-const Agency = dbHandler.makeModel('agency.server.model', 'Agency')
-const Form = dbHandler.makeModel('form.server.model', 'Form')
-const EncryptForm = mongoose.model('encrypt')
-
-describe('Encrypt Submissions Controller', () => {
-  // Declare global variables
-  // spec out controller such that calls to request are
-  // directed through a callback to the request spy,
-  // which will be destroyed and re-created for every test
-  const Controller = spec(
-    'dist/backend/app/controllers/encrypt-submissions.server.controller',
-    {
-      mongoose: Object.assign(mongoose, { '@noCallThru': true }),
-    },
-  )
-
-  beforeAll(async () => await dbHandler.connect())
-  afterEach(async () => await dbHandler.clearDatabase())
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  describe('/save-submission', () => {
-    describe('saveMetadataToDb', () => {
-      let testForm
-      let testAgency
-      let testUser
-      let testEncryptVersion = 234
-      let testReqBody = { version: testEncryptVersion }
-      let formData = ''
-      const app = express()
-      const endpointPath = '/save-submission'
-
-      const originalConsoleError = console.error
-
-      beforeAll(() => {
-        // Stubbing console error to prevent appearing in stdout
-        console.error = jasmine.createSpy()
-
-        app.route(endpointPath).get(
-          (req, res, next) => {
-            req.form = testForm
-            req.formData = formData
-            req.body = testReqBody
-            return next()
-          },
-          Controller.saveResponseToDb,
-          (req, res) => res.status(200).send(req.submission),
-        )
-      })
-
-      beforeEach((done) => {
-        testAgency = new Agency({
-          shortName: 'test',
-          fullName: 'Test Agency',
-          emailDomain: 'test.gov.sg',
-          logo: 'test.png',
-        })
-        testAgency
-          .save()
-          .then(() => {
-            testUser = new User({
-              email: 'user@test.gov.sg',
-              agency: testAgency._id,
-            })
-            return testUser.save()
-          })
-          .then(() => {
-            testForm = new EncryptForm({
-              title: 'Test Form',
-              emails: 'test@test.gov.sg',
-              admin: testUser._id,
-              publicKey: 'publicKey',
-            })
-            return testForm.save()
-          })
-          .then(() => done())
-      })
-
-      afterAll(() => {
-        console.error = originalConsoleError
-      })
-
-      it('saves encrypted responses to db', (done) => {
-        formData = 'encryptedContent'
-        request(app)
-          .get(endpointPath)
-          .expect(StatusCodes.OK)
-          .then(({ body: submission }) => {
-            expect(submission.form).toEqual(testForm._id.toString())
-            expect(submission.authType).toEqual('NIL')
-            expect(submission.myInfoFields).toEqual([])
-            expect(submission.encryptedContent).toEqual(formData)
-            expect(submission.version).toEqual(testEncryptVersion)
-          })
-          .then(done)
-          .catch(done)
-      })
-    })
-  })
-
-  describe('v2/submissions/encrypt', () => {
-    const formsg = require('@opengovsg/formsg-sdk')({ mode: 'test' })
-    const {
-      checkIsEncryptedEncoding,
-    } = require('../../../../dist/backend/app/utils/encryption')
-
-    const publicKey = 'gsyeH+Kl+daaV/GlPzn47tdw2BVeqnh9nhIxNXaKM2I='
-    const responses = 'responses'
-    const correctlyEncryptedContent = formsg.crypto.encrypt(
-      responses,
-      publicKey,
-    )
-    const wronglyEncryptedContent = 'abc'
-
-    const endpointPath = '/v2/submissions/encrypt'
-
-    let fixtures
-
-    const injectFixtures = (req, res, next) => {
-      Object.assign(req, fixtures)
-      next()
-    }
-
-    const sendSubmissionBack = (req, res) => {
-      res.status(200).send({
-        body: req.body,
-      })
-    }
-
-    describe('validateAndProcessEncryptSubmission', () => {
-      const app = express()
-
-      beforeAll(() => {
-        app
-          .route(endpointPath)
-          .post(
-            injectFixtures,
-            EncryptSubmissionsMiddleware.validateAndProcessEncryptSubmission,
-            sendSubmissionBack,
-          )
-      })
-
-      it('parses submissions', (done) => {
-        fixtures = {
-          form: new Form({
-            title: 'Test Form',
-            authType: 'NIL',
-            responseMode: 'encrypt',
-            publicKey: publicKey,
-            form_fields: [],
-          }).toObject(),
-          body: {
-            encryptedContent: correctlyEncryptedContent,
-            responses: [],
-          },
-        }
-
-        request(app)
-          .post(endpointPath)
-          .expect(StatusCodes.OK)
-          .expect(
-            JSON.stringify({
-              body: {
-                encryptedContent: correctlyEncryptedContent,
-                parsedResponses: [],
-              },
-            }),
-          )
-          .end(done)
-      })
-
-      it('Throws 400 for incorrectly encrypted content', (done) => {
-        fixtures = {
-          body: {
-            responses: [],
-            encryptedContent: wronglyEncryptedContent,
-          },
-          form: new Form({
-            title: 'Test Form',
-            authType: 'NIL',
-            responseMode: 'encrypt',
-            publicKey: publicKey,
-            form_fields: [],
-          }).toObject(),
-        }
-        request(app)
-          .post(endpointPath)
-          .expect(StatusCodes.BAD_REQUEST)
-          .end(done)
-      })
-    })
-
-    describe('prepareEncryptSubmission', () => {
-      let fixtures
-
-      const endpointPath = '/v2/submissions/encrypt'
-      const injectFixtures = (req, res, next) => {
-        Object.assign(req, fixtures.req)
-        Object.assign(res, fixtures.res)
-        next()
-      }
-      const sendSubmissionBack = (req, res) => {
-        const submissionData = {
-          body: req.body,
-          formData: req.formData,
-          verified: res.locals.verified,
-        }
-
-        // If does not exist, remove entirely from submissionData.
-        if (!res.locals.verified) delete submissionData.verified
-
-        res.status(200).send(submissionData)
-      }
-
-      const app = express()
-
-      beforeAll(() => {
-        app
-          .route(endpointPath)
-          .post(
-            injectFixtures,
-            VerifiedContentMiddleware.encryptVerifiedSpcpFields,
-            EncryptSubmissionsMiddleware.prepareEncryptSubmission,
-            sendSubmissionBack,
-          )
-      })
-
-      it('Verifies correctly encrypted content without verified content', (done) => {
-        fixtures = {
-          req: {
-            body: {
-              encryptedContent: correctlyEncryptedContent,
-            },
-            form: new Form({
-              title: 'Test Form',
-              authType: 'NIL',
-              responseMode: 'encrypt',
-              publicKey: publicKey,
-              form_fields: [],
-            }).toObject(),
-          },
-        }
-        request(app)
-          .post(endpointPath)
-          .expect(StatusCodes.OK)
-          .expect(
-            JSON.stringify({
-              body: { encryptedContent: correctlyEncryptedContent },
-              formData: correctlyEncryptedContent,
-            }),
-          )
-          .end(done)
-      })
-
-      it('should sign and encrypt local uinFin in SP forms when it exists', (done) => {
-        fixtures = {
-          req: {
-            body: {
-              encryptedContent: correctlyEncryptedContent,
-            },
-            form: new Form({
-              title: 'Test Form',
-              authType: 'SP',
-              responseMode: 'encrypt',
-              publicKey: publicKey,
-              form_fields: [],
-            }).toObject(),
-          },
-          res: {
-            locals: {
-              uinFin: 'SXXXXXXYZ',
-            },
-          },
-        }
-
-        request(app)
-          .post(endpointPath)
-          .expect(StatusCodes.OK)
-          .end((err, res) => {
-            if (err) return done(err)
-            expect(res.body.body).toEqual({
-              encryptedContent: correctlyEncryptedContent,
-            })
-            expect(res.body.formData).toEqual(correctlyEncryptedContent)
-            // Cannot get the exact verified string since it changes everytime.
-            // Just be content that a string of the correct encoding was
-            // returned
-            expect(checkIsEncryptedEncoding(res.body.verified).value).toBe(true)
-            return done()
-          })
-      })
-
-      it('should sign and encrypt CP data in CP forms when it exists', (done) => {
-        fixtures = {
-          req: {
-            body: {
-              encryptedContent: correctlyEncryptedContent,
-            },
-            form: new Form({
-              title: 'Test Form',
-              authType: 'CP',
-              responseMode: 'encrypt',
-              publicKey: publicKey,
-              form_fields: [],
-            }).toObject(),
-          },
-          res: {
-            locals: {
-              uinFin: 'ABCDEFG',
-              userInfo: 'SXXXXXXYZ',
-            },
-          },
-        }
-
-        request(app)
-          .post(endpointPath)
-          .expect(StatusCodes.OK)
-          .end((err, res) => {
-            if (err) return done(err)
-            expect(res.body.body).toEqual({
-              encryptedContent: correctlyEncryptedContent,
-            })
-            expect(res.body.formData).toEqual(correctlyEncryptedContent)
-            // Cannot get the exact verified string since it changes everytime.
-            // Just be content that a string of the correct encoding was
-            // returned
-            expect(checkIsEncryptedEncoding(res.body.verified).value).toBe(true)
-            return done()
-          })
-      })
-    })
-  })
-})
diff --git a/tests/unit/backend/helpers/generate-form-data.ts b/tests/unit/backend/helpers/generate-form-data.ts
index 9c407ef9ee..79a4175ab2 100644
--- a/tests/unit/backend/helpers/generate-form-data.ts
+++ b/tests/unit/backend/helpers/generate-form-data.ts
@@ -1,5 +1,6 @@
 /* eslint-disable typesafe/no-throw-sync-func */
 import { ObjectId } from 'bson'
+import { pick } from 'lodash'
 
 import {
   ProcessedAttachmentResponse,
@@ -49,7 +50,7 @@ export const generateDefaultField = (
     | IRatingField
     | IShortTextField
     | ILongTextField
-  >,
+  > & { _id?: string },
 ): IFieldSchema => {
   const defaultParams = {
     title: `test ${fieldType} field title`,
@@ -227,6 +228,18 @@ export const generateNewSingleAnswerResponse = (
   }
 }
 
+export const generateUnprocessedSingleAnswerResponse = (
+  fieldType: BasicField,
+  customParams?: Partial<ISingleAnswerResponse>,
+): ISingleAnswerResponse => {
+  return pick(generateNewSingleAnswerResponse(fieldType, customParams), [
+    '_id',
+    'question',
+    'fieldType',
+    'answer',
+  ])
+}
+
 export const generateAttachmentResponse = (
   field: IAttachmentFieldSchema,
   filename = 'filename',

From 84d46475311f700c3c59b0c3f98400155433bfda Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Thu, 8 Apr 2021 15:56:38 +0800
Subject: [PATCH 27/75] refactor: collapse email preview submission middleware
 (#1561)

---
 .../admin-forms.server.controller.js          |   66 -
 .../authentication.server.controller.js       |   89 -
 .../__tests__/admin-form.controller.spec.ts   | 1065 +++++++
 .../__tests__/admin-form.routes.spec.ts       |  452 +++
 .../form/admin-form/admin-form.constants.ts   |    5 +
 .../form/admin-form/admin-form.controller.ts  |  179 +-
 .../form/admin-form/admin-form.routes.ts      |   22 +
 .../form/admin-form/admin-form.service.ts     |   32 +-
 src/app/modules/spcp/spcp.controller.ts       |   35 +-
 .../email-submission.service.spec.ts          |   35 +
 .../email-submission.controller.ts            |    4 +-
 .../email-submission.middleware.ts            |  158 +-
 .../email-submission.service.ts               |   22 +
 .../email-submission.types.ts                 |   10 +-
 .../email-submission/email-submission.util.ts |   14 +-
 .../encrypt-submission.types.ts               |    6 -
 .../submission/submission.middleware.ts       |   49 -
 src/app/routes/admin-forms.server.routes.js   |   89 -
 src/app/routes/index.js                       |    1 -
 src/types/express.locals.ts                   |   33 +-
 .../admin-forms.server.controller.spec.js     |  188 --
 .../authentication.server.controller.spec.js  |   98 -
 ...mail-submissions.server.controller.spec.js | 2824 -----------------
 23 files changed, 1785 insertions(+), 3691 deletions(-)
 delete mode 100644 src/app/controllers/admin-forms.server.controller.js
 delete mode 100755 src/app/controllers/authentication.server.controller.js
 delete mode 100644 src/app/modules/submission/submission.middleware.ts
 delete mode 100644 src/app/routes/admin-forms.server.routes.js
 delete mode 100644 tests/unit/backend/controllers/admin-forms.server.controller.spec.js
 delete mode 100644 tests/unit/backend/controllers/authentication.server.controller.spec.js
 delete mode 100644 tests/unit/backend/controllers/email-submissions.server.controller.spec.js

diff --git a/src/app/controllers/admin-forms.server.controller.js b/src/app/controllers/admin-forms.server.controller.js
deleted file mode 100644
index 6ec33f04be..0000000000
--- a/src/app/controllers/admin-forms.server.controller.js
+++ /dev/null
@@ -1,66 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-const mongoose = require('mongoose')
-const _ = require('lodash')
-const { StatusCodes } = require('http-status-codes')
-
-const getSubmissionModel = require('../models/submission.server.model').default
-
-// Export individual functions (i.e. create, delete)
-// and makeModule function that takes in connection object
-module.exports = _.assign({ makeModule }, makeModule(mongoose))
-
-/**
- * Packages functions in module that can accept a db connection
- * @param  {Object} connection - DB connection instance
- * @return  {Object} functions - admin controller functions
- */
-function makeModule(connection) {
-  return {
-    /**
-     * Checks if form is active
-     * @param  {Object} req - Express request object
-     * @param  {Object} res - Express response object
-     * @param  {Object} next - Express next middleware function
-     */
-    isFormActive: function (req, res, next) {
-      if (req.form.status === 'ARCHIVED') {
-        return res.status(StatusCodes.NOT_FOUND).json({
-          message: 'Form has been archived',
-        })
-      } else {
-        return next()
-      }
-    },
-    /**
-     * Ensures form is encrypt mode
-     * @param {Object} req - Express request object
-     * @param {Object} res - Express response object
-     * @param  {Object} next - Express next middleware function
-     */
-    isFormEncryptMode: function (req, res, next) {
-      if (req.form.responseMode !== 'encrypt') {
-        return res.status(StatusCodes.UNPROCESSABLE_ENTITY).json({
-          message: 'Form is not encrypt mode',
-        })
-      }
-      return next()
-    },
-    /**
-     * Pass through save new Submission object to db
-     * Simply create and pass forward a submissions object w/o saving to db
-     * @param {Object} req - Express request object
-     * @param {Object} res - Express response object
-     * @param {Object} next - the next expressjs callback
-     */
-    passThroughSaveMetadataToDb: function (req, res, next) {
-      let Submission = getSubmissionModel(connection)
-      let submission = new Submission({})
-      req.submission = submission
-      return next()
-    },
-  }
-}
diff --git a/src/app/controllers/authentication.server.controller.js b/src/app/controllers/authentication.server.controller.js
deleted file mode 100755
index 42c4993b4f..0000000000
--- a/src/app/controllers/authentication.server.controller.js
+++ /dev/null
@@ -1,89 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-const { StatusCodes } = require('http-status-codes')
-const {
-  PermissionLevel,
-} = require('../modules/form/admin-form/admin-form.types')
-const {
-  assertHasReadPermissions,
-  assertHasWritePermissions,
-  assertHasDeletePermissions,
-} = require('../modules/form/admin-form/admin-form.utils')
-const { createReqMeta } = require('../utils/request')
-const logger = require('../../config/logger').createLoggerWithLabel(module)
-
-/**
- * Logs an error message when a user cannot perform an action on a form
- * @param {String} user -  user email
- * @param {String} requiredPermission -  level of permission required
- * @param {String} form -  form
- * @returns {String} - the error message
- */
-const logUnauthorizedAccess = (req, action, requiredPermission) => {
-  const user = req.session.user
-  const form = req.form
-  const msg = `User ${user.email} not authorized to perform ${requiredPermission} operation on Form ${form._id} with title: ${form.title}.`
-  logger.error({
-    message: msg,
-    meta: {
-      action: action,
-      ...createReqMeta(req),
-    },
-    error: Error(msg),
-  })
-}
-
-/**
- * Returns a middleware function that ensures that only users with the requiredPermission will pass.
- * @param {String} requiredPermission - one of PERMISSION_LEVELS, indicating the level of authorization required
- * @returns {function({Object}, {Object}, {Object})} - A middleware function that takes req, the express
- *   request object, and res, the express response object.
- */
-exports.verifyPermission = (requiredPermission) =>
-  /**
-   * Middleware function that ensures only those with the required permission level will pass.
-   * @param {Object} req - Express request object
-   * @param {Object} req.form - The form object retrieved from the DB
-   * @param {Object} req.session - The session info of the query
-   * @param {Object} res - Express response object
-   * @param {function} next - Next middleware function
-   */
-  (req, res, next) => {
-    let result
-    switch (requiredPermission) {
-      case PermissionLevel.Read:
-        result = assertHasReadPermissions(req.session.user, req.form)
-        break
-      case PermissionLevel.Write:
-        result = assertHasWritePermissions(req.session.user, req.form)
-        break
-      case PermissionLevel.Delete:
-        result = assertHasDeletePermissions(req.session.user, req.form)
-        break
-      default:
-        logger.error({
-          message:
-            'Unknown permission type encountered when verifying permissions',
-          meta: {
-            action: 'verifyPermission',
-            ...createReqMeta(req),
-          },
-        })
-        return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({
-          message: 'Unknown permission type',
-        })
-    }
-
-    if (result.isErr()) {
-      logUnauthorizedAccess(req, 'verifyPermission', requiredPermission)
-      return res.status(StatusCodes.FORBIDDEN).json({
-        message: result.error.message,
-      })
-    }
-
-    // No error, pass to next function.
-    return next()
-  }
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
index 150d700244..d3dd7dbfbd 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
@@ -15,16 +15,28 @@ import {
 } from 'src/app/modules/core/core.errors'
 import * as FeedbackService from 'src/app/modules/feedback/feedback.service'
 import { FeedbackResponse } from 'src/app/modules/feedback/feedback.types'
+import {
+  AttachmentTooLargeError,
+  InvalidFileExtensionError,
+} from 'src/app/modules/submission/email-submission/email-submission.errors'
+import * as EmailSubmissionService from 'src/app/modules/submission/email-submission/email-submission.service'
+import * as EmailSubmissionUtil from 'src/app/modules/submission/email-submission/email-submission.util'
 import * as EncryptSubmissionService from 'src/app/modules/submission/encrypt-submission/encrypt-submission.service'
 import {
   ConflictError,
   InvalidEncodingError,
   ProcessingError,
   ResponseModeError,
+  SendEmailConfirmationError,
   ValidateFieldError,
 } from 'src/app/modules/submission/submission.errors'
 import * as SubmissionService from 'src/app/modules/submission/submission.service'
 import { MissingUserError } from 'src/app/modules/user/user.errors'
+import {
+  MailGenerationError,
+  MailSendError,
+} from 'src/app/services/mail/mail.errors'
+import MailService from 'src/app/services/mail/mail.service'
 import * as EncryptionUtils from 'src/app/utils/encryption'
 import { EditFieldActions } from 'src/shared/constants'
 import {
@@ -32,9 +44,11 @@ import {
   BasicField,
   FormMetaView,
   FormSettings,
+  IEmailSubmissionSchema,
   IEncryptedSubmissionSchema,
   IForm,
   IFormSchema,
+  IPopulatedEmailForm,
   IPopulatedEncryptedForm,
   IPopulatedForm,
   IPopulatedUser,
@@ -83,12 +97,18 @@ jest.mock(
   'src/app/modules/submission/encrypt-submission/encrypt-submission.service',
 )
 const MockEncryptSubmissionService = mocked(EncryptSubmissionService)
+jest.mock(
+  'src/app/modules/submission/email-submission/email-submission.service',
+)
+const MockEmailSubmissionService = mocked(EmailSubmissionService)
 jest.mock('src/app/utils/encryption')
 const MockEncryptionUtils = mocked(EncryptionUtils)
 jest.mock('../admin-form.service')
 const MockAdminFormService = mocked(AdminFormService)
 jest.mock('../../../user/user.service')
 const MockUserService = mocked(UserService)
+jest.mock('src/app/services/mail/mail.service')
+const MockMailService = mocked(MailService)
 
 describe('admin-form.controller', () => {
   beforeEach(() => jest.clearAllMocks())
@@ -4807,6 +4827,1051 @@ describe('admin-form.controller', () => {
     })
   })
 
+  describe('handleEmailPreviewSubmission', () => {
+    const MOCK_FIELD_ID = new ObjectId().toHexString()
+    const MOCK_RESPONSES = [
+      generateUnprocessedSingleAnswerResponse(BasicField.Email, {
+        _id: MOCK_FIELD_ID,
+      }),
+    ]
+    const MOCK_PARSED_RESPONSES = [
+      generateNewSingleAnswerResponse(BasicField.Email, { _id: MOCK_FIELD_ID }),
+    ]
+    const MOCK_USER_ID = new ObjectId().toHexString()
+    const MOCK_FORM_ID = new ObjectId().toHexString()
+    const MOCK_SUBMISSION_ID = new ObjectId().toHexString()
+    const MOCK_USER = {
+      _id: MOCK_USER_ID,
+      email: 'somerandom@example.com',
+    } as IPopulatedUser
+    const MOCK_FORM = {
+      admin: MOCK_USER,
+      _id: MOCK_FORM_ID,
+      title: 'mock title',
+      form_fields: [
+        generateDefaultField(BasicField.Email, {
+          _id: MOCK_FIELD_ID,
+        }),
+      ],
+    } as IPopulatedEmailForm
+    const MOCK_SUBMISSION = {
+      id: MOCK_SUBMISSION_ID,
+      _id: MOCK_SUBMISSION_ID,
+      created: new Date(),
+    } as IEmailSubmissionSchema
+    const MOCK_SUBMISSION_BODY = {
+      responses: MOCK_RESPONSES,
+      isPreview: false,
+    }
+    const MOCK_DATA_COLLATION_DATA = 'mockDataCollation'
+    const MOCK_FORM_DATA = 'mockFormData'
+    const MOCK_AUTOREPLY_DATA = 'mockAutoReply'
+
+    beforeEach(() => {
+      MockUserService.getPopulatedUserById.mockReturnValue(okAsync(MOCK_USER))
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValue(
+        okAsync(MOCK_FORM),
+      )
+      MockEmailSubmissionService.checkFormIsEmailMode.mockReturnValue(
+        ok(MOCK_FORM),
+      )
+      MockEmailSubmissionService.validateAttachments.mockReturnValue(
+        okAsync(true),
+      )
+      MockSubmissionService.getProcessedResponses.mockReturnValue(
+        ok(MOCK_PARSED_RESPONSES),
+      )
+      MockEmailSubmissionService.createEmailSubmissionWithoutSave.mockReturnValue(
+        MOCK_SUBMISSION,
+      )
+      MockEmailSubmissionService.extractEmailAnswers.mockReturnValue([
+        MOCK_RESPONSES[0].answer,
+      ])
+      MockAdminFormService.extractMyInfoFieldIds.mockReturnValue([
+        MOCK_FIELD_ID,
+      ])
+      MockMailService.sendSubmissionToAdmin.mockReturnValue(okAsync(true))
+      MockSubmissionService.sendEmailConfirmations.mockReturnValue(
+        okAsync(true),
+      )
+      jest.spyOn(EmailSubmissionUtil, 'SubmissionEmailObj').mockReturnValue(({
+        dataCollationData: MOCK_DATA_COLLATION_DATA,
+        formData: MOCK_FORM_DATA,
+        autoReplyData: MOCK_AUTOREPLY_DATA,
+      } as unknown) as EmailSubmissionUtil.SubmissionEmailObj)
+    })
+
+    it('should call all services correctly when submission is valid', async () => {
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).toHaveBeenCalledWith(
+        MOCK_FORM.form_fields,
+      )
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).toHaveBeenCalledWith(MOCK_FORM, expect.any(String), expect.any(String))
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).toHaveBeenCalledWith(MOCK_PARSED_RESPONSES)
+      expect(MockMailService.sendSubmissionToAdmin).toHaveBeenCalledWith({
+        replyToEmails: [MOCK_RESPONSES[0].answer],
+        form: MOCK_FORM,
+        submission: MOCK_SUBMISSION,
+        attachments: [],
+        dataCollationData: MOCK_DATA_COLLATION_DATA,
+        formData: MOCK_FORM_DATA,
+      })
+      expect(MockSubmissionService.sendEmailConfirmations).toHaveBeenCalledWith(
+        {
+          form: MOCK_FORM,
+          parsedResponses: MOCK_PARSED_RESPONSES,
+          submission: MOCK_SUBMISSION,
+          attachments: [],
+          autoReplyData: MOCK_AUTOREPLY_DATA,
+        },
+      )
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: 'Form submission successful.',
+        submissionId: MOCK_SUBMISSION_ID,
+      })
+    })
+
+    it('should return 500 when generic database error occurs while retrieving user', async () => {
+      MockUserService.getPopulatedUserById.mockReturnValueOnce(
+        errAsync(new DatabaseError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(
+        MockAuthService.getFormAfterPermissionChecks,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(500)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 422 when user is missing', async () => {
+      MockUserService.getPopulatedUserById.mockReturnValueOnce(
+        errAsync(new MissingUserError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(
+        MockAuthService.getFormAfterPermissionChecks,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(422)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 500 when generic database error occurs while retrieving form', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new DatabaseError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(500)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 404 when form is not found', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new FormNotFoundError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(404)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 410 when form has been archived', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new FormDeletedError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(410)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 403 when user does not have read permissions', async () => {
+      MockAuthService.getFormAfterPermissionChecks.mockReturnValueOnce(
+        errAsync(new ForbiddenFormError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(403)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when form is not email mode', async () => {
+      MockEmailSubmissionService.checkFormIsEmailMode.mockReturnValueOnce(
+        err(new ResponseModeError(ResponseMode.Encrypt, ResponseMode.Email)),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).not.toHaveBeenCalled()
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when attachments are invalid', async () => {
+      MockEmailSubmissionService.validateAttachments.mockReturnValueOnce(
+        errAsync(new InvalidFileExtensionError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when attachments are too large', async () => {
+      MockEmailSubmissionService.validateAttachments.mockReturnValueOnce(
+        errAsync(new AttachmentTooLargeError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).not.toHaveBeenCalled()
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when responses cannot be processed', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ProcessingError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 409 when the submitted field IDs do not match the form field IDs', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ConflictError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(409)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when any answer is invalid', async () => {
+      MockSubmissionService.getProcessedResponses.mockReturnValueOnce(
+        err(new ValidateFieldError()),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).not.toHaveBeenCalled()
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).not.toHaveBeenCalled()
+      expect(MockMailService.sendSubmissionToAdmin).not.toHaveBeenCalled()
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when the submission email fails to be generated', async () => {
+      MockMailService.sendSubmissionToAdmin.mockReturnValueOnce(
+        errAsync(new MailGenerationError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).toHaveBeenCalledWith(
+        MOCK_FORM.form_fields,
+      )
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).toHaveBeenCalledWith(MOCK_FORM, expect.any(String), expect.any(String))
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).toHaveBeenCalledWith(MOCK_PARSED_RESPONSES)
+      expect(MockMailService.sendSubmissionToAdmin).toHaveBeenCalledWith({
+        replyToEmails: [MOCK_RESPONSES[0].answer],
+        form: MOCK_FORM,
+        submission: MOCK_SUBMISSION,
+        attachments: [],
+        dataCollationData: MOCK_DATA_COLLATION_DATA,
+        formData: MOCK_FORM_DATA,
+      })
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 400 when the submission email fails to be sent', async () => {
+      MockMailService.sendSubmissionToAdmin.mockReturnValueOnce(
+        errAsync(new MailSendError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).toHaveBeenCalledWith(
+        MOCK_FORM.form_fields,
+      )
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).toHaveBeenCalledWith(MOCK_FORM, expect.any(String), expect.any(String))
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).toHaveBeenCalledWith(MOCK_PARSED_RESPONSES)
+      expect(MockMailService.sendSubmissionToAdmin).toHaveBeenCalledWith({
+        replyToEmails: [MOCK_RESPONSES[0].answer],
+        form: MOCK_FORM,
+        submission: MOCK_SUBMISSION,
+        attachments: [],
+        dataCollationData: MOCK_DATA_COLLATION_DATA,
+        formData: MOCK_FORM_DATA,
+      })
+      expect(
+        MockSubmissionService.sendEmailConfirmations,
+      ).not.toHaveBeenCalled()
+      expect(mockRes.status).toHaveBeenCalledWith(400)
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: expect.any(String),
+      })
+    })
+
+    it('should return 200 regardless of errors while sending email confirmations', async () => {
+      MockSubmissionService.sendEmailConfirmations.mockReturnValueOnce(
+        errAsync(new SendEmailConfirmationError('')),
+      )
+      const mockReq = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        body: MOCK_SUBMISSION_BODY,
+        session: {
+          user: {
+            _id: MOCK_USER_ID,
+          },
+        },
+      })
+      const mockRes = expressHandler.mockResponse()
+
+      await AdminFormController.handleEmailPreviewSubmission(
+        mockReq,
+        mockRes,
+        jest.fn(),
+      )
+
+      expect(MockUserService.getPopulatedUserById).toHaveBeenCalledWith(
+        MOCK_USER_ID,
+      )
+      expect(MockAuthService.getFormAfterPermissionChecks).toHaveBeenCalledWith(
+        {
+          user: MOCK_USER,
+          formId: MOCK_FORM_ID,
+          level: PermissionLevel.Read,
+        },
+      )
+      expect(
+        MockEmailSubmissionService.checkFormIsEmailMode,
+      ).toHaveBeenCalledWith(MOCK_FORM)
+      expect(
+        MockEmailSubmissionService.validateAttachments,
+      ).toHaveBeenCalledWith(MOCK_RESPONSES)
+      expect(MockSubmissionService.getProcessedResponses).toHaveBeenCalledWith(
+        MOCK_FORM,
+        MOCK_RESPONSES,
+      )
+      expect(MockAdminFormService.extractMyInfoFieldIds).toHaveBeenCalledWith(
+        MOCK_FORM.form_fields,
+      )
+      expect(
+        MockEmailSubmissionService.createEmailSubmissionWithoutSave,
+      ).toHaveBeenCalledWith(MOCK_FORM, expect.any(String), expect.any(String))
+      expect(
+        MockEmailSubmissionService.extractEmailAnswers,
+      ).toHaveBeenCalledWith(MOCK_PARSED_RESPONSES)
+      expect(MockMailService.sendSubmissionToAdmin).toHaveBeenCalledWith({
+        replyToEmails: [MOCK_RESPONSES[0].answer],
+        form: MOCK_FORM,
+        submission: MOCK_SUBMISSION,
+        attachments: [],
+        dataCollationData: MOCK_DATA_COLLATION_DATA,
+        formData: MOCK_FORM_DATA,
+      })
+      expect(MockSubmissionService.sendEmailConfirmations).toHaveBeenCalledWith(
+        {
+          form: MOCK_FORM,
+          parsedResponses: MOCK_PARSED_RESPONSES,
+          submission: MOCK_SUBMISSION,
+          attachments: [],
+          autoReplyData: MOCK_AUTOREPLY_DATA,
+        },
+      )
+      expect(mockRes.json).toHaveBeenCalledWith({
+        message: 'Form submission successful.',
+        submissionId: MOCK_SUBMISSION_ID,
+      })
+    })
+  })
+
   describe('handleEncryptPreviewSubmission', () => {
     const MOCK_RESPONSES = [
       generateUnprocessedSingleAnswerResponse(BasicField.Email),
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index ab72a34bce..47bbf64f93 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -21,12 +21,25 @@ import {
   DatabaseError,
   DatabasePayloadSizeError,
 } from 'src/app/modules/core/core.errors'
+import {
+  MOCK_ATTACHMENT_FIELD,
+  MOCK_ATTACHMENT_RESPONSE,
+  MOCK_CHECKBOX_FIELD,
+  MOCK_CHECKBOX_RESPONSE,
+  MOCK_OPTIONAL_VERIFIED_FIELD,
+  MOCK_OPTIONAL_VERIFIED_RESPONSE,
+  MOCK_SECTION_FIELD,
+  MOCK_SECTION_RESPONSE,
+  MOCK_TEXT_FIELD,
+  MOCK_TEXTFIELD_RESPONSE,
+} from 'src/app/modules/submission/email-submission/__tests__/email-submission.test.constants'
 import { saveSubmissionMetadata } from 'src/app/modules/submission/email-submission/email-submission.service'
 import { SubmissionHash } from 'src/app/modules/submission/email-submission/email-submission.types'
 import { aws } from 'src/config/config'
 import { EditFieldActions, VALID_UPLOAD_FILE_TYPES } from 'src/shared/constants'
 import {
   BasicField,
+  IFieldSchema,
   IFormDocument,
   IFormSchema,
   IPopulatedEmailForm,
@@ -58,6 +71,11 @@ import * as AdminFormService from '../admin-form.service'
 
 // Prevent rate limiting.
 jest.mock('src/app/utils/limit-rate')
+jest.mock('nodemailer', () => ({
+  createTransport: jest.fn().mockReturnValue({
+    sendMail: jest.fn().mockResolvedValue(true),
+  }),
+}))
 
 const UserModel = getUserModel(mongoose)
 const FormModel = getFormModel(mongoose)
@@ -89,6 +107,440 @@ describe('admin-form.routes', () => {
   })
   afterAll(async () => await dbHandler.closeDatabase())
 
+  describe('POST /v2/submissions/email/preview/:formId', () => {
+    const SUBMISSIONS_ENDPT_BASE = '/v2/submissions/email/preview'
+    it('should return 200 when submission is valid', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [MOCK_TEXT_FIELD],
+          admin: defaultUser._id,
+        },
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        // MOCK_RESPONSE contains all required keys
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [MOCK_TEXTFIELD_RESPONSE],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 200 when answer is empty string for optional field', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [
+            { ...MOCK_TEXT_FIELD, required: false } as IFieldSchema,
+          ],
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [{ ...MOCK_TEXTFIELD_RESPONSE, answer: '' }],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 200 when attachment response has filename and content', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [MOCK_ATTACHMENT_FIELD],
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [
+              {
+                ...MOCK_ATTACHMENT_RESPONSE,
+                content: MOCK_ATTACHMENT_RESPONSE.content.toString('binary'),
+              },
+            ],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 200 when response has isHeader key', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [MOCK_SECTION_FIELD],
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [{ ...MOCK_SECTION_RESPONSE, isHeader: true }],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 200 when signature is empty string for optional verified field', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [MOCK_OPTIONAL_VERIFIED_FIELD],
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [{ ...MOCK_OPTIONAL_VERIFIED_RESPONSE, signature: '' }],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 200 when response has answerArray and no answer', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          form_fields: [MOCK_CHECKBOX_FIELD],
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [MOCK_CHECKBOX_RESPONSE],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(200)
+      expect(response.body).toEqual({
+        message: 'Form submission successful.',
+        submissionId: expect.any(String),
+      })
+    })
+
+    it('should return 400 when isPreview key is missing', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        // Note missing isPreview
+        .field('body', JSON.stringify({ responses: [] }))
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when responses key is missing', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        // Note missing responses
+        .field('body', JSON.stringify({ isPreview: false }))
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when response is missing _id', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [omit(MOCK_TEXTFIELD_RESPONSE, '_id')],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when response is missing fieldType', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [omit(MOCK_TEXTFIELD_RESPONSE, 'fieldType')],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when response has invalid fieldType', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [
+              { ...MOCK_TEXTFIELD_RESPONSE, fieldType: 'definitelyInvalid' },
+            ],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when response is missing answer', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [omit(MOCK_TEXTFIELD_RESPONSE, 'answer')],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when response has both answer and answerArray', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [{ ...MOCK_TEXTFIELD_RESPONSE, answerArray: [] }],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when attachment response has filename but not content', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [omit(MOCK_ATTACHMENT_RESPONSE), 'content'],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+
+    it('should return 400 when attachment response has content but not filename', async () => {
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          hasCaptcha: false,
+          status: Status.Public,
+          admin: defaultUser._id,
+        },
+        // Avoid default mail domain so that user emails in the database don't conflict
+        mailDomain: 'test2.gov.sg',
+      })
+
+      const response = await request
+        .post(`${SUBMISSIONS_ENDPT_BASE}/${form._id}`)
+        .field(
+          'body',
+          JSON.stringify({
+            isPreview: false,
+            responses: [omit(MOCK_ATTACHMENT_RESPONSE), 'filename'],
+          }),
+        )
+        .query({ captchaResponse: 'null' })
+
+      expect(response.status).toBe(400)
+      expect(response.body.message).toEqual(
+        'celebrate request validation failed',
+      )
+    })
+  })
+
   describe('POST /v2/submissions/encrypt/preview/:formId', () => {
     const MOCK_FIELD_ID = new ObjectId().toHexString()
     const MOCK_ATTACHMENT_FIELD_ID = new ObjectId().toHexString()
diff --git a/src/app/modules/form/admin-form/admin-form.constants.ts b/src/app/modules/form/admin-form/admin-form.constants.ts
index a948520383..105c8c705c 100644
--- a/src/app/modules/form/admin-form/admin-form.constants.ts
+++ b/src/app/modules/form/admin-form/admin-form.constants.ts
@@ -2,3 +2,8 @@
  * 900 seconds = 15 minutes. The expiry time for presigned POST URLs.
  */
 export const PRESIGNED_POST_EXPIRY_SECS = 900
+
+// Values used for preview submissions
+export const PREVIEW_SINGPASS_UINFIN = 'S1234567A'
+export const PREVIEW_CORPPASS_UINFIN = '123456789A'
+export const PREVIEW_CORPPASS_UID = 'ABC'
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 9530af82d6..95516eb76b 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -1,4 +1,4 @@
-import { RequestHandler } from 'express'
+import { Request, RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 import JSONStream from 'JSONStream'
@@ -7,16 +7,17 @@ import { ResultAsync } from 'neverthrow'
 import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   AuthType,
+  FieldResponse,
   FormSettings,
   IForm,
   IPopulatedForm,
-  WithForm,
 } from '../../../../types'
 import {
   EncryptSubmissionDto,
   ErrorDto,
   SettingsUpdateDto,
 } from '../../../../types/api'
+import MailService from '../../../services/mail/mail.service'
 import { checkIsEncryptedEncoding } from '../../../utils/encryption'
 import { createReqMeta } from '../../../utils/request'
 import * as AuthService from '../../auth/auth.service'
@@ -27,12 +28,27 @@ import {
   DatabaseValidationError,
 } from '../../core/core.errors'
 import * as FeedbackService from '../../feedback/feedback.service'
+import {
+  createCorppassParsedResponses,
+  createSingpassParsedResponses,
+} from '../../spcp/spcp.util'
+import * as EmailSubmissionService from '../../submission/email-submission/email-submission.service'
+import {
+  mapAttachmentsFromResponses,
+  mapRouteError as mapEmailSubmissionError,
+  SubmissionEmailObj,
+} from '../../submission/email-submission/email-submission.util'
 import * as EncryptSubmissionService from '../../submission/encrypt-submission/encrypt-submission.service'
 import { mapRouteError as mapEncryptSubmissionError } from '../../submission/encrypt-submission/encrypt-submission.utils'
 import * as SubmissionService from '../../submission/submission.service'
 import * as UserService from '../../user/user.service'
 import { PrivateFormError } from '../form.errors'
 
+import {
+  PREVIEW_CORPPASS_UID,
+  PREVIEW_CORPPASS_UINFIN,
+  PREVIEW_SINGPASS_UINFIN,
+} from './admin-form.constants'
 import { EditFieldError } from './admin-form.errors'
 import * as AdminFormService from './admin-form.service'
 import {
@@ -360,26 +376,6 @@ export const handleCountFormSubmissions: RequestHandler<
     })
 }
 
-/**
- * Allow submission in preview without Spcp authentication by providing default values
- * @param {Object} req - Express request object
- * @param {Object} res - Express response object
- * @param {Object} next - the next expressjs callback
- */
-export const passThroughSpcp: RequestHandler = (req, res, next) => {
-  const { authType } = (req as WithForm<typeof req>).form
-  if ([AuthType.SP, AuthType.CP, AuthType.MyInfo].includes(authType)) {
-    res.locals = {
-      ...res.locals,
-      ...AdminFormService.getMockSpcpLocals(
-        authType,
-        (req as WithForm<typeof req>).form.form_fields,
-      ),
-    }
-  }
-  return next()
-}
-
 /**
  * Handler for GET /{formId}/adminform/feedback/count.
  * @security session
@@ -1029,6 +1025,7 @@ export const handleUpdateSettings: RequestHandler<
  * @returns 403 when current user does not have read permissions to given form
  * @returns 404 when given form ID does not exist
  * @returns 410 when given form has been deleted
+ * @returns 422 when user ID in session is not found in database
  * @returns 500 when database error occurs
  */
 export const handleEncryptPreviewSubmission: RequestHandler<
@@ -1106,3 +1103,141 @@ export const handleEncryptPreviewSubmission: RequestHandler<
     submissionId: submission._id,
   })
 }
+
+/**
+ * Handler for POST /v2/submissions/encrypt/preview/:formId.
+ * @security session
+ *
+ * @returns 200 with a mock submission ID
+ * @returns 400 when body is malformed; e.g. invalid responses, or when admin email fails to be sent
+ * @returns 403 when current user does not have read permissions to given form
+ * @returns 404 when given form ID does not exist
+ * @returns 410 when given form has been deleted
+ * @returns 422 when user ID in session is not found in database
+ * @returns 500 when database error occurs
+ */
+export const handleEmailPreviewSubmission: RequestHandler<
+  { formId: string },
+  { message: string; submissionId?: string },
+  { responses: FieldResponse[]; isPreview: boolean },
+  { captchaResponse?: unknown }
+> = async (req, res) => {
+  const { formId } = req.params
+  const sessionUserId = (req.session as Express.AuthedSession).user._id
+  // No need to process attachments as we don't do anything with them
+  const { responses } = req.body
+  const logMeta = {
+    action: 'handleEmailPreviewSubmission',
+    formId,
+    ...createReqMeta(req as Request),
+  }
+
+  const formResult = await UserService.getPopulatedUserById(sessionUserId)
+    .andThen((user) =>
+      AuthService.getFormAfterPermissionChecks({
+        user,
+        formId,
+        level: PermissionLevel.Read,
+      }),
+    )
+    .andThen(EmailSubmissionService.checkFormIsEmailMode)
+  if (formResult.isErr()) {
+    logger.error({
+      message: 'Error while retrieving form for preview submission',
+      meta: logMeta,
+      error: formResult.error,
+    })
+    const { errorMessage, statusCode } = mapEmailSubmissionError(
+      formResult.error,
+    )
+    return res.status(statusCode).json({ message: errorMessage })
+  }
+  const form = formResult.value
+
+  const parsedResponsesResult = await EmailSubmissionService.validateAttachments(
+    responses,
+  ).andThen(() => SubmissionService.getProcessedResponses(form, responses))
+  if (parsedResponsesResult.isErr()) {
+    logger.error({
+      message: 'Error while parsing responses for preview submission',
+      meta: logMeta,
+      error: parsedResponsesResult.error,
+    })
+    const { errorMessage, statusCode } = mapEmailSubmissionError(
+      parsedResponsesResult.error,
+    )
+    return res.status(statusCode).json({ message: errorMessage })
+  }
+  const parsedResponses = parsedResponsesResult.value
+  const attachments = mapAttachmentsFromResponses(req.body.responses)
+
+  // Handle SingPass, CorpPass and MyInfo authentication and validation
+  if (form.authType === AuthType.SP || form.authType === AuthType.MyInfo) {
+    parsedResponses.push(
+      ...createSingpassParsedResponses(PREVIEW_SINGPASS_UINFIN),
+    )
+  } else if (form.authType === AuthType.CP) {
+    parsedResponses.push(
+      ...createCorppassParsedResponses(
+        PREVIEW_CORPPASS_UINFIN,
+        PREVIEW_CORPPASS_UID,
+      ),
+    )
+  }
+
+  const emailData = new SubmissionEmailObj(
+    parsedResponses,
+    // All MyInfo fields are verified in preview
+    new Set(AdminFormService.extractMyInfoFieldIds(form.form_fields)),
+    form.authType,
+  )
+  const submission = EmailSubmissionService.createEmailSubmissionWithoutSave(
+    form,
+    // Don't need to care about response hash or salt
+    '',
+    '',
+  )
+
+  const sendAdminEmailResult = await MailService.sendSubmissionToAdmin({
+    replyToEmails: EmailSubmissionService.extractEmailAnswers(parsedResponses),
+    form,
+    submission,
+    attachments,
+    dataCollationData: emailData.dataCollationData,
+    formData: emailData.formData,
+  })
+  if (sendAdminEmailResult.isErr()) {
+    logger.error({
+      message: 'Error sending submission to admin',
+      meta: logMeta,
+      error: sendAdminEmailResult.error,
+    })
+    const { statusCode, errorMessage } = mapEmailSubmissionError(
+      sendAdminEmailResult.error,
+    )
+    return res.status(statusCode).json({
+      message: errorMessage,
+    })
+  }
+
+  // Don't await on email confirmations, so submission is successful even if
+  // this fails
+  void SubmissionService.sendEmailConfirmations({
+    form,
+    parsedResponses,
+    submission,
+    attachments,
+    autoReplyData: emailData.autoReplyData,
+  }).mapErr((error) => {
+    logger.error({
+      message: 'Error while sending email confirmations',
+      meta: logMeta,
+      error,
+    })
+  })
+
+  return res.json({
+    message: 'Form submission successful.',
+    submissionId: submission.id,
+  })
+}
diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
index 99bab1eb59..6ae229987a 100644
--- a/src/app/modules/form/admin-form/admin-form.routes.ts
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -9,6 +9,7 @@ import { Router } from 'express'
 import { VALID_UPLOAD_FILE_TYPES } from '../../../../shared/constants'
 import { IForm, ResponseMode } from '../../../../types'
 import { withUserAuthentication } from '../../auth/auth.middlewares'
+import * as EmailSubmissionMiddleware from '../../submission/email-submission/email-submission.middleware'
 import * as EncryptSubmissionController from '../../submission/encrypt-submission/encrypt-submission.controller'
 import * as EncryptSubmissionMiddleware from '../../submission/encrypt-submission/encrypt-submission.middleware'
 
@@ -516,3 +517,24 @@ AdminFormsRouter.post(
   EncryptSubmissionMiddleware.validateEncryptSubmissionParams,
   AdminFormController.handleEncryptPreviewSubmission,
 )
+
+/**
+ * Submit an email mode form in preview mode
+ * @route POST /v2/submissions/email/preview/:formId([a-fA-F0-9]{24})
+ * @security session
+ *
+ * @returns 200 if submission was valid
+ * @returns 400 when error occurs while processing submission or submission is invalid
+ * @returns 403 when user does not have read permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsRouter.post(
+  '/v2/submissions/email/preview/:formId([a-fA-F0-9]{24})',
+  withUserAuthentication,
+  EmailSubmissionMiddleware.receiveEmailSubmission,
+  EmailSubmissionMiddleware.validateResponseParams,
+  AdminFormController.handleEmailPreviewSubmission,
+)
diff --git a/src/app/modules/form/admin-form/admin-form.service.ts b/src/app/modules/form/admin-form/admin-form.service.ts
index 76cd9151da..cac0f76728 100644
--- a/src/app/modules/form/admin-form/admin-form.service.ts
+++ b/src/app/modules/form/admin-form/admin-form.service.ts
@@ -11,7 +11,6 @@ import {
   VALID_UPLOAD_FILE_TYPES,
 } from '../../../../shared/constants'
 import {
-  AuthType,
   FormLogoState,
   FormMetaView,
   FormSettings,
@@ -21,7 +20,6 @@ import {
   IFormSchema,
   IPopulatedForm,
   IUserSchema,
-  SpcpLocals,
 } from '../../../../types'
 import { SettingsUpdateDto } from '../../../../types/api'
 import getFormModel from '../../../models/form.server.model'
@@ -206,33 +204,19 @@ export const createPresignedPostUrlForLogos = (
   return createPresignedPostUrl(AwsConfig.logoS3Bucket, uploadParams)
 }
 
-export const getMockSpcpLocals = (
-  authType: AuthType,
+/**
+ * Extracts IDs of MyInfo fields
+ * @param formFields
+ * @returns List of IDs of MyInfo fields
+ */
+export const extractMyInfoFieldIds = (
   formFields: IFieldSchema[] | undefined,
-): SpcpLocals => {
-  const myInfoFieldIds: string[] = formFields
+): string[] => {
+  return formFields
     ? formFields
         .filter((field) => field.myInfo?.attr)
         .map((field) => field._id.toString())
     : []
-  switch (authType) {
-    case AuthType.MyInfo:
-      return {
-        uinFin: 'S1234567A',
-        hashedFields: new Set(myInfoFieldIds),
-      }
-    case AuthType.SP:
-      return {
-        uinFin: 'S1234567A',
-      }
-    case AuthType.CP:
-      return {
-        uinFin: '123456789A',
-        userInfo: 'ABC',
-      }
-    default:
-      return {}
-  }
 }
 
 /**
diff --git a/src/app/modules/spcp/spcp.controller.ts b/src/app/modules/spcp/spcp.controller.ts
index 6513df583d..42f7f57b3f 100644
--- a/src/app/modules/spcp/spcp.controller.ts
+++ b/src/app/modules/spcp/spcp.controller.ts
@@ -8,15 +8,10 @@ import { AuthType, WithForm } from '../../../types'
 import { createReqMeta } from '../../utils/request'
 import { BillingFactory } from '../billing/billing.factory'
 import * as FormService from '../form/form.service'
-import { ProcessedFieldResponse } from '../submission/submission.types'
 
 import { SpcpFactory } from './spcp.factory'
 import { JwtName, LoginPageValidationResult } from './spcp.types'
-import {
-  createCorppassParsedResponses,
-  createSingpassParsedResponses,
-  mapRouteError,
-} from './spcp.util'
+import { mapRouteError } from './spcp.util'
 
 const logger = createLoggerWithLabel(module)
 
@@ -223,31 +218,3 @@ export const handleLogin: (
       return res.redirect(destination)
     })
 }
-
-/**
- * Append additional verified responses(s) for SP and CP responses so that they show up in email response
- * @param req - Express request object
- * @param res - Express response object
- */
-export const appendVerifiedSPCPResponses: RequestHandler<
-  ParamsDictionary,
-  unknown,
-  { parsedResponses: ProcessedFieldResponse[] }
-> = (req, res, next) => {
-  const { form } = req as WithForm<typeof req>
-  const { uinFin, userInfo } = res.locals
-  switch (form.authType) {
-    case AuthType.MyInfo:
-    case AuthType.SP:
-      req.body.parsedResponses.push(...createSingpassParsedResponses(uinFin))
-      break
-    case AuthType.CP:
-      // Note that maskUidOnLastField() relies on the fact that userInfo is pushed in last to parsedResponses
-      // TODO(#1104): Remove this comment after refactoring
-      req.body.parsedResponses.push(
-        ...createCorppassParsedResponses(uinFin, userInfo),
-      )
-      break
-  }
-  return next()
-}
diff --git a/src/app/modules/submission/email-submission/__tests__/email-submission.service.spec.ts b/src/app/modules/submission/email-submission/__tests__/email-submission.service.spec.ts
index b069a378f5..ab8042a986 100644
--- a/src/app/modules/submission/email-submission/__tests__/email-submission.service.spec.ts
+++ b/src/app/modules/submission/email-submission/__tests__/email-submission.service.spec.ts
@@ -20,6 +20,7 @@ import {
   generateNewAttachmentResponse,
   generateNewSingleAnswerResponse,
 } from 'tests/unit/backend/helpers/generate-form-data'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 import { ProcessedSingleAnswerResponse } from '../../submission.types'
 import {
@@ -42,6 +43,40 @@ const MOCK_HASH = Buffer.from('mockHash')
 const EmailSubmissionModel = getEmailSubmissionModel(mongoose)
 
 describe('email-submission.service', () => {
+  beforeAll(async () => await dbHandler.connect())
+  afterEach(async () => await dbHandler.clearDatabase())
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('createEmailSubmissionWithoutSave', () => {
+    const MOCK_EMAIL = 'a@abc.com'
+    const MOCK_RESPONSE_HASH = 'mockHash'
+    const MOCK_RESPONSE_SALT = 'mockSalt'
+    const MOCK_FORM = ({
+      admin: new ObjectId(),
+      _id: new ObjectId(),
+      title: 'mock title',
+      getUniqueMyInfoAttrs: () => [],
+      authType: 'NIL',
+      emails: [MOCK_EMAIL],
+    } as unknown) as IPopulatedEmailForm
+
+    it('should create a new submission without saving it to the database', async () => {
+      const result = EmailSubmissionService.createEmailSubmissionWithoutSave(
+        MOCK_FORM,
+        MOCK_RESPONSE_HASH,
+        MOCK_RESPONSE_SALT,
+      )
+      const foundInDatabase = await EmailSubmissionModel.findOne({
+        _id: result._id,
+      })
+
+      expect(result.form).toEqual(MOCK_FORM._id)
+      expect(result.responseHash).toEqual(MOCK_RESPONSE_HASH)
+      expect(result.responseSalt).toEqual(MOCK_RESPONSE_SALT)
+      expect(foundInDatabase).toBeNull()
+    })
+  })
+
   describe('validateAttachments', () => {
     it('should reject submissions when attachments are more than 7MB', async () => {
       const processedResponse1 = generateNewAttachmentResponse({
diff --git a/src/app/modules/submission/email-submission/email-submission.controller.ts b/src/app/modules/submission/email-submission/email-submission.controller.ts
index 781b411532..248da53408 100644
--- a/src/app/modules/submission/email-submission/email-submission.controller.ts
+++ b/src/app/modules/submission/email-submission/email-submission.controller.ts
@@ -261,9 +261,7 @@ export const handleEmailSubmission: RequestHandler<
   }).mapErr((error) => {
     logger.error({
       message: 'Error while sending email confirmations',
-      meta: {
-        action: 'sendEmailAutoReplies',
-      },
+      meta: logMetaWithSubmission,
       error,
     })
   })
diff --git a/src/app/modules/submission/email-submission/email-submission.middleware.ts b/src/app/modules/submission/email-submission/email-submission.middleware.ts
index 0aa07aa0a2..8c85e8acd6 100644
--- a/src/app/modules/submission/email-submission/email-submission.middleware.ts
+++ b/src/app/modules/submission/email-submission/email-submission.middleware.ts
@@ -1,61 +1,16 @@
 import { celebrate, Joi } from 'celebrate'
 import { RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
-import { Merge, SetOptional } from 'type-fest'
 
 import { createLoggerWithLabel } from '../../../../config/logger'
-import {
-  BasicField,
-  FieldResponse,
-  ResWithHashedFields,
-  WithAttachments,
-  WithEmailData,
-  WithForm,
-} from '../../../../types'
-import MailService from '../../../services/mail/mail.service'
+import { BasicField, FieldResponse } from '../../../../types'
 import { createReqMeta } from '../../../utils/request'
-import { getProcessedResponses } from '../submission.service'
-import { ProcessedFieldResponse } from '../submission.types'
 
 import * as EmailSubmissionReceiver from './email-submission.receiver'
-import * as EmailSubmissionService from './email-submission.service'
-import { WithAdminEmailData } from './email-submission.types'
-import {
-  mapAttachmentsFromResponses,
-  mapRouteError,
-  SubmissionEmailObj,
-} from './email-submission.util'
+import { mapRouteError } from './email-submission.util'
 
 const logger = createLoggerWithLabel(module)
 
-/**
- * Construct autoReply data and data to send admin from responses submitted
- *
- * @param req - Express request object
- * @param res - Express response object
- * @param next - Express next middleware function
- */
-export const prepareEmailSubmission: RequestHandler<
-  ParamsDictionary,
-  unknown,
-  { parsedResponses: ProcessedFieldResponse[] }
-> = (req, res, next) => {
-  const hashedFields =
-    (res as ResWithHashedFields<typeof res>).locals.hashedFields || new Set()
-  const { form } = req as WithForm<typeof req>
-  const emailData = new SubmissionEmailObj(
-    req.body.parsedResponses,
-    hashedFields,
-    form.authType,
-  )
-  // eslint-disable-next-line @typescript-eslint/no-extra-semi
-  ;(req as WithEmailData<typeof req>).autoReplyData = emailData.autoReplyData
-  ;(req as WithEmailData<typeof req>).dataCollationData =
-    emailData.dataCollationData
-  ;(req as WithEmailData<typeof req>).formData = emailData.formData
-  return next()
-}
-
 /**
  * Parses multipart-form data request. Parsed attachments are
  * placed into req.attachments and parsed fields are placed into
@@ -97,115 +52,6 @@ export const receiveEmailSubmission: RequestHandler<
     })
 }
 
-/**
- * Extracts relevant fields, injects questions, verifies visibility of field and validates answers
- * to produce req.body.parsedResponses
- *
- * @param req - Express request object
- * @param res - Express response object
- * @param next - Express next middleware function
- */
-export const validateEmailSubmission: RequestHandler<
-  ParamsDictionary,
-  { message: string },
-  { responses: FieldResponse[] }
-> = async (req, res, next) => {
-  const { form } = req as WithForm<typeof req>
-
-  return EmailSubmissionService.validateAttachments(req.body.responses)
-    .andThen(() => getProcessedResponses(form, req.body.responses))
-    .map((parsedResponses) => {
-      // Creates an array of attachments from the validated responses
-      // TODO (#42): remove these types when merging middlewares into controller
-      // eslint-disable-next-line @typescript-eslint/no-extra-semi
-      ;(req as WithAttachments<
-        typeof req
-      >).attachments = mapAttachmentsFromResponses(req.body.responses)
-      ;(req.body as Merge<
-        typeof req.body,
-        { parsedResponses: ProcessedFieldResponse[] }
-      >).parsedResponses = parsedResponses
-      delete (req.body as SetOptional<typeof req.body, 'responses'>).responses // Prevent downstream functions from using responses by deleting it
-      return next()
-    })
-    .mapErr((error) => {
-      logger.error({
-        message: 'Error processing responses',
-        meta: {
-          action: 'validateEmailSubmission',
-          ...createReqMeta(req),
-          formId: form._id,
-        },
-        error,
-      })
-      const { errorMessage, statusCode } = mapRouteError(error)
-      return res.status(statusCode).json({
-        message: errorMessage,
-      })
-    })
-}
-
-/**
- * Sends response email to admin
- * @param req - Express request object
- * @param req.form - form object from req
- * @param req.formData - the submission for the form
- * @param req.dataCollationData - data to be included in JSON section of email
- * @param req.submission - submission which was saved to database
- * @param req.attachments - submitted attachments, parsed by
- * exports.receiveSubmission
- * @param res - Express response object
- * @param next - the next expressjs callback, invoked once attachments
- * are processed
- */
-export const sendAdminEmail: RequestHandler<
-  ParamsDictionary,
-  { message: string; spcpSubmissionFailure: boolean },
-  { parsedResponses: ProcessedFieldResponse[] }
-> = async (req, res, next) => {
-  const {
-    form,
-    formData,
-    dataCollationData,
-    submission,
-    attachments,
-  } = req as WithAdminEmailData<typeof req>
-  const logMeta = {
-    action: 'sendAdminEmail',
-    submissionId: submission.id,
-    formId: form._id,
-    ...createReqMeta(req),
-    submissionHash: submission.responseHash,
-  }
-  logger.info({
-    message: 'Sending admin mail',
-    meta: logMeta,
-  })
-  return MailService.sendSubmissionToAdmin({
-    replyToEmails: EmailSubmissionService.extractEmailAnswers(
-      req.body.parsedResponses,
-    ),
-    form,
-    submission,
-    attachments,
-    dataCollationData,
-    formData,
-  })
-    .map(() => next())
-    .mapErr((error) => {
-      logger.error({
-        message: 'Error sending submission to admin',
-        meta: logMeta,
-        error,
-      })
-      const { statusCode, errorMessage } = mapRouteError(error)
-      return res.status(statusCode).json({
-        message: errorMessage,
-        spcpSubmissionFailure: false,
-      })
-    })
-}
-
 /**
  * Celebrate validation for the email submissions endpoint.
  */
diff --git a/src/app/modules/submission/email-submission/email-submission.service.ts b/src/app/modules/submission/email-submission/email-submission.service.ts
index 280544e7fc..90c3d30408 100644
--- a/src/app/modules/submission/email-submission/email-submission.service.ts
+++ b/src/app/modules/submission/email-submission/email-submission.service.ts
@@ -190,3 +190,25 @@ export const checkFormIsEmailMode = (
   }
   return err(new ResponseModeError(ResponseMode.Email, form.responseMode))
 }
+
+/**
+ * Creates an email submission without saving it to the database.
+ * @param form Form document
+ * @param responseHash Hash of response
+ * @param responseSalt Salt used to hash response
+ * @returns Submission document which has not been saved to database
+ */
+export const createEmailSubmissionWithoutSave = (
+  form: IPopulatedEmailForm,
+  responseHash: string,
+  responseSalt: string,
+): IEmailSubmissionSchema => {
+  return new EmailSubmissionModel({
+    form: form._id,
+    authType: form.authType,
+    myInfoFields: form.getUniqueMyInfoAttrs(),
+    recipientEmails: transformEmails(form.emails),
+    responseHash,
+    responseSalt,
+  })
+}
diff --git a/src/app/modules/submission/email-submission/email-submission.types.ts b/src/app/modules/submission/email-submission/email-submission.types.ts
index 2d66820eae..f1cabbda9c 100644
--- a/src/app/modules/submission/email-submission/email-submission.types.ts
+++ b/src/app/modules/submission/email-submission/email-submission.types.ts
@@ -1,10 +1,4 @@
-import {
-  BasicField,
-  FieldResponse,
-  IBaseResponse,
-  WithEmailModeMetadata,
-  WithSubmission,
-} from '../../../../types'
+import { BasicField, FieldResponse, IBaseResponse } from '../../../../types'
 import { ProcessedResponse } from '../submission.types'
 
 // When a response has been formatted for email, all answerArray
@@ -26,5 +20,3 @@ export interface SubmissionHash {
   hash: string
   salt: string
 }
-
-export type WithAdminEmailData<T> = WithEmailModeMetadata<T> & WithSubmission<T>
diff --git a/src/app/modules/submission/email-submission/email-submission.util.ts b/src/app/modules/submission/email-submission/email-submission.util.ts
index f0f9a100cb..c327a93fa6 100644
--- a/src/app/modules/submission/email-submission/email-submission.util.ts
+++ b/src/app/modules/submission/email-submission/email-submission.util.ts
@@ -39,6 +39,7 @@ import {
   MissingFeatureError,
 } from '../../core/core.errors'
 import {
+  ForbiddenFormError,
   FormDeletedError,
   FormNotFoundError,
   PrivateFormError,
@@ -56,6 +57,7 @@ import {
   MissingJwtError,
   VerifyJwtError,
 } from '../../spcp/spcp.errors'
+import { MissingUserError } from '../../user/user.errors'
 import {
   ConflictError,
   ProcessingError,
@@ -373,6 +375,16 @@ export const mapRouteError: MapRouteError = (error) => {
         errorMessage:
           'Could not send submission. For assistance, please contact the person who asked you to fill in this form.',
       }
+    case MissingUserError:
+      return {
+        statusCode: StatusCodes.UNPROCESSABLE_ENTITY,
+        errorMessage: 'You must be logged in to perform this action.',
+      }
+    case ForbiddenFormError:
+      return {
+        statusCode: StatusCodes.FORBIDDEN,
+        errorMessage: 'You do not have permission to perform this action.',
+      }
     case FormNotFoundError:
       return {
         statusCode: StatusCodes.NOT_FOUND,
@@ -603,7 +615,7 @@ const maskUidOnLastField = (
 ): EmailRespondentConfirmationField[] => {
   // Mask corppass UID and show only last 4 chars in autoreply to form filler
   // This does not affect response email to form admin
-  // Function assumes corppass UID is last in the autoReplyData array - see appendVerifiedSPCPResponses()
+  // Function assumes corppass UID is last in the autoReplyData array
   // TODO(#1104): Refactor to move validation and construction of parsedResponses in class constructor
   // This will allow for proper tagging of corppass UID field instead of checking field title and position
 
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
index cda813af4f..8feb259149 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.types.ts
@@ -10,12 +10,6 @@ export type EncryptSubmissionBodyAfterProcess = {
   parsedResponses: ProcessedFieldResponse[]
 }
 
-export type WithAttachmentsData<T> = T & {
-  attachmentData: EncryptedAttachmentsDto
-}
-
-export type WithFormData<T> = T & { formData: string }
-
 export type AttachmentMetadata = Map<string, string>
 
 export type SaveEncryptSubmissionParams = {
diff --git a/src/app/modules/submission/submission.middleware.ts b/src/app/modules/submission/submission.middleware.ts
deleted file mode 100644
index 0acfc5da8e..0000000000
--- a/src/app/modules/submission/submission.middleware.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { RequestHandler } from 'express'
-import { ParamsDictionary } from 'express-serve-static-core'
-
-import { createLoggerWithLabel } from '../../../config/logger'
-import { WithAutoReplyEmailData } from '../../../types'
-
-import * as SubmissionService from './submission.service'
-import { ProcessedFieldResponse } from './submission.types'
-
-const logger = createLoggerWithLabel(module)
-
-/**
- * Sends email confirmations to form-fillers, for email fields which have
- * email confirmation enabled.
- * @param req Express request object
- * @param res Express response object
- */
-export const sendEmailConfirmations: RequestHandler<
-  ParamsDictionary,
-  unknown,
-  { parsedResponses: ProcessedFieldResponse[] }
-> = async (req, res) => {
-  const {
-    form,
-    attachments,
-    autoReplyData,
-    submission,
-  } = req as WithAutoReplyEmailData<typeof req>
-  // Return the reply early to the submitter
-  res.json({
-    message: 'Form submission successful.',
-    submissionId: submission.id,
-  })
-  return SubmissionService.sendEmailConfirmations({
-    form,
-    parsedResponses: req.body.parsedResponses,
-    submission,
-    attachments,
-    autoReplyData,
-  }).mapErr((error) => {
-    logger.error({
-      message: 'Error while sending email confirmations',
-      meta: {
-        action: 'sendEmailAutoReplies',
-      },
-      error,
-    })
-  })
-}
diff --git a/src/app/routes/admin-forms.server.routes.js b/src/app/routes/admin-forms.server.routes.js
deleted file mode 100644
index f97c85f1cd..0000000000
--- a/src/app/routes/admin-forms.server.routes.js
+++ /dev/null
@@ -1,89 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-const { celebrate, Joi, Segments } = require('celebrate')
-
-let forms = require('../../app/controllers/forms.server.controller')
-let adminForms = require('../../app/controllers/admin-forms.server.controller')
-let auth = require('../../app/controllers/authentication.server.controller')
-const EmailSubmissionsMiddleware = require('../../app/modules/submission/email-submission/email-submission.middleware')
-const SubmissionsMiddleware = require('../../app/modules/submission/submission.middleware')
-const AdminFormController = require('../modules/form/admin-form/admin-form.controller')
-const { withUserAuthentication } = require('../modules/auth/auth.middlewares')
-const {
-  PermissionLevel,
-} = require('../modules/form/admin-form/admin-form.types')
-const SpcpController = require('../modules/spcp/spcp.controller')
-const { BasicField } = require('../../types')
-
-/**
- * Authenticates logged in user, before retrieving non-archived form
- * and verifying read/write permissions.
- * @param {enum} requiredPermission
- */
-let authActiveForm = (requiredPermission) => [
-  withUserAuthentication,
-  forms.formById,
-  adminForms.isFormActive,
-  auth.verifyPermission(requiredPermission),
-]
-
-module.exports = function (app) {
-  /**
-   * On preview, submit a form response, processing it as an email to be sent to
-   * the public servant who created the form. Optionally, email a PDF
-   * containing the submission back to the user, if an email address
-   * was given. SMS autoreplies for mobile number fields are also sent if feature
-   * is enabled.
-   * Note that preview submissions are not saved to db
-   * Note that spcp session is not verified, neither is myInfo data verified
-   * @route POST /v2/submissions/email/preview/{formId}
-   * @group forms - endpoints to serve forms
-   * @param {string} formId.path.required - the form id
-   * @param {Array} response.body.required - contains the entire form submission
-   * @consumes multipart/form-data
-   * @produces application/json
-   * @returns {SubmissionResponse.model} 200 - submission made
-   * @returns {SubmissionResponse.model} 400 - submission has bad data and could not be processed
-   * @security OTP
-   */
-  app.route('/v2/submissions/email/preview/:formId([a-fA-F0-9]{24})').post(
-    authActiveForm(PermissionLevel.Read),
-    EmailSubmissionsMiddleware.receiveEmailSubmission,
-    celebrate({
-      [Segments.BODY]: Joi.object({
-        responses: Joi.array()
-          .items(
-            Joi.object()
-              .keys({
-                _id: Joi.string().required(),
-                question: Joi.string().required(),
-                fieldType: Joi.string()
-                  .required()
-                  .valid(...Object.values(BasicField)),
-                answer: Joi.string().allow(''),
-                answerArray: Joi.array(),
-                filename: Joi.string(),
-                content: Joi.binary(),
-                isHeader: Joi.boolean(),
-                myInfo: Joi.object(),
-                signature: Joi.string().allow(''),
-              })
-              .xor('answer', 'answerArray') // only answer or answerArray can be present at once
-              .with('filename', 'content'), // if filename is present, content must be present
-          )
-          .required(),
-        isPreview: Joi.boolean().required(),
-      }),
-    }),
-    EmailSubmissionsMiddleware.validateEmailSubmission,
-    AdminFormController.passThroughSpcp,
-    SpcpController.appendVerifiedSPCPResponses,
-    EmailSubmissionsMiddleware.prepareEmailSubmission,
-    adminForms.passThroughSaveMetadataToDb,
-    EmailSubmissionsMiddleware.sendAdminEmail,
-    SubmissionsMiddleware.sendEmailConfirmations,
-  )
-}
diff --git a/src/app/routes/index.js b/src/app/routes/index.js
index dfb783cbe9..08270e7337 100644
--- a/src/app/routes/index.js
+++ b/src/app/routes/index.js
@@ -1,5 +1,4 @@
 module.exports = [
-  require('./admin-forms.server.routes.js'),
   require('./frontend.server.routes.js'),
   require('./public-forms.server.routes.js'),
 ]
diff --git a/src/types/express.locals.ts b/src/types/express.locals.ts
index 51032e3d97..cdd69b5b92 100644
--- a/src/types/express.locals.ts
+++ b/src/types/express.locals.ts
@@ -4,9 +4,7 @@ import { LeanDocument } from 'mongoose'
 import { ProcessedFieldResponse } from '../app/modules/submission/submission.types'
 
 import { BasicField } from './field'
-import { IEmailFormSchema, IPopulatedForm } from './form'
-import { SpcpSession } from './spcp'
-import { ISubmissionSchema } from './submission'
+import { IPopulatedForm } from './form'
 
 export type WithForm<T> = T & {
   form: IPopulatedForm
@@ -20,10 +18,6 @@ export type WithParsedResponses<T> = T & {
   parsedResponses: ProcessedFieldResponse[]
 }
 
-export type ResWithSpcpSession<T> = T & {
-  locals: { spcpSession?: SpcpSession }
-}
-
 export type ResWithUinFin<T> = T & {
   uinFin?: string
 }
@@ -32,14 +26,6 @@ export type ResWithHashedFields<T> = T & {
   locals: { hashedFields?: Set<string> }
 }
 
-export type SpcpLocals =
-  | {
-      uinFin: string
-      hashedFields?: Set<string>
-    }
-  | { uinFin: string; userInfo: string }
-  | { [key: string]: never } // empty object
-
 export type EmailRespondentConfirmationField = {
   question: string
   answerTemplate: string[]
@@ -74,25 +60,8 @@ export interface EmailDataForOneField {
   formData: EmailAdminDataField
 }
 
-export type WithSubmission<T> = T & { submission: ISubmissionSchema }
-
 export interface IAttachmentInfo {
   filename: string
   content: Buffer
   fieldId: string
 }
-
-export type WithAttachments<T> = T & { attachments: IAttachmentInfo[] }
-
-export type WithEmailData<T> = T & EmailData
-
-export type WithEmailForm<T> = T & { form: IEmailFormSchema }
-
-export type WithEmailModeMetadata<T> = WithEmailData<T> &
-  WithAttachments<T> &
-  WithEmailForm<T>
-
-export type WithAutoReplyEmailData<T> = WithForm<T> &
-  WithSubmission<T> &
-  Partial<WithAttachments<T>> &
-  Partial<WithEmailData<T>>
diff --git a/tests/unit/backend/controllers/admin-forms.server.controller.spec.js b/tests/unit/backend/controllers/admin-forms.server.controller.spec.js
deleted file mode 100644
index 35fcf4792a..0000000000
--- a/tests/unit/backend/controllers/admin-forms.server.controller.spec.js
+++ /dev/null
@@ -1,188 +0,0 @@
-const { StatusCodes } = require('http-status-codes')
-const mongoose = require('mongoose')
-
-const dbHandler = require('../helpers/db-handler')
-const Form = dbHandler.makeModel('form.server.model', 'Form')
-
-const Controller = spec(
-  'dist/backend/app/controllers/admin-forms.server.controller',
-).makeModule(mongoose)
-
-const NewController = require('../../../../dist/backend/app/modules/form/admin-form/admin-form.controller')
-const { ResponseMode } = require('../../../../dist/backend/types')
-
-describe('Admin-Forms Controller', () => {
-  // Declare global variables
-  let req
-  let res
-  let testForm
-  let testUser
-
-  beforeAll(async () => await dbHandler.connect())
-  beforeEach(async () => {
-    res = jasmine.createSpyObj('res', ['status', 'send', 'json'])
-    const collections = await dbHandler.preloadCollections()
-
-    testUser = collections.user
-    testForm = collections.form
-
-    req = {
-      query: {},
-      params: {},
-      body: {},
-      session: {
-        user: {
-          _id: testUser._id,
-          email: testUser.email,
-        },
-      },
-      headers: {},
-      ip: '127.0.0.1',
-      get: () => {},
-    }
-  })
-
-  afterEach(async () => await dbHandler.clearDatabase())
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  describe('isFormActive', () => {
-    it('should return 404 if form is archived', () => {
-      let req = { form: { status: 'ARCHIVED' }, headers: {}, ip: '127.0.0.1' }
-      res.status.and.callFake(function () {
-        return this
-      })
-      res.send.and.callFake(function () {
-        return this
-      })
-      Controller.isFormActive(req, res, () => {})
-      expect(res.status).toHaveBeenCalledWith(StatusCodes.NOT_FOUND)
-    })
-
-    it('should pass on to the next middleware if not archived', () => {
-      let req = { form: { status: 'PUBLIC' }, headers: {}, ip: '127.0.0.1' }
-      let next = jasmine.createSpy()
-      Controller.isFormActive(req, res, next)
-      expect(next).toHaveBeenCalled()
-    })
-  })
-
-  describe('isFormEncryptMode', () => {
-    let next
-    beforeEach(() => {
-      req.form = testForm
-      res.status.and.callFake(() => res)
-      next = jasmine.createSpy()
-    })
-    it('should reject forms that are not encrypt mode', () => {
-      req.form.responseMode = 'email'
-      Controller.isFormEncryptMode(req, res, next)
-      expect(next).not.toHaveBeenCalled()
-      expect(res.status).toHaveBeenCalledWith(StatusCodes.UNPROCESSABLE_ENTITY)
-    })
-    it('should accept forms that are encrypt mode', () => {
-      req.form.responseMode = 'encrypt'
-      Controller.isFormEncryptMode(req, res, next)
-      expect(next).toHaveBeenCalled()
-    })
-  })
-
-  describe('create', () => {
-    it('should successfully save a Form object with user defined fields', (done) => {
-      let expected = {
-        title: 'form_title',
-        responseMode: ResponseMode.Email,
-        emails: ['email@hello.gov.sg', 'user@byebye.gov.sg'],
-      }
-      req.body.form = _.cloneDeep(expected)
-
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(StatusCodes.OK)
-        return res
-      })
-
-      // Check for user-defined fields
-      res.json.and.callFake((args) => {
-        let returnObj = args.toObject()
-        expect(returnObj.title).toEqual(expected.title)
-        expect(returnObj.emails).toEqual(expected.emails)
-        expect(returnObj.admin.toString()).toEqual(
-          req.session.user._id.toString(),
-        )
-        Form.findOne({ title: expected.title }, (err, foundForm) => {
-          if (err || !foundForm) {
-            done(err || new Error('Form not saved'))
-          } else {
-            done()
-          }
-        })
-      })
-      NewController.handleCreateForm(req, res)
-    })
-
-    it('should return 422 error when saving a Form object with invalid fields', (done) => {
-      req.body.form = {
-        title: 'bad_form',
-        responseMode: ResponseMode.Email,
-        emails: 'wrongemail.com',
-      }
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(
-          StatusCodes.UNPROCESSABLE_ENTITY,
-        )
-        done()
-        return res
-      })
-      NewController.handleCreateForm(req, res)
-    })
-  })
-
-  describe('update', () => {
-    it('should successfully update a Form object with new fields', (done) => {
-      let expected = {
-        title: 'form_title2',
-        startPage: {
-          colorTheme: 'blue',
-          estTimeTaken: 1,
-        },
-        permissionList: [],
-      }
-      req.params.formId = testForm._id
-      req.body.form = _.cloneDeep(expected)
-      // Check for user-defined fields
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(StatusCodes.OK)
-        return res
-      })
-      res.json.and.callFake(() => {
-        Form.findOne({ _id: testForm._id }, (err, updatedForm) => {
-          expect(err).not.toBeTruthy()
-          let updatedFormObj = updatedForm.toObject()
-          expect(updatedFormObj.title).toEqual(expected.title)
-          expect(updatedFormObj.startPage).toEqual(expected.startPage)
-          done()
-        })
-      })
-      NewController.handleUpdateForm(req, res)
-    })
-
-    it('should return 422 error when updating a Form object with invalid fields', (done) => {
-      req.params.formId = testForm._id
-      req.body.form = {
-        title: 'form_title3',
-        startPage: {
-          colorTheme: 'wrong_color',
-          estTimeTaken: 1,
-        },
-        permissionList: [],
-      }
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(
-          StatusCodes.UNPROCESSABLE_ENTITY,
-        )
-        done()
-        return res
-      })
-      NewController.handleUpdateForm(req, res)
-    })
-  })
-})
diff --git a/tests/unit/backend/controllers/authentication.server.controller.spec.js b/tests/unit/backend/controllers/authentication.server.controller.spec.js
deleted file mode 100644
index add4854d9d..0000000000
--- a/tests/unit/backend/controllers/authentication.server.controller.spec.js
+++ /dev/null
@@ -1,98 +0,0 @@
-const { StatusCodes } = require('http-status-codes')
-const mongoose = require('mongoose')
-const {
-  PermissionLevel,
-} = require('../../../../dist/backend/app/modules/form/admin-form/admin-form.types')
-
-const dbHandler = require('../helpers/db-handler')
-let roles = require('../helpers/roles')
-
-describe('Authentication Controller', () => {
-  const TEST_OTP = '123456'
-  const bcrypt = jasmine.createSpyObj('bcrypt', ['hash'])
-  const mockSendNodeMail = jasmine.createSpy()
-
-  const Controller = spec(
-    'dist/backend/app/controllers/authentication.server.controller',
-    {
-      mongoose: Object.assign(mongoose, { '@noCallThru': true }),
-      '../utils/otp': {
-        generateOtp: () => TEST_OTP,
-      },
-      '../services/mail/mail.service': {
-        sendNodeMail: mockSendNodeMail,
-      },
-      bcrypt,
-    },
-  )
-
-  let req
-  let res
-  let testForm
-
-  beforeAll(async () => await dbHandler.connect())
-  afterEach(async () => await dbHandler.clearDatabase())
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  beforeEach(async () => {
-    req = {
-      query: {},
-      params: {},
-      body: {},
-      session: {
-        user: {
-          _id: mongoose.Types.ObjectId('000000000001'),
-          email: 'test@test.gov.sg',
-        },
-      },
-      headers: {},
-      ip: '127.0.0.1',
-      get: () => '',
-    }
-
-    res = jasmine.createSpyObj('res', ['status', 'send', 'json'])
-    res.locals = {}
-
-    const collections = await dbHandler.preloadCollections({
-      userId: req.session.user._id,
-    })
-
-    // Insert test form before each test
-    testForm = collections.form
-  })
-
-  describe('hasFormAdminAuthorization', () => {
-    it('should authorize if session user is admin', () => {
-      let next = jasmine.createSpy()
-      // Populate admin with partial user object
-      let testFormObj = testForm.toObject()
-      testFormObj.admin = { _id: req.session.user._id }
-      req.form = testFormObj
-      Controller.verifyPermission(PermissionLevel.Delete)(req, res, next)
-      expect(next).toHaveBeenCalled()
-    })
-    it('should authorize if session user is a collaborator', () => {
-      let next = jasmine.createSpy()
-      // Populate admin with partial user object
-      let testFormObj = testForm.toObject()
-      testFormObj.admin = { _id: mongoose.Types.ObjectId('000000000002') }
-      testFormObj.permissionList.push(
-        roles.collaborator(req.session.user.email),
-      )
-      req.form = testFormObj
-      Controller.verifyPermission(PermissionLevel.Write)(req, res, next)
-      expect(next).toHaveBeenCalled()
-    })
-    it('should not authorize if session user is not a collaborator nor admin', () => {
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(StatusCodes.FORBIDDEN)
-        return res
-      })
-      // Populate admin with partial user object
-      let testFormObj = testForm.toObject()
-      testFormObj.admin = { _id: mongoose.Types.ObjectId('000000000002') }
-      req.form = testFormObj
-      Controller.verifyPermission(PermissionLevel.Write)(req, res, () => {})
-    })
-  })
-})
diff --git a/tests/unit/backend/controllers/email-submissions.server.controller.spec.js b/tests/unit/backend/controllers/email-submissions.server.controller.spec.js
deleted file mode 100644
index 6c07a38a4c..0000000000
--- a/tests/unit/backend/controllers/email-submissions.server.controller.spec.js
+++ /dev/null
@@ -1,2824 +0,0 @@
-const { StatusCodes } = require('http-status-codes')
-const { times, omit } = require('lodash')
-const ejs = require('ejs')
-const { okAsync, errAsync } = require('neverthrow')
-const express = require('express')
-const request = require('supertest')
-const mongoose = require('mongoose')
-
-const dbHandler = require('../helpers/db-handler')
-
-const { ObjectID } = require('bson-ext')
-const MailService = require('../../../../dist/backend/app/services/mail/mail.service')
-  .default
-const EmailSubmissionsMiddleware = require('../../../../dist/backend/app/modules/submission/email-submission/email-submission.middleware')
-const User = dbHandler.makeModel('user.server.model', 'User')
-const Agency = dbHandler.makeModel('agency.server.model', 'Agency')
-const Form = dbHandler.makeModel('form.server.model', 'Form')
-const Verification = dbHandler.makeModel(
-  '../modules/verification/verification.model',
-  'Verification',
-)
-const vfnConstants = require('../../../../dist/backend/shared/util/verification')
-
-const {
-  SPCPFieldTitle,
-} = require('../../../../dist/backend/types/field/fieldTypes')
-const {
-  MailSendError,
-  MailGenerationError,
-} = require('../../../../dist/backend/app/services/mail/mail.errors')
-
-describe('Email Submissions Controller', () => {
-  // Declare global variables
-  let sendSubmissionMailSpy
-
-  // spec out controller such that calls to request are
-  // directed through a callback to the request spy,
-  // which will be destroyed and re-created for every test
-  const spcpController = spec('dist/backend/app/modules/spcp/spcp.controller', {
-    mongoose: Object.assign(mongoose, { '@noCallThru': true }),
-  })
-
-  beforeAll(async () => await dbHandler.connect())
-  afterEach(async () => await dbHandler.clearDatabase())
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  describe('notifyParties', () => {
-    const originalConsoleError = console.error
-
-    let fixtures
-
-    const endpointPath = '/send-admin-email'
-    const injectFixtures = (req, res, next) => {
-      Object.assign(req, fixtures)
-      return next()
-    }
-
-    const app = express()
-
-    // Set EJS as the template engine
-    app.engine('server.view.html', ejs.__express)
-
-    // Set views path and view engine
-    app.set('view engine', 'server.view.html')
-    app.set('views', './src/app/views')
-
-    beforeAll(() => {
-      console.error = jasmine.createSpy()
-      app
-        .route(endpointPath)
-        .get(
-          injectFixtures,
-          EmailSubmissionsMiddleware.sendAdminEmail,
-          (req, res) => res.status(200).send(),
-        )
-
-      sendSubmissionMailSpy = spyOn(MailService, 'sendSubmissionToAdmin')
-    })
-
-    afterAll(() => {
-      console.error = originalConsoleError
-    })
-
-    afterEach(() => sendSubmissionMailSpy.calls.reset())
-
-    beforeEach(() => {
-      fixtures = {
-        body: {
-          parsedResponses: [],
-        },
-        replyToEmails: [],
-        attachments: [
-          {
-            filename: 'file.txt',
-            content: Buffer.alloc(5),
-          },
-        ],
-        form: {
-          title: 'Form Title',
-          emails: ['test@test.gov.sg'],
-          responseMode: 'email',
-        },
-        formData: [
-          {
-            question: 'foo',
-            answerTemplate: ['bar'],
-          },
-        ],
-        submission: {
-          id: 1,
-          created: Date.now(),
-        },
-        dataCollationData: [
-          {
-            question: 'Reference Number',
-            answer: '123',
-          },
-          {
-            question: 'Timestamp',
-            answer: '1/2/3',
-          },
-          {
-            question: 'foo',
-            answer: 'bar',
-          },
-        ],
-      }
-    })
-
-    it('sends mail with correct parameters', (done) => {
-      // Arrange
-      sendSubmissionMailSpy.and.callFake(() => okAsync(true))
-
-      request(app)
-        .get(endpointPath)
-        .expect(StatusCodes.OK)
-        .then(() => {
-          const mailOptions = sendSubmissionMailSpy.calls.mostRecent().args[0]
-          expect(mailOptions).toEqual(omit(fixtures, 'body'))
-        })
-        .then(done)
-        .catch(done)
-    })
-
-    it('errors with 400 on send failure', (done) => {
-      // Arrange
-      sendSubmissionMailSpy.and.callFake(() => errAsync(new MailSendError()))
-      // Trigger error by deleting recipient list
-      delete fixtures.form.emails
-      request(app)
-        .get(endpointPath)
-        .expect(StatusCodes.BAD_REQUEST)
-        .then(done)
-        .catch(done)
-    })
-
-    it('errors with 400 on generation failure', (done) => {
-      // Arrange
-      sendSubmissionMailSpy.and.callFake(() =>
-        errAsync(new MailGenerationError()),
-      )
-      // Trigger error by deleting recipient list
-      delete fixtures.form.emails
-      request(app)
-        .get(endpointPath)
-        .expect(StatusCodes.BAD_REQUEST)
-        .then(done)
-        .catch(done)
-    })
-  })
-
-  describe('receiveEmailSubmissionUsingBusBoy', () => {
-    const endpointPath = '/v2/submissions/email'
-    const sendSubmissionBack = (req, res) => {
-      res.status(200).send({
-        body: req.body,
-      })
-    }
-
-    const app = express()
-
-    const injectForm = (req, res, next) => {
-      Object.assign(req, { form: { _id: 'formId' } })
-      next()
-    }
-
-    beforeAll(() => {
-      app
-        .route(endpointPath)
-        .post(
-          injectForm,
-          EmailSubmissionsMiddleware.receiveEmailSubmission,
-          sendSubmissionBack,
-        )
-    })
-
-    it('parses submissions without files', (done) => {
-      const body = { responses: [] }
-      request(app)
-        .post(endpointPath)
-        .field('body', JSON.stringify(body))
-        .expect(StatusCodes.OK)
-        .expect({ body })
-        .end(done)
-    })
-
-    it('parses submissions with files', (done) => {
-      const body = {
-        responses: [
-          {
-            _id: 'receiveId',
-            question: 'attachment question',
-            fieldType: 'attachment',
-            answer: 'govtech.jpg',
-          },
-        ],
-      }
-
-      const parsedBody = {
-        responses: [
-          {
-            _id: 'receiveId',
-            question: 'attachment question',
-            fieldType: 'attachment',
-            answer: 'govtech.jpg',
-            filename: 'govtech.jpg',
-            content: Buffer.alloc(1),
-          },
-        ],
-      }
-      request(app)
-        .post(endpointPath)
-        .field('body', JSON.stringify(body))
-        .attach('govtech.jpg', Buffer.alloc(1), 'receiveId')
-        .expect(StatusCodes.OK)
-        .expect(JSON.stringify({ body: parsedBody }))
-        .end(done)
-    })
-
-    it('changes duplicated file names', (done) => {
-      const body = {
-        responses: [
-          {
-            _id: 'attachment1',
-            question: 'question 1',
-            fieldType: 'attachment',
-            answer: 'attachment.jpg',
-          },
-          {
-            _id: 'attachment2',
-            question: 'question 2',
-            fieldType: 'attachment',
-            answer: 'attachment.jpg',
-          },
-        ],
-      }
-      const parsedBody = {
-        responses: [
-          {
-            _id: 'attachment1',
-            question: 'question 1',
-            fieldType: 'attachment',
-            answer: '1-attachment.jpg',
-            filename: '1-attachment.jpg',
-            content: Buffer.alloc(1),
-          },
-          {
-            _id: 'attachment2',
-            question: 'question 2',
-            fieldType: 'attachment',
-            answer: 'attachment.jpg',
-            filename: 'attachment.jpg',
-            content: Buffer.alloc(1),
-          },
-        ],
-      }
-
-      request(app)
-        .post(endpointPath)
-        .field('body', JSON.stringify(body))
-        .attach('attachment.jpg', Buffer.alloc(1), 'attachment1')
-        .attach('attachment.jpg', Buffer.alloc(1), 'attachment2')
-        .expect(StatusCodes.OK)
-        .expect(JSON.stringify({ body: parsedBody }))
-        .end(done)
-    })
-  })
-
-  describe('validateSubmission', () => {
-    let fixtures
-
-    beforeEach(() => {
-      fixtures = {
-        form: new Form({
-          title: 'Test Form',
-          authType: 'NIL',
-          responseMode: 'email',
-          form_fields: [],
-        }),
-        body: {
-          responses: [],
-        },
-      }
-    })
-
-    const endpointPath = '/v2/submissions/email'
-    const injectFixtures = (req, res, next) => {
-      Object.assign(req, fixtures)
-      next()
-    }
-    const sendSubmissionBack = (req, res) => {
-      res.status(200).send({
-        body: req.body,
-        attachments: req.attachments,
-      })
-    }
-
-    const app = express()
-
-    beforeAll(() => {
-      app
-        .route(endpointPath)
-        .post(
-          injectFixtures,
-          EmailSubmissionsMiddleware.validateEmailSubmission,
-          sendSubmissionBack,
-        )
-    })
-
-    it('parses submissions without files', (done) => {
-      request(app)
-        .post(endpointPath)
-        .expect(StatusCodes.OK)
-        .expect(
-          JSON.stringify({
-            body: {
-              parsedResponses: [],
-            },
-            attachments: [],
-          }),
-        )
-        .end(done)
-    })
-
-    it('parses submissions with attachments', (done) => {
-      const requiredAttachmentId = new ObjectID()
-      const optionalAttachmentId = new ObjectID()
-
-      const validAttachmentName = 'valid.pdf'
-
-      fixtures.form.form_fields.push({
-        title: 'Attachment',
-        required: true,
-        fieldType: 'attachment',
-        _id: requiredAttachmentId,
-        attachmentSize: '1',
-      })
-
-      fixtures.form.form_fields.push({
-        title: 'NotRequired',
-        required: false,
-        fieldType: 'attachment',
-        _id: optionalAttachmentId,
-        attachmentSize: '1',
-      })
-
-      fixtures.body.responses.push({
-        _id: String(requiredAttachmentId),
-        fieldType: 'attachment',
-        answer: validAttachmentName,
-        filename: validAttachmentName,
-        content: Buffer.alloc(1),
-      })
-
-      fixtures.body.responses.push({
-        _id: String(optionalAttachmentId),
-        fieldType: 'attachment',
-        answer: '',
-      })
-
-      const expectedResponses = []
-
-      expectedResponses.push({
-        _id: String(requiredAttachmentId),
-        fieldType: 'attachment',
-        answer: validAttachmentName,
-        filename: validAttachmentName,
-        content: Buffer.alloc(1),
-        isVisible: true,
-        question: 'Attachment',
-      })
-
-      expectedResponses.push({
-        _id: String(optionalAttachmentId),
-        fieldType: 'attachment',
-        answer: '',
-        isVisible: true,
-        question: 'NotRequired',
-      })
-
-      request(app)
-        .post(endpointPath)
-        .expect(StatusCodes.OK)
-        .expect(
-          JSON.stringify({
-            body: {
-              parsedResponses: expectedResponses,
-            },
-            attachments: [
-              {
-                fieldId: String(requiredAttachmentId),
-                filename: validAttachmentName,
-                content: Buffer.alloc(1),
-              },
-            ],
-          }),
-        )
-        .end(done)
-    })
-
-    it('returns 400 for attachments with invalid file exts', (done) => {
-      fixtures.body.responses.push({
-        title: 'Attachment',
-        required: true,
-        fieldType: 'attachment',
-        _id: String(new ObjectID()),
-        attachmentSize: '1',
-        content: Buffer.alloc(1),
-        filename: 'invalid.py',
-      })
-      request(app).post(endpointPath).expect(StatusCodes.BAD_REQUEST).end(done)
-    })
-
-    it('returns 400 for attachments beyond 7 million bytes', (done) => {
-      fixtures.body.responses.push({
-        title: 'Attachment',
-        required: true,
-        fieldType: 'attachment',
-        _id: String(new ObjectID()),
-        attachmentSize: '1',
-        content: Buffer.alloc(3000000),
-        filename: 'valid.jpg',
-      })
-      fixtures.body.responses.push({
-        title: 'Attachment',
-        required: true,
-        fieldType: 'attachment',
-        _id: String(new ObjectID()),
-        attachmentSize: '1',
-        content: Buffer.alloc(3000000),
-        filename: 'valid.jpg',
-      })
-      fixtures.body.responses.push({
-        title: 'Attachment',
-        required: true,
-        fieldType: 'attachment',
-        _id: String(new ObjectID()),
-        attachmentSize: '1',
-        content: Buffer.alloc(3000000),
-        filename: 'valid.jpg',
-      })
-      request(app).post(endpointPath).expect(StatusCodes.BAD_REQUEST).end(done)
-    })
-  })
-
-  describe('prepareSubmissionForEmail', () => {
-    let reqFixtures
-    let resLocalFixtures
-
-    beforeEach(() => {
-      reqFixtures = {
-        attachments: [],
-        form: new Form({
-          title: 'Test Form',
-          authType: 'NIL',
-          responseMode: 'email',
-        }),
-        body: { form_fields: [], responses: [] },
-      }
-
-      resLocalFixtures = {}
-    })
-
-    const endpointPath = '/v2/submissions/email'
-    const injectFixtures = (req, res, next) => {
-      Object.assign(req, reqFixtures)
-      if (Object.entries(resLocalFixtures).length !== 0) {
-        Object.assign(res, { locals: resLocalFixtures })
-      }
-      next()
-    }
-    const sendSubmissionBack = (req, res) => {
-      res.status(200).send({
-        formData: req.formData,
-        autoReplyData: req.autoReplyData,
-        dataCollationData: req.dataCollationData,
-        attachments: req.attachments.map((b) => {
-          b.content = b.content.toString('base64')
-          return b
-        }),
-      })
-    }
-
-    const app = express()
-
-    beforeAll(() => {
-      app
-        .route(endpointPath)
-        .get(
-          injectFixtures,
-          EmailSubmissionsMiddleware.validateEmailSubmission,
-          spcpController.appendVerifiedSPCPResponses,
-          EmailSubmissionsMiddleware.prepareEmailSubmission,
-          sendSubmissionBack,
-        )
-    })
-
-    const prepareSubmissionThenCompare = (expected, done) => {
-      request(app)
-        .get(endpointPath)
-        .expect(StatusCodes.OK)
-        .then(({ body: { formData, autoReplyData, dataCollationData } }) => {
-          expect(formData).withContext('Form Data').toEqual(expected.formData)
-          expect(autoReplyData)
-            .withContext('autoReplyData')
-            .toEqual(expected.autoReplyData)
-          expect(dataCollationData)
-            .withContext('dataCollationData')
-            .toEqual(expected.dataCollationData)
-        })
-        .then(done)
-        .catch(done)
-    }
-
-    const expectStatusCodeError = (statusCode, done) => {
-      request(app).get(endpointPath).expect(statusCode).then(done)
-    }
-    /**
-     * Mock a field
-     * @param {String} fieldId
-     * @param {String} fieldType
-     * @param {String} title
-     * @param {Object} options  other options that can be passed to a field in the field schema
-     */
-    const makeField = (fieldId, fieldType, title, options) => {
-      return { _id: new ObjectID(fieldId), fieldType, title, ...options }
-    }
-    /**
-     *  Mock a response
-     * @param {String} fieldId field id of the field that this response is meant for
-     * @param {String} fieldType field type of the field that this response is meant for
-     * @param {String} question
-     * @param {String} answer
-     * @param {Array} [answerArray] array of answers passed in for checkbox and table
-     * @param {Boolean} [isExpectedToBeVisible] this boolean is used for computing expected output, and should match isVisible injected by server to pass the test
-     */
-    const makeResponse = (
-      fieldId,
-      fieldType,
-      question,
-      answer,
-      answerArray = null,
-      isExpectedToBeVisible = true,
-    ) => {
-      let response = {
-        _id: String(fieldId),
-        fieldType,
-        question,
-        answer,
-        isExpectedToBeVisible,
-      }
-      if (answerArray) response.answerArray = answerArray
-      return response
-    }
-
-    /**
-     * Generate expected output for a table
-     * @param {Object} field
-     * @param {String} field.title
-     * @param {String} field.fieldType
-     * @param {Array} field.columns
-     * @param {Object} response
-     * @param {Array} response.answerArray
-     * @param {Boolean} response.isExpectedToBeVisible
-     */
-    const getExpectedForTable = (field, response) => {
-      const { answerArray, isExpectedToBeVisible } = response
-      const { columns, title, fieldType } = field
-      const columnTitles = columns.map(({ title }) => title)
-      const autoReplyQuestion = `${title} (${columnTitles.join(', ')})`
-      const question = `[table] ${autoReplyQuestion}`
-      let expected = {
-        autoReplyData: [],
-        formData: [],
-        dataCollationData: [],
-      }
-      for (let answer of answerArray) {
-        answer = String(answer)
-        const answerTemplate = answer.split('\n')
-        if (isExpectedToBeVisible) {
-          // Auto replies only show visible data
-          expected.autoReplyData.push({
-            question: autoReplyQuestion,
-            answerTemplate,
-          })
-        }
-        expected.dataCollationData.push({
-          question,
-          answer,
-        })
-        expected.formData.push({
-          question,
-          answerTemplate,
-          answer,
-          fieldType,
-        })
-      }
-      return expected
-    }
-
-    /**
-     *  Generate expected output
-     * @param {Array} fields
-     * @param {Array} responses
-     * @returns {Object} { autoReplyData: Array, formData: Array, dataCollationData: Array }
-     */
-    const getExpectedOutput = (fields, responses) => {
-      let expected = {
-        autoReplyData: [],
-        formData: [],
-        dataCollationData: [],
-      }
-      for (let i = 0; i < fields.length; i++) {
-        const answer = String(responses[i].answer)
-        const answerTemplate = answer.split('\n')
-        if (fields[i].fieldType === 'table') {
-          const expectedTable = getExpectedForTable(fields[i], responses[i])
-          expected.autoReplyData.push(...expectedTable.autoReplyData)
-          expected.dataCollationData.push(...expectedTable.dataCollationData)
-          expected.formData.push(...expectedTable.formData)
-        } else {
-          let question = fields[i].title
-          if (responses[i].isExpectedToBeVisible) {
-            // Auto replies only show visible data
-            expected.autoReplyData.push({
-              question,
-              answerTemplate,
-            })
-          }
-          if (fields[i].fieldType !== 'section') {
-            expected.dataCollationData.push({
-              question,
-              answer,
-            })
-          }
-          expected.formData.push({
-            question,
-            answerTemplate,
-            answer,
-            fieldType: fields[i].fieldType,
-          })
-        }
-      }
-      return expected
-    }
-
-    it('maps SingPass attributes', (done) => {
-      resLocalFixtures.uinFin = 'S1234567A'
-      reqFixtures.form.authType = 'SP'
-      const expectedFormData = [
-        {
-          question: SPCPFieldTitle.SpNric,
-          answerTemplate: [resLocalFixtures.uinFin],
-          answer: resLocalFixtures.uinFin,
-          fieldType: 'nric',
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: SPCPFieldTitle.SpNric,
-          answerTemplate: [resLocalFixtures.uinFin],
-        },
-      ]
-      const expectedDataCollationData = [
-        {
-          question: SPCPFieldTitle.SpNric,
-          answer: resLocalFixtures.uinFin,
-        },
-      ]
-      const expected = {
-        formData: expectedFormData,
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('maps CorpPass attributes', (done) => {
-      resLocalFixtures.uinFin = '123456789K'
-      resLocalFixtures.userInfo = 'S1234567A'
-      const maskedCpUid = '*****567A'
-      reqFixtures.form.authType = 'CP'
-      const expectedFormData = [
-        {
-          question: SPCPFieldTitle.CpUen,
-          answerTemplate: [resLocalFixtures.uinFin],
-          answer: resLocalFixtures.uinFin,
-          fieldType: 'textfield',
-        },
-        {
-          question: SPCPFieldTitle.CpUid,
-          answerTemplate: [resLocalFixtures.userInfo],
-          answer: resLocalFixtures.userInfo,
-          fieldType: 'nric',
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: SPCPFieldTitle.CpUen,
-          answerTemplate: [resLocalFixtures.uinFin],
-        },
-        {
-          question: SPCPFieldTitle.CpUid,
-          answerTemplate: [maskedCpUid],
-        },
-      ]
-      const expectedDataCollationData = [
-        {
-          question: SPCPFieldTitle.CpUen,
-          answer: resLocalFixtures.uinFin,
-        },
-        {
-          question: SPCPFieldTitle.CpUid,
-          answer: resLocalFixtures.userInfo,
-        },
-      ]
-      const expected = {
-        formData: expectedFormData,
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('prefixes MyInfo fields with [MyInfo]', (done) => {
-      const fieldId = new ObjectID()
-
-      const attr = 'passportnumber'
-      resLocalFixtures.hashedFields = new Set([fieldId.toHexString()])
-      const responseField = {
-        _id: String(fieldId),
-        question: 'myinfo',
-        fieldType: 'textfield',
-        isHeader: false,
-        answer: 'bar',
-        myInfo: { attr },
-      }
-      reqFixtures.body.responses.push(responseField)
-      reqFixtures.form.form_fields.push({
-        _id: fieldId,
-        title: 'myinfo',
-        fieldType: 'textfield',
-        required: true,
-        myInfo: { attr },
-      })
-      const expectedDataCollationData = [
-        {
-          question: 'myinfo',
-          answer: 'bar',
-        },
-      ]
-      const expectedFormData = [
-        {
-          question: '[MyInfo] myinfo',
-          answerTemplate: ['bar'],
-          answer: 'bar',
-          fieldType: 'textfield',
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: 'myinfo',
-          answerTemplate: ['bar'],
-        },
-      ]
-      const expected = {
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-        formData: expectedFormData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('maps text if isVisible', (done) => {
-      const fieldId = new ObjectID()
-      reqFixtures.body.responses.push({
-        _id: String(fieldId),
-        question: 'regular',
-        fieldType: 'textfield',
-        isHeader: false,
-        answer: 'foo',
-      })
-      reqFixtures.form.form_fields.push({
-        _id: fieldId,
-        title: 'regular',
-        fieldType: 'textfield',
-      })
-      const expectedAutoReplyData = [
-        {
-          question: 'regular',
-          answerTemplate: ['foo'],
-        },
-      ]
-      const expectedDataCollationData = [
-        {
-          question: 'regular',
-          answer: 'foo',
-        },
-      ]
-      const expectedFormData = [
-        {
-          question: 'regular',
-          answerTemplate: ['foo'],
-          answer: 'foo',
-          fieldType: 'textfield',
-        },
-      ]
-      const expected = {
-        formData: expectedFormData,
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('excludes field if isVisible is false for autoReplyData', (done) => {
-      const nonVisibleField = {
-        _id: new ObjectID(),
-        title: 'not visible to autoReplyData',
-        fieldType: 'textfield',
-      }
-      const yesNoField = {
-        _id: new ObjectID(),
-        title: 'Show textfield if this field is yes',
-        fieldType: 'yes_no',
-      }
-      const nonVisibleResponse = {
-        _id: String(nonVisibleField._id),
-        question: nonVisibleField.title,
-        fieldType: nonVisibleField.fieldType,
-        isHeader: false,
-        answer: '',
-      }
-      const yesNoResponse = {
-        _id: String(yesNoField._id),
-        question: yesNoField.title,
-        fieldType: yesNoField.fieldType,
-        isHeader: false,
-        answer: 'No',
-      }
-
-      reqFixtures.body.responses.push(nonVisibleResponse)
-      reqFixtures.body.responses.push(yesNoResponse)
-      reqFixtures.form.form_fields.push(nonVisibleField)
-      reqFixtures.form.form_fields.push(yesNoField)
-      reqFixtures.form.form_logics.push({
-        show: [nonVisibleField._id],
-        conditions: [
-          {
-            ifValueType: 'single-select',
-            _id: '58169',
-            field: yesNoField._id,
-            state: 'is equals to',
-            value: 'Yes',
-          },
-        ],
-        _id: '5db00a15af2ffb29487d4eb1',
-        logicType: 'showFields',
-      })
-      const expectedDataCollationData = [
-        {
-          question: nonVisibleField.title,
-          answer: nonVisibleResponse.answer,
-        },
-        {
-          question: yesNoField.title,
-          answer: yesNoResponse.answer,
-        },
-      ]
-      const expectedFormData = [
-        {
-          question: nonVisibleField.title,
-          answerTemplate: [nonVisibleResponse.answer],
-          answer: nonVisibleResponse.answer,
-          fieldType: nonVisibleField.fieldType,
-        },
-        {
-          question: yesNoField.title,
-          answerTemplate: [yesNoResponse.answer],
-          answer: yesNoResponse.answer,
-          fieldType: yesNoField.fieldType,
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: yesNoField.title,
-          answerTemplate: [yesNoResponse.answer],
-        },
-      ]
-      const expected = {
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-        formData: expectedFormData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('prefixes attachment fields with [attachment]', (done) => {
-      const validAttachmentName = 'valid.pdf'
-      const fieldId = new ObjectID()
-      reqFixtures.body.responses.push({
-        _id: String(fieldId),
-        question: 'an attachment',
-        fieldType: 'attachment',
-        isHeader: false,
-        answer: validAttachmentName,
-        filename: validAttachmentName,
-        content: Buffer.alloc(1),
-      })
-      reqFixtures.form.form_fields.push({
-        _id: fieldId,
-        title: 'an attachment',
-        fieldType: 'attachment',
-        attachmentSize: '1',
-      })
-      const expectedDataCollationData = [
-        {
-          question: '[attachment] an attachment',
-          answer: validAttachmentName,
-        },
-      ]
-      const expectedFormData = [
-        {
-          question: '[attachment] an attachment',
-          answerTemplate: [validAttachmentName],
-          answer: validAttachmentName,
-          fieldType: 'attachment',
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: 'an attachment',
-          answerTemplate: [validAttachmentName],
-        },
-      ]
-      const expected = {
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-        formData: expectedFormData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('prefixes table fields with [table]', (done) => {
-      const fieldId = new ObjectID()
-      reqFixtures.body.responses.push({
-        _id: String(fieldId),
-        question: 'a table',
-        fieldType: 'table',
-        isHeader: false,
-        answerArray: [['', '']],
-      })
-      reqFixtures.form.form_fields.push({
-        _id: fieldId,
-        title: 'a table',
-        fieldType: 'table',
-        columns: [
-          { title: 'Name', fieldType: 'textfield' },
-          { title: 'Age', fieldType: 'textfield' },
-        ],
-        minimumRows: 1,
-      })
-      const expectedDataCollationData = [
-        {
-          question: '[table] a table (Name, Age)',
-          answer: ',',
-        },
-      ]
-      const expectedFormData = [
-        {
-          question: '[table] a table (Name, Age)',
-          answerTemplate: [','],
-          answer: ',',
-          fieldType: 'table',
-        },
-      ]
-      const expectedAutoReplyData = [
-        {
-          question: 'a table (Name, Age)',
-          answerTemplate: [','],
-        },
-      ]
-      const expected = {
-        autoReplyData: expectedAutoReplyData,
-        dataCollationData: expectedDataCollationData,
-        formData: expectedFormData,
-      }
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('selects only first response for each form field', (done) => {
-      const fieldIds = times(15, () => String(new ObjectID()))
-      const responseIds = fieldIds.map((id) => String(id))
-
-      const fields = [
-        makeField(fieldIds[0], 'section', 'Title for section'),
-        makeField(fieldIds[1], 'radiobutton', 'Title for radiobutton', {
-          fieldOptions: ['rb1', 'rb2'],
-        }),
-        makeField(fieldIds[2], 'dropdown', 'Title for dropdown', {
-          fieldOptions: ['db1', 'db2'],
-        }),
-        makeField(fieldIds[3], 'email', 'Title for email', {
-          autoReplyOptions: { hasAutoReply: false },
-        }),
-        makeField(fieldIds[4], 'table', 'Title for table', {
-          minimumRows: 2,
-          addMoreRows: false,
-          maximumRows: 2,
-          columns: [
-            {
-              title: 'Some dropdown',
-              required: true,
-              _id: '5ca5d548ddafb6c289893537',
-              columnType: 'dropdown',
-              fieldOptions: ['Option 1', 'Option 2'],
-            },
-            {
-              title: 'Some textfield',
-              required: true,
-              _id: '5ca5d548ddafb6c289893538',
-              columnType: 'textfield',
-            },
-          ],
-        }),
-        makeField(fieldIds[5], 'number', 'Title for number'),
-        makeField(fieldIds[6], 'textfield', 'Title for textfield'),
-        makeField(fieldIds[7], 'textarea', 'Title for textarea'),
-        makeField(fieldIds[8], 'decimal', 'Title for decimal'),
-        makeField(fieldIds[9], 'nric', 'Title for nric'),
-        makeField(fieldIds[10], 'yes_no', 'Title for yes_no'),
-        makeField(fieldIds[11], 'mobile', 'Title for mobile'),
-        makeField(fieldIds[12], 'checkbox', 'Title for checkbox', {
-          fieldOptions: ['cb1', 'cb2', 'cb3'],
-        }),
-        makeField(fieldIds[13], 'rating', 'Title for rating', {
-          ratingOptions: { steps: 5, shape: 'Heart' },
-        }),
-        makeField(fieldIds[14], 'date', 'Title for date'),
-      ]
-      const responses = [
-        makeResponse(responseIds[0], 'section', 'Title for section', ''),
-        makeResponse(
-          responseIds[1],
-          'radiobutton',
-          'Title for radiobutton',
-          'rb1',
-        ),
-        makeResponse(responseIds[2], 'dropdown', 'Title for dropdown', 'db1'),
-        makeResponse(responseIds[3], 'email', 'Title for email', 'abc@abc.com'),
-        makeResponse(
-          responseIds[4],
-          'table',
-          'Title for table',
-          'Option 1, text 1',
-          [
-            ['Option 1', 'text 1'],
-            ['Option 1', 'text 2'],
-          ],
-        ),
-        makeResponse(responseIds[5], 'number', 'Title for number', '9000'),
-        makeResponse(
-          responseIds[6],
-          'textfield',
-          'Title for textfield',
-          'hola',
-        ),
-        makeResponse(responseIds[7], 'textarea', 'Title for textarea', 'ciao'),
-        makeResponse(responseIds[8], 'decimal', 'Title for decimal', '10.1'),
-        makeResponse(responseIds[9], 'nric', 'Title for nric', 'S9912345A'),
-        makeResponse(responseIds[10], 'yes_no', 'Title for yes_no', 'Yes'),
-        makeResponse(
-          responseIds[11],
-          'mobile',
-          'Title for mobile',
-          '+6583838383',
-        ),
-        makeResponse(
-          responseIds[12],
-          'checkbox',
-          'Title for checkbox',
-          'cb1, cb2, cb3',
-          ['cb1', 'cb2', 'cb3'],
-        ),
-        makeResponse(responseIds[13], 'rating', 'Title for rating', '5'),
-        makeResponse(responseIds[14], 'date', 'Title for date', '15 Nov 2019'),
-      ]
-
-      const extra = [
-        // Add extra responses
-        makeResponse(responseIds[0], 'section', 'Title for section', ''),
-        makeResponse(
-          responseIds[1],
-          'radiobutton',
-          'Title for radiobutton',
-          'rb2',
-        ),
-        makeResponse(responseIds[2], 'dropdown', 'Title for dropdown', 'db2'),
-        makeResponse(responseIds[3], 'email', 'Title for email', 'xyz@xyz.com'),
-        makeResponse(
-          responseIds[4],
-          'table',
-          'Title for table',
-          'Option 1, text 2',
-          [
-            ['Option 1', 'text 1'],
-            ['Option 1', 'text 2'],
-          ],
-        ),
-        makeResponse(
-          responseIds[4],
-          'table',
-          'Title for table',
-          'Option 2, text 3',
-          [
-            ['Option 1', 'text 1'],
-            ['Option 1', 'text 2'],
-            ['Option 2', 'text 3'],
-            ['Option 2', 'text 4'],
-          ],
-        ),
-        makeResponse(
-          responseIds[4],
-          'table',
-          'Title for table',
-          'Option 2, text 4',
-          [
-            ['Option 1', 'text 1'],
-            ['Option 1', 'text 2'],
-            ['Option 2', 'text 3'],
-            ['Option 2', 'text 4'],
-          ],
-        ),
-        makeResponse(responseIds[5], 'number', 'Title for number', '9999'),
-        makeResponse(
-          responseIds[6],
-          'textfield',
-          'Title for textfield',
-          'hello',
-        ),
-        makeResponse(
-          responseIds[7],
-          'textarea',
-          'Title for textarea',
-          'byebye',
-        ),
-        makeResponse(responseIds[8], 'decimal', 'Title for decimal', '202.12'),
-        makeResponse(responseIds[9], 'nric', 'Title for nric', 'S9634214D'),
-        makeResponse(responseIds[10], 'yes_no', 'Title for yes_no', 'No'),
-        makeResponse(
-          responseIds[11],
-          'mobile',
-          'Title for mobile',
-          '+6584848484',
-        ),
-        makeResponse(responseIds[12], 'checkbox', 'Title for checkbox', 'cb3', [
-          'cb3',
-        ]),
-        makeResponse(responseIds[13], 'rating', 'Title for rating', '1'),
-        makeResponse(responseIds[14], 'date', 'Title for date', '15 Dec 2019'),
-      ]
-
-      const expected = getExpectedOutput(fields, responses)
-      reqFixtures.form.form_fields = fields
-      reqFixtures.body.responses = responses.concat(extra)
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('ignores statement and image fields in submission', (done) => {
-      const fieldIds = times(4, () => new ObjectID())
-      const responseIds = fieldIds.map((id) => String(id))
-      const fields = [
-        { _id: fieldIds[0], fieldType: 'section', title: 'Welcome to my form' },
-        { _id: fieldIds[1], fieldType: 'statement', title: 'Hello there' },
-        {
-          _id: fieldIds[2],
-          fieldType: 'image',
-          title: 'Does image even have a title?',
-          url: 'http://myimage.com/image.jpg',
-        },
-        { _id: fieldIds[3], fieldType: 'number', title: 'Lottery number' },
-      ]
-      const responses = [
-        {
-          _id: responseIds[0],
-          fieldType: 'section',
-          question: 'Welcome to my form',
-          answer: '',
-        },
-        {
-          _id: responseIds[1],
-          fieldType: 'statement',
-          question: 'Hello there',
-          answer: '',
-        },
-        {
-          _id: responseIds[2],
-          fieldType: 'image',
-          question: 'Does image even have a title?',
-          answer: '',
-        },
-        {
-          _id: responseIds[3],
-          fieldType: 'number',
-          question: 'Lottery number',
-          answer: '37',
-        },
-      ]
-      let expected = {
-        autoReplyData: [],
-        formData: [],
-        dataCollationData: [],
-      }
-      for (let i = 0; i < fields.length; i++) {
-        let { fieldType, title } = fields[i]
-        let { answer } = responses[i]
-        if (!['image', 'statement'].includes(fieldType)) {
-          expected.autoReplyData.push({
-            question: title,
-            answerTemplate: String(answer).split('\n'),
-          })
-          if (fieldType !== 'section') {
-            expected.dataCollationData.push({
-              question: title,
-              answer: String(answer),
-            })
-          }
-          expected.formData.push({
-            question: title,
-            answerTemplate: String(answer).split('\n'),
-            answer,
-            fieldType,
-          })
-        }
-      }
-      reqFixtures.form.form_fields = fields
-      reqFixtures.body.responses = responses
-      prepareSubmissionThenCompare(expected, done)
-    })
-
-    it('errors with 409 when some fields are not submitted', (done) => {
-      const fields = [
-        { _id: '1', fieldType: 'section', title: 'Welcome to my form' },
-        { _id: '2', fieldType: 'number', title: 'Lottery number' },
-      ]
-      const responses = [
-        {
-          _id: '1',
-          fieldType: 'section',
-          question: 'Welcome to my form',
-          answer: '',
-        },
-      ]
-      reqFixtures.form.form_fields = fields
-      reqFixtures.body.responses = responses
-      request(app).get(endpointPath).expect(StatusCodes.CONFLICT).then(done)
-    })
-
-    describe('Logic', () => {
-      describe('Single-select value', () => {
-        const conditionField = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show text field if yes',
-        )
-        const logicField = makeField(new ObjectID(), 'textfield', 'Text field')
-        const visField = makeField(new ObjectID(), 'nric', 'Nric field')
-        const fields = [conditionField, logicField, visField]
-        const conditions = [
-          {
-            ifValueType: 'single-select',
-            _id: '58169',
-            field: conditionField._id,
-            state: 'is equals to',
-            value: 'Yes',
-          },
-        ]
-        const _id = '5db00a15af2ffb29487d4eb1'
-        const showFieldLogics = [
-          {
-            show: [logicField._id],
-            conditions,
-            _id,
-            logicType: 'showFields',
-          },
-        ]
-        const preventSubmitLogics = [
-          {
-            show: [],
-            conditions,
-            _id,
-            preventSubmitMessage: 'test',
-            logicType: 'preventSubmit',
-          },
-        ]
-        const makeSingleSelectFixtures = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              conditionFieldVal,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? 'lorem' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-            makeResponse(
-              visField._id,
-              visField.fieldType,
-              visField.title,
-              'S9912345A',
-            ), // This field is always visible
-          ]
-        }
-
-        const singleSelectSuccessTest = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeSingleSelectFixtures(
-            logics,
-            conditionFieldVal,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-
-        it('hides logic fields for single select value', (done) => {
-          // Does not fulfill condition, hence second field hidden
-          singleSelectSuccessTest(showFieldLogics, 'No', false, done)
-        })
-
-        it('shows logic fields for single select value', (done) => {
-          // Fulfills condition, hence second field shown
-          singleSelectSuccessTest(showFieldLogics, 'Yes', true, done)
-        })
-
-        it('allows submission when not prevented by single select value', (done) => {
-          // Does not fulfill condition, hence submission goes through
-          singleSelectSuccessTest(preventSubmitLogics, 'No', true, done)
-        })
-
-        it('rejects submission prevented by single select value', (done) => {
-          // Fulfills condition, hence submission rejected
-          makeSingleSelectFixtures(preventSubmitLogics, 'Yes', true)
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('Number value', () => {
-        const conditionField = makeField(
-          new ObjectID(),
-          'number',
-          'Show text field if less than 10',
-        )
-        const logicField = makeField(new ObjectID(), 'textfield', 'Text field')
-        const visField = makeField(new ObjectID(), 'nric', 'Nric field')
-        const fields = [conditionField, logicField, visField]
-        const conditions = [
-          {
-            ifValueType: 'number',
-            _id: '58169',
-            field: conditionField._id,
-            state: 'is less than or equal to',
-            value: 10,
-          },
-        ]
-        const _id = '5db00a15af2ffb29487d4eb1'
-        const showFieldLogics = [
-          {
-            show: [logicField._id],
-            conditions,
-            _id,
-            logicType: 'showFields',
-          },
-        ]
-        const preventSubmitLogics = [
-          {
-            show: [],
-            conditions,
-            _id,
-            preventSubmitMessage: 'test',
-            logicType: 'preventSubmit',
-          },
-        ]
-        const makeNumberValueFixtures = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              conditionFieldVal,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? 'lorem' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-            makeResponse(
-              visField._id,
-              visField.fieldType,
-              visField.title,
-              'S9912345A',
-            ), // This field is always visible
-          ]
-        }
-        const numberValueSuccessTest = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeNumberValueFixtures(
-            logics,
-            conditionFieldVal,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-        it('hides logic fields for number value', (done) => {
-          // Second field hidden
-          numberValueSuccessTest(showFieldLogics, '11', false, done)
-        })
-
-        it('shows logic for number value', (done) => {
-          // Second field shown
-          numberValueSuccessTest(showFieldLogics, '9', true, done)
-        })
-
-        it('accepts submission not prevented by number value', (done) => {
-          // Condition not fulfilled, form goes through
-          numberValueSuccessTest(preventSubmitLogics, '11', true, done)
-        })
-
-        it('rejects submission prevented by number value', (done) => {
-          makeNumberValueFixtures(preventSubmitLogics, '9', true)
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('Multi-select value', () => {
-        const conditionField = makeField(
-          new ObjectID(),
-          'dropdown',
-          'Show text field if value is Option 1 or Option 2',
-          {
-            fieldOptions: ['Option 1', 'Option 2', 'Option 3'],
-          },
-        )
-        const logicField = makeField(new ObjectID(), 'textfield', 'Text field')
-        const visField = makeField(new ObjectID(), 'nric', 'Nric field')
-        const fields = [conditionField, logicField, visField]
-        const conditions = [
-          {
-            ifValueType: 'multi-select',
-            _id: '58169',
-            field: conditionField._id,
-            state: 'is either',
-            value: ['Option 1', 'Option 2'],
-          },
-        ]
-        const _id = '5db00a15af2ffb29487d4eb1'
-        const showFieldLogics = [
-          {
-            show: [logicField._id],
-            conditions,
-            _id,
-            logicType: 'showFields',
-          },
-        ]
-        const preventSubmitLogics = [
-          {
-            show: [],
-            conditions,
-            _id,
-            preventSubmitMessage: 'test',
-            logicType: 'preventSubmit',
-          },
-        ]
-        const makeMultiSelectFixtures = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              conditionFieldVal,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? 'lorem' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-            makeResponse(
-              visField._id,
-              visField.fieldType,
-              visField.title,
-              'S9912345A',
-            ), // This field is always visible
-          ]
-        }
-        const multiSelectSuccessTest = (
-          logics,
-          conditionFieldVal,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeMultiSelectFixtures(
-            logics,
-            conditionFieldVal,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-
-        it('hides logic fields for multi-select value', (done) => {
-          multiSelectSuccessTest(showFieldLogics, 'Option 3', false, done)
-        })
-
-        it('shows logic for multi-select value', (done) => {
-          multiSelectSuccessTest(showFieldLogics, 'Option 1', true, done)
-        })
-
-        it('allows submission not prevented by logic', (done) => {
-          multiSelectSuccessTest(preventSubmitLogics, 'Option 3', true, done)
-        })
-
-        it('rejects submissions prevented by logic', (done) => {
-          makeMultiSelectFixtures(preventSubmitLogics, 'Option 1', true)
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('supports multiple AND conditions', () => {
-        const conditionField1 = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show text field if yes',
-        )
-        const conditionField2 = makeField(
-          new ObjectID(),
-          'dropdown',
-          'Show text field if dropdown says Textfield',
-          {
-            fieldOptions: ['Textfield', 'Radiobutton', 'Email'],
-          },
-        )
-        const logicField = makeField(new ObjectID(), 'textfield', 'Text field')
-        const fields = [conditionField1, conditionField2, logicField]
-        const conditions = [
-          {
-            ifValueType: 'single-select',
-            _id: '9577',
-            field: conditionField1._id,
-            state: 'is equals to',
-            value: 'Yes',
-          },
-          {
-            ifValueType: 'single-select',
-            _id: '45633',
-            field: conditionField2._id,
-            state: 'is equals to',
-            value: 'Textfield',
-          },
-        ]
-        const _id = '5df11ee1e6b6e7108a939c8a'
-        const showFieldLogics = [
-          {
-            show: [logicField._id],
-            conditions,
-            _id,
-            logicType: 'showFields',
-          },
-        ]
-        const preventSubmitLogics = [
-          {
-            show: [logicField._id],
-            conditions,
-            _id,
-            preventSubmitMessage: 'test',
-            logicType: 'preventSubmit',
-          },
-        ]
-        const makeMultiAndFixtures = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              conditionField1Val,
-            ),
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              conditionField2Val,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? 'lorem' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-          ]
-        }
-        const multiAndSuccessTest = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeMultiAndFixtures(
-            logics,
-            conditionField1Val,
-            conditionField2Val,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-
-        it('hides logic fields if any condition is not fulfilled', (done) => {
-          multiAndSuccessTest(
-            showFieldLogics,
-            'Yes',
-            'Radiobutton',
-            false,
-            done,
-          )
-        })
-
-        it('shows logic fields if every condition is fulfilled', (done) => {
-          multiAndSuccessTest(showFieldLogics, 'Yes', 'Textfield', true, done)
-        })
-
-        it('discards invalid logic when a condition is missing', (done) => {
-          reqFixtures.form.form_fields = [conditionField2, logicField] // Missing conditionField1
-          reqFixtures.form.form_logics = showFieldLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              'Radiobutton',
-            ), // Does not fulfill condition
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              'lorem',
-              null,
-              true,
-            ), // This field should be shown because logic has been discarded
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-
-        it('accepts submissions not prevented by logic', (done) => {
-          multiAndSuccessTest(
-            preventSubmitLogics,
-            'Yes',
-            'Radiobutton',
-            true,
-            done,
-          )
-        })
-
-        it('rejects submissions prevented by logic', (done) => {
-          makeMultiAndFixtures(preventSubmitLogics, 'Yes', 'Textfield', true)
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('supports multiple OR conditions', () => {
-        const conditionField1 = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show text field if yes',
-        )
-        const conditionField2 = makeField(
-          new ObjectID(),
-          'dropdown',
-          'Show text field if dropdown says Textfield',
-          {
-            fieldOptions: ['Textfield', 'Radiobutton', 'Email'],
-          },
-        )
-        const logicField = makeField(new ObjectID(), 'textfield', 'Text field')
-        const fields = [conditionField1, conditionField2, logicField]
-        const conditionses = [
-          [
-            {
-              ifValueType: 'single-select',
-              _id: '9577',
-              field: conditionField1._id,
-              state: 'is equals to',
-              value: 'Yes',
-            },
-          ],
-          [
-            {
-              ifValueType: 'single-select',
-              _id: '89906',
-              field: conditionField2._id,
-              state: 'is equals to',
-              value: 'Textfield',
-            },
-          ],
-        ]
-        const _ids = ['5df11ee1e6b6e7108a939c8a', '5df127a2e6b6e7108a939c90']
-        const showFieldLogics = _.zipWith(
-          conditionses,
-          _ids,
-          (conditions, _id) => {
-            return {
-              show: [logicField._id],
-              conditions,
-              _id,
-              logicType: 'showFields',
-            }
-          },
-        )
-        const preventSubmitLogics = _.zipWith(
-          conditionses,
-          _ids,
-          (conditions, _id) => {
-            return { show: [], conditions, _id, logicType: 'preventSubmit' }
-          },
-        )
-        const makeOrFixtures = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              conditionField1Val,
-            ),
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              conditionField2Val,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? 'lorem' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-          ]
-        }
-        const orSuccessTest = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeOrFixtures(
-            logics,
-            conditionField1Val,
-            conditionField2Val,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-
-        it('hides logic fields if every condition is not fulfilled', (done) => {
-          orSuccessTest(showFieldLogics, 'No', 'Radiobutton', false, done)
-        })
-
-        it('shows logic fields if any condition is fulfilled', (done) => {
-          orSuccessTest(showFieldLogics, 'Yes', 'Radiobutton', true, done)
-        })
-
-        it('accepts submission not prevented by logic', (done) => {
-          orSuccessTest(preventSubmitLogics, 'No', 'Radiobutton', true, done)
-        })
-
-        it('rejects submission prevented by logic', (done) => {
-          makeOrFixtures(preventSubmitLogics, 'Yes', 'Radiobutton', true)
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('supports multiple showable fields', () => {
-        const conditionField = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show text field if yes',
-        )
-        const logicField1 = makeField(new ObjectID(), 'textfield', 'Text field')
-        const logicField2 = makeField(
-          new ObjectID(),
-          'textarea',
-          'Long text field',
-        )
-        const fields = [conditionField, logicField1, logicField2]
-        const formLogics = [
-          {
-            show: [logicField1._id, logicField2._id],
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '58169',
-                field: conditionField._id,
-                state: 'is equals to',
-                value: 'Yes',
-              },
-            ],
-            _id: '5db00a15af2ffb29487d4eb1',
-            logicType: 'showFields',
-          },
-        ]
-        it('hides multiple logic fields when condition is not fulfilled', (done) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              'No',
-            ), // Does not fulfill condition
-            makeResponse(
-              logicField1._id,
-              logicField1.fieldType,
-              logicField1.title,
-              '',
-              null,
-              false,
-            ), // This field should be hidden
-            makeResponse(
-              logicField2._id,
-              logicField2.fieldType,
-              logicField2.title,
-              '',
-              null,
-              false,
-            ), // This field should be hidden
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-
-        it('shows multiple logic fields when condition is fulfilled', (done) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              'Yes',
-            ), // Fulfills condition
-            makeResponse(
-              logicField1._id,
-              logicField1.fieldType,
-              logicField1.title,
-              'lorem',
-              null,
-              true,
-            ), // This field should be shown
-            makeResponse(
-              logicField2._id,
-              logicField2.fieldType,
-              logicField2.title,
-              'ipsum',
-              null,
-              true,
-            ), // This field should be shown
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-
-        it('should hide unfulfilled logic field even when some of the logic fields are missing', (done) => {
-          reqFixtures.form.form_fields = [conditionField, logicField1] // Missing logicField2
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              'No',
-            ), //  Does not fulfill condition
-            makeResponse(
-              logicField1._id,
-              logicField1.fieldType,
-              logicField1.title,
-              '',
-              null,
-              false,
-            ), // This field should be hidden
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-
-        it('should show fulfilled logic field even when some of the logic fields are missing', (done) => {
-          reqFixtures.form.form_fields = [conditionField, logicField1] // Missing logicField2
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField._id,
-              conditionField.fieldType,
-              conditionField.title,
-              'Yes',
-            ), // Fulfills condition
-            makeResponse(
-              logicField1._id,
-              logicField1.fieldType,
-              logicField1.title,
-              'lorem',
-              null,
-              true,
-            ), // This field should be shown
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-      })
-
-      describe('supports chained logic', () => {
-        const conditionField1 = makeField(
-          new ObjectID(),
-          'rating',
-          'Show radio if rating is more than or equal 2',
-          {
-            ratingOptions: {
-              steps: 5,
-              shape: 'Heart',
-            },
-          },
-        )
-        const conditionField2 = makeField(
-          new ObjectID(),
-          'radiobutton',
-          'Show date if radio is others',
-          {
-            fieldOptions: ['Option 1', 'Option 2'],
-            othersRadioButton: true,
-          },
-        )
-        const logicField = makeField(new ObjectID(), 'date', 'Date field')
-        const fields = [conditionField1, conditionField2, logicField]
-        const showFieldLogics = [
-          {
-            show: [conditionField2._id],
-            _id: '5df12cf8e6b6e7108a939c99',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '57184',
-                field: conditionField1._id,
-                state: 'is more than or equal to',
-                value: 2,
-              },
-            ],
-            logicType: 'showFields',
-          },
-          {
-            show: [logicField._id],
-            _id: '5df12d0ee6b6e7108a939c9a',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '48323',
-                field: conditionField2._id,
-                state: 'is equals to',
-                value: 'Others',
-              },
-            ],
-            logicType: 'showFields',
-          },
-        ]
-        const preventSubmitLogics = [
-          {
-            show: [conditionField2._id],
-            _id: '5df12cf8e6b6e7108a939c99',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '57184',
-                field: conditionField1._id,
-                state: 'is more than or equal to',
-                value: 2,
-              },
-            ],
-            logicType: 'showFields',
-          },
-          {
-            show: [],
-            _id: '5df12d0ee6b6e7108a939c9a',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '48323',
-                field: conditionField2._id,
-                state: 'is equals to',
-                value: 'Others',
-              },
-            ],
-            logicType: 'preventSubmit',
-          },
-        ]
-        const makeChainedFixtures = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectedField2Visible,
-          expectLogicFieldVisible,
-        ) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = logics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              conditionField1Val,
-            ),
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              expectedField2Visible ? conditionField2Val : '',
-              null,
-              expectedField2Visible,
-            ),
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              expectLogicFieldVisible ? '12 Dec 2019' : '',
-              null,
-              expectLogicFieldVisible,
-            ),
-          ]
-        }
-        const chainedSuccessTest = (
-          logics,
-          conditionField1Val,
-          conditionField2Val,
-          expectedField2Visible,
-          expectLogicFieldVisible,
-          done,
-        ) => {
-          makeChainedFixtures(
-            logics,
-            conditionField1Val,
-            conditionField2Val,
-            expectedField2Visible,
-            expectLogicFieldVisible,
-          )
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        }
-        it('shows chained logic', (done) => {
-          chainedSuccessTest(
-            showFieldLogics,
-            '2',
-            'Others: peas',
-            true,
-            true,
-            done,
-          )
-        })
-
-        it('hides chained logic', (done) => {
-          chainedSuccessTest(
-            showFieldLogics,
-            '1',
-            'Others: peas',
-            false,
-            false,
-            done,
-          )
-        })
-
-        it('accepts submission not prevented by chained logic', (done) => {
-          chainedSuccessTest(
-            preventSubmitLogics,
-            '2',
-            'Option 1',
-            true,
-            true,
-            done,
-          )
-        })
-
-        it('rejects submission prevented by chained logic', (done) => {
-          makeChainedFixtures(
-            preventSubmitLogics,
-            '2',
-            'Others: peas',
-            true,
-            true,
-          )
-          expectStatusCodeError(StatusCodes.BAD_REQUEST, done)
-        })
-      })
-
-      describe('supports logic regardless of field order', () => {
-        const conditionField1 = makeField(
-          new ObjectID(),
-          'rating',
-          'Show radio if rating is more than or equal 2',
-          {
-            ratingOptions: {
-              steps: 5,
-              shape: 'Heart',
-            },
-          },
-        )
-        const conditionField2 = makeField(
-          new ObjectID(),
-          'radiobutton',
-          'Show date if radio is others',
-          {
-            fieldOptions: ['Option 1', 'Option 2'],
-            othersRadioButton: true,
-          },
-        )
-        const logicField = makeField(new ObjectID(), 'date', 'Date field')
-        const fields = [conditionField1, logicField, conditionField2]
-        const formLogics = [
-          {
-            show: [conditionField2._id],
-            _id: '5df12cf8e6b6e7108a939c99',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '57184',
-                field: conditionField1._id,
-                state: 'is more than or equal to',
-                value: 2,
-              },
-            ],
-            logicType: 'showFields',
-          },
-          {
-            show: [logicField._id],
-            _id: '5df12d0ee6b6e7108a939c9a',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '48323',
-                field: conditionField2._id,
-                state: 'is equals to',
-                value: 'Others',
-              },
-            ],
-            logicType: 'showFields',
-          },
-        ]
-        it('shows logic regardless of field order', (done) => {
-          reqFixtures.form.form_fields = fields
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              '2',
-            ), // Fulfills condition
-            makeResponse(
-              logicField._id,
-              logicField.fieldType,
-              logicField.title,
-              '12 Dec 2019',
-              null,
-              true,
-            ), // This field should be shown
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              'Others: peas',
-            ), // Fulfills condition
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-      })
-      describe('circular logic', () => {
-        const conditionField1 = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show field 2 if yes',
-        )
-        const conditionField2 = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show field 3 if yes',
-        )
-        const conditionField3 = makeField(
-          new ObjectID(),
-          'yes_no',
-          'Show field 1 if yes',
-        )
-        const visibleField = makeField(
-          new ObjectID(),
-          'textfield',
-          'Text field',
-        )
-        const formLogics = [
-          {
-            show: [conditionField2._id],
-            _id: '5df11ee1e6b6e7108a939c8a',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '9577',
-                field: conditionField1._id,
-                state: 'is equals to',
-                value: 'Yes',
-              },
-            ],
-            logicType: 'showFields',
-          },
-          {
-            show: [conditionField3._id],
-            _id: '5df11ee1e6b6e7108a939c8b',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '9577',
-                field: conditionField2._id,
-                state: 'is equals to',
-                value: 'Yes',
-              },
-            ],
-            logicType: 'showFields',
-          },
-          {
-            show: [conditionField1._id],
-            _id: '5df11ee1e6b6e7108a939c8c',
-            conditions: [
-              {
-                ifValueType: 'single-select',
-                _id: '9578',
-                field: conditionField3._id,
-                state: 'is equals to',
-                value: 'Yes',
-              },
-            ],
-            logicType: 'showFields',
-          },
-        ]
-        it('correctly parses circular logic where all fields are hidden', (done) => {
-          reqFixtures.form.form_fields = [
-            conditionField1,
-            conditionField2,
-            conditionField3,
-          ]
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-            makeResponse(
-              conditionField3._id,
-              conditionField3.fieldType,
-              conditionField3.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-        it('correctly parses circular logic for a mix of hidden and shown fields', (done) => {
-          reqFixtures.form.form_fields = [
-            conditionField1,
-            conditionField2,
-            conditionField3,
-            visibleField,
-          ]
-          reqFixtures.form.form_logics = formLogics
-          reqFixtures.body.responses = [
-            makeResponse(
-              conditionField1._id,
-              conditionField1.fieldType,
-              conditionField1.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-            makeResponse(
-              conditionField2._id,
-              conditionField2.fieldType,
-              conditionField2.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-            makeResponse(
-              conditionField3._id,
-              conditionField3.fieldType,
-              conditionField3.title,
-              '',
-              null,
-              false,
-            ), // Circular, never shown
-            makeResponse(
-              visibleField._id,
-              visibleField.fieldType,
-              visibleField.title,
-              'lorem',
-            ), // Always shown
-          ]
-          const expected = getExpectedOutput(
-            reqFixtures.form.form_fields,
-            reqFixtures.body.responses,
-          )
-          prepareSubmissionThenCompare(expected, done)
-        })
-      })
-    })
-  })
-
-  describe('Verified fields', () => {
-    let fixtures
-    let testAgency, testUser, testForm
-
-    const expireAt = new Date()
-    expireAt.setTime(
-      expireAt.getTime() + vfnConstants.TRANSACTION_EXPIRE_AFTER_SECONDS * 1000,
-    ) // Expires 4 hours later
-    const hasExpired = new Date()
-    hasExpired.setTime(
-      hasExpired.getTime() -
-        vfnConstants.TRANSACTION_EXPIRE_AFTER_SECONDS * 2000,
-    ) // Expired 2 days ago
-
-    const endpointPath = '/submissions'
-    const injectFixtures = (req, res, next) => {
-      Object.assign(req, fixtures)
-      next()
-    }
-    const sendSubmissionBack = (req, res) => {
-      res.status(200).send({
-        body: req.body,
-      })
-    }
-
-    const app = express()
-
-    const sendAndExpect = (status, expectedResponse = null) => {
-      let send = request(app).post(endpointPath).expect(status)
-      if (expectedResponse) {
-        send = send.expect(expectedResponse)
-      }
-      return send
-    }
-
-    const createTransactionForForm = (form) => {
-      return (expireAt, verifiableFields) => {
-        let t = {
-          formId: String(form._id),
-          expireAt,
-        }
-        t.fields = verifiableFields.map((field, i) => {
-          const {
-            fieldType,
-            hashCreatedAt,
-            hashedOtp,
-            signedData,
-            hashRetries,
-          } = field
-          return {
-            _id: form.form_fields[i]._id,
-            fieldType,
-            hashCreatedAt: hashCreatedAt === undefined ? null : hashCreatedAt,
-            hashedOtp: hashedOtp === undefined ? null : hashedOtp,
-            signedData: signedData === undefined ? null : signedData,
-            hashRetries: hashRetries === undefined ? 0 : hashRetries,
-          }
-        })
-        return Verification.create(t)
-      }
-    }
-
-    beforeAll((done) => {
-      app
-        .route(endpointPath)
-        .post(
-          injectFixtures,
-          EmailSubmissionsMiddleware.validateEmailSubmission,
-          sendSubmissionBack,
-        )
-      testAgency = new Agency({
-        shortName: 'govtest',
-        fullName: 'Government Testing Agency',
-        emailDomain: 'test.gov.sg',
-        logo: '/invalid-path/test.jpg',
-      })
-      testAgency
-        .save()
-        .then(() => {
-          return User.deleteMany({})
-        })
-        .then(() => {
-          testUser = new User({
-            email: 'test@test.gov.sg',
-            agency: testAgency._id,
-          })
-          return testUser.save()
-        })
-        .then(done)
-    })
-
-    // Submission
-    describe('No verified fields in form', () => {
-      beforeEach((done) => {
-        testForm = new Form({
-          title: 'Test Form',
-          emails: 'test@test.gov.sg',
-          admin: testUser._id,
-          responseMode: 'email',
-          form_fields: [{ title: 'Email', fieldType: 'email' }],
-        })
-        testForm
-          .save({ validateBeforeSave: false })
-          .then(() => {
-            fixtures = {
-              form: testForm,
-              body: {
-                responses: [],
-              },
-            }
-          })
-          .then(done)
-      })
-      it('should allow submission if transaction does not exist for forms that do not contain any fields that have to be verified', (done) => {
-        // No transaction created for testForm
-        const field = testForm.form_fields[0]
-        const response = {
-          _id: String(field._id),
-          fieldType: field.fieldType,
-          question: field.title,
-          answer: 'test@abc.com',
-        }
-        fixtures.body.responses.push(response)
-        sendAndExpect(StatusCodes.OK, {
-          body: {
-            parsedResponses: [Object.assign(response, { isVisible: true })],
-          },
-        }).end(done)
-      })
-    })
-    describe('Verified fields', () => {
-      let createTransaction
-      beforeAll((done) => {
-        testForm = new Form({
-          title: 'Test Form',
-          emails: 'test@test.gov.sg',
-          responseMode: 'email',
-          admin: testUser._id,
-          form_fields: [
-            { title: 'Email', fieldType: 'email', isVerifiable: true },
-          ],
-        })
-        testForm
-          .save({ validateBeforeSave: false })
-          .then(() => {
-            createTransaction = createTransactionForForm(testForm)
-          })
-          .then(done)
-      })
-      beforeEach(() => {
-        fixtures = {
-          form: testForm,
-          body: {
-            responses: [],
-          },
-        }
-      })
-
-      describe('No transaction', () => {
-        it('should prevent submission if transaction does not exist for a form containing fields that have to be verified', (done) => {
-          const field = testForm.form_fields[0]
-          const response = {
-            _id: String(field._id),
-            fieldType: field.fieldType,
-            question: field.title,
-            answer: 'test@abc.com',
-          }
-          fixtures.body.responses.push(response)
-
-          sendAndExpect(StatusCodes.BAD_REQUEST).end(done)
-        })
-      })
-
-      describe('Has transaction', () => {
-        it('should prevent submission if transaction has expired for a form containing fields that have to be verified', (done) => {
-          createTransaction(hasExpired, [
-            {
-              fieldType: 'email',
-              hashCreatedAt: new Date(),
-              hashedOtp: 'someHashValue',
-              signedData: 'someData',
-            },
-          ]).then(() => {
-            const field = testForm.form_fields[0]
-            const response = {
-              _id: String(field._id),
-              fieldType: field.fieldType,
-              question: field.title,
-              answer: 'test@abc.com',
-              signature: 'someData',
-            }
-            fixtures.body.responses.push(response)
-
-            sendAndExpect(StatusCodes.BAD_REQUEST).end(done)
-          })
-        })
-
-        it('should prevent submission if any of the transaction fields are not verified', (done) => {
-          createTransaction(expireAt, [
-            {
-              fieldType: 'email',
-              hashCreatedAt: null,
-              hashedOtp: null,
-              signedData: null,
-            },
-          ]).then(() => {
-            const field = testForm.form_fields[0]
-            const response = {
-              _id: String(field._id),
-              fieldType: field.fieldType,
-              question: field.title,
-              answer: 'test@abc.com',
-            }
-            fixtures.body.responses.push(response)
-
-            sendAndExpect(StatusCodes.BAD_REQUEST).end(done)
-          })
-        })
-
-        it('should allow submission if all of the transaction fields are verified', (done) => {
-          const formsg = require('@opengovsg/formsg-sdk')({
-            mode: 'test',
-            verificationOptions: {
-              secretKey: process.env.VERIFICATION_SECRET_KEY,
-            },
-          })
-          const transactionId = mongoose.Types.ObjectId(
-            '5e71ef8b19c1ed04b54cd5f9',
-          )
-
-          const field = testForm.form_fields[0]
-          const formId = testForm._id
-          let response = {
-            _id: String(field._id),
-            fieldType: field.fieldType,
-            question: field.title,
-            answer: 'test@abc.com',
-          }
-          const signature = formsg.verification.generateSignature({
-            transactionId: String(transactionId),
-            formId: String(formId),
-            fieldId: response._id,
-            answer: response.answer,
-          })
-          response.signature = signature
-
-          createTransaction(expireAt, [
-            {
-              fieldType: 'email',
-              hashCreatedAt: new Date(),
-              hashedOtp: 'someHashValue',
-              signedData: signature,
-            },
-          ]).then(() => {
-            fixtures.body.responses.push(response)
-            sendAndExpect(StatusCodes.OK).end(done)
-          })
-        })
-      })
-    })
-
-    describe('Hidden and optional fields', () => {
-      const expireAt = new Date()
-      expireAt.setTime(expireAt.getTime() + 86400)
-
-      beforeEach(() => {
-        fixtures = {
-          form: {},
-          body: {
-            responses: [],
-          },
-        }
-      })
-
-      const test = ({
-        fieldValue,
-        fieldIsRequired,
-        fieldIsHidden,
-        expectedStatus,
-        done,
-      }) => {
-        const field = {
-          _id: '5e719d5b62a2c4aa5d9789e2',
-          title: 'Email',
-          fieldType: 'email',
-          isVerifiable: true,
-          required: fieldIsRequired,
-        }
-        const yesNoField = {
-          _id: '5e719d5b62a2c4aa5d9789e3',
-          title: 'Show email if this field is yes',
-          fieldType: 'yes_no',
-        }
-        let form = new Form({
-          title: 'Test Form',
-          emails: 'test@test.gov.sg',
-          responseMode: 'email',
-          admin: testUser._id,
-          form_fields: [field, yesNoField],
-          form_logics: [
-            {
-              show: [field._id],
-              conditions: [
-                {
-                  ifValueType: 'single-select',
-                  _id: '58169',
-                  field: yesNoField._id,
-                  state: 'is equals to',
-                  value: 'Yes',
-                },
-              ],
-              _id: '5db00a15af2ffb29487d4eb1',
-              logicType: 'showFields',
-            },
-          ],
-        })
-        form.save({ validateBeforeSave: false }).then(() => {
-          const response = {
-            _id: String(field._id),
-            fieldType: field.fieldType,
-            question: field.title,
-            answer: fieldValue,
-          }
-          const yesNoResponse = {
-            _id: yesNoField._id,
-            question: yesNoField.title,
-            fieldType: yesNoField.fieldType,
-            answer: fieldIsHidden ? 'No' : 'Yes',
-          }
-          fixtures.form = form
-          fixtures.body.responses.push(yesNoResponse)
-          fixtures.body.responses.push(response)
-          sendAndExpect(expectedStatus).end(done)
-        })
-      }
-      it('should verify fields that are optional and filled in', (done) => {
-        test({
-          fieldValue: 'test@abc.com',
-          fieldIsRequired: false,
-          fieldIsHidden: false,
-          expectedStatus: StatusCodes.BAD_REQUEST,
-          done,
-        })
-      })
-      it('should not verify fields that are optional and not filled in', (done) => {
-        test({
-          fieldValue: '',
-          fieldIsRequired: false,
-          fieldIsHidden: false,
-          expectedStatus: StatusCodes.OK,
-          done,
-        })
-      })
-      it('should verify fields that are required and not hidden by logic', (done) => {
-        test({
-          fieldValue: 'test@abc.com',
-          fieldIsRequired: true,
-          fieldIsHidden: false,
-          expectedStatus: StatusCodes.BAD_REQUEST,
-          done,
-        })
-      })
-
-      it('should not verify fields that are required and hidden by logic', (done) => {
-        test({
-          fieldValue: '',
-          fieldIsRequired: true,
-          fieldIsHidden: true,
-          expectedStatus: StatusCodes.OK,
-          done,
-        })
-      })
-    })
-  })
-})

From fa9d4bb85ecb62fa51b7d2210f65fc069fa5e5cf Mon Sep 17 00:00:00 2001
From: seaerchin <44049504+seaerchin@users.noreply.github.com>
Date: Thu, 8 Apr 2021 15:57:51 +0800
Subject: [PATCH 28/75] refactor: update getPublicForm endpoint to typescript
 (#1398)

* refactor(modules/spcp): shifts get spcp session out into service

* refactor(modules/form): adds utility methods and refactored checkFormSubmission

* refactor(modules/form): refactors GET public forms end point from js to ts

* refactor(utils): adds utility type for all possible db errors

* fix(types/form): fixed the type of submissionLimit to allow for null

* refactor(modules/form): updated deactiveForm so that it uses never throw and adds logging

* refactor(modules/form): updated form limit checking to account for submission limit being null

* refactor(modules/form): adds logging to getSpcpSession

* refactor(modules/form): refactored handleGetPublicForm for clarity and code cleanliness

* refactor(publicformctrl): refactored handler for GET public forms to be cleaner and easier to read

* refactor(spcpsvc): added logging to extract JWT; updated typings for getSpcpSession

* revert(formsvc): removes retrievePublicForm (will be done in another PR) to limit scope

* style(public-form/controller): updated object to use variables

* style(services/types): updated documentation for functions and removed unneeded logging

* refactor(public-form/controller): refactored spcp flow so it's clearer

* refactor(public-form/controller): wip for myInfo

* refactor(myinfo): extracts myInfoCookiePayload to 2 types and adds utility function to differentiate

* refactor(public-form/controller): refactored myinfo chunk so it's neater

* test(form/service): fixes failing tests due to checkFormSubmissionLimitAndDeactivateForm

* refactor(myinfo): removed unneeded cookie type and updated extractSuccessfulCookie to reflect this

* docs(public-form/controller): adds docs to confusing sections of handlGetPublicForm

* test(public-form/controller/test): add test for database error when GET /getPublicForm

* test(public-form/controller/tests): add more tests

* test(public-form/controller/test): adds test for success cases

* refactor(myinfo): extracts out chunks form public-form controller into myinfo service

* refactor(public-form/controller): updated controller to use MyInfoFactory method

* test(public-form/controller/test): updated tests to use mocks

* fix(public-form/controller): fixed succesful  200 when auth using myInfo returning a private view

* test(public-form/controller/test): adds remaining tests for myInfo

* refactor(spcp): combined controller calls to spcp services into a single spcp call

* refactor(myinfo): refactored multiple controller calls to myInfo into a single call

* refactor(public-form): updated typings and refactored getPublicForm to be cleaner

* style(public-form/controller/test): updated comments in tests to use when

* refactor(form/service): updated deactiveForm to return the form itself; updated tests

* style(myinfo): extractMyInfoData renamed to fetchMyInfoData

* fix(public-form/controller): fixed bug where wrong extract cookie method is being called

* refactor(spcp/myinfo): removed extra logging in spcp; updated names in myinfo

* test(spcp/service/test): adds service tests

* test(spcp/service/test): adds unit tests for createFormWithSpcpSession

* test(myinfo.service): adds tests for createFormWithMyInfo

* feat(form): adds new errors and utility methods

* refactor(public-form): refactor to account for intarnet

* refactor(public-form/controller): added compatability for checking intranet access

* test(public-form/controller): adds tests for checking intranet; fixes old tests due to this addition

* style(spcp/service/test): changed naming to camelCase for variables

* fix(form.service): fixed intranet ip checking

* refactor(public-form): shifts utility method out into public form service

* test(public-form/controller): updates tests

* refactor(public-forms/server/routes): swaps to new controller for express middleware

* fix(myinfo/util): added cookie access check

* fix(form/service): adds error recovery for missing feature error when checking intranet access

* refactor(public-form/controller): tightened logic for myinfo error

* build(package.json): added ts-essential for UnreachableCaseException

* refactor(forms): added new type for intranet form

* refactor(spcp/service): updated service methods

* refactor(intranet/factory): updated isIntranetIp and factory signature typings

* refactor(myinfo): updated typings and factory methods to remove responsibility from service

* refactor(public-form/controller): wip

* refactor(form/service): remove result wrapping as only error is MissingFeatureError

* refactor(myinfo): updated typings and comments for myInfo

* refactor(publicform): updated handleGetPublicForm method and removed unused types

* refactor(public-form/service): removed unnused method

* fix(public-form/controller): changed returned form to be a publicForm

* test(myinfo/service): updated tests for myinfo service

* test(public-form/controller): updated tests to fit iwth refactor

* chore(intranet): removed unused variables

* test(intranet/service): fixes failing tests due to refactor

* refactor(app/utils): removed duplicate datatype in handle mongo errors

* style(form/service): updated logger message

* test(spcp/service): removed tests for deleted method; updated test for getSpcpSession

* refactor(public-form/controller): extracts logger meta property into a variable

* style(form/service): updated action property of logger meta

* docs(public-form/controller): updated comments for getPublicForm on conditions for  myInfoError

* refactor(myinfo): deleted unused middleware; made fetchMyInfoPersonData private

* refactor(myinfo): changed fetchMyInfoPersonData to become a private field

* test(myinfo): fixed factory and service tests due to making myInfoPersonData private

* chore(webhook/service/test): fixed import

* chore(types/forms): removed unused type declaration

* style(form/service): chains calls together for clarity

* refactor(myinfo): refactored methods so that atomic operations are performed together

* test(myinfo): fixes tests for myinfo

* style(spcp): renamed service methods for clarity; removed unused error

* test(spcp): fixes spcp tests

* refactor(public-form): updated controller to account for myinfo/spcp refactoring

* test(public-form): updated tests

* fix(public-form/controller): fixed cp returning userInfo as ewll
---
 package-lock.json                             |   6 +
 package.json                                  |   1 +
 .../form/__tests__/form.service.spec.ts       |   8 +-
 src/app/modules/form/form.service.ts          | 118 ++-
 .../__tests__/public-form.controller.spec.ts  | 754 +++++++++++++++++-
 .../public-form/public-form.controller.ts     | 162 +++-
 .../form/public-form/public-form.routes.ts    |  27 +
 .../form/public-form/public-form.types.ts     |  18 +
 .../myinfo/__tests__/myinfo.factory.spec.ts   |  30 +-
 .../myinfo/__tests__/myinfo.service.spec.ts   | 180 +++--
 .../myinfo/__tests__/myinfo.test.constants.ts |  29 +-
 src/app/modules/myinfo/myinfo.errors.ts       |   9 +
 src/app/modules/myinfo/myinfo.factory.ts      |  42 +-
 src/app/modules/myinfo/myinfo.middleware.ts   | 101 ---
 src/app/modules/myinfo/myinfo.service.ts      | 170 ++--
 src/app/modules/myinfo/myinfo.types.ts        |  16 +-
 src/app/modules/myinfo/myinfo.util.ts         |  49 ++
 .../spcp/__tests__/spcp.service.spec.ts       | 180 ++++-
 .../spcp/__tests__/spcp.test.constants.ts     |  13 +
 src/app/modules/spcp/spcp.factory.ts          |   2 +
 src/app/modules/spcp/spcp.service.ts          |  26 +-
 src/app/routes/public-forms.server.routes.js  |  12 +-
 .../__tests__/intranet.service.spec.ts        |   4 +-
 src/app/services/intranet/intranet.factory.ts |   9 +-
 src/app/services/intranet/intranet.service.ts |   6 +-
 src/app/utils/handle-mongo-error.ts           |  21 +-
 src/types/form.ts                             |   6 +-
 27 files changed, 1674 insertions(+), 325 deletions(-)
 create mode 100644 src/app/modules/form/public-form/public-form.routes.ts
 delete mode 100644 src/app/modules/myinfo/myinfo.middleware.ts

diff --git a/package-lock.json b/package-lock.json
index 6ac8a54707..f2b03dc5c7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23921,6 +23921,12 @@
         "utf8-byte-length": "^1.0.1"
       }
     },
+    "ts-essentials": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/ts-essentials/-/ts-essentials-7.0.1.tgz",
+      "integrity": "sha512-8lwh3QJtIc1UWhkQtr9XuksXu3O0YQdEE5g79guDfhCaU1FWTDIEDZ1ZSx4HTHUmlJZ8L812j3BZQ4a0aOUkSA==",
+      "dev": true
+    },
     "ts-jest": {
       "version": "26.5.4",
       "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-26.5.4.tgz",
diff --git a/package.json b/package.json
index d60b176cdd..79ae4eb9c8 100644
--- a/package.json
+++ b/package.json
@@ -247,6 +247,7 @@
     "supertest-session": "^4.1.0",
     "terser-webpack-plugin": "^1.2.3",
     "testcafe": "^1.14.0",
+    "ts-essentials": "^7.0.1",
     "ts-jest": "^26.5.4",
     "ts-loader": "^7.0.5",
     "ts-mock-imports": "^1.3.3",
diff --git a/src/app/modules/form/__tests__/form.service.spec.ts b/src/app/modules/form/__tests__/form.service.spec.ts
index f4668bf567..20be4ce147 100644
--- a/src/app/modules/form/__tests__/form.service.spec.ts
+++ b/src/app/modules/form/__tests__/form.service.spec.ts
@@ -242,10 +242,10 @@ describe('FormService', () => {
       )
 
       // Assert
-      expect(actual._unsafeUnwrap()).toEqual(true)
+      expect(actual._unsafeUnwrap()).toEqual(form)
     })
 
-    it('should let requests through when form has not reached submission limit', async () => {
+    it('should return the form when the submission limit is not reached', async () => {
       // Arrange
       const formParams = merge({}, MOCK_ENCRYPTED_FORM_PARAMS, {
         status: Status.Public,
@@ -268,11 +268,11 @@ describe('FormService', () => {
 
       // Act
       const actual = await FormService.checkFormSubmissionLimitAndDeactivateForm(
-        form,
+        form as IPopulatedForm,
       )
 
       // Assert
-      expect(actual._unsafeUnwrap()).toEqual(true)
+      expect(actual._unsafeUnwrap()).toEqual(validForm)
     })
 
     it('should not let requests through and deactivate form when form has reached submission limit', async () => {
diff --git a/src/app/modules/form/form.service.ts b/src/app/modules/form/form.service.ts
index f4ddf91ed1..5ff5e62333 100644
--- a/src/app/modules/form/form.service.ts
+++ b/src/app/modules/form/form.service.ts
@@ -3,6 +3,7 @@ import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
 import { createLoggerWithLabel } from '../../../config/logger'
 import {
+  AuthType,
   IEmailFormModel,
   IEncryptedFormModel,
   IFormSchema,
@@ -15,6 +16,7 @@ import getFormModel, {
   getEncryptedFormModel,
 } from '../../models/form.server.model'
 import getSubmissionModel from '../../models/submission.server.model'
+import { IntranetFactory } from '../../services/intranet/intranet.factory'
 import {
   getMongoErrorMessage,
   transformMongoError,
@@ -37,10 +39,42 @@ const EmailFormModel = getEmailFormModel(mongoose)
 const EncryptedFormModel = getEncryptedFormModel(mongoose)
 const SubmissionModel = getSubmissionModel(mongoose)
 
-export const deactivateForm = async (
+/**
+ * Deactivates a given form by its id
+ * @param formId the id of the form to deactivate
+ * @returns ok(true) if the form has been deactivated successfully
+ * @returns err(PossibleDatabaseError) if an error occurred while trying to deactivate the form
+ * @returns err(FormNotFoundError) if there is no form with the given formId
+ */
+export const deactivateForm = (
   formId: string,
-): Promise<IFormSchema | null> => {
-  return FormModel.deactivateById(formId)
+): ResultAsync<IFormSchema, PossibleDatabaseError | FormNotFoundError> => {
+  return ResultAsync.fromPromise(FormModel.deactivateById(formId), (error) => {
+    logger.error({
+      message: 'Error deactivating form by id',
+      meta: {
+        action: 'deactivateForm',
+        form: formId,
+      },
+      error,
+    })
+
+    return transformMongoError(error)
+  }).andThen((deactivatedForm) => {
+    if (!deactivatedForm) {
+      logger.error({
+        message:
+          'Attempted to deactivate form that cannot be found in the database',
+        meta: {
+          action: 'deactivateForm',
+          form: formId,
+        },
+      })
+      return errAsync(new FormNotFoundError())
+    }
+    // Successfully deactivated.
+    return okAsync(deactivatedForm)
+  })
 }
 
 /**
@@ -118,9 +152,9 @@ export const retrieveFormById = (
  * Method to ensure given form is available to the public.
  * @param form the form to check
  * @returns ok(true) if form is public
+ * @returns err(ApplicationError) if form has an invalid state
  * @returns err(FormDeletedError) if form has been deleted
  * @returns err(PrivateFormError) if form is private, the message will be the form inactive message
- * @returns err(ApplicationError) if form has an invalid state
  */
 export const isFormPublic = (
   form: IPopulatedForm,
@@ -128,7 +162,6 @@ export const isFormPublic = (
   if (!form.status) {
     return err(new ApplicationError())
   }
-
   switch (form.status) {
     case Status.Public:
       return ok(true)
@@ -142,20 +175,30 @@ export const isFormPublic = (
 /**
  * Method to check whether a form has reached submission limits, and deactivate the form if necessary
  * @param form the form to check
- * @returns ok(true) if submission is allowed because the form has not reached limits
- * @returns ok(false) if submission is not allowed because the form has reached limits
+ * @returns ok(form) if submission is allowed because the form has not reached limits
+ * @returns err(PossibleDatabaseError) if an error occurred while querying the database for the specified form
+ * @returns err(FormNotFoundError) if the form has exceeded the submission limits but could not be found and deactivated
+ * @returns err(PrivateFormError) if the count of the form has been exceeded and the form has been deactivated
  */
 export const checkFormSubmissionLimitAndDeactivateForm = (
   form: IPopulatedForm,
-): ResultAsync<true, PrivateFormError | PossibleDatabaseError> => {
+): ResultAsync<
+  IPopulatedForm,
+  PossibleDatabaseError | PrivateFormError | FormNotFoundError
+> => {
   const logMeta = {
     action: 'checkFormSubmissionLimitAndDeactivateForm',
     formId: form._id,
   }
-  if (form.submissionLimit === null) return okAsync(true)
+  const { submissionLimit } = form
+  const formId = String(form._id)
+  // Not using falsey check as submissionLimit === 0 can result in incorrectly
+  // returning form without any actions.
+  if (submissionLimit === null) return okAsync(form)
+
   return ResultAsync.fromPromise(
     SubmissionModel.countDocuments({
-      form: form._id,
+      form: formId,
     }).exec(),
     (error) => {
       logger.error({
@@ -165,21 +208,18 @@ export const checkFormSubmissionLimitAndDeactivateForm = (
       })
       return transformMongoError(error)
     },
-  ).andThen((count) => {
-    if (count < form.submissionLimit) return okAsync(true)
+  ).andThen((currentCount) => {
+    // Limit has not been hit yet, passthrough.
+    if (currentCount < submissionLimit) return okAsync(form)
+
     logger.info({
       message: 'Form reached maximum submission count, deactivating.',
       meta: logMeta,
     })
-    return ResultAsync.fromPromise(deactivateForm(form._id), (error) => {
-      logger.error({
-        message: 'Error while deactivating form',
-        meta: logMeta,
-        error,
-      })
-      return transformMongoError(error)
-    }).andThen(() =>
-      // Always return err because submission limit was exceeded
+
+    // Map success case back into error to display to client as form has been
+    // deactivated.
+    return deactivateForm(formId).andThen(() =>
       errAsync(
         new PrivateFormError(
           'Submission made after form submission limit was reached',
@@ -200,3 +240,39 @@ export const getFormModelByResponseMode = (
       return EncryptedFormModel
   }
 }
+
+/**
+ * Checks if a form is accessed from within intranet and sets the property accordingly
+ * @param ip The ip of the request
+ * @param publicFormView The form to check
+ * @returns ok(PublicFormView) if the form is accessed from the internet
+ * @returns err(ApplicationError) if an error occured while checking if the ip of the request is from the intranet
+ */
+export const checkIsIntranetFormAccess = (
+  ip: string,
+  form: IPopulatedForm,
+): boolean => {
+  return (
+    IntranetFactory.isIntranetIp(ip)
+      .andThen((isIntranetUser) => {
+        // Warn if form is being accessed from within intranet
+        // and the form has authentication set
+        if (
+          isIntranetUser &&
+          [AuthType.SP, AuthType.CP, AuthType.MyInfo].includes(form.authType)
+        ) {
+          logger.warn({
+            message:
+              'Attempting to access SingPass, CorpPass or MyInfo form from intranet',
+            meta: {
+              action: 'checkIsIntranetFormAccess',
+              formId: form._id,
+            },
+          })
+        }
+        return ok(isIntranetUser)
+      })
+      // This is required becausing the factory can throw missing feature error on initialization
+      .unwrapOr(false)
+  )
+}
diff --git a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
index cc3cf172fc..e18cce6cdd 100644
--- a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
+++ b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
@@ -1,3 +1,4 @@
+import { IPersonResponse } from '@opengovsg/myinfo-gov-client'
 import { ObjectId } from 'bson-ext'
 import { merge } from 'lodash'
 import mongoose from 'mongoose'
@@ -6,11 +7,35 @@ import querystring from 'querystring'
 import { mocked } from 'ts-jest/utils'
 
 import getFormFeedbackModel from 'src/app/models/form_feedback.server.model'
-import { DatabaseError } from 'src/app/modules/core/core.errors'
-import { IPopulatedForm } from 'src/types'
+import {
+  DatabaseError,
+  MissingFeatureError,
+} from 'src/app/modules/core/core.errors'
+import { MyInfoData } from 'src/app/modules/myinfo/myinfo.adapter'
+import {
+  MyInfoAuthTypeError,
+  MyInfoCookieAccessError,
+  MyInfoMissingAccessTokenError,
+  MyInfoNoESrvcIdError,
+} from 'src/app/modules/myinfo/myinfo.errors'
+import { MyInfoCookieState } from 'src/app/modules/myinfo/myinfo.types'
+import { JwtPayload } from 'src/app/modules/spcp/spcp.types'
+import { FeatureNames } from 'src/config/feature-manager/types'
+import {
+  AuthType,
+  IPopulatedForm,
+  IPopulatedUser,
+  MyInfoAttribute,
+  PublicForm,
+} from 'src/types'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
+import * as AuthService from '../../../auth/auth.service'
+import { MyInfoCookieStateError } from '../../../myinfo/myinfo.errors'
+import { MyInfoFactory } from '../../../myinfo/myinfo.factory'
+import { MissingJwtError } from '../../../spcp/spcp.errors'
+import { SpcpFactory } from '../../../spcp/spcp.factory'
 import {
   FormDeletedError,
   FormNotFoundError,
@@ -21,10 +46,17 @@ import * as PublicFormController from '../public-form.controller'
 import * as PublicFormService from '../public-form.service'
 import { Metatags } from '../public-form.types'
 
-jest.mock('../../form.service')
 jest.mock('../public-form.service')
+jest.mock('../../form.service')
+jest.mock('../../../auth/auth.service')
+jest.mock('../../../spcp/spcp.factory')
+jest.mock('../../../myinfo/myinfo.factory')
+
 const MockFormService = mocked(FormService)
 const MockPublicFormService = mocked(PublicFormService)
+const MockAuthService = mocked(AuthService)
+const MockSpcpFactory = mocked(SpcpFactory, true)
+const MockMyInfoFactory = mocked(MyInfoFactory, true)
 
 const FormFeedbackModel = getFormFeedbackModel(mongoose)
 
@@ -185,7 +217,7 @@ describe('public-form.controller', () => {
       expect(mockRes.json).toHaveBeenCalledWith({ message: 'Gone' })
     })
 
-    it('should return 500 when databse errors occur', async () => {
+    it('should return 500 when database errors occur', async () => {
       // Arrange
       const mockRes = expressHandler.mockResponse()
       const mockErrorString = 'Form feedback could not be created'
@@ -389,4 +421,718 @@ describe('public-form.controller', () => {
       expect(mockRes.redirect).toHaveBeenCalledWith(expectedRedirectPath)
     })
   })
+
+  describe('handleGetPublicForm', () => {
+    const MOCK_FORM_ID = new ObjectId().toHexString()
+    const MOCK_USER_ID = new ObjectId().toHexString()
+    const MOCK_USER = {
+      _id: MOCK_USER_ID,
+      email: 'randomrandomtest@example.com',
+    } as IPopulatedUser
+
+    const MOCK_SCRUBBED_FORM = ({
+      _id: MOCK_FORM_ID,
+      title: 'mock title',
+      admin: { _id: MOCK_USER_ID },
+    } as unknown) as PublicForm
+
+    const BASE_FORM = {
+      admin: MOCK_USER,
+      _id: MOCK_FORM_ID,
+      title: MOCK_SCRUBBED_FORM.title,
+      getUniqueMyInfoAttrs: jest.fn().mockReturnValue([MyInfoAttribute.Name]),
+      getPublicView: jest.fn().mockReturnValue(MOCK_SCRUBBED_FORM),
+    }
+
+    const MOCK_REQ = expressHandler.mockRequest({
+      params: {
+        formId: MOCK_FORM_ID,
+      },
+    })
+
+    const MOCK_MYINFO_COOKIE = {
+      accessToken: 'cookie',
+      usedCount: 0,
+      state: MyInfoCookieState.Success,
+    }
+
+    let mockReqWithCookies: ReturnType<typeof expressHandler.mockRequest>
+
+    beforeEach(() => {
+      mockReqWithCookies = expressHandler.mockRequest({
+        params: {
+          formId: MOCK_FORM_ID,
+        },
+        others: { cookies: { MyInfoCookie: MOCK_MYINFO_COOKIE } },
+      })
+    })
+
+    // Success
+    describe('valid form id', () => {
+      const MOCK_JWT_PAYLOAD: JwtPayload = {
+        userName: 'mock',
+        rememberMe: false,
+      }
+
+      beforeAll(() => {
+        MockFormService.checkIsIntranetFormAccess.mockReturnValue(false)
+      })
+
+      it('should return 200 when there is no AuthType on the request', async () => {
+        // Arrange
+        const MOCK_NIL_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.NIL,
+        } as unknown) as IPopulatedForm
+        const mockRes = expressHandler.mockResponse()
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_NIL_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_NIL_AUTH_FORM),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_NIL_AUTH_FORM.getPublicView(),
+          isIntranetUser: false,
+        })
+      })
+
+      it('should return 200 when client authenticates using SP', async () => {
+        // Arrange
+        const MOCK_SPCP_SESSION = { userName: MOCK_JWT_PAYLOAD.userName }
+        const MOCK_SP_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.SP,
+        } as unknown) as IPopulatedForm
+        const mockRes = expressHandler.mockResponse()
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_SP_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_SP_AUTH_FORM),
+        )
+        MockSpcpFactory.extractJwtPayloadFromRequest.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_SESSION),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_SP_AUTH_FORM.getPublicView(),
+          isIntranetUser: false,
+          spcpSession: MOCK_SPCP_SESSION,
+        })
+      })
+
+      it('should return 200 when client authenticates using CP', async () => {
+        // Arrange
+        const MOCK_SPCP_SESSION = { userName: MOCK_JWT_PAYLOAD.userName }
+        const MOCK_CP_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.CP,
+        } as unknown) as IPopulatedForm
+        const mockRes = expressHandler.mockResponse()
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_CP_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_CP_AUTH_FORM),
+        )
+        MockSpcpFactory.extractJwtPayloadFromRequest.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_SESSION),
+        )
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_CP_AUTH_FORM.getPublicView(),
+          isIntranetUser: false,
+          spcpSession: MOCK_SPCP_SESSION,
+        })
+      })
+
+      it('should return 200 when client authenticates using MyInfo', async () => {
+        // Arrange
+        const MOCK_MYINFO_AUTH_FORM = ({
+          ...BASE_FORM,
+          esrvcId: 'thing',
+          authType: AuthType.MyInfo,
+          toJSON: jest.fn().mockReturnValue(BASE_FORM),
+        } as unknown) as IPopulatedForm
+        const MOCK_MYINFO_DATA = new MyInfoData({
+          uinFin: 'i am a fish',
+        } as IPersonResponse)
+        const MOCK_SPCP_SESSION = { userName: MOCK_MYINFO_DATA.getUinFin() }
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+          cookie: jest.fn().mockReturnThis(),
+        })
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_AUTH_FORM),
+        )
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_DATA),
+        )
+        MockMyInfoFactory.prefillAndSaveMyInfoFields.mockReturnValueOnce(
+          okAsync([]),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).not.toHaveBeenCalled()
+        expect(mockRes.cookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: { ...MOCK_MYINFO_AUTH_FORM.getPublicView(), form_fields: [] },
+          spcpSession: MOCK_SPCP_SESSION,
+          isIntranetUser: false,
+        })
+      })
+    })
+
+    // Errors
+    describe('errors in myInfo', () => {
+      const MOCK_MYINFO_FORM = ({
+        ...BASE_FORM,
+        toJSON: jest.fn().mockReturnThis(),
+        authType: AuthType.MyInfo,
+      } as unknown) as IPopulatedForm
+
+      // Setup because this gets invoked at the start of the controller to decide which branch to take
+      beforeAll(() => {
+        MockAuthService.getFormIfPublic.mockReturnValue(
+          okAsync(MOCK_MYINFO_FORM),
+        )
+
+        MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(false)
+
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValue(
+          okAsync(MOCK_MYINFO_FORM),
+        )
+      })
+
+      it('should return 200 but the response should have cookies cleared with myInfoError set to undefined when the request has no cookie', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(new MyInfoMissingAccessTokenError()),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: undefined,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared with myInfoError set to undefined when the cookie has been used before', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(new MyInfoCookieAccessError()),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: undefined,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared and myInfoError when the cookie cannot be validated', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(new MyInfoCookieStateError()),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: true,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared and myInfoError if the form cannot be validated', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(new MyInfoAuthTypeError()),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          myInfoError: true,
+          isIntranetUser: false,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared and myInfoError when the form has no eservcId', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(new MyInfoNoESrvcIdError()),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: true,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared and myInfoError when the form could not be filled', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          errAsync(
+            new MissingFeatureError(
+              'testing is the missing feature' as FeatureNames,
+            ),
+          ),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: true,
+        })
+      })
+
+      it('should return 200 but the response should have cookies cleared and myInfoError if a database error occurs while saving hashes', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const MOCK_MYINFO_DATA = new MyInfoData({
+          uinFin: 'i am a fish',
+        } as IPersonResponse)
+        const expected = new DatabaseError('fish error')
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+        })
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_DATA),
+        )
+        MockMyInfoFactory.prefillAndSaveMyInfoFields.mockReturnValueOnce(
+          errAsync(expected),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_MYINFO_FORM.getPublicView(),
+          isIntranetUser: false,
+          myInfoError: true,
+        })
+      })
+    })
+
+    describe('errors in spcp', () => {
+      const MOCK_SPCP_FORM = ({
+        ...BASE_FORM,
+        authType: AuthType.SP,
+      } as unknown) as IPopulatedForm
+      it('should return 200 with the form but without a spcpSession when the JWT token could not be found', async () => {
+        // Arrange
+        // 1. Mock the response and calls
+        const mockRes = expressHandler.mockResponse()
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_FORM),
+        )
+        MockSpcpFactory.extractJwtPayloadFromRequest.mockReturnValueOnce(
+          errAsync(new MissingJwtError()),
+        )
+
+        // Act
+        // 2. GET the endpoint
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        // Status should be 200
+        // json object should only have form property
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_SPCP_FORM.getPublicView(),
+          isIntranetUser: false,
+        })
+      })
+    })
+
+    describe('errors in form retrieval', () => {
+      const MOCK_ERROR_STRING = 'mockingbird'
+
+      it('should return 500 when a database error occurs', async () => {
+        // Arrange
+        // 1. Mock the response
+        const mockRes = expressHandler.mockResponse()
+
+        // 2. Mock the call to retrieve the form
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          errAsync(new DatabaseError(MOCK_ERROR_STRING)),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        // 1. Check args of mocked services
+        expect(MockAuthService.getFormIfPublic).toHaveBeenCalledWith(
+          MOCK_FORM_ID,
+        )
+        // 2. Check that error is correct
+        expect(
+          MockFormService.checkFormSubmissionLimitAndDeactivateForm,
+        ).not.toHaveBeenCalled()
+        expect(mockRes.status).toHaveBeenCalledWith(500)
+        expect(mockRes.json).toHaveBeenCalledWith({
+          message: MOCK_ERROR_STRING,
+        })
+      })
+
+      it('should return 404 when the form is not found', async () => {
+        // Arrange
+        // 1. Mock the response
+        const mockRes = expressHandler.mockResponse()
+        const MOCK_ERROR_STRING = 'Your form was eaten up by a monster'
+
+        // 2. Mock the call to retrieve the form
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          errAsync(new FormNotFoundError(MOCK_ERROR_STRING)),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        // 1. Check args of mocked services
+        expect(MockAuthService.getFormIfPublic).toHaveBeenCalledWith(
+          MOCK_FORM_ID,
+        )
+        // 2. Check that error is correct
+        expect(
+          MockFormService.checkFormSubmissionLimitAndDeactivateForm,
+        ).not.toHaveBeenCalled()
+        expect(mockRes.status).toHaveBeenCalledWith(404)
+        expect(mockRes.json).toHaveBeenCalledWith({
+          message: MOCK_ERROR_STRING,
+        })
+      })
+
+      it('should return 404 when the form is private and not accessible by the public', async () => {
+        // Arrange
+        // 1. Mock the response
+        const mockRes = expressHandler.mockResponse()
+
+        // 2. Mock the call to retrieve the form
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          errAsync(new PrivateFormError(MOCK_ERROR_STRING, 'private form')),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        // 1. Check args of mocked services
+        expect(MockAuthService.getFormIfPublic).toHaveBeenCalledWith(
+          MOCK_FORM_ID,
+        )
+        // 2. Check that error is correct
+        expect(
+          MockFormService.checkFormSubmissionLimitAndDeactivateForm,
+        ).not.toHaveBeenCalled()
+        expect(mockRes.status).toHaveBeenCalledWith(404)
+        expect(mockRes.json).toHaveBeenCalledWith({
+          message: MOCK_ERROR_STRING,
+        })
+      })
+    })
+
+    describe('errors in form access', () => {
+      const MOCK_SPCP_SESSION = {
+        userName: 'mock',
+      }
+
+      it('should return 200 with isIntranetUser set to false when a user accesses a form from outside intranet', async () => {
+        // Arrange
+        const MOCK_NIL_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.NIL,
+        } as unknown) as IPopulatedForm
+        const mockRes = expressHandler.mockResponse()
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_NIL_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_NIL_AUTH_FORM),
+        )
+        MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(false)
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_NIL_AUTH_FORM.getPublicView(),
+          isIntranetUser: false,
+        })
+      })
+
+      it('should return 200 with isIntranetUser set to true when a intranet user accesses an AuthType.SP form', async () => {
+        // Arrange
+        const MOCK_SP_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.SP,
+        } as unknown) as IPopulatedForm
+
+        const mockRes = expressHandler.mockResponse()
+
+        MockSpcpFactory.extractJwtPayloadFromRequest.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_SESSION),
+        )
+        MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(true)
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_SP_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_SP_AUTH_FORM),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_SP_AUTH_FORM.getPublicView(),
+          spcpSession: MOCK_SPCP_SESSION,
+          isIntranetUser: true,
+        })
+      })
+
+      it('should return 200 with isIntranetUser set to true when a intranet user accesses an AuthType.CP form', async () => {
+        // Arrange
+        const MOCK_CP_AUTH_FORM = ({
+          ...BASE_FORM,
+          authType: AuthType.CP,
+        } as unknown) as IPopulatedForm
+
+        const mockRes = expressHandler.mockResponse()
+
+        MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(true)
+        MockSpcpFactory.extractJwtPayloadFromRequest.mockReturnValueOnce(
+          okAsync(MOCK_SPCP_SESSION),
+        )
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_CP_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_CP_AUTH_FORM),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          MOCK_REQ,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: MOCK_CP_AUTH_FORM.getPublicView(),
+          spcpSession: MOCK_SPCP_SESSION,
+          isIntranetUser: true,
+        })
+      })
+
+      it('should return 200 with isIntranetUser set to true when a intranet user accesses an AuthType.MyInfo form', async () => {
+        // Arrange
+        const MOCK_MYINFO_AUTH_FORM = ({
+          ...BASE_FORM,
+          esrvcId: 'thing',
+          authType: AuthType.MyInfo,
+          toJSON: jest.fn().mockReturnValue(BASE_FORM),
+        } as unknown) as IPopulatedForm
+        const mockRes = expressHandler.mockResponse({
+          clearCookie: jest.fn().mockReturnThis(),
+          cookie: jest.fn().mockReturnThis(),
+        })
+
+        const MOCK_MYINFO_DATA = new MyInfoData({
+          uinFin: 'i am a fish',
+        } as IPersonResponse)
+
+        MockAuthService.getFormIfPublic.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_AUTH_FORM),
+        )
+        MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_AUTH_FORM),
+        )
+        MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(true)
+        MockMyInfoFactory.getMyInfoDataForForm.mockReturnValueOnce(
+          okAsync(MOCK_MYINFO_DATA),
+        )
+        MockMyInfoFactory.prefillAndSaveMyInfoFields.mockReturnValueOnce(
+          okAsync([]),
+        )
+
+        // Act
+        await PublicFormController.handleGetPublicForm(
+          mockReqWithCookies,
+          mockRes,
+          jest.fn(),
+        )
+
+        // Assert
+        expect(mockRes.clearCookie).not.toHaveBeenCalled()
+        expect(mockRes.cookie).toHaveBeenCalled()
+        expect(mockRes.json).toHaveBeenCalledWith({
+          form: { ...MOCK_MYINFO_AUTH_FORM.getPublicView(), form_fields: [] },
+          spcpSession: { userName: MOCK_MYINFO_DATA.getUinFin() },
+          isIntranetUser: true,
+        })
+      })
+    })
+  })
 })
diff --git a/src/app/modules/form/public-form/public-form.controller.ts b/src/app/modules/form/public-form/public-form.controller.ts
index 474058a54c..90034261da 100644
--- a/src/app/modules/form/public-form/public-form.controller.ts
+++ b/src/app/modules/form/public-form/public-form.controller.ts
@@ -1,14 +1,31 @@
 import { RequestHandler } from 'express'
 import { StatusCodes } from 'http-status-codes'
 import querystring from 'querystring'
+import { UnreachableCaseError } from 'ts-essentials'
 
 import { createLoggerWithLabel } from '../../../../config/logger'
-import { createReqMeta } from '../../../utils/request'
+import { AuthType } from '../../../../types'
+import { ErrorDto } from '../../../../types/api'
+import { isMongoError } from '../../../utils/handle-mongo-error'
+import { createReqMeta, getRequestIp } from '../../../utils/request'
+import { getFormIfPublic } from '../../auth/auth.service'
+import {
+  MYINFO_COOKIE_NAME,
+  MYINFO_COOKIE_OPTIONS,
+} from '../../myinfo/myinfo.constants'
+import {
+  MyInfoCookieAccessError,
+  MyInfoMissingAccessTokenError,
+} from '../../myinfo/myinfo.errors'
+import { MyInfoFactory } from '../../myinfo/myinfo.factory'
+import { extractAndAssertMyInfoCookieValidity } from '../../myinfo/myinfo.util'
+import { InvalidJwtError, VerifyJwtError } from '../../spcp/spcp.errors'
+import { SpcpFactory } from '../../spcp/spcp.factory'
 import { PrivateFormError } from '../form.errors'
 import * as FormService from '../form.service'
 
 import * as PublicFormService from './public-form.service'
-import { RedirectParams } from './public-form.types'
+import { PublicFormViewDto, RedirectParams } from './public-form.types'
 import { mapRouteError } from './public-form.utils'
 
 const logger = createLoggerWithLabel(module)
@@ -161,3 +178,144 @@ export const handleRedirect: RequestHandler<
     redirectPath,
   })
 }
+
+/**
+ * Handler for GET /:formId/publicform endpoint
+ * @returns 200 if the form exists
+ * @returns 404 if form with formId does not exist or is private
+ * @returns 410 if form has been archived
+ * @returns 500 if database error occurs or if the type of error is unknown
+ */
+export const handleGetPublicForm: RequestHandler<
+  { formId: string },
+  PublicFormViewDto | ErrorDto
+> = async (req, res) => {
+  const { formId } = req.params
+  const logMeta = {
+    action: 'handleGetPublicForm',
+    ...createReqMeta(req),
+    formId,
+  }
+
+  const formResult = await getFormIfPublic(formId).andThen((form) =>
+    FormService.checkFormSubmissionLimitAndDeactivateForm(form),
+  )
+
+  // Early return if form is not public or any error occurred.
+  if (formResult.isErr()) {
+    const { error } = formResult
+    // NOTE: Only log on possible database errors.
+    // This is because the other kinds of errors are expected errors and are not truly exceptional
+    if (isMongoError(error)) {
+      logger.error({
+        message: 'Error retrieving public form',
+        meta: logMeta,
+        error,
+      })
+    }
+    const { errorMessage, statusCode } = mapRouteError(error)
+    return res.status(statusCode).json({ message: errorMessage })
+  }
+
+  const form = formResult.value
+  const publicForm = form.getPublicView()
+  const { authType } = form
+  const isIntranetUser = FormService.checkIsIntranetFormAccess(
+    getRequestIp(req),
+    form,
+  )
+
+  switch (authType) {
+    case AuthType.NIL:
+      return res.json({ form: publicForm, isIntranetUser })
+    case AuthType.SP:
+    case AuthType.CP:
+      return SpcpFactory.extractJwtPayloadFromRequest(authType, req.cookies)
+        .map(({ userName }) =>
+          res.json({
+            form: publicForm,
+            isIntranetUser,
+            spcpSession: { userName },
+          }),
+        )
+        .mapErr((error) => {
+          // Report only relevant errors - verification failed for user here
+          if (
+            error instanceof VerifyJwtError ||
+            error instanceof InvalidJwtError
+          ) {
+            logger.error({
+              message: 'Error getting public form',
+              meta: logMeta,
+              error,
+            })
+          }
+          return res.json({ form: publicForm, isIntranetUser })
+        })
+    case AuthType.MyInfo: {
+      // Step 1. Fetch required data and fill the form based off data retrieved
+      return (
+        MyInfoFactory.getMyInfoDataForForm(form, req.cookies)
+          .andThen((myInfoData) => {
+            return MyInfoFactory.prefillAndSaveMyInfoFields(
+              form._id,
+              myInfoData,
+              form.toJSON().form_fields,
+            ).map((prefilledFields) => ({
+              prefilledFields,
+              spcpSession: { userName: myInfoData.getUinFin() },
+            }))
+          })
+          // Check if the user is signed in
+          .andThen(({ prefilledFields, spcpSession }) => {
+            return extractAndAssertMyInfoCookieValidity(req.cookies).map(
+              (myInfoCookie) => ({
+                prefilledFields,
+                spcpSession,
+                myInfoCookie,
+              }),
+            )
+          })
+          .map(({ myInfoCookie, prefilledFields, spcpSession }) => {
+            const updatedMyInfoCookie = {
+              ...myInfoCookie,
+              usedCount: myInfoCookie.usedCount + 1,
+            }
+            // Set the updated cookie accordingly and return the form back to the user
+            return res
+              .cookie(
+                MYINFO_COOKIE_NAME,
+                updatedMyInfoCookie,
+                MYINFO_COOKIE_OPTIONS,
+              )
+              .json({
+                spcpSession,
+                form: { ...publicForm, form_fields: prefilledFields },
+                isIntranetUser,
+              })
+          })
+          .mapErr((error) => {
+            // NOTE: If the user is not signed in or if the user refreshes the page while logged in, it is not an error.
+            // myInfoError is set to true only when the authentication provider rejects the user's attempt at auth
+            // or when there is a network or database error during the process of retrieval
+            const isMyInfoError = !(
+              error instanceof MyInfoCookieAccessError ||
+              error instanceof MyInfoMissingAccessTokenError
+            )
+            // No need for cookie if data could not be retrieved
+            // NOTE: If the user does not have any cookie, clearing the cookie still has the same result
+            return res
+              .clearCookie(MYINFO_COOKIE_NAME, MYINFO_COOKIE_OPTIONS)
+              .json({
+                form: publicForm,
+                // Setting to undefined ensures that the frontend does not get myInfoError if it is false
+                myInfoError: isMyInfoError || undefined,
+                isIntranetUser,
+              })
+          })
+      )
+    }
+    default:
+      return new UnreachableCaseError(authType)
+  }
+}
diff --git a/src/app/modules/form/public-form/public-form.routes.ts b/src/app/modules/form/public-form/public-form.routes.ts
new file mode 100644
index 0000000000..0d4fd71cc0
--- /dev/null
+++ b/src/app/modules/form/public-form/public-form.routes.ts
@@ -0,0 +1,27 @@
+import { Router } from 'express'
+
+import * as PublicFormController from './public-form.controller'
+
+export const PublicFormRouter = Router()
+
+/**
+ * Returns the specified form to the user, along with any
+ * identity information obtained from SingPass/CorpPass,
+ * and MyInfo details, if any.
+ *
+ * WARNING: TemperatureSG batch jobs rely on this endpoint to
+ * retrieve the master list of personnel for daily reporting.
+ * Please strictly ensure backwards compatibility.
+ *
+ * @route GET /{formId}/publicform
+ * @group forms - endpoints to serve forms
+ * @param {string} formId.path.required - the form id
+ * @consumes application/json
+ * @produces application/json
+ * @returns {string} 404 - form is not made public
+ * @returns {PublicForm.model} 200 - the form, and other information
+ */
+PublicFormRouter.get(
+  '/:formId([a-fA-F0-9]{24})/publicform',
+  PublicFormController.handleGetPublicForm,
+)
diff --git a/src/app/modules/form/public-form/public-form.types.ts b/src/app/modules/form/public-form/public-form.types.ts
index 543318873c..6f970f46f6 100644
--- a/src/app/modules/form/public-form/public-form.types.ts
+++ b/src/app/modules/form/public-form/public-form.types.ts
@@ -1,5 +1,10 @@
 import { ParamsDictionary } from 'express-serve-static-core'
 
+import { IFieldSchema, PublicForm } from 'src/types'
+
+import { SpcpSession } from '../../../../types/spcp'
+import { IPossiblyPrefilledField } from '../../myinfo/myinfo.types'
+
 export type Metatags = {
   title: string
   description?: string
@@ -13,3 +18,16 @@ export type RedirectParams = ParamsDictionary & {
   // TODO(#144): Rename Id to formId after all routes have been updated.
   Id: string
 }
+
+// NOTE: This is needed because PublicForm inherits from IFormDocument (where form_fields has type of IFieldSchema).
+// However, the form returned back to the client has form_field of two possible types
+interface PossiblyPrefilledPublicForm extends Omit<PublicForm, 'form_fields'> {
+  form_fields: IPossiblyPrefilledField[] | IFieldSchema[]
+}
+
+export type PublicFormViewDto = {
+  form: PossiblyPrefilledPublicForm
+  spcpSession?: SpcpSession
+  isIntranetUser?: boolean
+  myInfoError?: true
+}
diff --git a/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts b/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
index 4812b81efc..932d5200ca 100644
--- a/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
@@ -2,7 +2,7 @@ import { mocked } from 'ts-jest/utils'
 
 import config from 'src/config/config'
 import { ISpcpMyInfo } from 'src/config/feature-manager'
-import { Environment } from 'src/types'
+import { Environment, IPopulatedForm } from 'src/types'
 
 import { MyInfoData } from '../myinfo.adapter'
 import { createMyInfoFactory } from '../myinfo.factory'
@@ -45,12 +45,12 @@ describe('myinfo.factory', () => {
     )
     const parseMyInfoRelayStateResult = MyInfoFactory.parseMyInfoRelayState('')
     const extractUinFinResult = MyInfoFactory.extractUinFin('')
-    const fetchMyInfoPersonDataResult = await MyInfoFactory.fetchMyInfoPersonData(
-      '',
-      [],
-      '',
+    const getMyInfoDataForFormResult = await MyInfoFactory.getMyInfoDataForForm(
+      ({} as unknown) as IPopulatedForm,
+      {},
     )
-    const prefillMyInfoFieldsResult = MyInfoFactory.prefillMyInfoFields(
+    const prefillAndSaveMyInfoFieldsResult = await MyInfoFactory.prefillAndSaveMyInfoFields(
+      '',
       {} as MyInfoData,
       [],
     )
@@ -71,8 +71,8 @@ describe('myinfo.factory', () => {
     expect(parseMyInfoRelayStateResult._unsafeUnwrapErr()).toEqual(error)
     expect(createRedirectURLResult._unsafeUnwrapErr()).toEqual(error)
     expect(extractUinFinResult._unsafeUnwrapErr()).toEqual(error)
-    expect(fetchMyInfoPersonDataResult._unsafeUnwrapErr()).toEqual(error)
-    expect(prefillMyInfoFieldsResult._unsafeUnwrapErr()).toEqual(error)
+    expect(getMyInfoDataForFormResult._unsafeUnwrapErr()).toEqual(error)
+    expect(prefillAndSaveMyInfoFieldsResult._unsafeUnwrapErr()).toEqual(error)
     expect(saveMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
     expect(fetchMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
     expect(checkMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
@@ -94,12 +94,12 @@ describe('myinfo.factory', () => {
     )
     const parseMyInfoRelayStateResult = MyInfoFactory.parseMyInfoRelayState('')
     const extractUinFinResult = MyInfoFactory.extractUinFin('')
-    const fetchMyInfoPersonDataResult = await MyInfoFactory.fetchMyInfoPersonData(
-      '',
-      [],
-      '',
+    const getMyInfoDataForFormResult = await MyInfoFactory.getMyInfoDataForForm(
+      ({} as unknown) as IPopulatedForm,
+      {},
     )
-    const prefillMyInfoFieldsResult = MyInfoFactory.prefillMyInfoFields(
+    const prefillAndSaveMyInfoFieldsResult = await MyInfoFactory.prefillAndSaveMyInfoFields(
+      '',
       {} as MyInfoData,
       [],
     )
@@ -120,8 +120,8 @@ describe('myinfo.factory', () => {
     expect(parseMyInfoRelayStateResult._unsafeUnwrapErr()).toEqual(error)
     expect(createRedirectURLResult._unsafeUnwrapErr()).toEqual(error)
     expect(extractUinFinResult._unsafeUnwrapErr()).toEqual(error)
-    expect(fetchMyInfoPersonDataResult._unsafeUnwrapErr()).toEqual(error)
-    expect(prefillMyInfoFieldsResult._unsafeUnwrapErr()).toEqual(error)
+    expect(getMyInfoDataForFormResult._unsafeUnwrapErr()).toEqual(error)
+    expect(prefillAndSaveMyInfoFieldsResult._unsafeUnwrapErr()).toEqual(error)
     expect(saveMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
     expect(fetchMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
     expect(checkMyInfoHashesResult._unsafeUnwrapErr()).toEqual(error)
diff --git a/src/app/modules/myinfo/__tests__/myinfo.service.spec.ts b/src/app/modules/myinfo/__tests__/myinfo.service.spec.ts
index b433e47025..418ec67bac 100644
--- a/src/app/modules/myinfo/__tests__/myinfo.service.spec.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo.service.spec.ts
@@ -1,4 +1,5 @@
 import bcrypt from 'bcrypt'
+import { ObjectId } from 'bson-ext'
 import mongoose from 'mongoose'
 import { mocked } from 'ts-jest/utils'
 import { v4 as uuidv4 } from 'uuid'
@@ -10,17 +11,20 @@ import {
   IFieldSchema,
   IHashes,
   IMyInfoHashSchema,
+  IPopulatedForm,
   MyInfoAttribute,
 } from 'src/types'
 
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
+import { DatabaseError } from '../../core/core.errors'
 import { MyInfoData } from '../myinfo.adapter'
 import { MYINFO_CONSENT_PAGE_PURPOSE } from '../myinfo.constants'
 import {
   MyInfoCircuitBreakerError,
   MyInfoFetchError,
   MyInfoInvalidAccessTokenError,
+  MyInfoMissingAccessTokenError,
   MyInfoParseRelayStateError,
 } from '../myinfo.errors'
 import { IPossiblyPrefilledField, MyInfoRelayState } from '../myinfo.types'
@@ -35,11 +39,13 @@ import {
   MOCK_HASHED_FIELD_IDS,
   MOCK_HASHES,
   MOCK_MYINFO_DATA,
+  MOCK_MYINFO_FORM,
   MOCK_POPULATED_FORM_FIELDS,
   MOCK_REDIRECT_URL,
   MOCK_REQUESTED_ATTRS,
   MOCK_RESPONSES,
   MOCK_SERVICE_PARAMS,
+  MOCK_SUCCESSFUL_COOKIE,
   MOCK_UINFIN,
 } from './myinfo.test.constants'
 
@@ -183,75 +189,14 @@ describe('MyInfoService', () => {
     })
   })
 
-  describe('fetchMyInfoPersonData', () => {
-    beforeEach(() => {
-      myInfoService = new MyInfoService(MOCK_SERVICE_PARAMS)
-    })
-
-    it('should call MyInfoGovClient.getPerson with the correct parameters', async () => {
-      const mockReturnedParams = {
-        uinFin: MOCK_UINFIN,
-        data: MOCK_MYINFO_DATA,
-      }
-      mockGetPerson.mockResolvedValueOnce(mockReturnedParams)
-      const result = await myInfoService.fetchMyInfoPersonData(
-        MOCK_ACCESS_TOKEN,
-        MOCK_REQUESTED_ATTRS,
-        MOCK_ESRVC_ID,
-      )
-
-      expect(mockGetPerson).toHaveBeenCalledWith(
-        MOCK_ACCESS_TOKEN,
-        MOCK_REQUESTED_ATTRS.concat('uinfin' as MyInfoAttribute),
-        MOCK_ESRVC_ID,
-      )
-      expect(result._unsafeUnwrap()).toEqual(new MyInfoData(mockReturnedParams))
-    })
-
-    it('should throw MyInfoFetchError when getPerson fails once', async () => {
-      mockGetPerson.mockRejectedValueOnce(new Error())
-      const result = await myInfoService.fetchMyInfoPersonData(
-        MOCK_ACCESS_TOKEN,
-        MOCK_REQUESTED_ATTRS,
-        MOCK_ESRVC_ID,
-      )
-
-      expect(mockGetPerson).toHaveBeenCalledWith(
-        MOCK_ACCESS_TOKEN,
-        MOCK_REQUESTED_ATTRS.concat('uinfin' as MyInfoAttribute),
-        MOCK_ESRVC_ID,
-      )
-      expect(result._unsafeUnwrapErr()).toEqual(new MyInfoFetchError())
-    })
-
-    it('should throw MyInfoCircuitBreakerError when getPerson fails 5 times', async () => {
-      mockGetPerson.mockRejectedValue(new Error())
-      for (let i = 0; i < 5; i++) {
-        await myInfoService.fetchMyInfoPersonData(
-          MOCK_ACCESS_TOKEN,
-          MOCK_REQUESTED_ATTRS,
-          MOCK_ESRVC_ID,
-        )
-      }
-      const result = await myInfoService.fetchMyInfoPersonData(
-        MOCK_ACCESS_TOKEN,
-        MOCK_REQUESTED_ATTRS,
-        MOCK_ESRVC_ID,
-      )
-
-      // Last function call doesn't count as breaker is open, so expect 5 calls
-      expect(mockGetPerson).toHaveBeenCalledTimes(5)
-      expect(result._unsafeUnwrapErr()).toEqual(new MyInfoCircuitBreakerError())
-    })
-  })
-
-  describe('prefillMyInfoFields', () => {
-    it('should prefill fields correctly', () => {
+  describe('prefillAndSaveMyInfoFields', () => {
+    it('should prefill fields correctly', async () => {
       const mockData = new MyInfoData({
         data: MOCK_MYINFO_DATA,
         uinFin: MOCK_UINFIN,
       })
-      const result = myInfoService.prefillMyInfoFields(
+      const result = await myInfoService.prefillAndSaveMyInfoFields(
+        new ObjectId().toHexString(),
         mockData,
         MOCK_FORM_FIELDS as IFieldSchema[],
       )
@@ -313,7 +258,7 @@ describe('MyInfoService', () => {
         MOCK_POPULATED_FORM_FIELDS as IPossiblyPrefilledField[],
       )
       expect(result._unsafeUnwrapErr()).toEqual(
-        new Error('Failed to save MyInfo hashes to database'),
+        new DatabaseError('Failed to save MyInfo hashes to database'),
       )
     })
   })
@@ -435,4 +380,107 @@ describe('MyInfoService', () => {
       )
     })
   })
+
+  describe('getMyInfoDataForForm', () => {
+    // NOTE: Mocks the underlying circuit breaker implementation to avoid network calls
+    beforeEach(() => {
+      myInfoService = new MyInfoService(MOCK_SERVICE_PARAMS)
+    })
+
+    it('should return myInfo data when the provided form and cookie is valid', async () => {
+      // Arrange
+      const mockReturnedParams = {
+        uinFin: MOCK_UINFIN,
+        data: MOCK_MYINFO_DATA,
+      }
+
+      mockGetPerson.mockResolvedValueOnce(mockReturnedParams)
+
+      // Act
+      const result = await myInfoService.getMyInfoDataForForm(
+        MOCK_MYINFO_FORM as IPopulatedForm,
+        { MyInfoCookie: MOCK_SUCCESSFUL_COOKIE },
+      )
+
+      // Assert
+      expect(result._unsafeUnwrap()).toEqual(new MyInfoData(mockReturnedParams))
+    })
+
+    it('should call MyInfoGovClient.getPerson with the correct parameters', async () => {
+      // Arrange
+      const mockReturnedParams = {
+        uinFin: MOCK_UINFIN,
+        data: MOCK_MYINFO_DATA,
+      }
+      mockGetPerson.mockResolvedValueOnce(mockReturnedParams)
+
+      // Act
+      const result = await myInfoService.getMyInfoDataForForm(
+        MOCK_MYINFO_FORM as IPopulatedForm,
+        { MyInfoCookie: MOCK_SUCCESSFUL_COOKIE },
+      )
+
+      // Assert
+      expect(mockGetPerson).toHaveBeenCalledWith(
+        MOCK_ACCESS_TOKEN,
+        MOCK_REQUESTED_ATTRS.concat('uinfin' as MyInfoAttribute),
+        MOCK_ESRVC_ID,
+      )
+      expect(result._unsafeUnwrap()).toEqual(new MyInfoData(mockReturnedParams))
+    })
+
+    it('should throw MyInfoFetchError when getPerson fails once', async () => {
+      // Arrange
+      mockGetPerson.mockRejectedValueOnce(new Error())
+
+      // Act
+      const result = await myInfoService.getMyInfoDataForForm(
+        MOCK_MYINFO_FORM as IPopulatedForm,
+        { MyInfoCookie: MOCK_SUCCESSFUL_COOKIE },
+      )
+
+      // Assert
+      expect(mockGetPerson).toHaveBeenCalledWith(
+        MOCK_ACCESS_TOKEN,
+        MOCK_REQUESTED_ATTRS.concat('uinfin' as MyInfoAttribute),
+        MOCK_ESRVC_ID,
+      )
+      expect(result._unsafeUnwrapErr()).toEqual(new MyInfoFetchError())
+    })
+
+    it('should throw MyInfoCircuitBreakerError when getPerson fails 5 times', async () => {
+      // Arrange
+      mockGetPerson.mockRejectedValue(new Error())
+      for (let i = 0; i < 5; i++) {
+        await myInfoService.getMyInfoDataForForm(
+          MOCK_MYINFO_FORM as IPopulatedForm,
+          { MyInfoCookie: MOCK_SUCCESSFUL_COOKIE },
+        )
+      }
+
+      // Act
+      const result = await myInfoService.getMyInfoDataForForm(
+        MOCK_MYINFO_FORM as IPopulatedForm,
+        { MyInfoCookie: MOCK_SUCCESSFUL_COOKIE },
+      )
+
+      // Assert
+      // Last function call doesn't count as breaker is open, so expect 5 calls
+      expect(mockGetPerson).toHaveBeenCalledTimes(5)
+      expect(result._unsafeUnwrapErr()).toEqual(new MyInfoCircuitBreakerError())
+    })
+    it('should not validate the form if the cookie does not exist', async () => {
+      // Arrange
+      const expected = new MyInfoMissingAccessTokenError()
+
+      // Act
+      const result = await myInfoService.getMyInfoDataForForm(
+        MOCK_MYINFO_FORM as IPopulatedForm,
+        {},
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+  })
 })
diff --git a/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts b/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
index 3ac62d4c4b..033b77af50 100644
--- a/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
@@ -5,12 +5,16 @@ import {
   MyInfoSource,
 } from '@opengovsg/myinfo-gov-client'
 import { ObjectId } from 'bson'
-import { merge, zipWith } from 'lodash'
+import { merge, omit, zipWith } from 'lodash'
 
 import { ISpcpMyInfo } from 'src/config/feature-manager'
-import { Environment, IFormSchema, MyInfoAttribute } from 'src/types'
+import { AuthType, Environment, IFormSchema, MyInfoAttribute } from 'src/types'
 
-import { IMyInfoServiceConfig } from '../myinfo.types'
+import {
+  IMyInfoServiceConfig,
+  MyInfoCookieState,
+  MyInfoSuccessfulCookiePayload,
+} from '../myinfo.types'
 
 export const MOCK_MYINFO_DATA = {
   name: {
@@ -144,6 +148,23 @@ export const MOCK_SERVICE_PARAMS: IMyInfoServiceConfig = {
 export const MOCK_MYINFO_FORM = ({
   _id: MOCK_FORM_ID,
   esrvcId: MOCK_ESRVC_ID,
-  authType: 'MyInfo',
+  authType: AuthType.MyInfo,
+  admin: {
+    _id: new ObjectId().toHexString(),
+    agency: new ObjectId().toHexString(),
+  },
   getUniqueMyInfoAttrs: () => MOCK_REQUESTED_ATTRS,
+  getPublicView: function () {
+    return omit(this, 'admin')
+  },
+  toJSON: function () {
+    return this
+  },
+  form_fields: [],
 } as unknown) as IFormSchema
+
+export const MOCK_SUCCESSFUL_COOKIE: MyInfoSuccessfulCookiePayload = {
+  accessToken: MOCK_ACCESS_TOKEN,
+  usedCount: 0,
+  state: MyInfoCookieState.Success,
+}
diff --git a/src/app/modules/myinfo/myinfo.errors.ts b/src/app/modules/myinfo/myinfo.errors.ts
index 29f25c8c04..f149653498 100644
--- a/src/app/modules/myinfo/myinfo.errors.ts
+++ b/src/app/modules/myinfo/myinfo.errors.ts
@@ -103,3 +103,12 @@ export class MyInfoCookieStateError extends ApplicationError {
     super(message)
   }
 }
+
+/**
+ * MyInfo cookie has been used more than once
+ */
+export class MyInfoCookieAccessError extends ApplicationError {
+  constructor(message = 'MyInfo cookie has already been used') {
+    super(message)
+  }
+}
diff --git a/src/app/modules/myinfo/myinfo.factory.ts b/src/app/modules/myinfo/myinfo.factory.ts
index 9327f04d5f..d7f51b04b6 100644
--- a/src/app/modules/myinfo/myinfo.factory.ts
+++ b/src/app/modules/myinfo/myinfo.factory.ts
@@ -10,19 +10,24 @@ import {
   IFieldSchema,
   IHashes,
   IMyInfoHashSchema,
-  MyInfoAttribute,
+  IPopulatedForm,
 } from '../../../types'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { ProcessedFieldResponse } from '../submission/submission.types'
 
 import { MyInfoData } from './myinfo.adapter'
 import {
+  MyInfoAuthTypeError,
   MyInfoCircuitBreakerError,
+  MyInfoCookieAccessError,
+  MyInfoCookieStateError,
   MyInfoFetchError,
   MyInfoHashDidNotMatchError,
   MyInfoHashingError,
   MyInfoInvalidAccessTokenError,
+  MyInfoMissingAccessTokenError,
   MyInfoMissingHashError,
+  MyInfoNoESrvcIdError,
   MyInfoParseRelayStateError,
 } from './myinfo.errors'
 import { MyInfoService } from './myinfo.service'
@@ -39,24 +44,20 @@ interface IMyInfoFactory {
   retrieveAccessToken: (
     authCode: string,
   ) => ResultAsync<string, MyInfoCircuitBreakerError | MyInfoFetchError>
-  fetchMyInfoPersonData: (
-    accessToken: string,
-    requestedAttributes: MyInfoAttribute[],
-    singpassEserviceId: string,
-  ) => ResultAsync<
-    MyInfoData,
-    MyInfoCircuitBreakerError | MyInfoFetchError | MissingFeatureError
-  >
   parseMyInfoRelayState: (
     relayState: string,
   ) => Result<
     MyInfoParsedRelayState,
     MyInfoParseRelayStateError | MissingFeatureError
   >
-  prefillMyInfoFields: (
+  prefillAndSaveMyInfoFields: (
+    formId: string,
     myInfoData: MyInfoData,
     currFormFields: LeanDocument<IFieldSchema[]>,
-  ) => Result<IPossiblyPrefilledField[], MissingFeatureError>
+  ) => ResultAsync<
+    IPossiblyPrefilledField[],
+    MyInfoHashingError | DatabaseError
+  >
   saveMyInfoHashes: (
     uinFin: string,
     formId: string,
@@ -82,6 +83,21 @@ interface IMyInfoFactory {
   extractUinFin: (
     accessToken: string,
   ) => Result<string, MyInfoInvalidAccessTokenError | MissingFeatureError>
+
+  getMyInfoDataForForm: (
+    form: IPopulatedForm,
+    cookies: Record<string, unknown>,
+  ) => ResultAsync<
+    MyInfoData,
+    | MyInfoMissingAccessTokenError
+    | MyInfoCookieStateError
+    | MyInfoNoESrvcIdError
+    | MyInfoAuthTypeError
+    | MyInfoCircuitBreakerError
+    | MyInfoFetchError
+    | MissingFeatureError
+    | MyInfoCookieAccessError
+  >
 }
 
 export const createMyInfoFactory = ({
@@ -92,14 +108,14 @@ export const createMyInfoFactory = ({
     const error = new MissingFeatureError(FeatureNames.SpcpMyInfo)
     return {
       retrieveAccessToken: () => errAsync(error),
-      fetchMyInfoPersonData: () => errAsync(error),
-      prefillMyInfoFields: () => err(error),
+      prefillAndSaveMyInfoFields: () => errAsync(error),
       saveMyInfoHashes: () => errAsync(error),
       fetchMyInfoHashes: () => errAsync(error),
       checkMyInfoHashes: () => errAsync(error),
       createRedirectURL: () => err(error),
       parseMyInfoRelayState: () => err(error),
       extractUinFin: () => err(error),
+      getMyInfoDataForForm: () => errAsync(error),
     }
   }
   return new MyInfoService({
diff --git a/src/app/modules/myinfo/myinfo.middleware.ts b/src/app/modules/myinfo/myinfo.middleware.ts
deleted file mode 100644
index 2741a4a211..0000000000
--- a/src/app/modules/myinfo/myinfo.middleware.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-// TODO (#144): move these into their respective controllers when
-// those controllers are being refactored.
-// A services module should not contain a controller.
-import { RequestHandler } from 'express'
-import { ParamsDictionary } from 'express-serve-static-core'
-
-import { createLoggerWithLabel } from '../../../config/logger'
-import { AuthType, WithForm, WithJsonForm } from '../../../types'
-import { createReqMeta } from '../../utils/request'
-
-import { MYINFO_COOKIE_NAME, MYINFO_COOKIE_OPTIONS } from './myinfo.constants'
-import { MyInfoFactory } from './myinfo.factory'
-import { MyInfoCookiePayload, MyInfoCookieState } from './myinfo.types'
-import { extractMyInfoCookie, validateMyInfoForm } from './myinfo.util'
-
-const logger = createLoggerWithLabel(module)
-
-/**
- * Middleware for prefilling MyInfo values.
- * @returns next, always. If any error occurs, res.locals.myInfoError is set to true.
- */
-export const addMyInfo: RequestHandler<ParamsDictionary> = async (
-  req,
-  res,
-  next,
-) => {
-  // TODO (#42): add proper types here when migrating away from middleware pattern
-  const formDocument = (req as WithForm<typeof req>).form
-  const formJson = formDocument.toJSON()
-  const myInfoCookieResult = extractMyInfoCookie(req.cookies)
-
-  // No action needed if no cookie is present, this just means user is not signed in
-  if (formDocument.authType !== AuthType.MyInfo || myInfoCookieResult.isErr())
-    return next()
-  const myInfoCookie = myInfoCookieResult.value
-
-  // Error occurred while retrieving access token
-  if (myInfoCookie.state !== MyInfoCookieState.Success) {
-    res.locals.myInfoError = true
-    // Important - clear the cookie so that user will not see error on refresh
-    res.clearCookie(MYINFO_COOKIE_NAME, MYINFO_COOKIE_OPTIONS)
-    return next()
-  }
-
-  // Access token is already used
-  if (myInfoCookie.usedCount > 0) {
-    res.clearCookie(MYINFO_COOKIE_NAME, MYINFO_COOKIE_OPTIONS)
-    return next()
-  }
-
-  const requestedAttributes = (req as WithForm<
-    typeof req
-  >).form.getUniqueMyInfoAttrs()
-  return validateMyInfoForm(formDocument)
-    .asyncAndThen((form) =>
-      MyInfoFactory.fetchMyInfoPersonData(
-        myInfoCookie.accessToken,
-        requestedAttributes,
-        form.esrvcId,
-      ),
-    )
-    .andThen((myInfoData) => {
-      // Increment count in cookie
-      const cookiePayload: MyInfoCookiePayload = {
-        ...myInfoCookie,
-        usedCount: myInfoCookie.usedCount + 1,
-      }
-      res.cookie(MYINFO_COOKIE_NAME, cookiePayload, MYINFO_COOKIE_OPTIONS)
-      return MyInfoFactory.prefillMyInfoFields(
-        myInfoData,
-        formJson.form_fields,
-      ).asyncAndThen((prefilledFields) => {
-        formJson.form_fields = prefilledFields
-        ;(req as WithJsonForm<typeof req>).form = formJson
-        res.locals.spcpSession = { userName: myInfoData.getUinFin() }
-        return MyInfoFactory.saveMyInfoHashes(
-          myInfoData.getUinFin(),
-          formDocument._id,
-          prefilledFields,
-        )
-      })
-    })
-    .map(() => next())
-    .mapErr((error) => {
-      // No need for cookie if data could not be retrieved
-      res.clearCookie(MYINFO_COOKIE_NAME, MYINFO_COOKIE_OPTIONS)
-      logger.error({
-        message: error.message,
-        meta: {
-          action: 'addMyInfo',
-          ...createReqMeta(req),
-          formId: formDocument._id,
-          esrvcId: formDocument.esrvcId,
-          requestedAttributes,
-        },
-        error,
-      })
-      res.locals.myInfoError = true
-      return next()
-    })
-}
diff --git a/src/app/modules/myinfo/myinfo.service.ts b/src/app/modules/myinfo/myinfo.service.ts
index 92291c1b23..99e5062269 100644
--- a/src/app/modules/myinfo/myinfo.service.ts
+++ b/src/app/modules/myinfo/myinfo.service.ts
@@ -16,9 +16,10 @@ import {
   IFieldSchema,
   IHashes,
   IMyInfoHashSchema,
+  IPopulatedForm,
   MyInfoAttribute,
 } from '../../../types'
-import { DatabaseError } from '../core/core.errors'
+import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { ProcessedFieldResponse } from '../submission/submission.types'
 
 import { internalAttrListToScopes, MyInfoData } from './myinfo.adapter'
@@ -28,12 +29,17 @@ import {
   MYINFO_ROUTER_PREFIX,
 } from './myinfo.constants'
 import {
+  MyInfoAuthTypeError,
   MyInfoCircuitBreakerError,
+  MyInfoCookieAccessError,
+  MyInfoCookieStateError,
   MyInfoFetchError,
   MyInfoHashDidNotMatchError,
   MyInfoHashingError,
   MyInfoInvalidAccessTokenError,
+  MyInfoMissingAccessTokenError,
   MyInfoMissingHashError,
+  MyInfoNoESrvcIdError,
   MyInfoParseRelayStateError,
 } from './myinfo.errors'
 import {
@@ -43,10 +49,13 @@ import {
   MyInfoParsedRelayState,
 } from './myinfo.types'
 import {
+  assertMyInfoCookieUnused,
   compareHashedValues,
   createRelayState,
+  extractAndAssertMyInfoCookieValidity,
   hashFieldValues,
   isMyInfoRelayState,
+  validateMyInfoForm,
 } from './myinfo.util'
 import getMyInfoHashModel from './myinfo_hash.model'
 
@@ -86,6 +95,12 @@ export class MyInfoService {
    */
   #spCookieMaxAge: number
 
+  #fetchMyInfoPersonData: (
+    accessToken: string,
+    requestedAttributes: MyInfoAttribute[],
+    singpassEserviceId: string,
+  ) => ResultAsync<MyInfoData, MyInfoCircuitBreakerError | MyInfoFetchError>
+
   /**
    *
    * @param myInfoConfig Environment variables including myInfoClientMode and myInfoKeyPath
@@ -118,6 +133,54 @@ export class MyInfoService {
         this.#myInfoGovClient.getPerson(accessToken, attributes, eSrvcId),
       BREAKER_PARAMS,
     )
+
+    /**
+     * Fetches MyInfo person detail with given params.
+     * This function has circuit breaking built into it, and will throw an error
+     * if any recent usages of this function returned an error.
+     * @param params The params required to retrieve the data.
+     * @param params.uinFin The uin/fin of the person's data to retrieve.
+     * @param params.requestedAttributes The requested attributes to fetch.
+     * @param params.singpassEserviceId The eservice id of the form requesting the data.
+     * @returns the person object retrieved.
+     * @throws an error on fetch failure or if circuit breaker is in the opened state. Use {@link CircuitBreaker#isOurError} to determine if a rejection was a result of the circuit breaker or the action.
+     */
+    this.#fetchMyInfoPersonData = function (
+      accessToken: string,
+      requestedAttributes: MyInfoAttribute[],
+      singpassEserviceId: string,
+    ): ResultAsync<MyInfoData, MyInfoCircuitBreakerError | MyInfoFetchError> {
+      return ResultAsync.fromPromise(
+        this.#myInfoPersonBreaker
+          .fire(
+            accessToken,
+            internalAttrListToScopes(requestedAttributes),
+            singpassEserviceId,
+          )
+          .then((response) => new MyInfoData(response)),
+        (error) => {
+          const logMeta = {
+            action: 'fetchMyInfoPersonData',
+            requestedAttributes,
+          }
+          if (CircuitBreaker.isOurError(error)) {
+            logger.error({
+              message: 'Circuit breaker tripped',
+              meta: logMeta,
+              error,
+            })
+            return new MyInfoCircuitBreakerError()
+          } else {
+            logger.error({
+              message: 'Error retrieving data from MyInfo',
+              meta: logMeta,
+              error,
+            })
+            return new MyInfoFetchError()
+          }
+        },
+      )
+    }
   }
 
   /**
@@ -218,64 +281,21 @@ export class MyInfoService {
     )
   }
 
-  /**
-   * Fetches MyInfo person detail with given params.
-   * This function has circuit breaking built into it, and will throw an error
-   * if any recent usages of this function returned an error.
-   * @param params The params required to retrieve the data.
-   * @param params.uinFin The uin/fin of the person's data to retrieve.
-   * @param params.requestedAttributes The requested attributes to fetch.
-   * @param params.singpassEserviceId The eservice id of the form requesting the data.
-   * @returns the person object retrieved.
-   * @throws an error on fetch failure or if circuit breaker is in the opened state. Use {@link CircuitBreaker#isOurError} to determine if a rejection was a result of the circuit breaker or the action.
-   */
-  fetchMyInfoPersonData(
-    accessToken: string,
-    requestedAttributes: MyInfoAttribute[],
-    singpassEserviceId: string,
-  ): ResultAsync<MyInfoData, MyInfoCircuitBreakerError | MyInfoFetchError> {
-    return ResultAsync.fromPromise(
-      this.#myInfoPersonBreaker
-        .fire(
-          accessToken,
-          internalAttrListToScopes(requestedAttributes),
-          singpassEserviceId,
-        )
-        .then((response) => new MyInfoData(response)),
-      (error) => {
-        const logMeta = {
-          action: 'fetchMyInfoPersonData',
-          requestedAttributes,
-        }
-        if (CircuitBreaker.isOurError(error)) {
-          logger.error({
-            message: 'Circuit breaker tripped',
-            meta: logMeta,
-            error,
-          })
-          return new MyInfoCircuitBreakerError()
-        } else {
-          logger.error({
-            message: 'Error retrieving data from MyInfo',
-            meta: logMeta,
-            error,
-          })
-          return new MyInfoFetchError()
-        }
-      },
-    )
-  }
-
   /**
    * Prefill given current form fields with given MyInfo data.
+   * Saves the has of the prefilled fields as well because the two operations are atomic and should not be separated
    * @param myInfoData
    * @param currFormFields
    * @returns currFormFields with the MyInfo fields prefilled with data from myInfoData
    */
-  prefillMyInfoFields(
+  prefillAndSaveMyInfoFields(
+    formId: string,
     myInfoData: MyInfoData,
     currFormFields: LeanDocument<IFieldSchema[]>,
-  ): Result<IPossiblyPrefilledField[], never> {
+  ): ResultAsync<
+    IPossiblyPrefilledField[],
+    MyInfoHashingError | DatabaseError
+  > {
     const prefilledFields = currFormFields.map((field) => {
       if (!field.myInfo?.attr) return field
 
@@ -290,7 +310,11 @@ export class MyInfoService {
       prefilledField.disabled = isReadOnly
       return prefilledField
     })
-    return ok(prefilledFields)
+    return this.saveMyInfoHashes(
+      myInfoData.getUinFin(),
+      formId,
+      prefilledFields,
+    ).map(() => prefilledFields)
   }
 
   /**
@@ -451,4 +475,46 @@ export class MyInfoService {
       },
     )()
   }
+
+  /**
+   * Gets myInfo data using the provided form and the cookies of the request
+   * @param form the form to validate
+   * @param cookies cookies of the request
+   * @returns ok(MyInfoData) if the form has been validated successfully
+   * @returns err(MyInfoMissingAccessTokenError) if no myInfoCookie was found on the request
+   * @returns err(MyInfoCookieStateError) if cookie was not successful
+   * @returns err(MyInfoCookieAccessError) if the cookie has already been used before
+   * @returns err(MyInfoNoESrvcIdError) if form has no eserviceId
+   * @returns err(MyInfoAuthTypeError) if the client was not authenticated using MyInfo
+   * @returns err(MyInfoCircuitBreakerError) if circuit breaker was active
+   * @returns err(MyInfoFetchError) if validated but the data could not be retrieved
+   * @returns err(MissingFeatureError) if using an outdated version that does not support myInfo
+   */
+  getMyInfoDataForForm(
+    form: IPopulatedForm,
+    cookies: Record<string, unknown>,
+  ): ResultAsync<
+    MyInfoData,
+    | MyInfoMissingAccessTokenError
+    | MyInfoCookieStateError
+    | MyInfoNoESrvcIdError
+    | MyInfoAuthTypeError
+    | MyInfoCircuitBreakerError
+    | MyInfoFetchError
+    | MissingFeatureError
+    | MyInfoCookieAccessError
+  > {
+    const requestedAttributes = form.getUniqueMyInfoAttrs()
+    return extractAndAssertMyInfoCookieValidity(cookies)
+      .andThen((myInfoCookie) => assertMyInfoCookieUnused(myInfoCookie))
+      .asyncAndThen((cookiePayload) =>
+        validateMyInfoForm(form).asyncAndThen((form) =>
+          this.#fetchMyInfoPersonData(
+            cookiePayload.accessToken,
+            requestedAttributes,
+            form.esrvcId,
+          ),
+        ),
+      )
+  }
 }
diff --git a/src/app/modules/myinfo/myinfo.types.ts b/src/app/modules/myinfo/myinfo.types.ts
index d5d91c8a9f..2be487cad8 100644
--- a/src/app/modules/myinfo/myinfo.types.ts
+++ b/src/app/modules/myinfo/myinfo.types.ts
@@ -44,15 +44,15 @@ export enum MyInfoCookieState {
   Error = 'error',
 }
 
+export type MyInfoSuccessfulCookiePayload = {
+  accessToken: string
+  usedCount: number
+  state: MyInfoCookieState.Success
+}
+
 export type MyInfoCookiePayload =
-  | {
-      accessToken: string
-      usedCount: number
-      state: MyInfoCookieState.Success
-    }
-  | {
-      state: Exclude<MyInfoCookieState, MyInfoCookieState.Success>
-    }
+  | MyInfoSuccessfulCookiePayload
+  | { state: Exclude<MyInfoCookieState, MyInfoCookieState.Success> }
 
 /**
  * The stringified properties included in the state sent to MyInfo.
diff --git a/src/app/modules/myinfo/myinfo.util.ts b/src/app/modules/myinfo/myinfo.util.ts
index a77db98b0c..cf154b7274 100644
--- a/src/app/modules/myinfo/myinfo.util.ts
+++ b/src/app/modules/myinfo/myinfo.util.ts
@@ -29,6 +29,7 @@ import { ProcessedFieldResponse } from '../submission/submission.types'
 import { MYINFO_COOKIE_NAME } from './myinfo.constants'
 import {
   MyInfoAuthTypeError,
+  MyInfoCookieAccessError,
   MyInfoCookieStateError,
   MyInfoHashDidNotMatchError,
   MyInfoHashingError,
@@ -44,6 +45,7 @@ import {
   MyInfoCookieState,
   MyInfoHashPromises,
   MyInfoRelayState,
+  MyInfoSuccessfulCookiePayload,
   VisibleMyInfoResponse,
 } from './myinfo.types'
 
@@ -346,6 +348,53 @@ export const extractMyInfoCookie = (
   return err(new MyInfoMissingAccessTokenError())
 }
 
+/**
+ * Asserts that myInfoCookie is in success state
+ * This function acts as a discriminator so that the type of the cookie is encoded in its type
+ * @param cookie the cookie to
+ * @returns ok(cookie) the successful myInfoCookie
+ * @returns err(cookie) the errored cookie
+ */
+export const assertMyInfoCookieSuccessState = (
+  cookie: MyInfoCookiePayload,
+): Result<MyInfoSuccessfulCookiePayload, MyInfoCookieStateError> =>
+  cookie.state === MyInfoCookieState.Success
+    ? ok(cookie)
+    : err(new MyInfoCookieStateError())
+
+/**
+ * Extracts and asserts a successful myInfoCookie from a request's cookies
+ * @param cookies Cookies in a request
+ * @return ok(cookie) the successful myInfoCookie
+ * @return err(MyInfoMissingAccessTokenError) if myInfoCookie is not present on the request
+ * @return err(MyInfoCookieStateError) if the extracted myInfoCookie was in an error state
+ * @return err(MyInfoCookieAccessError) if the cookie has been accessed before
+ */
+export const extractAndAssertMyInfoCookieValidity = (
+  cookies: Record<string, unknown>,
+): Result<
+  MyInfoSuccessfulCookiePayload,
+  | MyInfoCookieStateError
+  | MyInfoMissingAccessTokenError
+  | MyInfoCookieAccessError
+> =>
+  extractMyInfoCookie(cookies)
+    .andThen((cookiePayload) => assertMyInfoCookieSuccessState(cookiePayload))
+    .andThen((cookiePayload) => assertMyInfoCookieUnused(cookiePayload))
+
+/**
+ * Asserts that the myInfoCookie has not been used before
+ * @param myInfoCookie
+ * @returns ok(myInfoCookie) if the cookie has not been used before
+ * @returns err(MyInfoCookieAccessError) if the cookie has been used before
+ */
+export const assertMyInfoCookieUnused = (
+  myInfoCookie: MyInfoSuccessfulCookiePayload,
+): Result<MyInfoSuccessfulCookiePayload, MyInfoCookieAccessError> =>
+  myInfoCookie.usedCount <= 0
+    ? ok(myInfoCookie)
+    : err(new MyInfoCookieAccessError())
+
 /**
  * Extracts access token from a MyInfo cookie
  * @param cookie Cookie from which access token should be extracted
diff --git a/src/app/modules/spcp/__tests__/spcp.service.spec.ts b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
index 3a96990ed0..43746bbcf4 100644
--- a/src/app/modules/spcp/__tests__/spcp.service.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
@@ -13,6 +13,7 @@ import dbHandler from 'tests/unit/backend/helpers/jest-db'
 import {
   CreateRedirectUrlError,
   FetchLoginPageError,
+  InvalidJwtError,
   InvalidOOBParamsError,
   LoginPageValidationError,
   MissingAttributesError,
@@ -226,7 +227,7 @@ describe('spcp.service', () => {
       expect(result._unsafeUnwrap()).toEqual(MOCK_SP_JWT_PAYLOAD)
     })
 
-    it('should return VerifyJwtError when SingPass JWT is invalid', async () => {
+    it('should return VerifyJwtError when SingPass JWT could not be verified', async () => {
       const spcpService = new SpcpService(MOCK_PARAMS)
       // Assumes that SP auth client was instantiated first
       const mockClient = mocked(MockAuthClient.mock.instances[0], true)
@@ -237,6 +238,21 @@ describe('spcp.service', () => {
       expect(result._unsafeUnwrapErr()).toEqual(new VerifyJwtError())
     })
 
+    it('should return InvalidJwtError when SP JWT has invalid shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[0], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) => cb(null, {}))
+      const expected = new InvalidJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.SP)
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+
     it('should return the correct payload for Corppass when JWT is valid', async () => {
       const spcpService = new SpcpService(MOCK_PARAMS)
       // Assumes that SP auth client was instantiated first
@@ -248,7 +264,7 @@ describe('spcp.service', () => {
       expect(result._unsafeUnwrap()).toEqual(MOCK_CP_JWT_PAYLOAD)
     })
 
-    it('should return VerifyJwtError when CorpPass JWT is invalid', async () => {
+    it('should return VerifyJwtError when CorpPass JWT could not be verified', async () => {
       const spcpService = new SpcpService(MOCK_PARAMS)
       // Assumes that SP auth client was instantiated first
       const mockClient = mocked(MockAuthClient.mock.instances[1], true)
@@ -258,6 +274,21 @@ describe('spcp.service', () => {
       const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.CP)
       expect(result._unsafeUnwrapErr()).toEqual(new VerifyJwtError())
     })
+
+    it('should return InvalidJwtError when CorpPass JWT has invalid shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[1], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) => cb(null, {}))
+      const expected = new InvalidJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.CP)
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
   })
 
   describe('parseOOBParams', () => {
@@ -768,4 +799,149 @@ describe('spcp.service', () => {
       expect(result._unsafeUnwrapErr()).toEqual(new MissingJwtError())
     })
   })
+
+  describe('extractJwtPayloadFromRequest', () => {
+    it('should return a SP JWT payload when there is a valid JWT in the request', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[0], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
+        cb(null, MOCK_SP_JWT_PAYLOAD),
+      )
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.SP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrap()).toEqual(MOCK_SP_JWT_PAYLOAD)
+    })
+
+    it('should return a CP JWT payload when there is a valid JWT in the request', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that CP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[1], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
+        cb(null, MOCK_CP_JWT_PAYLOAD),
+      )
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.CP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrap()).toEqual(MOCK_CP_JWT_PAYLOAD)
+    })
+
+    it('should return MissingJwtError if there is no JWT when client authenticates using SP', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      const expected = new MissingJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.SP,
+        {},
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+
+    it('should return MissingJwtError when client authenticates using CP and there is no JWT', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      const expected = new MissingJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.CP,
+        {},
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+
+    it('should return InvalidJwtError when the client authenticates using SP and the JWT has wrong shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[0], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
+        cb(new Error(), null),
+      )
+      const expected = new VerifyJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.SP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+
+    it('should return VerifyJwtError when the client authenticates using CP and the JWT has wrong shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[1], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
+        cb(new Error(), null),
+      )
+      const expected = new VerifyJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.CP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+    it('should return InvalidJwtError when the client authenticates using SP and the JWT has invalid shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[0], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) => cb(null, {}))
+      const expected = new InvalidJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.SP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+
+    it('should return InvalidJwtError when the client authenticates using CP and the JWT has invalid shape', async () => {
+      // Arrange
+      const spcpService = new SpcpService(MOCK_PARAMS)
+      // Assumes that SP auth client was instantiated first
+      const mockClient = mocked(MockAuthClient.mock.instances[1], true)
+      mockClient.verifyJWT.mockImplementationOnce((jwt, cb) => cb(null, {}))
+      const expected = new InvalidJwtError()
+
+      // Act
+      const result = await spcpService.extractJwtPayloadFromRequest(
+        AuthType.CP,
+        MOCK_COOKIES,
+      )
+
+      // Assert
+      expect(result._unsafeUnwrapErr()).toEqual(expected)
+    })
+  })
 })
diff --git a/src/app/modules/spcp/__tests__/spcp.test.constants.ts b/src/app/modules/spcp/__tests__/spcp.test.constants.ts
index 6a059fc214..2a036f4a12 100644
--- a/src/app/modules/spcp/__tests__/spcp.test.constants.ts
+++ b/src/app/modules/spcp/__tests__/spcp.test.constants.ts
@@ -1,6 +1,7 @@
 import { MyInfoMode } from '@opengovsg/myinfo-gov-client'
 import { ObjectId } from 'bson'
 import crypto from 'crypto'
+import _ from 'lodash'
 
 import { ISpcpMyInfo } from 'src/config/feature-manager'
 import { ILoginSchema, IPopulatedForm } from 'src/types'
@@ -114,6 +115,7 @@ export const MOCK_SP_FORM = ({
     _id: new ObjectId().toHexString(),
     agency: new ObjectId().toHexString(),
   },
+  getPublicView: () => _.omit(this, 'admin'),
 } as unknown) as IPopulatedForm
 
 export const MOCK_CP_FORM = ({
@@ -124,6 +126,17 @@ export const MOCK_CP_FORM = ({
     _id: new ObjectId().toHexString(),
     agency: new ObjectId().toHexString(),
   },
+  getPublicView: () => _.omit(this, 'admin'),
+} as unknown) as IPopulatedForm
+
+export const MOCK_MYINFO_FORM = ({
+  authType: 'MyInfo',
+  title: 'Mock MyInfo form',
+  _id: new ObjectId().toHexString(),
+  admin: {
+    _id: new ObjectId().toHexString(),
+    agency: new ObjectId().toHexString(),
+  },
 } as unknown) as IPopulatedForm
 
 export const MOCK_LOGIN_DOC = {
diff --git a/src/app/modules/spcp/spcp.factory.ts b/src/app/modules/spcp/spcp.factory.ts
index d7db1f322d..69cc2c031c 100644
--- a/src/app/modules/spcp/spcp.factory.ts
+++ b/src/app/modules/spcp/spcp.factory.ts
@@ -19,6 +19,7 @@ interface ISpcpFactory {
   createJWT: SpcpService['createJWT']
   createJWTPayload: SpcpService['createJWTPayload']
   getCookieSettings: SpcpService['getCookieSettings']
+  extractJwtPayloadFromRequest: SpcpService['extractJwtPayloadFromRequest']
 }
 
 export const createSpcpFactory = ({
@@ -38,6 +39,7 @@ export const createSpcpFactory = ({
       createJWT: () => err(error),
       createJWTPayload: () => err(error),
       getCookieSettings: () => ({}),
+      extractJwtPayloadFromRequest: () => errAsync(error),
     }
   }
   return new SpcpService(props)
diff --git a/src/app/modules/spcp/spcp.service.ts b/src/app/modules/spcp/spcp.service.ts
index aae6ae8b9e..74911cdbda 100644
--- a/src/app/modules/spcp/spcp.service.ts
+++ b/src/app/modules/spcp/spcp.service.ts
@@ -201,10 +201,7 @@ export class SpcpService {
   ): Result<string, MissingJwtError> {
     const jwtName = authType === AuthType.SP ? JwtName.SP : JwtName.CP
     const cookie = cookies[jwtName]
-    if (!cookie) {
-      return err(new MissingJwtError())
-    }
-    return ok(cookie)
+    return cookie ? ok(cookie) : err(new MissingJwtError())
   }
 
   /**
@@ -394,4 +391,25 @@ export class SpcpService {
     const spcpCookieDomain = this.#spcpProps.spcpCookieDomain
     return spcpCookieDomain ? { domain: spcpCookieDomain, path: '/' } : {}
   }
+
+  /**
+   * Gets the spcp session info from the auth, cookies
+   * @param authType The authentication type of the user
+   * @param cookies The spcp cookies set by the redirect
+   * @return ok(jwtPayload) if successful
+   * @return err(MissingJwtError) if the specified cookie for the authType (spcp) does not exist
+   * @return err(VerifyJwtError) if the jwt exists but could not be authenticated
+   * @return err(InvalidJwtError) if the jwt exists but the payload is invalid
+   */
+  extractJwtPayloadFromRequest(
+    authType: AuthType.SP | AuthType.CP,
+    cookies: SpcpCookies,
+  ): ResultAsync<
+    JwtPayload,
+    VerifyJwtError | InvalidJwtError | MissingJwtError
+  > {
+    return this.extractJwt(cookies, authType).asyncAndThen((jwtResult) =>
+      this.extractJwtPayload(jwtResult, authType),
+    )
+  }
 }
diff --git a/src/app/routes/public-forms.server.routes.js b/src/app/routes/public-forms.server.routes.js
index 2e4bf9cf81..b3ed749508 100644
--- a/src/app/routes/public-forms.server.routes.js
+++ b/src/app/routes/public-forms.server.routes.js
@@ -4,14 +4,11 @@
  * Module dependencies.
  */
 const forms = require('../../app/controllers/forms.server.controller')
-const publicForms = require('../modules/form/public-form/public-form.middlewares')
-const MyInfoMiddleware = require('../modules/myinfo/myinfo.middleware')
 const { celebrate, Joi, Segments } = require('celebrate')
 const { CaptchaFactory } = require('../services/captcha/captcha.factory')
 const { limitRate } = require('../utils/limit-rate')
 const { rateLimitConfig } = require('../../config/config')
 const PublicFormController = require('../modules/form/public-form/public-form.controller')
-const SpcpController = require('../modules/spcp/spcp.controller')
 const EncryptSubmissionController = require('../modules/submission/encrypt-submission/encrypt-submission.controller')
 const EncryptSubmissionMiddleware = require('../modules/submission/encrypt-submission/encrypt-submission.middleware')
 
@@ -127,14 +124,7 @@ module.exports = function (app) {
    */
   app
     .route('/:formId([a-fA-F0-9]{24})/publicform')
-    .get(
-      forms.formById,
-      publicForms.isFormPublicCheck,
-      publicForms.checkFormSubmissionLimitAndDeactivate,
-      SpcpController.addSpcpSessionInfo,
-      MyInfoMiddleware.addMyInfo,
-      forms.read(forms.REQUEST_TYPE.PUBLIC),
-    )
+    .get(PublicFormController.handleGetPublicForm)
 
   /**
    * On preview, submit a form response, and stores the encrypted contents. Optionally, an autoreply
diff --git a/src/app/services/intranet/__tests__/intranet.service.spec.ts b/src/app/services/intranet/__tests__/intranet.service.spec.ts
index 654256d133..ed4db49f4c 100644
--- a/src/app/services/intranet/__tests__/intranet.service.spec.ts
+++ b/src/app/services/intranet/__tests__/intranet.service.spec.ts
@@ -31,7 +31,7 @@ describe('IntranetService', () => {
     it('should return true when IP is in intranet IP list', () => {
       const result = intranetService.isIntranetIp(MOCK_IP_LIST[0])
 
-      expect(result._unsafeUnwrap()).toBe(true)
+      expect(result).toBe(true)
     })
 
     it('should return false when IP is not in intranet IP list', () => {
@@ -39,7 +39,7 @@ describe('IntranetService', () => {
 
       const result = intranetService.isIntranetIp(ipNotInList)
 
-      expect(result._unsafeUnwrap()).toBe(false)
+      expect(result).toBe(false)
     })
   })
 })
diff --git a/src/app/services/intranet/intranet.factory.ts b/src/app/services/intranet/intranet.factory.ts
index 6b15b317a6..32860b2eea 100644
--- a/src/app/services/intranet/intranet.factory.ts
+++ b/src/app/services/intranet/intranet.factory.ts
@@ -1,4 +1,4 @@
-import { err } from 'neverthrow'
+import { err, ok, Result } from 'neverthrow'
 
 import FeatureManager, {
   FeatureNames,
@@ -9,7 +9,7 @@ import { MissingFeatureError } from '../../modules/core/core.errors'
 import { IntranetService } from './intranet.service'
 
 interface IIntranetFactory {
-  isIntranetIp: IntranetService['isIntranetIp']
+  isIntranetIp: (ip: string) => Result<boolean, MissingFeatureError>
 }
 
 export const createIntranetFactory = ({
@@ -17,7 +17,10 @@ export const createIntranetFactory = ({
   props,
 }: RegisteredFeature<FeatureNames.Intranet>): IIntranetFactory => {
   if (isEnabled && props?.intranetIpListPath) {
-    return new IntranetService(props)
+    const intranetService = new IntranetService(props)
+    return {
+      isIntranetIp: (ip: string) => ok(intranetService.isIntranetIp(ip)),
+    }
   }
 
   const error = new MissingFeatureError(FeatureNames.Intranet)
diff --git a/src/app/services/intranet/intranet.service.ts b/src/app/services/intranet/intranet.service.ts
index 56c1f00b97..91d957231b 100644
--- a/src/app/services/intranet/intranet.service.ts
+++ b/src/app/services/intranet/intranet.service.ts
@@ -1,9 +1,7 @@
 import fs from 'fs'
-import { ok, Result } from 'neverthrow'
 
 import { IIntranet } from '../../../config/feature-manager'
 import { createLoggerWithLabel } from '../../../config/logger'
-import { ApplicationError } from '../../modules/core/core.errors'
 
 const logger = createLoggerWithLabel(module)
 
@@ -42,7 +40,7 @@ export class IntranetService {
    * @param ip IP address to check
    * @returns Whether the IP address originated from the intranet
    */
-  isIntranetIp(ip: string): Result<boolean, ApplicationError> {
-    return ok(this.intranetIps.includes(ip))
+  isIntranetIp(ip: string): boolean {
+    return this.intranetIps.includes(ip)
   }
 }
diff --git a/src/app/utils/handle-mongo-error.ts b/src/app/utils/handle-mongo-error.ts
index cf3033402c..2ca25fcf43 100644
--- a/src/app/utils/handle-mongo-error.ts
+++ b/src/app/utils/handle-mongo-error.ts
@@ -6,6 +6,7 @@ import {
   DatabaseError,
   DatabasePayloadSizeError,
   DatabaseValidationError,
+  PossibleDatabaseError,
 } from '../modules/core/core.errors'
 
 /**
@@ -66,13 +67,7 @@ export const getMongoErrorMessage = (
  * @param error the error thrown by database operations
  * @returns errors that extend from ApplicationError class
  */
-export const transformMongoError = (
-  error: unknown,
-):
-  | DatabaseError
-  | DatabaseValidationError
-  | DatabaseConflictError
-  | DatabasePayloadSizeError => {
+export const transformMongoError = (error: unknown): PossibleDatabaseError => {
   const errorMessage = getMongoErrorMessage(error)
   if (!(error instanceof Error)) {
     return new DatabaseError(errorMessage)
@@ -99,3 +94,15 @@ export const transformMongoError = (
 
   return new DatabaseError(errorMessage)
 }
+
+export const isMongoError = (error: Error): boolean => {
+  switch (error.constructor) {
+    case DatabaseConflictError:
+    case DatabaseError:
+    case DatabasePayloadSizeError:
+    case DatabaseValidationError:
+      return true
+    default:
+      return false
+  }
+}
diff --git a/src/types/form.ts b/src/types/form.ts
index c2928fb977..e8964e443a 100644
--- a/src/types/form.ts
+++ b/src/types/form.ts
@@ -129,7 +129,7 @@ export interface IForm {
   status?: Status
 
   inactiveMessage?: string
-  submissionLimit?: number
+  submissionLimit?: number | null
   isListed?: boolean
   esrvcId?: string
   webhook?: Webhook
@@ -208,7 +208,9 @@ export interface IFormDocument extends IFormSchema {
   authType: NonNullable<IFormSchema['authType']>
   status: NonNullable<IFormSchema['status']>
   inactiveMessage: NonNullable<IFormSchema['inactiveMessage']>
-  submissionLimit: NonNullable<IFormSchema['submissionLimit']>
+  // NOTE: Due to the way creating a form works, creating a form without specifying submissionLimit will throw an error.
+  // Hence, using Exclude here over NonNullable.
+  submissionLimit: Exclude<IFormSchema['submissionLimit'], undefined>
   isListed: NonNullable<IFormSchema['isListed']>
   form_fields: NonNullable<IFormSchema['form_fields']>
   startPage: SetRequired<NonNullable<IFormSchema['startPage']>, 'colorTheme'>

From 1ae669516fb5775ec7d2ddeaeac14af32cad4051 Mon Sep 17 00:00:00 2001
From: tshuli <63710093+tshuli@users.noreply.github.com>
Date: Thu, 8 Apr 2021 17:45:13 +0800
Subject: [PATCH 29/75] refactor: migrate frontend routes and google analytics
 factory to ts (#1405)

---
 src/app/factories/google-analytics.factory.js | 19 ------
 .../frontend.server.controller.spec.ts        | 14 ++---
 .../google-analytics.factory.spec.ts          | 55 ++++++++++++++++
 .../frontend/frontend.server.controller.ts}   | 62 ++++++++++++++-----
 .../frontend/frontend.server.routes.ts        | 49 +++++++++++++++
 .../frontend/google-analytics.factory.ts      | 43 +++++++++++++
 src/app/routes/frontend.server.routes.js      | 27 --------
 src/app/routes/index.js                       |  5 +-
 src/loaders/express/index.ts                  |  2 +
 9 files changed, 203 insertions(+), 73 deletions(-)
 delete mode 100644 src/app/factories/google-analytics.factory.js
 rename src/app/{controllers => modules/frontend}/__tests__/frontend.server.controller.spec.ts (83%)
 create mode 100644 src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
 rename src/app/{controllers/frontend.server.controller.js => modules/frontend/frontend.server.controller.ts} (56%)
 create mode 100644 src/app/modules/frontend/frontend.server.routes.ts
 create mode 100644 src/app/modules/frontend/google-analytics.factory.ts
 delete mode 100644 src/app/routes/frontend.server.routes.js

diff --git a/src/app/factories/google-analytics.factory.js b/src/app/factories/google-analytics.factory.js
deleted file mode 100644
index 0e0a924481..0000000000
--- a/src/app/factories/google-analytics.factory.js
+++ /dev/null
@@ -1,19 +0,0 @@
-const featureManager = require('../../config/feature-manager').default
-const frontend = require('../controllers/frontend.server.controller')
-const { StatusCodes } = require('http-status-codes')
-
-const googleAnalyticsFactory = ({ isEnabled }) => {
-  if (isEnabled) {
-    return {
-      datalayer: frontend.datalayer,
-    }
-  } else {
-    return {
-      datalayer: (req, res) => {
-        res.type('text/javascript').sendStatus(StatusCodes.OK)
-      },
-    }
-  }
-}
-
-module.exports = googleAnalyticsFactory(featureManager.get('google-analytics'))
diff --git a/src/app/controllers/__tests__/frontend.server.controller.spec.ts b/src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts
similarity index 83%
rename from src/app/controllers/__tests__/frontend.server.controller.spec.ts
rename to src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts
index 5fdc2e0e37..05ce6016a2 100644
--- a/src/app/controllers/__tests__/frontend.server.controller.spec.ts
+++ b/src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts
@@ -2,7 +2,7 @@ import { StatusCodes } from 'http-status-codes'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
-import frontendServerController from '../frontend.server.controller'
+import * as FrontendServerController from '../frontend.server.controller'
 
 describe('frontend.server.controller', () => {
   afterEach(() => jest.clearAllMocks())
@@ -24,7 +24,7 @@ describe('frontend.server.controller', () => {
   }
   describe('datalayer', () => {
     it('should return the correct response when the request is valid', () => {
-      frontendServerController.datalayer(mockReq, mockRes)
+      FrontendServerController.addGoogleAnalyticsData(mockReq, mockRes)
       expect(mockRes.send).toHaveBeenCalledWith(
         expect.stringContaining("'app_name': 'xyz'"),
       )
@@ -35,20 +35,20 @@ describe('frontend.server.controller', () => {
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.OK)
     })
     it('should return BAD_REQUEST if the request is not valid', () => {
-      frontendServerController.datalayer(mockBadReq, mockRes)
+      FrontendServerController.addGoogleAnalyticsData(mockBadReq, mockRes)
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.BAD_REQUEST)
     })
   })
 
   describe('environment', () => {
     it('should return the correct response when the request is valid', () => {
-      frontendServerController.environment(mockReq, mockRes)
+      FrontendServerController.addEnvVarData(mockReq, mockRes)
       expect(mockRes.send).toHaveBeenCalledWith('efg')
       expect(mockRes.type).toHaveBeenCalledWith('text/javascript')
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.OK)
     })
     it('should return BAD_REQUEST if the request is not valid', () => {
-      frontendServerController.environment(mockBadReq, mockRes)
+      FrontendServerController.addEnvVarData(mockBadReq, mockRes)
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.BAD_REQUEST)
     })
   })
@@ -65,7 +65,7 @@ describe('frontend.server.controller', () => {
         'window.location.hash = "#!/formId?fieldId1=abc&fieldId2=&lt;&gt;&#39;&#34;'
       // Note this is different from mockReqModified.query.redirectPath as
       // there are html-encoded characters
-      frontendServerController.redirectLayer(mockReqModified, mockRes)
+      FrontendServerController.generateRedirectUrl(mockReqModified, mockRes)
       expect(mockRes.send).toHaveBeenCalledWith(
         expect.stringContaining(redirectString),
       )
@@ -73,7 +73,7 @@ describe('frontend.server.controller', () => {
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.OK)
     })
     it('should return BAD_REQUEST if the request is not valid', () => {
-      frontendServerController.redirectLayer(mockBadReq, mockRes)
+      FrontendServerController.generateRedirectUrl(mockBadReq, mockRes)
       expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.BAD_REQUEST)
     })
   })
diff --git a/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts b/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
new file mode 100644
index 0000000000..a868f00c09
--- /dev/null
+++ b/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
@@ -0,0 +1,55 @@
+import { StatusCodes } from 'http-status-codes'
+
+import { FeatureNames, RegisteredFeature } from 'src/config/feature-manager'
+
+import expressHandler from 'tests/unit/backend/helpers/jest-express'
+
+import { createGoogleAnalyticsFactory } from '../google-analytics.factory'
+
+describe('google-analytics.factory', () => {
+  afterEach(() => jest.clearAllMocks())
+  const mockReq = expressHandler.mockRequest({
+    others: {
+      app: {
+        locals: {
+          GATrackingID: 'abc',
+          appName: 'xyz',
+          environment: 'efg',
+        },
+      },
+    },
+  })
+  const mockRes = expressHandler.mockResponse()
+
+  it('should call res correctly if google-analytics feature is disabled', () => {
+    const MOCK_DISABLED_GA_FEATURE: RegisteredFeature<FeatureNames.GoogleAnalytics> = {
+      isEnabled: false,
+    }
+
+    const GoogleAnalyticsFactory = createGoogleAnalyticsFactory(
+      MOCK_DISABLED_GA_FEATURE,
+    )
+
+    GoogleAnalyticsFactory.addGoogleAnalyticsData(mockReq, mockRes)
+
+    expect(mockRes.type).toHaveBeenCalledWith('text/javascript')
+    expect(mockRes.sendStatus).toHaveBeenCalledWith(StatusCodes.OK)
+    expect(mockRes.send).not.toHaveBeenCalled()
+  })
+
+  it('should call res correctly if google-analytics feature is enabled', () => {
+    const MOCK_ENABLED_GA_FEATURE: RegisteredFeature<FeatureNames.GoogleAnalytics> = {
+      isEnabled: true,
+    }
+
+    const GoogleAnalyticsFactory = createGoogleAnalyticsFactory(
+      MOCK_ENABLED_GA_FEATURE,
+    )
+
+    GoogleAnalyticsFactory.addGoogleAnalyticsData(mockReq, mockRes)
+
+    expect(mockRes.send).toHaveBeenCalledWith(expect.stringContaining('gtag'))
+    expect(mockRes.type).toHaveBeenCalledWith('text/javascript')
+    expect(mockRes.status).toHaveBeenCalledWith(StatusCodes.OK)
+  })
+})
diff --git a/src/app/controllers/frontend.server.controller.js b/src/app/modules/frontend/frontend.server.controller.ts
similarity index 56%
rename from src/app/controllers/frontend.server.controller.js
rename to src/app/modules/frontend/frontend.server.controller.ts
index a89ba93c83..32f54e6a02 100644
--- a/src/app/controllers/frontend.server.controller.js
+++ b/src/app/modules/frontend/frontend.server.controller.ts
@@ -1,16 +1,24 @@
-'use strict'
+import ejs from 'ejs'
+import { RequestHandler } from 'express'
+import { ParamsDictionary } from 'express-serve-static-core'
+import { StatusCodes } from 'http-status-codes'
 
-const ejs = require('ejs')
-const { StatusCodes } = require('http-status-codes')
-const logger = require('../../config/logger').createLoggerWithLabel(module)
-const { createReqMeta } = require('../utils/request')
+import featureManager from '../../../config/feature-manager'
+import { createLoggerWithLabel } from '../../../config/logger'
+import { createReqMeta } from '../../utils/request'
+
+const logger = createLoggerWithLabel(module)
 
 /**
- * Google Tag Manager initialisation Javascript code templated
- * with environment variables.
- * @returns {String} Templated Javascript code for the frontend
+ * Handler for GET /frontend/datalayer endpoint.
+ * @param req - Express request object
+ * @param res - Express response object
+ * @returns {String} Templated Javascript code for the frontend to initialise Google Tag Manager
  */
-module.exports.datalayer = function (req, res) {
+export const addGoogleAnalyticsData: RequestHandler<
+  ParamsDictionary,
+  string | { message: string }
+> = (req, res) => {
   const js = `
     window.dataLayer = window.dataLayer || [];
       function gtag(){dataLayer.push(arguments);}
@@ -40,10 +48,15 @@ module.exports.datalayer = function (req, res) {
 }
 
 /**
- * Custom Javascript code templated with environment variables.
- * @returns {String} Templated Javascript code for the frontend
+ * Handler for GET /frontend/environment endpoint.
+ * @param req - Express request object
+ * @param res - Express response object
+ * @returns {String} Templated Javascript code with environment variables for the frontend
  */
-module.exports.environment = function (req, res) {
+export const addEnvVarData: RequestHandler<
+  ParamsDictionary,
+  { message: string }
+> = (req, res) => {
   try {
     return res
       .type('text/javascript')
@@ -65,10 +78,15 @@ module.exports.environment = function (req, res) {
 }
 
 /**
- * Custom Javascript code that redirects to specific form url
- * @returns {String} Templated Javascript code for the frontend
+ * Handler for GET /frontend/redirect endpoint.
+ * @param req - Express request object
+ * @param res - Express response object
+ * @returns {String} Templated Javascript code for the frontend that redirects to specific form url
  */
-module.exports.redirectLayer = function (req, res) {
+export const generateRedirectUrl: RequestHandler<
+  ParamsDictionary,
+  string | { message: string }
+> = (req, res) => {
   const js = `
     // Update hash to match form id
     window.location.hash = "#!/<%= redirectPath%>"
@@ -79,7 +97,6 @@ module.exports.redirectLayer = function (req, res) {
   // Prefer to replace just '&' instead of using <%- to output unescaped values into the template
   // As this could potentially introduce security vulnerability
   // See https://ejs.co/#docs for tags
-
   try {
     const ejsRendered = ejs.render(js, req.query).replace(/&amp;/g, '&')
     return res.type('text/javascript').status(StatusCodes.OK).send(ejsRendered)
@@ -97,3 +114,16 @@ module.exports.redirectLayer = function (req, res) {
     })
   }
 }
+
+/**
+ * Handler for GET /frontend/features endpoint.
+ * @param req - Express request object
+ * @param res - Express response object
+ * @returns {String} Current featureManager states
+ */
+export const showFeaturesStates: RequestHandler<
+  unknown,
+  typeof featureManager.states
+> = (req, res) => {
+  return res.json(featureManager.states)
+}
diff --git a/src/app/modules/frontend/frontend.server.routes.ts b/src/app/modules/frontend/frontend.server.routes.ts
new file mode 100644
index 0000000000..0038ce44d0
--- /dev/null
+++ b/src/app/modules/frontend/frontend.server.routes.ts
@@ -0,0 +1,49 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import * as FrontendServerController from './frontend.server.controller'
+import { GoogleAnalyticsFactory } from './google-analytics.factory'
+
+export const FrontendRouter = Router()
+
+/**
+ * Generate the templated Javascript code for the frontend to initialise Google Tag Manager
+ * Code depends on whether googleAnalyticsFeature.isEnabled
+ * @route GET /frontend/datalayer
+ * @return 200 when code generation is successful
+ * @return 400 when code generation fails
+ */
+FrontendRouter.get('/datalayer', GoogleAnalyticsFactory.addGoogleAnalyticsData)
+
+/**
+ * Generate the templated Javascript code with environment variables for the frontend
+ * @route GET /frontend/environment
+ * @return 200 when code generation is successful
+ * @return 400 when code generation fails
+ */
+FrontendRouter.get('/environment', FrontendServerController.addEnvVarData)
+
+/**
+ * Generate a json of current activated features
+ * @route GET /frontend/features
+ * @return json with featureManager.states
+ */
+FrontendRouter.get('/features', FrontendServerController.showFeaturesStates)
+
+/**
+ * Generate the javascript code to redirect to the correct url
+ * @route GET /frontend/redirect
+ * @return 200 when redirect code is  successful
+ * @return 400 when redirect code fails
+ */
+FrontendRouter.get(
+  '/redirect',
+  celebrate({
+    [Segments.QUERY]: {
+      redirectPath: Joi.string()
+        .regex(/^[a-fA-F0-9]{24}(\/(preview|template|use-template))?/)
+        .required(),
+    },
+  }),
+  FrontendServerController.generateRedirectUrl,
+)
diff --git a/src/app/modules/frontend/google-analytics.factory.ts b/src/app/modules/frontend/google-analytics.factory.ts
new file mode 100644
index 0000000000..1273dec4e6
--- /dev/null
+++ b/src/app/modules/frontend/google-analytics.factory.ts
@@ -0,0 +1,43 @@
+import { RequestHandler } from 'express'
+import { ParamsDictionary } from 'express-serve-static-core'
+import { StatusCodes } from 'http-status-codes'
+
+import FeatureManager, {
+  FeatureNames,
+  RegisteredFeature,
+} from '../../../config/feature-manager'
+
+import * as FrontendServerController from './frontend.server.controller'
+
+interface IGoogleAnalyticsFactory {
+  addGoogleAnalyticsData: RequestHandler<
+    ParamsDictionary,
+    string | { message: string }
+  >
+}
+
+const googleAnalyticsFeature = FeatureManager.get(FeatureNames.GoogleAnalytics)
+
+/**
+ * Factory function which returns the correct handler
+ * for /frontend/datalayer endpoint depending on googleAnalyticsFeature.isEnabled
+ * @param googleAnalyticsFeature
+ */
+export const createGoogleAnalyticsFactory = (
+  googleAnalyticsFeature: RegisteredFeature<FeatureNames.GoogleAnalytics>,
+): IGoogleAnalyticsFactory => {
+  if (!googleAnalyticsFeature.isEnabled) {
+    return {
+      addGoogleAnalyticsData: (req, res) => {
+        res.type('text/javascript').sendStatus(StatusCodes.OK)
+      },
+    }
+  }
+  return {
+    addGoogleAnalyticsData: FrontendServerController.addGoogleAnalyticsData,
+  }
+}
+
+export const GoogleAnalyticsFactory = createGoogleAnalyticsFactory(
+  googleAnalyticsFeature,
+)
diff --git a/src/app/routes/frontend.server.routes.js b/src/app/routes/frontend.server.routes.js
deleted file mode 100644
index e139ae225e..0000000000
--- a/src/app/routes/frontend.server.routes.js
+++ /dev/null
@@ -1,27 +0,0 @@
-'use strict'
-
-const frontendCtrl = require('../controllers/frontend.server.controller')
-const featureManager = require('../../config/feature-manager').default
-const googleAnalyticsFactory = require('../factories/google-analytics.factory')
-const { celebrate, Joi, Segments } = require('celebrate')
-
-module.exports = function (app) {
-  app.route('/frontend/datalayer').get(googleAnalyticsFactory.datalayer)
-
-  app.route('/frontend/environment').get(frontendCtrl.environment)
-
-  app.route('/frontend/redirect').get(
-    celebrate({
-      [Segments.QUERY]: {
-        redirectPath: Joi.string()
-          .regex(/^[a-fA-F0-9]{24}(\/(preview|template|use-template))?/)
-          .required(),
-      },
-    }),
-    frontendCtrl.redirectLayer,
-  )
-
-  app.route('/frontend/features').get((req, res) => {
-    res.json(featureManager.states)
-  })
-}
diff --git a/src/app/routes/index.js b/src/app/routes/index.js
index 08270e7337..953d0f67c0 100644
--- a/src/app/routes/index.js
+++ b/src/app/routes/index.js
@@ -1,4 +1 @@
-module.exports = [
-  require('./frontend.server.routes.js'),
-  require('./public-forms.server.routes.js'),
-]
+module.exports = [require('./public-forms.server.routes.js')]
diff --git a/src/loaders/express/index.ts b/src/loaders/express/index.ts
index 31129db757..170803036a 100644
--- a/src/loaders/express/index.ts
+++ b/src/loaders/express/index.ts
@@ -14,6 +14,7 @@ import { BillingRouter } from '../../app/modules/billing/billing.routes'
 import { BounceRouter } from '../../app/modules/bounce/bounce.routes'
 import { ExamplesRouter } from '../../app/modules/examples/examples.routes'
 import { AdminFormsRouter } from '../../app/modules/form/admin-form/admin-form.routes'
+import { FrontendRouter } from '../../app/modules/frontend/frontend.server.routes'
 import { HomeRouter } from '../../app/modules/home/home.routes'
 import { MYINFO_ROUTER_PREFIX } from '../../app/modules/myinfo/myinfo.constants'
 import { MyInfoRouter } from '../../app/modules/myinfo/myinfo.routes'
@@ -149,6 +150,7 @@ const loadExpressApp = async (connection: Connection) => {
   })
 
   app.use('/', HomeRouter)
+  app.use('/frontend', FrontendRouter)
   app.use('/auth', AuthRouter)
   app.use('/user', UserRouter)
   app.use('/emailnotifications', BounceRouter)

From f32f7a62c7dc81bc3f9dc26f98135ebfacb88f07 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 8 Apr 2021 19:15:08 +0800
Subject: [PATCH 30/75] feat: migrate EncryptSubmissionRouter to own router,
 remove unused forms.server.controller, remove jasmine (#1592)

* feat: migrate storage mode submission endpoint to own router

* test(EncryptSubRoutes): use imported router instead of creating

* feat: delete unused forms.server.controller.js and tests

* chore: rip out jasmine
---
 .travis.yml                                   |   5 +-
 package-lock.json                             |  42 -----
 package.json                                  |  12 +-
 .../controllers/forms.server.controller.js    | 154 ----------------
 .../encrypt-submission.routes.spec.ts         |  67 +------
 .../encrypt-submission.routes.ts              |  30 ++++
 .../modules/submission/submission.routes.ts   |   3 +
 src/app/routes/public-forms.server.routes.js  |  36 ----
 tests/unit/backend/.eslintrc                  |  18 --
 .../forms.server.controller.spec.js           | 164 ------------------
 tests/unit/backend/helpers/db-handler.js      | 132 --------------
 tests/unit/backend/helpers/index.js           |  14 --
 tests/unit/backend/helpers/reporter.js        |  11 --
 tests/unit/backend/helpers/roles.js           |   6 -
 tests/unit/backend/jasmine.json               |  11 --
 15 files changed, 44 insertions(+), 661 deletions(-)
 delete mode 100644 src/app/controllers/forms.server.controller.js
 create mode 100644 src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
 delete mode 100644 tests/unit/backend/.eslintrc
 delete mode 100644 tests/unit/backend/controllers/forms.server.controller.spec.js
 delete mode 100644 tests/unit/backend/helpers/db-handler.js
 delete mode 100644 tests/unit/backend/helpers/index.js
 delete mode 100644 tests/unit/backend/helpers/reporter.js
 delete mode 100644 tests/unit/backend/helpers/roles.js
 delete mode 100644 tests/unit/backend/jasmine.json

diff --git a/.travis.yml b/.travis.yml
index 188a48ad1b..d256a72259 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -36,17 +36,16 @@ jobs:
           name: build
           paths: .
     - stage: Tests
-      name: Javascript tests
+      name: Frontend tests
       workspaces:
         use: build
       script:
-        - npm run test-backend-jasmine
         - npm run test-frontend
     - name: Typescript tests
       workspaces:
         use: build
       script:
-        - npm run test-backend-jest
+        - npm run test-backend
       after_success:
         - cat ./coverage/lcov.info | ./node_modules/coveralls/bin/coveralls.js
     - name: End-to-end tests
diff --git a/package-lock.json b/package-lock.json
index f2b03dc5c7..095f804a6e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13769,48 +13769,6 @@
         }
       }
     },
-    "jasmine": {
-      "version": "3.7.0",
-      "resolved": "https://registry.npmjs.org/jasmine/-/jasmine-3.7.0.tgz",
-      "integrity": "sha512-wlzGQ+cIFzMEsI+wDqmOwvnjTvolLFwlcpYLCqSPPH0prOQaW3P+IzMhHYn934l1imNvw07oCyX+vGUv3wmtSQ==",
-      "dev": true,
-      "requires": {
-        "glob": "^7.1.6",
-        "jasmine-core": "~3.7.0"
-      },
-      "dependencies": {
-        "jasmine-core": {
-          "version": "3.7.0",
-          "resolved": "https://registry.npmjs.org/jasmine-core/-/jasmine-core-3.7.0.tgz",
-          "integrity": "sha512-jmeRIgxS/abz8afk9NKJ1yP7n93aZdRaHDWtTHJBlYu6fhbzvErjiO3mMlSSrJefVk1a+26JlABrHS2iBH8Azw==",
-          "dev": true
-        }
-      }
-    },
-    "jasmine-core": {
-      "version": "3.7.1",
-      "resolved": "https://registry.npmjs.org/jasmine-core/-/jasmine-core-3.7.1.tgz",
-      "integrity": "sha512-DH3oYDS/AUvvr22+xUBW62m1Xoy7tUlY1tsxKEJvl5JeJ7q8zd1K5bUwiOxdH+erj6l2vAMM3hV25Xs9/WrmuQ==",
-      "dev": true
-    },
-    "jasmine-sinon": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/jasmine-sinon/-/jasmine-sinon-0.4.0.tgz",
-      "integrity": "sha1-gECheaAa4DSbI0ruQ4wkGRI5rpg=",
-      "dev": true,
-      "requires": {
-        "sinon": ">= 1.7.1"
-      }
-    },
-    "jasmine-spec-reporter": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/jasmine-spec-reporter/-/jasmine-spec-reporter-6.0.0.tgz",
-      "integrity": "sha512-MvTOVoMxDZAftQYBApIlSfKnGMzi9cj351nXeqtnZTuXffPlbONN31+Es7F+Ke4okUeQ2xISukt4U1npfzLVrQ==",
-      "dev": true,
-      "requires": {
-        "colors": "1.4.0"
-      }
-    },
     "jest": {
       "version": "26.6.3",
       "resolved": "https://registry.npmjs.org/jest/-/jest-26.6.3.tgz",
diff --git a/package.json b/package.json
index 79ae4eb9c8..4376bf685b 100644
--- a/package.json
+++ b/package.json
@@ -16,11 +16,9 @@
     "npm": "~6.4.0"
   },
   "scripts": {
-    "test-backend-jest": "env-cmd -f tests/.test-full-env jest --coverage --maxWorkers=4",
-    "test-backend-jest:watch": "env-cmd -f tests/.test-full-env jest --watch",
-    "test-backend-jasmine": "env-cmd -f tests/.test-full-env --use-shell \"npm run download-binary && jasmine --config=tests/unit/backend/jasmine.json\"",
+    "test-backend": "env-cmd -f tests/.test-full-env jest --coverage --maxWorkers=4",
+    "test-backend:watch": "env-cmd -f tests/.test-full-env jest --watch",
     "test-frontend": "jest --config=tests/unit/frontend/jest.config.js",
-    "test-backend": "npm run test-backend-jasmine && npm run test-backend-jest",
     "build": "npm run build-backend && npm run build-frontend",
     "build-backend": "tsc -p tsconfig.build.json",
     "build-frontend": "webpack --config webpack.prod.js",
@@ -29,7 +27,7 @@
     "start": "node dist/backend/server.js",
     "dev": "docker-compose up --build",
     "docker-dev": "npm run build-frontend-dev:watch & ts-node-dev --respawn --transpile-only --inspect=0.0.0.0 --exit-child -- src/server.ts",
-    "test": "npm run build-backend && npm run test-backend && npm run test-frontend",
+    "test": "npm run test-backend && npm run test-frontend",
     "test-e2e-build": "npm run build-backend && npm run build-frontend-dev",
     "test-run": "concurrently --success last --kill-others \"mockpass\" \"maildev\" \"node dist/backend/server.js\" \"node ./tests/mock-webhook-server.js\"",
     "testcafe-full-env": "testcafe --skip-js-errors -c 3 chrome:headless ./tests/end-to-end --test-meta full-env=true --app \"npm run test-run\" --app-init-delay 10000",
@@ -219,10 +217,6 @@
     "html-loader": "~0.5.5",
     "htmlhint": "^0.14.2",
     "husky": "^6.0.0",
-    "jasmine": "^3.7.0",
-    "jasmine-core": "^3.7.1",
-    "jasmine-sinon": "^0.4.0",
-    "jasmine-spec-reporter": "^6.0.0",
     "jest": "^26.6.3",
     "jest-extended": "^0.11.5",
     "jest-mock-axios": "^4.3.0",
diff --git a/src/app/controllers/forms.server.controller.js b/src/app/controllers/forms.server.controller.js
deleted file mode 100644
index 32c1d8bbf7..0000000000
--- a/src/app/controllers/forms.server.controller.js
+++ /dev/null
@@ -1,154 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-const mongoose = require('mongoose')
-const _ = require('lodash')
-const { StatusCodes } = require('http-status-codes')
-
-const { createReqMeta } = require('../utils/request')
-const logger = require('../../config/logger').createLoggerWithLabel(module)
-const getFormModel = require('../models/form.server.model').default
-const { IntranetFactory } = require('../services/intranet/intranet.factory')
-const { getRequestIp } = require('../utils/request')
-const { AuthType } = require('../../types')
-
-const Form = getFormModel(mongoose)
-
-/**
- * @typedef {string} RequestType
- */
-
-/**
- * @enum {RequestType}
- */
-const requestTypes = {
-  ADMIN: 'ADMIN',
-  PUBLIC: 'PUBLIC',
-}
-exports.REQUEST_TYPE = requestTypes
-
-const adminPublicFields = ['agency']
-const adminPrivateFields = ['email', 'betaFlags']
-const formPublicFields = [
-  'admin',
-  'authType',
-  'endPage',
-  'esrvcId',
-  'form_fields',
-  'form_logics',
-  'hasCaptcha',
-  'publicKey',
-  'startPage',
-  'status',
-  'title',
-  '_id',
-  'responseMode',
-]
-
-/**
- * Shows the current form. If the form is for public use, more extensive scrubbing of admin details is carried out.
- * @param {RequestType} requestType - Whether this request is for admin use or public use of a form
- * @returns {function({Object}, {Object})} - A function that takes req, the express request object, and
- *   res, the express response object.
- */
-exports.read = (requestType) =>
-  /**
-   * ! Note that this function should not call any mongoose functions on req.form as it is possibly already a plain JSON object.
-   * Takes the form and replaces admin details with agency details, as well as scrubbing the form if the
-   * request is not for admin purposes.
-   * @param  {Object} req - Express request object
-   * @param  {Object} req.form - The form from the DB that was retrieved from a previous middleware function
-   * @param  {Object} res - Express response object
-   */
-  (req, res) => {
-    let form = req.form
-    let spcpSession = res.locals.spcpSession || {}
-    let myInfoError = res.locals.myInfoError
-
-    // Remove sensitive admin details
-    const adminFields = adminPublicFields.concat(
-      requestType === requestTypes.ADMIN && adminPrivateFields,
-    )
-    form.admin = _.pick(form.admin, adminFields)
-
-    // For non-admin forms, we have more extensive scrubbing of irrelevant fields
-    if (requestType !== requestTypes.ADMIN) {
-      form = _.pick(form, formPublicFields)
-    }
-
-    const isIntranetResult = IntranetFactory.isIntranetIp(getRequestIp(req))
-    let isIntranetUser = false
-    if (isIntranetResult.isOk()) {
-      isIntranetUser = isIntranetResult.value
-    }
-
-    // SP, CP and MyInfo are not available on intranet
-    if (
-      isIntranetUser &&
-      [AuthType.SP, AuthType.CP, AuthType.MyInfo].includes(form.authType)
-    ) {
-      logger.warn({
-        message:
-          'Attempting to access SingPass, CorpPass or MyInfo form from intranet',
-        meta: {
-          action: 'read',
-          formId: form._id,
-        },
-      })
-    }
-
-    return res.json({
-      form,
-      spcpSession,
-      myInfoError,
-      isIntranetUser,
-    })
-  }
-
-/**
- *    Form middleware used to set form in the request after
- *    grabbing it from MongoDB
- *    @param  {Object} req - Express request object
- *    @param  {Object} res - Express response object
- *    @param  {Object} next - Express next middleware function
- *    @param  {Object} id - Form ID
- *    @return {Void}
- */
-exports.formById = async function (req, res, next) {
-  let id = req.params && req.params.formId
-
-  if (!mongoose.Types.ObjectId.isValid(id)) {
-    return res.status(StatusCodes.BAD_REQUEST).json({
-      message: 'Form URL is invalid.',
-    })
-  }
-  try {
-    const form = await Form.getFullFormById(id)
-    if (!form) {
-      return res.status(StatusCodes.NOT_FOUND).json({
-        message: "Oops! We can't find the form you're looking for.",
-      })
-    } else {
-      // Remove sensitive information from User object
-      if (!form.admin) {
-        return res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({
-          message: 'Server error.',
-        })
-      }
-      req.form = form
-      return next()
-    }
-  } catch (err) {
-    logger.error({
-      message: 'Error retrieving form from database',
-      meta: {
-        action: 'formById',
-        ...createReqMeta(req),
-      },
-      error: err,
-    })
-    return next(err)
-  }
-}
diff --git a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.routes.spec.ts b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.routes.spec.ts
index b153537bf7..d251979576 100644
--- a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.routes.spec.ts
+++ b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.routes.spec.ts
@@ -1,23 +1,18 @@
 import SPCPAuthClient from '@opengovsg/spcp-auth-client'
-import { celebrate, Joi } from 'celebrate'
-import { Router } from 'express'
 import session, { Session } from 'supertest-session'
 import { mocked } from 'ts-jest/utils'
 
-import * as FormController from 'src/app/controllers/forms.server.controller'
-import * as EncryptSubmissionController from 'src/app/modules/submission/encrypt-submission/encrypt-submission.controller'
-import { CaptchaFactory } from 'src/app/services/captcha/captcha.factory'
-import { AuthType, BasicField, Status } from 'src/types'
+import { AuthType, Status } from 'src/types'
 
 import { setupApp } from 'tests/integration/helpers/express-setup'
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
+import { EncryptSubmissionRouter } from '../encrypt-submission.routes'
+
 jest.mock('@opengovsg/spcp-auth-client')
 const MockAuthClient = mocked(SPCPAuthClient, true)
 
-// TODO (#149): Import router instead of creating it here
 const SUBMISSIONS_ENDPT_BASE = '/v2/submissions/encrypt'
-const SUBMISSIONS_ENDPT = `${SUBMISSIONS_ENDPT_BASE}/:formId([a-fA-F0-9]{24})`
 
 const MOCK_ENCRYPTED_CONTENT = `${'a'.repeat(44)};${'a'.repeat(
   32,
@@ -29,61 +24,11 @@ const MOCK_SUBMISSION_BODY = {
   version: 1,
 }
 
-// TODO (#149): Import router instead of creating it here
-const EncryptSubmissionsRouter = Router()
-EncryptSubmissionsRouter.post(
-  SUBMISSIONS_ENDPT,
-  CaptchaFactory.validateCaptchaParams,
-  celebrate({
-    body: Joi.object({
-      responses: Joi.array()
-        .items(
-          Joi.object().keys({
-            _id: Joi.string().required(),
-            answer: Joi.string().allow('').required(),
-            fieldType: Joi.string()
-              .required()
-              .valid(...Object.values(BasicField)),
-            signature: Joi.string().allow(''),
-          }),
-        )
-        .required(),
-      encryptedContent: Joi.string()
-        .custom((value, helpers) => {
-          const parts = String(value).split(/;|:/)
-          if (
-            parts.length !== 3 ||
-            parts[0].length !== 44 || // public key
-            parts[1].length !== 32 || // nonce
-            !parts.every((part) => Joi.string().base64().validate(part))
-          ) {
-            return helpers.error('Invalid encryptedContent.')
-          }
-          return value
-        }, 'encryptedContent')
-        .required(),
-      attachments: Joi.object()
-        .pattern(
-          /^[a-fA-F0-9]{24}$/,
-          Joi.object().keys({
-            encryptedFile: Joi.object().keys({
-              binary: Joi.string().required(),
-              nonce: Joi.string().required(),
-              submissionPublicKey: Joi.string().required(),
-            }),
-          }),
-        )
-        .optional(),
-      isPreview: Joi.boolean().required(),
-      version: Joi.number().required(),
-    }),
-  }),
-  FormController.formById,
-  EncryptSubmissionController.handleEncryptedSubmission,
+const EncryptSubmissionsApp = setupApp(
+  SUBMISSIONS_ENDPT_BASE,
+  EncryptSubmissionRouter,
 )
 
-const EncryptSubmissionsApp = setupApp('/', EncryptSubmissionsRouter)
-
 describe('encrypt-submission.routes', () => {
   let request: Session
   const mockSpClient = mocked(MockAuthClient.mock.instances[0], true)
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
new file mode 100644
index 0000000000..f9a6a80fbe
--- /dev/null
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
@@ -0,0 +1,30 @@
+import { Router } from 'express'
+
+import { rateLimitConfig } from '../../../../config/config'
+import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
+import { limitRate } from '../../../utils/limit-rate'
+
+import * as EncryptSubmissionController from './encrypt-submission.controller'
+import * as EncryptSubmissionMiddleware from './encrypt-submission.middleware'
+
+export const EncryptSubmissionRouter = Router()
+
+/**
+ * Submit a form response, submit a form response, and stores the encrypted
+ * contents.
+ * Optionally, an autoreply confirming submission is sent back to the user, if
+ * an email address was given. SMS autoreplies for mobile number fields are also
+ * sent if the feature is enabled.
+ * @route POST /v2/submissions/encrypt/:formId
+ * @param response.body.required - contains the entire form submission
+ * @param captchaResponse.query - contains the reCAPTCHA response artifact, if any
+ * @returns 200 - submission made
+ * @returns 400 - submission has bad data and could not be processed
+ */
+EncryptSubmissionRouter.post(
+  '/:formId([a-fA-F0-9]{24})',
+  limitRate({ max: rateLimitConfig.submissions }),
+  CaptchaFactory.validateCaptchaParams,
+  EncryptSubmissionMiddleware.validateEncryptSubmissionParams,
+  EncryptSubmissionController.handleEncryptedSubmission,
+)
diff --git a/src/app/modules/submission/submission.routes.ts b/src/app/modules/submission/submission.routes.ts
index 6c45a90c9f..45f3baa271 100644
--- a/src/app/modules/submission/submission.routes.ts
+++ b/src/app/modules/submission/submission.routes.ts
@@ -1,6 +1,9 @@
 import { Router } from 'express'
 
 import { EmailSubmissionRouter } from './email-submission/email-submission.routes'
+import { EncryptSubmissionRouter } from './encrypt-submission/encrypt-submission.routes'
 
 export const SubmissionRouter = Router()
+
 SubmissionRouter.use('/email', EmailSubmissionRouter)
+SubmissionRouter.use('/encrypt', EncryptSubmissionRouter)
diff --git a/src/app/routes/public-forms.server.routes.js b/src/app/routes/public-forms.server.routes.js
index b3ed749508..d4731d0d9a 100644
--- a/src/app/routes/public-forms.server.routes.js
+++ b/src/app/routes/public-forms.server.routes.js
@@ -3,15 +3,8 @@
 /**
  * Module dependencies.
  */
-const forms = require('../../app/controllers/forms.server.controller')
 const { celebrate, Joi, Segments } = require('celebrate')
-const { CaptchaFactory } = require('../services/captcha/captcha.factory')
-const { limitRate } = require('../utils/limit-rate')
-const { rateLimitConfig } = require('../../config/config')
 const PublicFormController = require('../modules/form/public-form/public-form.controller')
-const EncryptSubmissionController = require('../modules/submission/encrypt-submission/encrypt-submission.controller')
-const EncryptSubmissionMiddleware = require('../modules/submission/encrypt-submission/encrypt-submission.middleware')
-
 module.exports = function (app) {
   /**
    * Redirect a form to the main index, with the specified path
@@ -125,33 +118,4 @@ module.exports = function (app) {
   app
     .route('/:formId([a-fA-F0-9]{24})/publicform')
     .get(PublicFormController.handleGetPublicForm)
-
-  /**
-   * On preview, submit a form response, and stores the encrypted contents. Optionally, an autoreply
-   * confirming submission is sent back to the user, if an email address
-   * was given. SMS autoreplies for mobile number fields are also sent if feature
-   * is enabled.
-   * Note that v2 endpoint no longer accepts body.captchaResponse
-   * Note that v2 endpoint accepts requests in content-type json, instead of content-type multi-part
-   * Note that v2 endpoint now requires body.version
-   * @route POST /v2/submissions/encrypt/{formId}
-   * @group forms - endpoints to serve forms
-   * @param {string} formId.path.required - the form id
-   * @param {string} response.body.required - contains the entire form submission
-   * @param {string} captchaResponse.query - contains the reCAPTCHA response artifact, if any
-   * @param {string} encryptedContent.body.required - contains the entire encrypted form submission
-   * @consumes multipart/form-data
-   * @produces application/json
-   * @returns {SubmissionResponse.model} 200 - submission made
-   * @returns {SubmissionResponse.model} 400 - submission has bad data and could not be processed
-   */
-  app
-    .route('/v2/submissions/encrypt/:formId([a-fA-F0-9]{24})')
-    .post(
-      limitRate({ max: rateLimitConfig.submissions }),
-      CaptchaFactory.validateCaptchaParams,
-      EncryptSubmissionMiddleware.validateEncryptSubmissionParams,
-      forms.formById,
-      EncryptSubmissionController.handleEncryptedSubmission,
-    )
 }
diff --git a/tests/unit/backend/.eslintrc b/tests/unit/backend/.eslintrc
deleted file mode 100644
index 8e33c17583..0000000000
--- a/tests/unit/backend/.eslintrc
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "env": {
-    "jasmine": true
-  },
-  "globals": {
-    "expect": true,
-    "sinon": true,
-    "spec": true,
-    "expectAsync": true
-  },
-  "overrides": [
-    {
-      "files": ["*.ts"],
-      "env": { "jest": true, "jasmine": false },
-      "extends": ["plugin:jest/recommended"]
-    }
-  ]
-}
diff --git a/tests/unit/backend/controllers/forms.server.controller.spec.js b/tests/unit/backend/controllers/forms.server.controller.spec.js
deleted file mode 100644
index ac0769282c..0000000000
--- a/tests/unit/backend/controllers/forms.server.controller.spec.js
+++ /dev/null
@@ -1,164 +0,0 @@
-const { StatusCodes } = require('http-status-codes')
-const mongoose = require('mongoose')
-const { ObjectId } = require('bson-ext')
-
-const dbHandler = require('../helpers/db-handler')
-const Form = dbHandler.makeModel('form.server.model', 'Form')
-
-const Controller = spec(
-  'dist/backend/app/controllers/forms.server.controller',
-  {
-    mongoose: Object.assign(mongoose, { '@noCallThru': true }),
-  },
-)
-
-describe('Form Controller', () => {
-  // Declare global variables
-  let req
-  let res
-  let testForm
-
-  beforeAll(async () => await dbHandler.connect())
-  afterEach(async () => await dbHandler.clearDatabase())
-  afterAll(async () => await dbHandler.closeDatabase())
-
-  beforeEach(async () => {
-    res = jasmine.createSpyObj('res', ['status', 'send', 'json'])
-
-    const { form, user } = await dbHandler.preloadCollections()
-    testForm = form
-    req = {
-      query: {},
-      params: {},
-      body: {},
-      session: {
-        user: {
-          _id: user._id,
-          email: user.email,
-        },
-      },
-      headers: {},
-      ip: '127.0.0.1',
-      get: () => this.ip,
-    }
-  })
-
-  describe('read (admin)', () => {
-    it('should send response with required args', () => {
-      req.form = testForm.toJSON()
-      res.locals = {
-        spcpSession: {},
-        myInfoError: {},
-      }
-      // Expected form should not contain sensitive user info
-      let expectedForm = testForm.toJSON()
-      expectedForm.admin = _.pick(testForm.admin, [
-        'agency',
-        'email',
-        'betaFlags',
-      ])
-      Controller.read(Controller.REQUEST_TYPE.ADMIN)(req, res)
-      expect(res.json).toHaveBeenCalledWith({
-        form: expectedForm,
-        spcpSession: res.locals.spcpSession,
-        myInfoError: res.locals.myInfoError,
-        isIntranetUser: false,
-      })
-    })
-  })
-
-  describe('read (public)', () => {
-    it('should send response with required args', () => {
-      req.form = testForm.toJSON()
-      res.locals = {
-        spcpSession: {},
-        myInfoError: {},
-      }
-
-      // Expected form should not contain sensitive user info
-      let expectedForm = testForm.toJSON()
-      expectedForm.admin = _.pick(testForm.admin, ['agency'])
-      // Expected form for public use should not contain certain things that are included in admin forms
-      expectedForm = _.pick(expectedForm, [
-        'admin',
-        'authType',
-        'endPage',
-        'esrvcId',
-        'form_fields',
-        'form_logics',
-        'hasCaptcha',
-        'publicKey',
-        'startPage',
-        'status',
-        'title',
-        '_id',
-        'responseMode',
-      ])
-
-      Controller.read(Controller.REQUEST_TYPE.PUBLIC)(req, res)
-      expect(res.json).toHaveBeenCalledWith({
-        form: expectedForm,
-        spcpSession: res.locals.spcpSession,
-        myInfoError: res.locals.myInfoError,
-        isIntranetUser: false,
-      })
-    })
-  })
-
-  describe('formById', () => {
-    it('should return a 400 error if form id is invalid', () => {
-      let id = 'invalid_id'
-      res.status.and.callFake(() => {
-        return res
-      })
-      Controller.formById(req, res, null, id)
-      expect(res.status).toHaveBeenCalledWith(StatusCodes.BAD_REQUEST)
-    })
-
-    it('should return a 404 error if form id is not found', (done) => {
-      req.params.formId = mongoose.Types.ObjectId()
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(StatusCodes.NOT_FOUND)
-        done()
-        return res
-      })
-      Controller.formById(req, res, null)
-    })
-
-    it('should return a 500 error if admin is not a valid user', (done) => {
-      let invalidForm = new Form({
-        title: 'Test Form',
-        emails: 'test@test.gov.sg',
-        admin: new ObjectId(), // Random admin id
-      })
-      req.params.formId = invalidForm._id
-      res.status.and.callFake(() => {
-        expect(res.status).toHaveBeenCalledWith(
-          StatusCodes.INTERNAL_SERVER_ERROR,
-        )
-        done()
-        return res
-      })
-
-      // Disable validation since invalid admin id will prevent document from
-      // being saved if validation is turned on.
-      // This test is for backwards compatibility before form creation had the
-      // user validation stage.
-      invalidForm.save({ validateBeforeSave: false }).then(() => {
-        Controller.formById(req, res, null)
-      })
-    })
-
-    it('should populate form and pass on to next middleware if valid', (done) => {
-      req.params.formId = testForm._id
-      res.status.and.callFake((_args) => {
-        return res
-      })
-      let next = jasmine.createSpy().and.callFake(() => {
-        expect(next).toHaveBeenCalled()
-        done()
-      })
-      Controller.formById(req, res, next)
-    })
-  })
-})
diff --git a/tests/unit/backend/helpers/db-handler.js b/tests/unit/backend/helpers/db-handler.js
deleted file mode 100644
index 1e6b3fb539..0000000000
--- a/tests/unit/backend/helpers/db-handler.js
+++ /dev/null
@@ -1,132 +0,0 @@
-const mongoose = require('mongoose')
-const { MongoMemoryServer } = require('mongodb-memory-server-core')
-const { ObjectID } = require('bson-ext')
-
-if (!process.env.MONGO_BINARY_VERSION) {
-  console.error('Environment var MONGO_BINARY_VERSION is missing')
-  process.exit(1)
-}
-const mongod = new MongoMemoryServer({
-  binary: { version: String(process.env.MONGO_BINARY_VERSION) },
-})
-
-/**
- * Connect to the in-memory database.
- */
-const connect = async () => {
-  const uri = await mongod.getConnectionString()
-
-  const mongooseOpts = {
-    useNewUrlParser: true,
-    useUnifiedTopology: true,
-  }
-
-  await mongoose.connect(uri, mongooseOpts)
-}
-
-/**
- * Drop database, close the connection and stop mongod.
- */
-const closeDatabase = async () => {
-  await mongoose.connection.dropDatabase()
-  await mongoose.connection.close()
-  await mongod.stop()
-}
-
-/**
- * Remove all the data for all db collections.
- */
-const clearDatabase = async () => {
-  const collections = mongoose.connection.collections
-
-  for (const key in collections) {
-    const collection = collections[key]
-    await collection.deleteMany()
-  }
-}
-
-// TODO: Remove this function and all references once all schemas are using the
-// default mongoose instance.
-/**
- * Creates Mongoose model.
- * @param {string} modelFilename Name of file which exports model in app/models
- * @param {string} modelName Name of exported model
- */
-const makeModel = (modelFilename, modelName) => {
-  if (modelName !== undefined && modelName !== null) {
-    // check if model has already been compiled
-    try {
-      return mongoose.connection.model(modelName)
-    } catch (error) {
-      if (error.name !== 'MissingSchemaError') {
-        console.error(error)
-      }
-      // else fail silently as we will create the model
-    }
-  }
-
-  // Need this try catch block as some schemas may have been converted to
-  // TypeScript and use default exports instead, or does not require a
-  // connection
-  try {
-    return require(`../../../../dist/backend/app/models/${modelFilename}`)(
-      mongoose,
-    )
-  } catch (e) {
-    try {
-      return require(`../../../../dist/backend/app/models/${modelFilename}`).default(
-        mongoose,
-      )
-    } catch (e) {
-      return require(`../../../../dist/backend/app/models/${modelFilename}`)
-        .default
-    }
-  }
-}
-
-const preloadCollections = async (
-  { userId, saveForm } = { saveForm: true },
-) => {
-  const Agency = makeModel('agency.server.model', 'Agency')
-  const User = makeModel('user.server.model', 'User')
-  const Form = makeModel('form.server.model', 'Form')
-
-  const adminId = userId ? new ObjectID(userId) : new ObjectID()
-
-  const agency = new Agency({
-    shortName: 'govtest',
-    fullName: 'Government Testing Agency',
-    emailDomain: 'test.gov.sg',
-    logo: '/invalid-path/test.jpg',
-  })
-  const user = new User({
-    email: 'test@test.gov.sg',
-    _id: adminId,
-    agency: agency._id,
-  })
-  const form = new Form({
-    title: 'Test Form',
-    emails: 'test@test.gov.sg',
-    admin: user._id,
-  })
-
-  await agency.save()
-  await user.save()
-  if (saveForm) {
-    await form.save()
-  }
-
-  return {
-    agency,
-    user,
-    form,
-  }
-}
-
-module.exports = {
-  connect,
-  closeDatabase,
-  clearDatabase,
-  makeModel,
-  preloadCollections,
-}
diff --git a/tests/unit/backend/helpers/index.js b/tests/unit/backend/helpers/index.js
deleted file mode 100644
index 443b80bbac..0000000000
--- a/tests/unit/backend/helpers/index.js
+++ /dev/null
@@ -1,14 +0,0 @@
-// Increase upper bound for time-out so tests don't fail on travis
-jasmine.DEFAULT_TIMEOUT_INTERVAL = 100 * 1000
-
-const proxyquire = require('proxyquire')
-
-global.spec = (path, proxy) => {
-  let fullPath = `${process.env.PWD}/${path}`
-  if (proxy) {
-    return proxyquire(fullPath, proxy)
-  }
-  return require(fullPath)
-}
-
-global._ = require('lodash')
diff --git a/tests/unit/backend/helpers/reporter.js b/tests/unit/backend/helpers/reporter.js
deleted file mode 100644
index 0f180055a3..0000000000
--- a/tests/unit/backend/helpers/reporter.js
+++ /dev/null
@@ -1,11 +0,0 @@
-const { SpecReporter } = require('jasmine-spec-reporter')
-// remove default reporter logs
-jasmine.getEnv().clearReporters()
-// add jasmine-spec-reporter
-jasmine.getEnv().addReporter(
-  new SpecReporter({
-    spec: {
-      displayPending: true,
-    },
-  }),
-)
diff --git a/tests/unit/backend/helpers/roles.js b/tests/unit/backend/helpers/roles.js
deleted file mode 100644
index 3fab2c7373..0000000000
--- a/tests/unit/backend/helpers/roles.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Used for creating permissionList for test files more succinctly
-let collabPermissions = { write: true }
-
-module.exports.collaborator = (email) => {
-  return Object.assign({ email }, collabPermissions)
-}
diff --git a/tests/unit/backend/jasmine.json b/tests/unit/backend/jasmine.json
deleted file mode 100644
index 2b706accb4..0000000000
--- a/tests/unit/backend/jasmine.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "spec_dir": "tests/unit/backend",
-  "spec_files": [
-    "**/*[sS]pec.js"
-  ],
-  "helpers": [
-    "helpers/**/*.js"
-  ],
-  "stopSpecOnExpectationFailure": false,
-  "random": true
-}
\ No newline at end of file

From 9c96a320d21ba0d69c494b9977bcda7fabc005be Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 8 Apr 2021 22:27:17 +0800
Subject: [PATCH 31/75] fix: clear current worker pool on download (#1590)

this prevents messages from being posted to dead workers
---
 src/public/modules/forms/services/submissions.client.factory.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/public/modules/forms/services/submissions.client.factory.js b/src/public/modules/forms/services/submissions.client.factory.js
index 815560dcff..744005024f 100644
--- a/src/public/modules/forms/services/submissions.client.factory.js
+++ b/src/public/modules/forms/services/submissions.client.factory.js
@@ -274,6 +274,8 @@ function SubmissionsFactory(
       downloadAttachments,
       secretKey,
     ) {
+      // Clear current worker pool.
+      workerPool = []
       // Creates a new AbortController for every request
       downloadAbortController = new AbortController()
 

From d3ee8c0150f9a9697f32c16c3f78b4f4bed0b66f Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Fri, 9 Apr 2021 08:47:57 +0800
Subject: [PATCH 32/75] refactor: convert Bounce module to use neverthrow
 (#1591)

* ref: re-implement service with neverthrow

* ref: update controller to neverthrow implementation

* ref: avoid calling MailService when no recipients

* test: update service tests

* test: update controller tests

* chore: remove unnecessary eslint-disable
---
 .../__tests__/bounce.controller.spec.ts       | 154 ++++-----
 .../bounce/__tests__/bounce.service.spec.ts   | 194 +++++++----
 src/app/modules/bounce/bounce.controller.ts   | 184 +++++-----
 src/app/modules/bounce/bounce.errors.ts       |  63 ++++
 src/app/modules/bounce/bounce.service.ts      | 320 ++++++++++++------
 src/app/modules/bounce/bounce.util.ts         |  43 +--
 .../bounce.types.ts => user/user.types.ts}    |   5 -
 src/app/modules/user/user.utils.ts            |  14 +
 8 files changed, 584 insertions(+), 393 deletions(-)
 create mode 100644 src/app/modules/bounce/bounce.errors.ts
 rename src/app/modules/{bounce/bounce.types.ts => user/user.types.ts} (59%)

diff --git a/src/app/modules/bounce/__tests__/bounce.controller.spec.ts b/src/app/modules/bounce/__tests__/bounce.controller.spec.ts
index 75244e8e47..85e91c8e29 100644
--- a/src/app/modules/bounce/__tests__/bounce.controller.spec.ts
+++ b/src/app/modules/bounce/__tests__/bounce.controller.spec.ts
@@ -1,9 +1,10 @@
 import { ObjectId } from 'bson'
 import mongoose from 'mongoose'
-import { errAsync, okAsync } from 'neverthrow'
+import { errAsync, ok, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
 import getFormModel from 'src/app/models/form.server.model'
+import { handleSns } from 'src/app/modules/bounce/bounce.controller'
 import getBounceModel from 'src/app/modules/bounce/bounce.model'
 import * as BounceService from 'src/app/modules/bounce/bounce.service'
 import * as FormService from 'src/app/modules/form/form.service'
@@ -19,6 +20,7 @@ import dbHandler from 'tests/unit/backend/helpers/jest-db'
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
 import { DatabaseError } from '../../core/core.errors'
+import { InvalidNotificationError } from '../bounce.errors'
 
 const Bounce = getBounceModel(mongoose)
 const FormModel = getFormModel(mongoose)
@@ -39,8 +41,6 @@ jest.doMock('mongoose', () => ({
     VersionError: MockVersionError,
   },
 }))
-// eslint-disable-next-line import/first
-import { handleSns } from 'src/app/modules/bounce/bounce.controller'
 
 const MOCK_NOTIFICATION = { notificationType: 'Bounce' } as IEmailNotification
 const MOCK_REQ = expressHandler.mockRequest({
@@ -100,49 +100,39 @@ describe('handleSns', () => {
   beforeEach(() => {
     jest.resetAllMocks()
     // Default mocks
-    MockBounceService.isValidSnsRequest.mockResolvedValue(true)
+    MockBounceService.validateSnsRequest.mockReturnValue(okAsync(true))
+    MockBounceService.safeParseNotification.mockReturnValue(
+      ok(MOCK_NOTIFICATION),
+    )
     MockBounceService.extractEmailType.mockReturnValue(EmailType.AdminResponse)
-    MockBounceService.getUpdatedBounceDoc.mockResolvedValue(mockBounceDoc)
+    MockBounceService.getUpdatedBounceDoc.mockReturnValue(
+      okAsync(mockBounceDoc),
+    )
     MockFormService.retrieveFullFormById.mockResolvedValue(okAsync(mockForm))
     mockBounceDoc.isCriticalBounce.mockReturnValue(true)
-    MockBounceService.getEditorsWithContactNumbers.mockResolvedValue(
-      MOCK_CONTACTS,
+    MockBounceService.getEditorsWithContactNumbers.mockReturnValue(
+      okAsync(MOCK_CONTACTS),
     )
     mockBounceDoc.hasNotified.mockReturnValue(false)
-    MockBounceService.notifyAdminsOfBounce.mockResolvedValue({
-      emailRecipients: MOCK_EMAIL_RECIPIENTS,
-      smsRecipients: MOCK_CONTACTS,
-    })
+    MockBounceService.sendEmailBounceNotification.mockReturnValue(
+      okAsync(MOCK_EMAIL_RECIPIENTS),
+    )
+    MockBounceService.sendSmsBounceNotification.mockReturnValue(
+      okAsync(MOCK_CONTACTS),
+    )
+    MockBounceService.saveBounceDoc.mockReturnValue(okAsync(mockBounceDoc))
     // Note that this is true to simulate permanent bounce
     mockBounceDoc.areAllPermanentBounces.mockReturnValue(true)
   })
 
   afterEach(async () => await dbHandler.clearDatabase())
 
-  it('should return immediately when requests are invalid', async () => {
-    MockBounceService.isValidSnsRequest.mockResolvedValueOnce(false)
-    await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
-      MOCK_REQ.body,
+  it('should return 401 when requests are invalid', async () => {
+    MockBounceService.validateSnsRequest.mockReturnValueOnce(
+      errAsync(new InvalidNotificationError()),
     )
-    expect(MockBounceService.logEmailNotification).not.toHaveBeenCalled()
-    expect(MockFormService.retrieveFullFormById).not.toHaveBeenCalled()
-    expect(
-      MockBounceService.getEditorsWithContactNumbers,
-    ).not.toHaveBeenCalled()
-    expect(MockBounceService.notifyAdminsOfBounce).not.toHaveBeenCalled()
-    expect(MockFormService.deactivateForm).not.toHaveBeenCalled()
-    expect(MockBounceService.notifyAdminsOfDeactivation).not.toHaveBeenCalled()
-    expect(MockBounceService.logCriticalBounce).not.toHaveBeenCalled()
-    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(403)
-  })
-
-  it('should return 400 when errors are thrown in isValidSnsRequest', async () => {
-    MockBounceService.isValidSnsRequest.mockImplementation(() => {
-      throw new Error()
-    })
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).not.toHaveBeenCalled()
@@ -150,11 +140,12 @@ describe('handleSns', () => {
     expect(
       MockBounceService.getEditorsWithContactNumbers,
     ).not.toHaveBeenCalled()
-    expect(MockBounceService.notifyAdminsOfBounce).not.toHaveBeenCalled()
+    expect(MockBounceService.sendEmailBounceNotification).not.toHaveBeenCalled()
+    expect(MockBounceService.sendSmsBounceNotification).not.toHaveBeenCalled()
     expect(MockFormService.deactivateForm).not.toHaveBeenCalled()
     expect(MockBounceService.notifyAdminsOfDeactivation).not.toHaveBeenCalled()
     expect(MockBounceService.logCriticalBounce).not.toHaveBeenCalled()
-    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(400)
+    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(401)
   })
 
   it('should call services correctly for permanent critical bounces', async () => {
@@ -162,7 +153,7 @@ describe('handleSns', () => {
     // to mocks are needed
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
 
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -181,7 +172,11 @@ describe('handleSns', () => {
     expect(MockBounceService.getEditorsWithContactNumbers).toHaveBeenCalledWith(
       mockForm,
     )
-    expect(MockBounceService.notifyAdminsOfBounce).toHaveBeenCalledWith(
+    expect(MockBounceService.sendEmailBounceNotification).toHaveBeenCalledWith(
+      mockBounceDoc,
+      mockForm,
+    )
+    expect(MockBounceService.sendSmsBounceNotification).toHaveBeenCalledWith(
       mockBounceDoc,
       mockForm,
       MOCK_CONTACTS,
@@ -205,7 +200,7 @@ describe('handleSns', () => {
       autoSmsRecipients: MOCK_CONTACTS,
       hasDeactivated: true,
     })
-    expect(mockBounceDoc.save).toHaveBeenCalled()
+    expect(MockBounceService.saveBounceDoc).toHaveBeenCalledWith(mockBounceDoc)
     expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(200)
   })
 
@@ -215,7 +210,7 @@ describe('handleSns', () => {
 
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
 
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -234,7 +229,11 @@ describe('handleSns', () => {
     expect(MockBounceService.getEditorsWithContactNumbers).toHaveBeenCalledWith(
       mockForm,
     )
-    expect(MockBounceService.notifyAdminsOfBounce).toHaveBeenCalledWith(
+    expect(MockBounceService.sendEmailBounceNotification).toHaveBeenCalledWith(
+      mockBounceDoc,
+      mockForm,
+    )
+    expect(MockBounceService.sendSmsBounceNotification).toHaveBeenCalledWith(
       mockBounceDoc,
       mockForm,
       MOCK_CONTACTS,
@@ -254,16 +253,16 @@ describe('handleSns', () => {
       autoSmsRecipients: MOCK_CONTACTS,
       hasDeactivated: false,
     })
-    expect(mockBounceDoc.save).toHaveBeenCalled()
+    expect(MockBounceService.saveBounceDoc).toHaveBeenCalledWith(mockBounceDoc)
     expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(200)
   })
 
-  it('should return 400 when errors are thrown in getUpdatedBounceDoc', async () => {
-    MockBounceService.getUpdatedBounceDoc.mockImplementationOnce(() => {
-      throw new Error()
-    })
+  it('should return 200 even when errors are thrown in getUpdatedBounceDoc', async () => {
+    MockBounceService.getUpdatedBounceDoc.mockReturnValueOnce(
+      errAsync(new DatabaseError()),
+    )
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -275,7 +274,7 @@ describe('handleSns', () => {
     expect(MockBounceService.getUpdatedBounceDoc).toHaveBeenCalledWith(
       MOCK_NOTIFICATION,
     )
-    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(400)
+    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(200)
   })
 
   it('should return 500 early if error occurs while retrieving form', async () => {
@@ -285,7 +284,7 @@ describe('handleSns', () => {
 
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
 
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -303,19 +302,20 @@ describe('handleSns', () => {
     expect(
       MockBounceService.getEditorsWithContactNumbers,
     ).not.toHaveBeenCalled()
-    expect(MockBounceService.notifyAdminsOfBounce).not.toHaveBeenCalled()
+    expect(MockBounceService.sendEmailBounceNotification).not.toHaveBeenCalled()
+    expect(MockBounceService.sendSmsBounceNotification).not.toHaveBeenCalled()
     expect(MockBounceService.notifyAdminsOfDeactivation).not.toHaveBeenCalled()
     expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(500)
   })
 
-  it('should return 400 when errors are thrown in deactivateForm', async () => {
-    MockFormService.deactivateForm.mockImplementationOnce(() => {
-      throw new Error()
-    })
+  it('should return 200 even when errors are returned from deactivateForm', async () => {
+    MockFormService.deactivateForm.mockReturnValueOnce(
+      errAsync(new DatabaseError()),
+    )
 
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
 
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -338,41 +338,7 @@ describe('handleSns', () => {
     expect(MockFormService.deactivateForm).toHaveBeenCalledWith(
       mockBounceDoc.formId,
     )
-    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(400)
-  })
-
-  it('should return 400 when errors are thrown in notifyAdminsOfBounce', async () => {
-    MockBounceService.notifyAdminsOfBounce.mockImplementationOnce(() => {
-      throw new Error()
-    })
-
-    await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
-
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
-      MOCK_REQ.body,
-    )
-    expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
-      MOCK_NOTIFICATION,
-    )
-    expect(MockBounceService.extractEmailType).toHaveBeenCalledWith(
-      MOCK_NOTIFICATION,
-    )
-    expect(MockBounceService.getUpdatedBounceDoc).toHaveBeenCalledWith(
-      MOCK_NOTIFICATION,
-    )
-    expect(MockFormService.retrieveFullFormById).toHaveBeenCalledWith(
-      mockBounceDoc.formId,
-    )
-    expect(mockBounceDoc.isCriticalBounce).toHaveBeenCalled()
-    expect(MockBounceService.getEditorsWithContactNumbers).toHaveBeenCalledWith(
-      mockForm,
-    )
-    expect(MockBounceService.notifyAdminsOfBounce).toHaveBeenCalledWith(
-      mockBounceDoc,
-      mockForm,
-      MOCK_CONTACTS,
-    )
-    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(400)
+    expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(200)
   })
 
   it('should return 200 when VersionErrors are thrown', async () => {
@@ -382,7 +348,7 @@ describe('handleSns', () => {
 
     await handleSns(MOCK_REQ, MOCK_RES, jest.fn())
 
-    expect(MockBounceService.isValidSnsRequest).toHaveBeenCalledWith(
+    expect(MockBounceService.validateSnsRequest).toHaveBeenCalledWith(
       MOCK_REQ.body,
     )
     expect(MockBounceService.logEmailNotification).toHaveBeenCalledWith(
@@ -405,7 +371,11 @@ describe('handleSns', () => {
     expect(MockFormService.deactivateForm).toHaveBeenCalledWith(
       mockBounceDoc.formId,
     )
-    expect(MockBounceService.notifyAdminsOfBounce).toHaveBeenCalledWith(
+    expect(MockBounceService.sendEmailBounceNotification).toHaveBeenCalledWith(
+      mockBounceDoc,
+      mockForm,
+    )
+    expect(MockBounceService.sendSmsBounceNotification).toHaveBeenCalledWith(
       mockBounceDoc,
       mockForm,
       MOCK_CONTACTS,
@@ -421,7 +391,7 @@ describe('handleSns', () => {
       autoSmsRecipients: MOCK_CONTACTS,
       hasDeactivated: true,
     })
-    expect(mockBounceDoc.save).toHaveBeenCalled()
+    expect(MockBounceService.saveBounceDoc).toHaveBeenCalledWith(mockBounceDoc)
     expect(MOCK_RES.sendStatus).toHaveBeenCalledWith(200)
   })
 })
diff --git a/src/app/modules/bounce/__tests__/bounce.service.spec.ts b/src/app/modules/bounce/__tests__/bounce.service.spec.ts
index f29fb5306f..8e5e773660 100644
--- a/src/app/modules/bounce/__tests__/bounce.service.spec.ts
+++ b/src/app/modules/bounce/__tests__/bounce.service.spec.ts
@@ -25,7 +25,7 @@ import dbHandler from 'tests/unit/backend/helpers/jest-db'
 import getMockLogger from 'tests/unit/backend/helpers/jest-logger'
 
 import { DatabaseError } from '../../core/core.errors'
-import { UserWithContactNumber } from '../bounce.types'
+import { UserWithContactNumber } from '../../user/user.types'
 
 import { makeBounceNotification, MOCK_SNS_BODY } from './bounce-test-helpers'
 
@@ -52,21 +52,17 @@ MockLoggerModule.createLoggerWithLabel.mockReturnValue(mockLogger)
 
 // Import modules which depend on config last so that mocks get imported correctly
 import getBounceModel from 'src/app/modules/bounce/bounce.model'
-import {
-  extractEmailType,
-  getEditorsWithContactNumbers,
-  getUpdatedBounceDoc,
-  isValidSnsRequest,
-  logCriticalBounce,
-  logEmailNotification,
-  notifyAdminsOfBounce,
-  notifyAdminsOfDeactivation,
-} from 'src/app/modules/bounce/bounce.service'
+import * as BounceService from 'src/app/modules/bounce/bounce.service'
 import {
   InvalidNumberError,
   SmsSendError,
 } from 'src/app/services/sms/sms.errors'
 
+import {
+  InvalidNotificationError,
+  MissingEmailHeadersError,
+} from '../bounce.errors'
+
 const Form = getFormModel(mongoose)
 const Bounce = getBounceModel(mongoose)
 
@@ -87,6 +83,10 @@ const MOCK_SUBMISSION_ID = new ObjectId()
 describe('BounceService', () => {
   beforeAll(async () => await dbHandler.connect())
 
+  beforeEach(() => {
+    MockMailService.sendBounceNotification.mockReturnValue(okAsync(true))
+  })
+
   afterEach(async () => {
     await dbHandler.clearDatabase()
     jest.clearAllMocks()
@@ -99,7 +99,9 @@ describe('BounceService', () => {
       const notification = makeBounceNotification({
         emailType: EmailType.AdminResponse,
       })
-      expect(extractEmailType(notification)).toBe(EmailType.AdminResponse)
+      expect(BounceService.extractEmailType(notification)).toBe(
+        EmailType.AdminResponse,
+      )
     })
   })
 
@@ -112,7 +114,7 @@ describe('BounceService', () => {
       await dbHandler.clearDatabase()
     })
 
-    it('should return null when there is no form ID', async () => {
+    it('should return MissingEmailHeadersError when there is no form ID', async () => {
       const notification = makeBounceNotification()
       const header = notification.mail.headers.find(
         (header) => header.name === EMAIL_HEADERS.formId,
@@ -121,8 +123,8 @@ describe('BounceService', () => {
       if (header) {
         header.value = ''
       }
-      const result = await getUpdatedBounceDoc(notification)
-      expect(result).toBeNull()
+      const result = await BounceService.getUpdatedBounceDoc(notification)
+      expect(result._unsafeUnwrapErr()).toEqual(new MissingEmailHeadersError())
     })
 
     it('should call updateBounceInfo if the document exists', async () => {
@@ -133,8 +135,8 @@ describe('BounceService', () => {
       const notification = makeBounceNotification({
         formId: MOCK_FORM_ID,
       })
-      const result = await getUpdatedBounceDoc(notification)
-      expect(result?.toObject()).toEqual(
+      const result = await BounceService.getUpdatedBounceDoc(notification)
+      expect(result._unsafeUnwrap().toObject()).toEqual(
         bounceDoc.updateBounceInfo(notification).toObject(),
       )
     })
@@ -144,8 +146,8 @@ describe('BounceService', () => {
       const notification = makeBounceNotification({
         formId: MOCK_FORM_ID,
       })
-      const result = await getUpdatedBounceDoc(notification)
-      const actual = pick(result?.toObject(), [
+      const result = await BounceService.getUpdatedBounceDoc(notification)
+      const actual = pick(result._unsafeUnwrap().toObject(), [
         'formId',
         'bounces',
         'hasAutoEmailed',
@@ -178,7 +180,7 @@ describe('BounceService', () => {
         bounceType: BounceType.Transient,
         emailType: EmailType.EmailConfirmation,
       })
-      logEmailNotification(notification)
+      BounceService.logEmailNotification(notification)
       expect(mockLogger.info).not.toHaveBeenCalled()
       expect(mockLogger.warn).not.toHaveBeenCalled()
       expect(mockShortTermLogger.info).toHaveBeenCalledWith(notification)
@@ -195,7 +197,7 @@ describe('BounceService', () => {
         bounceType: BounceType.Transient,
         emailType: EmailType.AdminResponse,
       })
-      logEmailNotification(notification)
+      BounceService.logEmailNotification(notification)
       expect(mockLogger.info).toHaveBeenCalledWith({
         message: 'Email notification',
         meta: {
@@ -218,7 +220,7 @@ describe('BounceService', () => {
         bounceType: BounceType.Transient,
         emailType: EmailType.LoginOtp,
       })
-      logEmailNotification(notification)
+      BounceService.logEmailNotification(notification)
       expect(mockLogger.info).toHaveBeenCalledWith({
         message: 'Email notification',
         meta: {
@@ -241,7 +243,7 @@ describe('BounceService', () => {
         bounceType: BounceType.Transient,
         emailType: EmailType.AdminBounce,
       })
-      logEmailNotification(notification)
+      BounceService.logEmailNotification(notification)
       expect(mockLogger.info).toHaveBeenCalledWith({
         message: 'Email notification',
         meta: {
@@ -264,14 +266,14 @@ describe('BounceService', () => {
         bounceType: BounceType.Transient,
         emailType: EmailType.VerificationOtp,
       })
-      logEmailNotification(notification)
+      BounceService.logEmailNotification(notification)
       expect(mockLogger.info).not.toHaveBeenCalled()
       expect(mockLogger.warn).not.toHaveBeenCalled()
       expect(mockShortTermLogger.info).toHaveBeenCalledWith(notification)
     })
   })
 
-  describe('notifyAdminsOfBounce', () => {
+  describe('sendEmailBounceNotification', () => {
     const MOCK_FORM_TITLE = 'FormTitle'
     let testUser: IUserSchema
 
@@ -282,10 +284,6 @@ describe('BounceService', () => {
       testUser = user
     })
 
-    beforeEach(async () => {
-      jest.resetAllMocks()
-    })
-
     it('should auto-email when admin is not email recipient', async () => {
       const form = (await new Form({
         admin: testUser._id,
@@ -300,7 +298,10 @@ describe('BounceService', () => {
         ],
       })
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [])
+      const notifiedRecipients = await BounceService.sendEmailBounceNotification(
+        bounceDoc,
+        form,
+      )
 
       expect(MockMailService.sendBounceNotification).toHaveBeenCalledWith({
         emailRecipients: [testUser.email],
@@ -309,7 +310,7 @@ describe('BounceService', () => {
         formTitle: form.title,
         formId: form._id,
       })
-      expect(notifiedRecipients.emailRecipients).toEqual([testUser.email])
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([testUser.email])
     })
 
     it('should auto-email when any collaborator is not email recipient', async () => {
@@ -328,7 +329,10 @@ describe('BounceService', () => {
         ],
       })
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [])
+      const notifiedRecipients = await BounceService.sendEmailBounceNotification(
+        bounceDoc,
+        form,
+      )
 
       expect(MockMailService.sendBounceNotification).toHaveBeenCalledWith({
         emailRecipients: [collabEmail],
@@ -337,7 +341,7 @@ describe('BounceService', () => {
         formTitle: form.title,
         formId: form._id,
       })
-      expect(notifiedRecipients.emailRecipients).toEqual([collabEmail])
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([collabEmail])
     })
 
     it('should not auto-email when admin is email recipient', async () => {
@@ -354,10 +358,13 @@ describe('BounceService', () => {
         ],
       })
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [])
+      const notifiedRecipients = await BounceService.sendEmailBounceNotification(
+        bounceDoc,
+        form,
+      )
 
       expect(MockMailService.sendBounceNotification).not.toHaveBeenCalled()
-      expect(notifiedRecipients.emailRecipients).toEqual([])
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([])
     })
 
     it('should not auto-email when all collabs are email recipients', async () => {
@@ -377,10 +384,29 @@ describe('BounceService', () => {
         ],
       })
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [])
+      const notifiedRecipients = await BounceService.sendEmailBounceNotification(
+        bounceDoc,
+        form,
+      )
 
       expect(MockMailService.sendBounceNotification).not.toHaveBeenCalled()
-      expect(notifiedRecipients.emailRecipients).toEqual([])
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([])
+    })
+  })
+
+  describe('sendSmsBounceNotification', () => {
+    const MOCK_FORM_TITLE = 'FormTitle'
+    let testUser: IUserSchema
+
+    beforeEach(async () => {
+      const { user } = await dbHandler.insertFormCollectionReqs({
+        userId: MOCK_ADMIN_ID,
+      })
+      testUser = user
+    })
+
+    beforeEach(async () => {
+      jest.resetAllMocks()
     })
 
     it('should send text for all SMS recipients and return successful ones', async () => {
@@ -396,10 +422,11 @@ describe('BounceService', () => {
       })
       MockSmsFactory.sendBouncedSubmissionSms.mockReturnValue(okAsync(true))
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [
-        MOCK_CONTACT,
-        MOCK_CONTACT_2,
-      ])
+      const notifiedRecipients = await BounceService.sendSmsBounceNotification(
+        bounceDoc,
+        form,
+        [MOCK_CONTACT, MOCK_CONTACT_2],
+      )
 
       expect(MockSmsFactory.sendBouncedSubmissionSms).toHaveBeenCalledTimes(2)
       expect(MockSmsFactory.sendBouncedSubmissionSms).toHaveBeenCalledWith({
@@ -418,7 +445,7 @@ describe('BounceService', () => {
         recipient: MOCK_CONTACT_2.contact,
         recipientEmail: MOCK_CONTACT_2.email,
       })
-      expect(notifiedRecipients.smsRecipients).toEqual([
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([
         MOCK_CONTACT,
         MOCK_CONTACT_2,
       ])
@@ -439,10 +466,11 @@ describe('BounceService', () => {
         .mockReturnValueOnce(okAsync(true))
         .mockReturnValueOnce(errAsync(new InvalidNumberError()))
 
-      const notifiedRecipients = await notifyAdminsOfBounce(bounceDoc, form, [
-        MOCK_CONTACT,
-        MOCK_CONTACT_2,
-      ])
+      const notifiedRecipients = await BounceService.sendSmsBounceNotification(
+        bounceDoc,
+        form,
+        [MOCK_CONTACT, MOCK_CONTACT_2],
+      )
 
       expect(MockSmsFactory.sendBouncedSubmissionSms).toHaveBeenCalledTimes(2)
       expect(MockSmsFactory.sendBouncedSubmissionSms).toHaveBeenCalledWith({
@@ -461,7 +489,7 @@ describe('BounceService', () => {
         recipient: MOCK_CONTACT_2.contact,
         recipientEmail: MOCK_CONTACT_2.email,
       })
-      expect(notifiedRecipients.smsRecipients).toEqual([MOCK_CONTACT])
+      expect(notifiedRecipients._unsafeUnwrap()).toEqual([MOCK_CONTACT])
     })
   })
 
@@ -488,7 +516,7 @@ describe('BounceService', () => {
       })
       const autoEmailRecipients = [MOCK_EMAIL, MOCK_EMAIL_2]
       const autoSmsRecipients = [MOCK_CONTACT, MOCK_CONTACT_2]
-      logCriticalBounce({
+      BounceService.logCriticalBounce({
         bounceDoc,
         notification: snsInfo,
         autoEmailRecipients,
@@ -533,7 +561,7 @@ describe('BounceService', () => {
       })
       const autoEmailRecipients: string[] = []
       const autoSmsRecipients = [MOCK_CONTACT, MOCK_CONTACT_2]
-      logCriticalBounce({
+      BounceService.logCriticalBounce({
         bounceDoc,
         notification: snsInfo,
         autoEmailRecipients,
@@ -578,7 +606,7 @@ describe('BounceService', () => {
       })
       const autoEmailRecipients: string[] = []
       const autoSmsRecipients = [MOCK_CONTACT, MOCK_CONTACT_2]
-      logCriticalBounce({
+      BounceService.logCriticalBounce({
         bounceDoc,
         notification: snsInfo,
         autoEmailRecipients,
@@ -620,7 +648,7 @@ describe('BounceService', () => {
       })
       const autoEmailRecipients: string[] = []
       const autoSmsRecipients: UserWithContactNumber[] = []
-      logCriticalBounce({
+      BounceService.logCriticalBounce({
         bounceDoc,
         notification: snsInfo,
         autoEmailRecipients,
@@ -662,7 +690,7 @@ describe('BounceService', () => {
       })
       const autoEmailRecipients: string[] = []
       const autoSmsRecipients: UserWithContactNumber[] = []
-      logCriticalBounce({
+      BounceService.logCriticalBounce({
         bounceDoc,
         notification: snsInfo,
         autoEmailRecipients,
@@ -690,7 +718,7 @@ describe('BounceService', () => {
     })
   })
 
-  describe('isValidSnsRequest', () => {
+  describe('validateSnsRequest', () => {
     const keys = crypto.generateKeyPairSync('rsa', {
       modulusLength: 2048,
       publicKeyEncoding: {
@@ -712,30 +740,43 @@ describe('BounceService', () => {
       })
     })
 
-    it('should gracefully reject when input is empty', () => {
-      return expect(isValidSnsRequest(undefined!)).resolves.toBe(false)
+    it('should gracefully reject when input is empty', async () => {
+      const result = await BounceService.validateSnsRequest(undefined!)
+
+      expect(result._unsafeUnwrapErr()).toEqual(new InvalidNotificationError())
     })
 
-    it('should reject requests when their structure is invalid', () => {
+    it('should reject requests when their structure is invalid', async () => {
       const invalidBody = omit(cloneDeep(body), 'Type') as ISnsNotification
-      return expect(isValidSnsRequest(invalidBody)).resolves.toBe(false)
+
+      const result = await BounceService.validateSnsRequest(invalidBody)
+
+      expect(result._unsafeUnwrapErr()).toEqual(new InvalidNotificationError())
     })
 
-    it('should reject requests when their certificate URL is invalid', () => {
+    it('should reject requests when their certificate URL is invalid', async () => {
       body.SigningCertURL = 'http://www.example.com'
-      return expect(isValidSnsRequest(body)).resolves.toBe(false)
+
+      const result = await BounceService.validateSnsRequest(body)
+
+      expect(result._unsafeUnwrapErr()).toEqual(new InvalidNotificationError())
     })
 
-    it('should reject requests when their signature version is invalid', () => {
+    it('should reject requests when their signature version is invalid', async () => {
       body.SignatureVersion = 'wrongSignatureVersion'
-      return expect(isValidSnsRequest(body)).resolves.toBe(false)
+
+      const result = await BounceService.validateSnsRequest(body)
+
+      expect(result._unsafeUnwrapErr()).toEqual(new InvalidNotificationError())
     })
 
-    it('should reject requests when their signature is invalid', () => {
-      return expect(isValidSnsRequest(body)).resolves.toBe(false)
+    it('should reject requests when their signature is invalid', async () => {
+      const result = await BounceService.validateSnsRequest(body)
+
+      expect(result._unsafeUnwrapErr()).toEqual(new InvalidNotificationError())
     })
 
-    it('should accept when requests are valid', () => {
+    it('should accept when requests are valid', async () => {
       const signer = crypto.createSign('RSA-SHA1')
       const baseString =
         dedent`Message
@@ -751,7 +792,10 @@ describe('BounceService', () => {
         ` + '\n'
       signer.write(baseString)
       body.Signature = signer.sign(keys.privateKey, 'base64')
-      return expect(isValidSnsRequest(body)).resolves.toBe(true)
+
+      const result = await BounceService.validateSnsRequest(body)
+
+      expect(result._unsafeUnwrap()).toBe(true)
     })
   })
 
@@ -785,13 +829,13 @@ describe('BounceService', () => {
         okAsync([MOCK_CONTACT]),
       )
 
-      const result = await getEditorsWithContactNumbers(form)
+      const result = await BounceService.getEditorsWithContactNumbers(form)
 
       expect(MockUserService.findContactsForEmails).toHaveBeenCalledWith([
         form.admin.email,
         MOCK_EMAIL,
       ])
-      expect(result).toEqual([MOCK_CONTACT])
+      expect(result._unsafeUnwrap()).toEqual([MOCK_CONTACT])
     })
 
     it('should filter out collaborators without contact numbers', async () => {
@@ -809,13 +853,13 @@ describe('BounceService', () => {
         okAsync([omit(MOCK_CONTACT, 'contact'), MOCK_CONTACT_2]),
       )
 
-      const result = await getEditorsWithContactNumbers(form)
+      const result = await BounceService.getEditorsWithContactNumbers(form)
 
       expect(MockUserService.findContactsForEmails).toHaveBeenCalledWith([
         form.admin.email,
         MOCK_EMAIL,
       ])
-      expect(result).toEqual([MOCK_CONTACT_2])
+      expect(result._unsafeUnwrap()).toEqual([MOCK_CONTACT_2])
     })
 
     it('should return empty array when UserService returns error', async () => {
@@ -833,13 +877,13 @@ describe('BounceService', () => {
         errAsync(new DatabaseError()),
       )
 
-      const result = await getEditorsWithContactNumbers(form)
+      const result = await BounceService.getEditorsWithContactNumbers(form)
 
       expect(MockUserService.findContactsForEmails).toHaveBeenCalledWith([
         form.admin.email,
         MOCK_EMAIL,
       ])
-      expect(result).toEqual([])
+      expect(result._unsafeUnwrap()).toEqual([])
     })
   })
 
@@ -867,12 +911,12 @@ describe('BounceService', () => {
         .execPopulate()) as IPopulatedForm
       MockSmsFactory.sendFormDeactivatedSms.mockReturnValue(okAsync(true))
 
-      const result = await notifyAdminsOfDeactivation(form, [
+      const result = await BounceService.notifyAdminsOfDeactivation(form, [
         MOCK_CONTACT,
         MOCK_CONTACT_2,
       ])
 
-      expect(result).toEqual(true)
+      expect(result._unsafeUnwrap()).toEqual(true)
       expect(MockSmsFactory.sendFormDeactivatedSms).toHaveBeenCalledTimes(2)
       expect(MockSmsFactory.sendFormDeactivatedSms).toHaveBeenCalledWith({
         adminEmail: form.admin.email,
@@ -903,12 +947,12 @@ describe('BounceService', () => {
         .mockReturnValueOnce(okAsync(true))
         .mockReturnValueOnce(errAsync(new SmsSendError()))
 
-      const result = await notifyAdminsOfDeactivation(form, [
+      const result = await BounceService.notifyAdminsOfDeactivation(form, [
         MOCK_CONTACT,
         MOCK_CONTACT_2,
       ])
 
-      expect(result).toEqual(true)
+      expect(result._unsafeUnwrap()).toEqual(true)
       expect(MockSmsFactory.sendFormDeactivatedSms).toHaveBeenCalledTimes(2)
       expect(MockSmsFactory.sendFormDeactivatedSms).toHaveBeenCalledWith({
         adminEmail: form.admin.email,
diff --git a/src/app/modules/bounce/bounce.controller.ts b/src/app/modules/bounce/bounce.controller.ts
index 160cbff392..074be5ff54 100644
--- a/src/app/modules/bounce/bounce.controller.ts
+++ b/src/app/modules/bounce/bounce.controller.ts
@@ -1,121 +1,123 @@
 import { RequestHandler } from 'express'
-import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
-import mongoose from 'mongoose'
 
 import { createLoggerWithLabel } from '../../../config/logger'
-import { IEmailNotification, ISnsNotification } from '../../../types'
+import { ISnsNotification } from '../../../types'
 import { EmailType } from '../../services/mail/mail.constants'
+import { DatabaseConflictError } from '../core/core.errors'
 import * as FormService from '../form/form.service'
 
 import * as BounceService from './bounce.service'
-import { AdminNotificationResult } from './bounce.types'
 
 const logger = createLoggerWithLabel(module)
+
 /**
  * Validates that a request came from Amazon SNS, then updates the Bounce
  * collection. Also informs form admins and collaborators if their form responses
- * bounced.
+ * bounced. Note that the response code is meaningless as it goes back to AWS.
  * @param req Express request object
  * @param res - Express response object
  */
 export const handleSns: RequestHandler<
-  ParamsDictionary,
+  unknown,
   never,
   ISnsNotification
 > = async (req, res) => {
-  // Since this function is for a public endpoint, catch all possible errors
-  // so we never fail on malformed input. The response code is meaningless since
-  // it is meant to go back to AWS.
-  try {
-    const isValid = await BounceService.isValidSnsRequest(req.body)
-    if (!isValid) return res.sendStatus(StatusCodes.FORBIDDEN)
-
-    const notification: IEmailNotification = JSON.parse(req.body.Message)
-    BounceService.logEmailNotification(notification)
-    if (
-      BounceService.extractEmailType(notification) !== EmailType.AdminResponse
-    ) {
-      return res.sendStatus(StatusCodes.OK)
-    }
-    const bounceDoc = await BounceService.getUpdatedBounceDoc(notification)
-    // Missing headers in notification
-    if (!bounceDoc) return res.sendStatus(StatusCodes.OK)
-
-    const formResult = await FormService.retrieveFullFormById(bounceDoc.formId)
-    if (formResult.isErr()) {
-      // Either database error occurred or the formId saved in the bounce collection
-      // doesn't exist, so something went wrong.
-      logger.error({
-        message: 'Failed to retrieve form corresponding to bounced formId',
-        meta: {
-          action: 'handleSns',
-          formId: bounceDoc.formId,
-        },
-      })
-      return res.sendStatus(StatusCodes.INTERNAL_SERVER_ERROR)
-    }
-    const form = formResult.value
-
-    if (bounceDoc.isCriticalBounce()) {
-      // Get contact numbers
-      const possibleSmsRecipients = await BounceService.getEditorsWithContactNumbers(
-        form,
-      )
-
-      // Notify admin and collaborators
-      let notificationRecipients: AdminNotificationResult = {
-        emailRecipients: [],
-        smsRecipients: [],
-      }
-      if (!bounceDoc.hasNotified()) {
-        notificationRecipients = await BounceService.notifyAdminsOfBounce(
-          bounceDoc,
-          form,
-          possibleSmsRecipients,
-        )
-        bounceDoc.setNotificationState(
-          notificationRecipients.emailRecipients,
-          notificationRecipients.smsRecipients,
-        )
-      }
-
-      // Deactivate if all bounces are permanent
-      const shouldDeactivate = bounceDoc.areAllPermanentBounces()
-      if (shouldDeactivate) {
-        await FormService.deactivateForm(bounceDoc.formId)
-        await BounceService.notifyAdminsOfDeactivation(
-          form,
-          possibleSmsRecipients,
-        )
-      }
+  const notificationResult = await BounceService.validateSnsRequest(
+    req.body,
+  ).andThen(() => BounceService.safeParseNotification(req.body.Message))
+  if (notificationResult.isErr()) {
+    logger.warn({
+      message: 'Unable to parse email notification request',
+      meta: {
+        action: 'handleSns',
+      },
+      error: notificationResult.error,
+    })
+    return res.sendStatus(StatusCodes.UNAUTHORIZED)
+  }
+  const notification = notificationResult.value
 
-      // Important log message for user follow-ups
-      BounceService.logCriticalBounce({
-        bounceDoc,
-        notification,
-        autoEmailRecipients: notificationRecipients.emailRecipients,
-        autoSmsRecipients: notificationRecipients.smsRecipients,
-        hasDeactivated: shouldDeactivate,
-      })
-    }
-    await bounceDoc.save()
+  BounceService.logEmailNotification(notification)
+  // If not admin response, no more action to be taken
+  if (
+    BounceService.extractEmailType(notification) !== EmailType.AdminResponse
+  ) {
     return res.sendStatus(StatusCodes.OK)
-  } catch (err) {
+  }
+
+  const bounceDocResult = await BounceService.getUpdatedBounceDoc(notification)
+  if (bounceDocResult.isErr()) {
     logger.warn({
-      message: 'Error updating bounces',
+      message: 'Error while retrieving or creating new bounce doc',
       meta: {
         action: 'handleSns',
       },
-      error: err,
+      error: bounceDocResult.error,
     })
-    // Accept the risk that there might be concurrency problems
-    // when multiple server instances try to access the same
-    // document, due to notifications arriving asynchronously.
-    if (err instanceof mongoose.Error.VersionError) {
-      return res.sendStatus(StatusCodes.OK)
+    return res.sendStatus(StatusCodes.OK)
+  }
+  const bounceDoc = bounceDocResult.value
+
+  const formResult = await FormService.retrieveFullFormById(bounceDoc.formId)
+  if (formResult.isErr()) {
+    // Either database error occurred or the formId saved in the bounce collection
+    // doesn't exist, so something went wrong.
+    logger.error({
+      message: 'Failed to retrieve form corresponding to bounced formId',
+      meta: {
+        action: 'handleSns',
+        formId: bounceDoc.formId,
+      },
+    })
+    return res.sendStatus(StatusCodes.INTERNAL_SERVER_ERROR)
+  }
+  const form = formResult.value
+
+  if (bounceDoc.isCriticalBounce()) {
+    // Send notifications and deactivate form on best-effort basis, ignore errors
+    const possibleSmsRecipients = await BounceService.getEditorsWithContactNumbers(
+      form,
+    ).unwrapOr([])
+    const emailRecipients = await BounceService.sendEmailBounceNotification(
+      bounceDoc,
+      form,
+    ).unwrapOr([])
+    const smsRecipients = await BounceService.sendSmsBounceNotification(
+      bounceDoc,
+      form,
+      possibleSmsRecipients,
+    ).unwrapOr([])
+    bounceDoc.setNotificationState(emailRecipients, smsRecipients)
+
+    const shouldDeactivate = bounceDoc.areAllPermanentBounces()
+    if (shouldDeactivate) {
+      await FormService.deactivateForm(bounceDoc.formId)
+      await BounceService.notifyAdminsOfDeactivation(
+        form,
+        possibleSmsRecipients,
+      )
     }
-    // Malformed request, could not be parsed
-    return res.sendStatus(StatusCodes.BAD_REQUEST)
+
+    // Important log message for user follow-ups
+    BounceService.logCriticalBounce({
+      bounceDoc,
+      notification,
+      autoEmailRecipients: emailRecipients,
+      autoSmsRecipients: smsRecipients,
+      hasDeactivated: shouldDeactivate,
+    })
   }
+
+  return BounceService.saveBounceDoc(bounceDoc)
+    .map(() => res.sendStatus(StatusCodes.OK))
+    .mapErr((error) => {
+      // Accept the risk that there might be concurrency problems
+      // when multiple server instances try to access the same
+      // document, due to notifications arriving asynchronously.
+      if (error instanceof DatabaseConflictError)
+        return res.sendStatus(StatusCodes.OK)
+      // Otherwise internal database error
+      return res.sendStatus(StatusCodes.INTERNAL_SERVER_ERROR)
+    })
 }
diff --git a/src/app/modules/bounce/bounce.errors.ts b/src/app/modules/bounce/bounce.errors.ts
new file mode 100644
index 0000000000..e97ef45168
--- /dev/null
+++ b/src/app/modules/bounce/bounce.errors.ts
@@ -0,0 +1,63 @@
+import { InvalidNumberError, SmsSendError } from '../../services/sms/sms.errors'
+import { ApplicationError } from '../core/core.errors'
+
+/**
+ * Error while retrieving the public key from the certificate URL provided
+ * in the SNS notification body.
+ */
+export class RetrieveAwsCertError extends ApplicationError {
+  constructor(message = 'Error while retrieving AWS signing public key') {
+    super(message)
+  }
+}
+
+/**
+ * Unexpected shape of request body.
+ */
+export class InvalidNotificationError extends ApplicationError {
+  constructor(message = 'Notification from AWS could not be validated') {
+    super(message)
+  }
+}
+
+/**
+ * Error while sending bounce-related notification to form admins via SMS.
+ */
+export class SendBounceSmsNotificationError extends ApplicationError {
+  meta: {
+    contact: string
+    originalError: SmsSendError | InvalidNumberError
+  }
+
+  constructor(
+    originalError: SmsSendError | InvalidNumberError,
+    contact: string,
+    message = 'Error while sending bounce notification via SMS',
+  ) {
+    super(message)
+    this.meta = {
+      contact,
+      originalError,
+    }
+  }
+}
+
+/**
+ * Email headers are missing the custom headers containing form and submission IDs.
+ */
+export class MissingEmailHeadersError extends ApplicationError {
+  constructor(
+    message = 'Email is missing custom header containing form or submission ID',
+  ) {
+    super(message)
+  }
+}
+
+/**
+ * Error while parsing notification
+ */
+export class ParseNotificationError extends ApplicationError {
+  constructor(message = 'Could not parse SNS notification') {
+    super(message)
+  }
+}
diff --git a/src/app/modules/bounce/bounce.service.ts b/src/app/modules/bounce/bounce.service.ts
index 93a9418dc9..78d9173bb6 100644
--- a/src/app/modules/bounce/bounce.service.ts
+++ b/src/app/modules/bounce/bounce.service.ts
@@ -2,6 +2,13 @@ import axios from 'axios'
 import crypto from 'crypto'
 import { difference, isEmpty } from 'lodash'
 import mongoose from 'mongoose'
+import {
+  combineWithAllErrors,
+  errAsync,
+  okAsync,
+  Result,
+  ResultAsync,
+} from 'neverthrow'
 
 import {
   createCloudWatchLogger,
@@ -17,14 +24,24 @@ import {
 import { EMAIL_HEADERS, EmailType } from '../../services/mail/mail.constants'
 import MailService from '../../services/mail/mail.service'
 import { SmsFactory } from '../../services/sms/sms.factory'
+import { transformMongoError } from '../../utils/handle-mongo-error'
+import { hasProp } from '../../utils/has-prop'
+import { PossibleDatabaseError } from '../core/core.errors'
 import { getCollabEmailsWithPermission } from '../form/form.utils'
 import * as UserService from '../user/user.service'
+import { UserWithContactNumber } from '../user/user.types'
+import { isUserWithContactNumber } from '../user/user.utils'
 
+import {
+  InvalidNotificationError,
+  MissingEmailHeadersError,
+  ParseNotificationError,
+  RetrieveAwsCertError,
+  SendBounceSmsNotificationError,
+} from './bounce.errors'
 import getBounceModel from './bounce.model'
-import { AdminNotificationResult, UserWithContactNumber } from './bounce.types'
 import {
   extractHeader,
-  extractSmsErrors,
   extractSuccessfulSmsRecipients,
   isBounceNotification,
 } from './bounce.util'
@@ -54,8 +71,8 @@ const AWS_HOSTNAME = '.amazonaws.com'
  * @param body body from Express request object
  * @returns true if all required keys are present
  */
-const hasRequiredKeys = (body: any): body is ISnsNotification => {
-  return !isEmpty(body) && snsKeys.every((keyObj) => body[keyObj.key])
+const hasRequiredKeys = (body: unknown): body is ISnsNotification => {
+  return !isEmpty(body) && snsKeys.every((keyObj) => hasProp(body, keyObj.key))
 }
 
 /**
@@ -96,13 +113,29 @@ const getSnsBasestring = (body: ISnsNotification): string => {
  * @param body body from Express request object
  * @returns true if signature is valid
  */
-const isValidSnsSignature = async (
+const isValidSnsSignature = (
   body: ISnsNotification,
-): Promise<boolean> => {
-  const { data: cert } = await axios.get(body.SigningCertURL)
-  const verifier = crypto.createVerify('RSA-SHA1')
-  verifier.update(getSnsBasestring(body), 'utf8')
-  return verifier.verify(cert, body.Signature, 'base64')
+): ResultAsync<true, RetrieveAwsCertError | InvalidNotificationError> => {
+  return ResultAsync.fromPromise(
+    axios.get<string>(body.SigningCertURL),
+    (error) => {
+      logger.warn({
+        message: 'Error while retrieving AWS signing certificate',
+        meta: {
+          action: 'isValidSnsSignature',
+          signingCertUrl: body.SigningCertURL,
+        },
+        error,
+      })
+      return new RetrieveAwsCertError()
+    },
+  ).andThen(({ data: cert }) => {
+    const verifier = crypto.createVerify('RSA-SHA1')
+    verifier.update(getSnsBasestring(body), 'utf8')
+    return verifier.verify(cert, body.Signature, 'base64')
+      ? okAsync(true)
+      : errAsync(new InvalidNotificationError())
+  })
 }
 
 /**
@@ -111,15 +144,16 @@ const isValidSnsSignature = async (
  * @param body Body of Express request object
  * @returns true if request shape and signature are valid
  */
-export const isValidSnsRequest = async (
+export const validateSnsRequest = (
   body: ISnsNotification,
-): Promise<boolean> => {
-  const isValid =
-    hasRequiredKeys(body) &&
-    body.SignatureVersion === '1' && // We only check for SHA1-RSA signatures
-    isValidCertUrl(body.SigningCertURL) &&
-    (await isValidSnsSignature(body))
-  return isValid
+): ResultAsync<true, RetrieveAwsCertError | InvalidNotificationError> => {
+  if (
+    !hasRequiredKeys(body) ||
+    body.SignatureVersion !== '1' ||
+    !isValidCertUrl(body.SigningCertURL)
+  )
+    return errAsync(new InvalidNotificationError())
+  return isValidSnsSignature(body)
 }
 
 /**
@@ -197,35 +231,63 @@ const computeValidEmails = (
 }
 
 /**
- * Notifies admin and collaborators via email and SMS that response was lost.
+ * Notifies admin and collaborators via email that response was lost.
  * @param bounceDoc Document from Bounce collection
  * @param form Form corresponding to the formId from bounceDoc
- * @param possibleSmsRecipients Contact details of recipients to attempt to SMS
- * @returns contact details for email and SMSes which were successfully sent. Note that
- * this doesn't mean the emails and SMSes were received, only that they were delivered
+ * @returns contact details for emails which were successfully sent. Note that
+ * this doesn't mean the emails were received, only that they were delivered
  * to the mail server/carrier.
  */
-export const notifyAdminsOfBounce = async (
+export const sendEmailBounceNotification = (
   bounceDoc: IBounceSchema,
   form: IPopulatedForm,
-  possibleSmsRecipients: UserWithContactNumber[],
-): Promise<AdminNotificationResult> => {
+  // Returns no errors. If emails fail, returns
+  // empty array as list of recipients.
+): ResultAsync<string[], never> => {
   // Email all collaborators
   const emailRecipients = computeValidEmails(form, bounceDoc)
-  if (emailRecipients.length > 0) {
-    await MailService.sendBounceNotification({
-      emailRecipients,
-      bouncedRecipients: bounceDoc.getEmails(),
-      bounceType: bounceDoc.areAllPermanentBounces()
-        ? BounceType.Permanent
-        : BounceType.Transient,
-      formTitle: form.title,
-      formId: bounceDoc.formId,
+  if (emailRecipients.length === 0) return okAsync([])
+  return MailService.sendBounceNotification({
+    emailRecipients,
+    bouncedRecipients: bounceDoc.getEmails(),
+    bounceType: bounceDoc.areAllPermanentBounces()
+      ? BounceType.Permanent
+      : BounceType.Transient,
+    formTitle: form.title,
+    formId: bounceDoc.formId,
+  })
+    .map(() => emailRecipients)
+    .orElse((error) => {
+      // Log error, then return empty array as email was sent
+      logger.warn({
+        message: 'Failed to send some bounce notification emails',
+        meta: {
+          action: 'notifyAdminOfBounce',
+          formId: form._id,
+        },
+        error,
+      })
+      return okAsync([])
     })
-  }
+}
 
-  // Sms given recipients
-  const smsPromises = possibleSmsRecipients.map((recipient) =>
+/**
+ * Notifies admin and collaborators via SMS that response was lost.
+ * @param bounceDoc Document from Bounce collection
+ * @param form Form corresponding to the formId from bounceDoc
+ * @param possibleSmsRecipients Contact details of recipients to attempt to SMS
+ * @returns contact details for SMSes which were successfully sent. Note that
+ * this doesn't mean and SMSes were received, only that they were delivered
+ * to the carrier.
+ */
+export const sendSmsBounceNotification = (
+  bounceDoc: IBounceSchema,
+  form: IPopulatedForm,
+  possibleSmsRecipients: UserWithContactNumber[],
+  // Returns no errors. If SMSes fail, returns
+  // empty array as list of recipients.
+): ResultAsync<UserWithContactNumber[], never> => {
+  const smsResults = possibleSmsRecipients.map((recipient) =>
     SmsFactory.sendBouncedSubmissionSms({
       adminEmail: form.admin.email,
       adminId: form.admin._id,
@@ -233,26 +295,30 @@ export const notifyAdminsOfBounce = async (
       formTitle: form.title,
       recipient: recipient.contact,
       recipientEmail: recipient.email,
-    }),
+    })
+      .map(() => recipient)
+      .mapErr(
+        (error) => new SendBounceSmsNotificationError(error, recipient.contact),
+      ),
   )
-
-  // neverthrow#combine is not used since we do not want to short circuit on the first error.
-  const smsResults = await Promise.all(smsPromises)
-  const successfulSmsRecipients = extractSuccessfulSmsRecipients(
-    smsResults,
-    possibleSmsRecipients,
+  return (
+    combineWithAllErrors(smsResults)
+      // All succeeded
+      .map(() => possibleSmsRecipients)
+      .orElse((errors) => {
+        logger.warn({
+          message: 'Failed to send some bounce notification SMSes',
+          meta: {
+            action: 'notifyAdminOfBounce',
+            formId: form._id,
+            errors,
+          },
+        })
+        return okAsync(
+          extractSuccessfulSmsRecipients(errors, possibleSmsRecipients),
+        )
+      })
   )
-  if (successfulSmsRecipients.length < possibleSmsRecipients.length) {
-    logger.warn({
-      message: 'Failed to send some bounce notification SMSes',
-      meta: {
-        action: 'notifyAdminOfBounce',
-        formId: form._id,
-        reasons: extractSmsErrors(smsResults),
-      },
-    })
-  }
-  return { emailRecipients, smsRecipients: successfulSmsRecipients }
 }
 
 /**
@@ -290,15 +356,31 @@ export const logEmailNotification = (
  * @param body The request body of the notification
  * @return the updated document from the Bounce collection or null if there are missing headers.
  */
-export const getUpdatedBounceDoc = async (
+export const getUpdatedBounceDoc = (
   notification: IEmailNotification,
-): Promise<IBounceSchema | null> => {
+): ResultAsync<
+  IBounceSchema,
+  MissingEmailHeadersError | PossibleDatabaseError
+> => {
   const formId = extractHeader(notification, EMAIL_HEADERS.formId)
-  if (!formId) return null
-  const oldBounces = await Bounce.findOne({ formId })
-  return oldBounces
-    ? oldBounces.updateBounceInfo(notification)
-    : Bounce.fromSnsNotification(notification, formId)
+  if (!formId) return errAsync(new MissingEmailHeadersError())
+  return ResultAsync.fromPromise(Bounce.findOne({ formId }).exec(), (error) => {
+    logger.error({
+      message: 'Error while retrieving Bounce document',
+      meta: {
+        action: 'getUpdatedBounceDoc',
+        formId,
+      },
+    })
+    return transformMongoError(error)
+  }).map((bounceDoc) => {
+    // Doc already exists for this form, so update it with latest info
+    if (bounceDoc) {
+      return bounceDoc.updateBounceInfo(notification)
+    }
+    // Create new doc from scratch
+    return Bounce.fromSnsNotification(notification, formId)
+  })
 }
 
 /**
@@ -319,30 +401,27 @@ export const extractEmailType = (
  * @returns The contact details, filtered for the emails which have verified
  * contact numbers in the database
  */
-export const getEditorsWithContactNumbers = async (
+export const getEditorsWithContactNumbers = (
   form: IPopulatedForm,
-): Promise<UserWithContactNumber[]> => {
+  // Never return an error. If database query fails, return empty array.
+): ResultAsync<UserWithContactNumber[], never> => {
   const possibleEditors = [
     form.admin.email,
     ...getCollabEmailsWithPermission(form.permissionList, true),
   ]
-  const smsRecipientsResult = await UserService.findContactsForEmails(
-    possibleEditors,
-  )
-  if (smsRecipientsResult.isOk()) {
-    return smsRecipientsResult.value.filter(
-      (r) => !!r.contact,
-    ) as UserWithContactNumber[]
-  } else {
-    logger.warn({
-      message: 'Failed to retrieve contact numbers for form editors',
-      meta: {
-        action: 'getEditorsWithContactNumbers',
-        formId: form._id,
-      },
+  return UserService.findContactsForEmails(possibleEditors)
+    .map((editors) => editors.filter(isUserWithContactNumber))
+    .orElse((error) => {
+      logger.warn({
+        message: 'Failed to retrieve contact numbers for form editors',
+        meta: {
+          action: 'getEditorsWithContactNumbers',
+          formId: form._id,
+        },
+        error,
+      })
+      return okAsync([])
     })
-    return []
-  }
 }
 
 /**
@@ -352,11 +431,12 @@ export const getEditorsWithContactNumbers = async (
  * @param possibleSmsRecipients Recipients to attempt to notify
  * @returns true regardless of the outcome
  */
-export const notifyAdminsOfDeactivation = async (
+export const notifyAdminsOfDeactivation = (
   form: IPopulatedForm,
   possibleSmsRecipients: UserWithContactNumber[],
-): Promise<true> => {
-  const smsPromises = possibleSmsRecipients.map((recipient) =>
+  // Best-effort attempt to send SMSes, don't propagate error upwards
+): ResultAsync<true, never> => {
+  const smsResults = possibleSmsRecipients.map((recipient) =>
     SmsFactory.sendFormDeactivatedSms({
       adminEmail: form.admin.email,
       adminId: form.admin._id,
@@ -366,19 +446,65 @@ export const notifyAdminsOfDeactivation = async (
       recipientEmail: recipient.email,
     }),
   )
-
-  // neverthrow#combine is not used since we do not want to short circuit on the first error.
-  const smsResults = await Promise.all(smsPromises)
-  const smsErrors = extractSmsErrors(smsResults)
-  if (smsErrors.length > 0) {
-    logger.warn({
-      message: 'Failed to send some form deactivation notification SMSes',
-      meta: {
-        action: 'notifyAdminsOfDeactivation',
-        formId: form._id,
-        reasons: smsErrors,
-      },
+  return combineWithAllErrors(smsResults)
+    .map(() => true as const)
+    .orElse((errors) => {
+      logger.warn({
+        message: 'Failed to send some form deactivation notification SMSes',
+        meta: {
+          action: 'notifyAdminsOfDeactivation',
+          formId: form._id,
+          errors,
+        },
+      })
+      return okAsync(true)
     })
-  }
-  return true
+}
+
+/**
+ * Saves a document to the database.
+ * @param bounceDoc Bounce document
+ * @returns The saved document
+ */
+export const saveBounceDoc = (
+  bounceDoc: IBounceSchema,
+): ResultAsync<IBounceSchema, PossibleDatabaseError> => {
+  return ResultAsync.fromPromise(bounceDoc.save(), (error) => {
+    // Accept the risk that there might be concurrency problems
+    // when multiple server instances try to access the same
+    // document, due to notifications arriving asynchronously.
+    // Hence avoid logging so logs do not get polluted
+    if (!(error instanceof mongoose.Error.VersionError)) {
+      logger.warn({
+        message: 'Error while saving Bounce document',
+        meta: {
+          action: 'saveBounceDoc',
+          formId: bounceDoc.formId,
+        },
+      })
+    }
+    return transformMongoError(error)
+  })
+}
+
+/**
+ * Safely parses an SNS notification.
+ * @param message Content of notification
+ */
+export const safeParseNotification = (
+  message: string,
+): Result<IEmailNotification, ParseNotificationError> => {
+  return Result.fromThrowable(
+    () => JSON.parse(message),
+    (error) => {
+      logger.warn({
+        message: 'Unable to parse SNS notification',
+        meta: {
+          action: 'safeParseNotification',
+        },
+        error,
+      })
+      return new ParseNotificationError()
+    },
+  )()
 }
diff --git a/src/app/modules/bounce/bounce.util.ts b/src/app/modules/bounce/bounce.util.ts
index fb88898427..f378275c6f 100644
--- a/src/app/modules/bounce/bounce.util.ts
+++ b/src/app/modules/bounce/bounce.util.ts
@@ -1,13 +1,12 @@
-import { Result } from 'neverthrow'
-
 import {
   IBounceNotification,
   IDeliveryNotification,
   IEmailNotification,
 } from '../../../types'
-import { InvalidNumberError, SmsSendError } from '../../services/sms/sms.errors'
+import { UserWithContactNumber } from '../user/user.types'
+
+import { SendBounceSmsNotificationError } from './bounce.errors'
 
-import { UserWithContactNumber } from './bounce.types'
 /**
  * Extracts custom headers which we send with all emails, such as form ID, submission ID
  * and email type (admin response, email confirmation OTP etc).
@@ -70,39 +69,17 @@ export const isDeliveryNotification = (
 
 /**
  * Filters the given SMS recipients to only those which were sent succesfully
- * @param smsResults Array of sms results
- * @param smsRecipients Recipients who were SMSed. This array must correspond
- * exactly to smsResults, i.e. the result at smsResults[i] corresponds
- * to the result of the attempt to SMS smsRecipients[i]
+ * @param smsErrors Array of sms errors
+ * @param smsRecipients Recipients who were SMSed
  * @returns the contact details of SMSes sent successfully
  */
 export const extractSuccessfulSmsRecipients = (
-  smsResults: Result<true, unknown>[],
+  smsErrors: SendBounceSmsNotificationError[],
   smsRecipients: UserWithContactNumber[],
 ): UserWithContactNumber[] => {
-  return smsResults.reduce<UserWithContactNumber[]>((acc, result, index) => {
-    if (result.isOk()) {
-      acc.push(smsRecipients[index])
-    }
-    return acc
-  }, [])
-}
-
-/**
- * Extracts the errors from results of attempting to send SMSes
- * @param smsResults Array of Promise.allSettled results
- * @returns Array of errors
- */
-export const extractSmsErrors = (
-  smsResults: Result<true, SmsSendError | InvalidNumberError>[],
-): (SmsSendError | InvalidNumberError)[] => {
-  return smsResults.reduce<(SmsSendError | InvalidNumberError)[]>(
-    (acc, result) => {
-      if (result.isErr()) {
-        acc.push(result.error)
-      }
-      return acc
-    },
-    [],
+  // Get recipients which errored
+  const failedRecipients = smsErrors.map((error) => error.meta.contact)
+  return smsRecipients.filter(
+    (recipient) => !failedRecipients.includes(recipient.contact),
   )
 }
diff --git a/src/app/modules/bounce/bounce.types.ts b/src/app/modules/user/user.types.ts
similarity index 59%
rename from src/app/modules/bounce/bounce.types.ts
rename to src/app/modules/user/user.types.ts
index 0246f4c1e1..8800101055 100644
--- a/src/app/modules/bounce/bounce.types.ts
+++ b/src/app/modules/user/user.types.ts
@@ -3,8 +3,3 @@ import { SetRequired } from 'type-fest'
 import { UserContactView } from '../../../types'
 
 export type UserWithContactNumber = SetRequired<UserContactView, 'contact'>
-
-export interface AdminNotificationResult {
-  emailRecipients: string[]
-  smsRecipients: UserWithContactNumber[]
-}
diff --git a/src/app/modules/user/user.utils.ts b/src/app/modules/user/user.utils.ts
index 5b09487b5c..d9026359e6 100644
--- a/src/app/modules/user/user.utils.ts
+++ b/src/app/modules/user/user.utils.ts
@@ -1,12 +1,14 @@
 import { StatusCodes } from 'http-status-codes'
 
 import { createLoggerWithLabel } from '../../../config/logger'
+import { UserContactView } from '../../../types'
 import * as SmsErrors from '../../services/sms/sms.errors'
 import { HashingError } from '../../utils/hash'
 import * as CoreErrors from '../core/core.errors'
 import { ErrorResponseData } from '../core/core.types'
 
 import * as UserErrors from './user.errors'
+import { UserWithContactNumber } from './user.types'
 
 const logger = createLoggerWithLabel(module)
 /**
@@ -58,3 +60,15 @@ export const mapRouteError = (
       }
   }
 }
+
+/**
+ * Checks for presence of contact number in a user's contact
+ * details. Type guard.
+ * @param userDetails Contact view of user
+ * @returns True if user has a contact number
+ */
+export const isUserWithContactNumber = (
+  userDetails: UserContactView,
+): userDetails is UserWithContactNumber => {
+  return !!userDetails.contact
+}

From 685277b9f3a105862c032df1c8a1b7660ac7b5fc Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Fri, 9 Apr 2021 08:48:25 +0800
Subject: [PATCH 33/75] refactor: migrate public routes to TypeScript (#1595)

* ref: move all PublicForm routes to TS

* docs: update Travis build stage name

* docs: update JSdocs for publicform routes
---
 .travis.yml                                   |   2 +-
 .../form/public-form/public-form.routes.ts    |  77 +++++++++--
 src/app/routes/index.js                       |   1 -
 src/app/routes/public-forms.server.routes.js  | 121 ------------------
 src/loaders/express/index.ts                  |   8 +-
 5 files changed, 71 insertions(+), 138 deletions(-)
 delete mode 100644 src/app/routes/index.js
 delete mode 100644 src/app/routes/public-forms.server.routes.js

diff --git a/.travis.yml b/.travis.yml
index d256a72259..3188c6cb8d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -41,7 +41,7 @@ jobs:
         use: build
       script:
         - npm run test-frontend
-    - name: Typescript tests
+    - name: Backend tests
       workspaces:
         use: build
       script:
diff --git a/src/app/modules/form/public-form/public-form.routes.ts b/src/app/modules/form/public-form/public-form.routes.ts
index 0d4fd71cc0..17d8b76227 100644
--- a/src/app/modules/form/public-form/public-form.routes.ts
+++ b/src/app/modules/form/public-form/public-form.routes.ts
@@ -1,3 +1,4 @@
+import { celebrate, Joi, Segments } from 'celebrate'
 import { Router } from 'express'
 
 import * as PublicFormController from './public-form.controller'
@@ -6,22 +7,80 @@ export const PublicFormRouter = Router()
 
 /**
  * Returns the specified form to the user, along with any
- * identity information obtained from SingPass/CorpPass,
- * and MyInfo details, if any.
+ * identify information obtained from Singpass/Corppass/MyInfo.
  *
  * WARNING: TemperatureSG batch jobs rely on this endpoint to
  * retrieve the master list of personnel for daily reporting.
  * Please strictly ensure backwards compatibility.
+ * @route GET /:formId/publicform
  *
- * @route GET /{formId}/publicform
- * @group forms - endpoints to serve forms
- * @param {string} formId.path.required - the form id
- * @consumes application/json
- * @produces application/json
- * @returns {string} 404 - form is not made public
- * @returns {PublicForm.model} 200 - the form, and other information
+ * @returns 200 with form when form exists and is public
+ * @returns 404 when form is private or form with given ID does not exist
+ * @returns 410 when form is archived
+ * @returns 500 when database error occurs
  */
 PublicFormRouter.get(
   '/:formId([a-fA-F0-9]{24})/publicform',
   PublicFormController.handleGetPublicForm,
 )
+
+/**
+ * Redirect a form to the main index, with the specified path
+ * suffixed with a hashbang (`/#!`).
+ * @route GET /{Id}
+ * @route GET /{Id}/embed
+ * @route GET /{Id}/preview
+ * @route GET /{Id}/template
+ * @route GET /{Id}/use-template
+ * @route GET /forms/:agency/{Id}
+ * @route GET /forms/:agency/{Id}/embed
+ * @route GET /forms/:agency/{Id}/preview
+ * @route GET /forms/:agency/{Id}/template
+ * @route GET /forms/:agency/{Id}/use-template
+ * @group forms - endpoints to serve forms
+ * @returns 302 - redirects the user to the specified form,
+ * through the main index, with the form ID specified as a hashbang path
+ */
+PublicFormRouter.get(
+  '/:Id([a-fA-F0-9]{24})/:state(preview|template|use-template)?',
+  PublicFormController.handleRedirect,
+)
+
+PublicFormRouter.get(
+  '/:Id([a-fA-F0-9]{24})/embed',
+  PublicFormController.handleRedirect,
+)
+
+PublicFormRouter.get(
+  '/forms/:agency/:Id([a-fA-F0-9]{24})/:state(preview|template|use-template)?',
+  PublicFormController.handleRedirect,
+)
+
+PublicFormRouter.get(
+  '/forms/:agency/:Id([a-fA-F0-9]{24})/embed',
+  PublicFormController.handleRedirect,
+)
+
+/**
+ * Send feedback for a public form
+ * @route POST /:formId/feedback
+ * @returns 200 if feedback was successfully saved
+ * @returns 400 if form feedback was malformed and hence cannot be saved
+ * @returns 404 if form with formId does not exist or is private
+ * @returns 410 if form has been archived
+ * @returns 500 if database error occurs
+ */
+PublicFormRouter.post(
+  '/:formId([a-fA-F0-9]{24})/feedback',
+  celebrate({
+    [Segments.BODY]: Joi.object()
+      .keys({
+        rating: Joi.number().min(1).max(5).cast('string').required(),
+        comment: Joi.string().allow('').required(),
+      })
+      // Allow other keys for backwards compability as frontend might put
+      // extra keys in the body.
+      .unknown(true),
+  }),
+  PublicFormController.handleSubmitFeedback,
+)
diff --git a/src/app/routes/index.js b/src/app/routes/index.js
deleted file mode 100644
index 953d0f67c0..0000000000
--- a/src/app/routes/index.js
+++ /dev/null
@@ -1 +0,0 @@
-module.exports = [require('./public-forms.server.routes.js')]
diff --git a/src/app/routes/public-forms.server.routes.js b/src/app/routes/public-forms.server.routes.js
deleted file mode 100644
index d4731d0d9a..0000000000
--- a/src/app/routes/public-forms.server.routes.js
+++ /dev/null
@@ -1,121 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-const { celebrate, Joi, Segments } = require('celebrate')
-const PublicFormController = require('../modules/form/public-form/public-form.controller')
-module.exports = function (app) {
-  /**
-   * Redirect a form to the main index, with the specified path
-   * suffixed with a hashbang (`/#!`)
-   * parameter Id is used instead of formId as formById middleware is not needed
-   * @route GET /{Id}
-   * @route GET /{Id}/preview
-   * @route GET /{Id}/embed
-   * @route GET /{Id}/template
-   * @route GET /{Id}/use-template
-   * @group forms - endpoints to serve forms
-   * @param {string} Id.path.required - the form id
-   * @produces text/html
-   * @returns {string} 302 - redirects the user to the specified form,
-   * through the main index, with the form id specified as a hashbang path
-   */
-  app
-    .route('/:Id([a-fA-F0-9]{24})/:state(preview|template|use-template)?')
-    .get(PublicFormController.handleRedirect)
-
-  // TODO: Remove this embed endpoint
-  app
-    .route('/:Id([a-fA-F0-9]{24})/embed')
-    .get(PublicFormController.handleRedirect)
-
-  /**
-   * Redirect a form to the main index, with the specified path
-   * suffixed with a hashbang (`/#!`). /forms/:agency is added for backward compatibility.
-   * parameter Id is used instead of formId as formById middleware is not needed
-   * TODO: Remove once all form links being shared do not have /forms/:agency
-   * @route GET /forms/:agency/{Id}
-   * @route GET /forms/:agency/{Id}/preview
-   * @route GET /forms/:agency/{Id}/embed
-   * @route GET /forms/:agency/{Id}/template
-   * @route GET /{Id}/use-template
-   * @group forms - endpoints to serve forms
-   * @param {string} Id.path.required - the form id
-   * @produces text/html
-   * @returns {string} 302 - redirects the user to the specified form,
-   * through the main index, with the form id specified as a hashbang path
-   */
-  app
-    .route(
-      '/forms/:agency/:Id([a-fA-F0-9]{24})/:state(preview|template|use-template)?',
-    )
-    .get(PublicFormController.handleRedirect)
-
-  // TODO: Remove this embed endpoint
-  app
-    .route('/forms/:agency/:Id([a-fA-F0-9]{24})/embed')
-    .get(PublicFormController.handleRedirect)
-
-  /**
-   * @typedef Feedback
-   * @property {number} rating.required - the user's rating of the form
-   * @property {string} comment - any comments the user might have
-   */
-
-  /**
-   * Send feedback for a public form
-   * @route POST /:formId/feedback
-   * @group forms - endpoints to serve forms
-   * @param {string} formId.path.required - the form id
-   * @param {Feedback.model} feedback.body.required - the user's feedback
-   * @consumes application/json
-   * @produces application/json
-   * @returns 200 if feedback was successfully saved
-   * @returns 400 if form feedback was malformed and hence cannot be saved
-   * @returns 404 if form with formId does not exist or is private
-   * @returns 410 if form has been archived
-   * @returns 500 if database error occurs
-   */
-  app.route('/:formId([a-fA-F0-9]{24})/feedback').post(
-    celebrate({
-      [Segments.BODY]: Joi.object()
-        .keys({
-          rating: Joi.number().min(1).max(5).cast('string').required(),
-          comment: Joi.string().allow('').required(),
-        })
-        // Allow other keys for backwards compability as frontend might put
-        // extra keys in the body.
-        .unknown(true),
-    }),
-    PublicFormController.handleSubmitFeedback,
-  )
-
-  /**
-   * @typedef PublicForm
-   * @property {object} form.required - the form
-   * @property {object} spcpSession - contains identity information from SingPass/CorpPass
-   * @property {boolean} myInfoError - indicates if there was any errors while accessing MyInfo
-   */
-
-  /**
-   * Returns the specified form to the user, along with any
-   * identity information obtained from SingPass/CorpPass,
-   * and MyInfo details, if any.
-   *
-   * WARNING: TemperatureSG batch jobs rely on this endpoint to
-   * retrieve the master list of personnel for daily reporting.
-   * Please strictly ensure backwards compatibility.
-   *
-   * @route GET /{formId}/publicform
-   * @group forms - endpoints to serve forms
-   * @param {string} formId.path.required - the form id
-   * @consumes application/json
-   * @produces application/json
-   * @returns {string} 404 - form is not made public
-   * @returns {PublicForm.model} 200 - the form, and other information
-   */
-  app
-    .route('/:formId([a-fA-F0-9]{24})/publicform')
-    .get(PublicFormController.handleGetPublicForm)
-}
diff --git a/src/loaders/express/index.ts b/src/loaders/express/index.ts
index 170803036a..1acdd06314 100644
--- a/src/loaders/express/index.ts
+++ b/src/loaders/express/index.ts
@@ -14,6 +14,7 @@ import { BillingRouter } from '../../app/modules/billing/billing.routes'
 import { BounceRouter } from '../../app/modules/bounce/bounce.routes'
 import { ExamplesRouter } from '../../app/modules/examples/examples.routes'
 import { AdminFormsRouter } from '../../app/modules/form/admin-form/admin-form.routes'
+import { PublicFormRouter } from '../../app/modules/form/public-form/public-form.routes'
 import { FrontendRouter } from '../../app/modules/frontend/frontend.server.routes'
 import { HomeRouter } from '../../app/modules/home/home.routes'
 import { MYINFO_ROUTER_PREFIX } from '../../app/modules/myinfo/myinfo.constants'
@@ -26,7 +27,6 @@ import {
 import { SubmissionRouter } from '../../app/modules/submission/submission.routes'
 import UserRouter from '../../app/modules/user/user.routes'
 import { VfnRouter } from '../../app/modules/verification/verification.routes'
-import apiRoutes from '../../app/routes'
 import { ApiRouter } from '../../app/routes/api'
 import * as IntranetMiddleware from '../../app/services/intranet/intranet.middleware'
 import config from '../../config/config'
@@ -144,11 +144,6 @@ const loadExpressApp = async (connection: Connection) => {
   // Log intranet usage
   app.use(IntranetMiddleware.logIntranetUsage)
 
-  // Mount all API endpoints
-  apiRoutes.forEach(function (routeFunction) {
-    routeFunction(app)
-  })
-
   app.use('/', HomeRouter)
   app.use('/frontend', FrontendRouter)
   app.use('/auth', AuthRouter)
@@ -167,6 +162,7 @@ const loadExpressApp = async (connection: Connection) => {
   // Use constant for registered routes with MyInfo servers
   app.use(MYINFO_ROUTER_PREFIX, MyInfoRouter)
   app.use(AdminFormsRouter)
+  app.use(PublicFormRouter)
 
   // New routes in preparation for API refactor.
   app.use('/api', ApiRouter)

From 437e16e746e3f18d080f5c4ef6d22ab7bb9ec2bc Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Fri, 9 Apr 2021 09:36:03 +0800
Subject: [PATCH 34/75] refactor: remove typecasts and non-null assertions
 (#1596)

* ref: remove type casts where possible

* ref: remove unused middleware and dependencies

* ref: improve typing of JWT payload

* ref: remove non-null assertions

* ref: rename express.locals.ts

* ref: remove final non-null assertion

* chore: enforce no non-null assertion lint rule

* chore: titlecase Singpass and Corppass

* ref: use switch in extractJwtPayloadFromRequest

* ref: use switch in submissions controllers
---
 .eslintrc                                     |   5 +-
 src/app/modules/examples/examples.service.ts  |   4 -
 .../__tests__/public-form.middlewares.spec.ts | 218 ------------------
 .../public-form/public-form.middlewares.ts    |  54 -----
 src/app/modules/myinfo/myinfo.util.ts         |  23 +-
 .../spcp/__tests__/spcp.factory.spec.ts       |  18 +-
 .../spcp/__tests__/spcp.service.spec.ts       |  16 +-
 src/app/modules/spcp/spcp.controller.ts       |  38 +--
 src/app/modules/spcp/spcp.factory.ts          |   6 +-
 src/app/modules/spcp/spcp.service.ts          |  71 ++++--
 src/app/modules/spcp/spcp.types.ts            |  11 +-
 src/app/modules/spcp/spcp.util.ts             |  54 +++--
 .../email-submission.controller.ts            | 136 ++++++-----
 .../encrypt-submission.controller.ts          | 112 ++++-----
 src/app/utils/encryption.ts                   |   5 -
 src/app/utils/limit-rate.ts                   |   3 +-
 src/config/config.ts                          |   5 +-
 src/config/logger.ts                          |  49 +---
 src/loaders/mongoose.ts                       |   3 +-
 src/shared/util/logic.ts                      |  12 +-
 .../{express.locals.ts => email_mode_data.ts} |  26 ---
 src/types/index.ts                            |   2 +-
 22 files changed, 293 insertions(+), 578 deletions(-)
 delete mode 100644 src/app/modules/form/public-form/__tests__/public-form.middlewares.spec.ts
 delete mode 100644 src/app/modules/form/public-form/public-form.middlewares.ts
 rename src/types/{express.locals.ts => email_mode_data.ts} (59%)

diff --git a/.eslintrc b/.eslintrc
index f69d51124f..87b14ecf6e 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -66,9 +66,10 @@
     { "files": ["*.spec.ts"], "extends": ["plugin:jest/recommended"] },
     {
       "files": ["*.ts", "*.js"],
-      "excludedFiles": ["**/*.spec.ts", "**/.spec.js"],
+      "excludedFiles": ["**/*.spec.ts", "**/.spec.js", "**/__tests__/**/*.ts"],
       "rules": {
-        "typesafe/no-await-without-trycatch": "warn"
+        "typesafe/no-await-without-trycatch": "warn",
+        "@typescript-eslint/no-non-null-assertion": "error"
       }
     }
   ],
diff --git a/src/app/modules/examples/examples.service.ts b/src/app/modules/examples/examples.service.ts
index b4d4ef62c3..3ca8f7ba31 100644
--- a/src/app/modules/examples/examples.service.ts
+++ b/src/app/modules/examples/examples.service.ts
@@ -157,10 +157,6 @@ const execExamplesQuery = (
 ): ResultAsync<QueryPageResult, DatabaseError> => {
   return ResultAsync.fromPromise(
     queryBuilder
-      // TODO(#42): Missing type in native typescript, waiting on upstream fixes.
-      // Tracking at https://github.com/Automattic/mongoose/issues/9714.
-      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-      // @ts-ignore
       .append(
         selectAndProjectCardInfo(/* limit= */ PAGE_SIZE, /* offset= */ offset),
       )
diff --git a/src/app/modules/form/public-form/__tests__/public-form.middlewares.spec.ts b/src/app/modules/form/public-form/__tests__/public-form.middlewares.spec.ts
deleted file mode 100644
index 2d2d9fa9df..0000000000
--- a/src/app/modules/form/public-form/__tests__/public-form.middlewares.spec.ts
+++ /dev/null
@@ -1,218 +0,0 @@
-import { ObjectId } from 'bson-ext'
-import { Request } from 'express'
-import { StatusCodes } from 'http-status-codes'
-import { merge, times } from 'lodash'
-import mongoose from 'mongoose'
-
-import expressHandler from 'tests/unit/backend/helpers/jest-express'
-
-import dbHandler from '../../../../../../tests/unit/backend/helpers/jest-db'
-import {
-  IEncryptedSubmissionSchema,
-  ResponseMode,
-  Status,
-  SubmissionType,
-  WithForm,
-} from '../../../../../types'
-import getFormModel from '../../../../models/form.server.model'
-import getSubmissionModel from '../../../../models/submission.server.model'
-import {
-  checkFormSubmissionLimitAndDeactivate,
-  isFormPublicCheck,
-} from '../public-form.middlewares'
-
-const FormModel = getFormModel(mongoose)
-const SubmissionModel = getSubmissionModel(mongoose)
-
-const MOCK_ADMIN_OBJ_ID = new ObjectId()
-
-const MOCK_FORM_PARAMS = {
-  title: 'Test Form',
-  admin: String(MOCK_ADMIN_OBJ_ID),
-}
-const MOCK_ENCRYPTED_FORM_PARAMS = {
-  ...MOCK_FORM_PARAMS,
-  publicKey: 'mockPublicKey',
-  responseMode: ResponseMode.Encrypt,
-}
-
-describe('public-form.middlewares', () => {
-  describe('checkFormSubmissionLimitAndDeactivate', () => {
-    beforeAll(async () => await dbHandler.connect())
-    beforeEach(async () => {
-      await dbHandler.insertFormCollectionReqs({
-        userId: MOCK_ADMIN_OBJ_ID,
-      })
-    })
-    afterEach(async () => await dbHandler.clearDatabase())
-    afterAll(async () => await dbHandler.closeDatabase())
-
-    it('should let requests through when form has no submission limit', async () => {
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: { submissionLimit: null },
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      await checkFormSubmissionLimitAndDeactivate(mockReq, mockRes, mockNext)
-
-      expect(mockNext).toBeCalled()
-      expect(mockRes.sendStatus).not.toBeCalled()
-      expect(mockRes.status).not.toBeCalled()
-      expect(mockRes.json).not.toBeCalled()
-    })
-
-    it('should let requests through when form has not reached submission limit', async () => {
-      const formParams = merge({}, MOCK_ENCRYPTED_FORM_PARAMS, {
-        status: Status.Public,
-        submissionLimit: 10,
-      })
-      const validForm = new FormModel(formParams)
-      const form = await validForm.save()
-
-      const submissionPromises = times(5, () =>
-        SubmissionModel.create<IEncryptedSubmissionSchema>({
-          form: form._id,
-          myInfoFields: [],
-          submissionType: SubmissionType.Encrypt,
-          encryptedContent: 'mockEncryptedContent',
-          version: 1,
-          created: new Date('2020-01-01'),
-        }),
-      )
-      await Promise.all(submissionPromises)
-
-      const title = 'My private form'
-      const inactiveMessage = 'The form is not available.'
-
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: {
-          _id: form._id.toHexString(),
-          submissionLimit: 10,
-          title,
-          inactiveMessage,
-        },
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      await checkFormSubmissionLimitAndDeactivate(mockReq, mockRes, mockNext)
-
-      expect(mockNext).toBeCalled()
-      expect(mockRes.sendStatus).not.toBeCalled()
-      expect(mockRes.status).not.toBeCalled()
-      expect(mockRes.json).not.toBeCalled()
-    })
-
-    it('should not let requests through and deactivate form when form has reached submission limit', async () => {
-      const formParams = merge({}, MOCK_ENCRYPTED_FORM_PARAMS, {
-        status: Status.Public,
-        submissionLimit: 5,
-      })
-      const validForm = new FormModel(formParams)
-      const form = await validForm.save()
-
-      const submissionPromises = times(5, () =>
-        SubmissionModel.create<IEncryptedSubmissionSchema>({
-          form: form._id,
-          myInfoFields: [],
-          submissionType: SubmissionType.Encrypt,
-          encryptedContent: 'mockEncryptedContent',
-          version: 1,
-          created: new Date('2020-01-01'),
-        }),
-      )
-      await Promise.all(submissionPromises)
-
-      const title = 'My private form'
-      const inactiveMessage = 'The form is not available.'
-
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: {
-          _id: form._id.toHexString(),
-          submissionLimit: 5,
-          title,
-          inactiveMessage,
-        },
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      await checkFormSubmissionLimitAndDeactivate(mockReq, mockRes, mockNext)
-
-      expect(mockNext).not.toBeCalled()
-      expect(mockRes.json).toBeCalledWith({
-        message: inactiveMessage,
-        isPageFound: true,
-        formTitle: title,
-      })
-      expect(mockRes.status).toBeCalledWith(StatusCodes.NOT_FOUND)
-
-      const updated = await FormModel.findById(form._id)
-      expect(updated!.status).toBe('PRIVATE')
-    })
-  })
-
-  describe('isFormPublicCheck', () => {
-    it('should call next middleware function if form is public', () => {
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form: { status: Status.Public },
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      isFormPublicCheck(mockReq, mockRes, mockNext)
-
-      expect(mockNext).toBeCalled()
-      expect(mockRes.sendStatus).not.toBeCalled()
-      expect(mockRes.status).not.toBeCalled()
-      expect(mockRes.json).not.toBeCalled()
-    })
-
-    it('should return HTTP 404 Not Found if form is private', () => {
-      const title = 'My private form'
-      const inactiveMessage = 'The form is not available.'
-      const form = {
-        status: Status.Private,
-        title,
-        inactiveMessage,
-      }
-
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form,
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      isFormPublicCheck(mockReq, mockRes, mockNext)
-
-      expect(mockNext).not.toBeCalled()
-      expect(mockRes.sendStatus).not.toBeCalled()
-      expect(mockRes.status).toBeCalledWith(StatusCodes.NOT_FOUND)
-      expect(mockRes.json).toBeCalledWith({
-        message: inactiveMessage,
-        isPageFound: true,
-        formTitle: title,
-      })
-    })
-
-    it('should return HTTP 410 Gone if form is archived', () => {
-      const form = {
-        status: Status.Archived,
-      }
-
-      const mockReq = Object.assign(expressHandler.mockRequest(), {
-        form,
-      }) as WithForm<Request>
-      const mockRes = expressHandler.mockResponse()
-      const mockNext = jest.fn()
-
-      isFormPublicCheck(mockReq, mockRes, mockNext)
-
-      expect(mockNext).not.toBeCalled()
-      expect(mockRes.sendStatus).toBeCalledWith(StatusCodes.GONE)
-      expect(mockRes.status).not.toBeCalled()
-      expect(mockRes.json).not.toBeCalledWith()
-    })
-  })
-})
diff --git a/src/app/modules/form/public-form/public-form.middlewares.ts b/src/app/modules/form/public-form/public-form.middlewares.ts
deleted file mode 100644
index a47ee97a98..0000000000
--- a/src/app/modules/form/public-form/public-form.middlewares.ts
+++ /dev/null
@@ -1,54 +0,0 @@
-import { RequestHandler } from 'express'
-import { StatusCodes } from 'http-status-codes'
-
-import { WithForm } from '../../../../types'
-import { FormDeletedError } from '../form.errors'
-import {
-  checkFormSubmissionLimitAndDeactivateForm,
-  isFormPublic,
-} from '../form.service'
-
-/**
- * Express middleware function that checks if a form has exceeded its submission limits before allowing
- * downstream middleware to handle the request. Otherwise, it returns a HTTP 404.
- */
-export const checkFormSubmissionLimitAndDeactivate: RequestHandler = async (
-  req,
-  res,
-  next,
-) => {
-  const { form } = req as WithForm<typeof req>
-  const formResult = await checkFormSubmissionLimitAndDeactivateForm(form)
-  if (formResult.isErr()) {
-    return res.status(StatusCodes.NOT_FOUND).json({
-      message: form.inactiveMessage,
-      isPageFound: true, // Flag to prevent default 404 subtext ("please check link") from showing
-      formTitle: form.title,
-    })
-  }
-
-  return next()
-}
-
-/**
- * Express middleware function that checks if a form attached to the Express request handler is public.
- * before allowing downstream middleware to handle the request. Otherwise, it returns a HTTP 404 if the
- * form is private, or HTTP 410 if the form has been archived.
- * @param req - Express request object
- * @param res - Express response object
- * @param next - Express next middleware function
- */
-export const isFormPublicCheck: RequestHandler = (req, res, next) => {
-  const { form } = req as WithForm<typeof req>
-  return isFormPublic(form)
-    .map(() => next())
-    .mapErr((error) => {
-      return error instanceof FormDeletedError
-        ? res.sendStatus(StatusCodes.GONE)
-        : res.status(StatusCodes.NOT_FOUND).json({
-            message: form.inactiveMessage,
-            isPageFound: true, // Flag to prevent default 404 subtext ("please check link") from showing
-            formTitle: form.title,
-          })
-    })
-}
diff --git a/src/app/modules/myinfo/myinfo.util.ts b/src/app/modules/myinfo/myinfo.util.ts
index cf154b7274..4f5ef51a33 100644
--- a/src/app/modules/myinfo/myinfo.util.ts
+++ b/src/app/modules/myinfo/myinfo.util.ts
@@ -83,16 +83,6 @@ const hasMyInfoAnswer = (
   return !!field.isVisible && !!field.myInfo?.attr
 }
 
-const filterFieldsWithHashes = (
-  responses: ProcessedFieldResponse[],
-  hashes: IHashes,
-): VisibleMyInfoResponse[] => {
-  // Filter twice to get types to cooperate
-  return responses
-    .filter(hasMyInfoAnswer)
-    .filter((response) => !!hashes[response.myInfo.attr])
-}
-
 const transformAnswer = (field: VisibleMyInfoResponse): string => {
   const answer = field.answer
   return field.fieldType === BasicField.Date
@@ -117,14 +107,15 @@ export const compareHashedValues = (
   responses: ProcessedFieldResponse[],
   hashes: IHashes,
 ): MyInfoComparePromises => {
-  // Filter responses to only those fields with a corresponding hash
-  const fieldsWithHashes = filterFieldsWithHashes(responses, hashes)
   // Map MyInfoAttribute to response
   const myInfoResponsesMap: MyInfoComparePromises = new Map()
-  fieldsWithHashes.forEach((field) => {
-    const attr = field.myInfo.attr
-    // Already checked that hashes contains this attr
-    myInfoResponsesMap.set(field._id, compareSingleHash(hashes[attr]!, field))
+  responses.forEach((field) => {
+    if (hasMyInfoAnswer(field)) {
+      const hash = hashes[field.myInfo.attr]
+      if (hash) {
+        myInfoResponsesMap.set(field._id, compareSingleHash(hash, field))
+      }
+    }
   })
   return myInfoResponsesMap
 }
diff --git a/src/app/modules/spcp/__tests__/spcp.factory.spec.ts b/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
index 2cab38f5c4..7d8903e1dc 100644
--- a/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
@@ -27,9 +27,11 @@ describe('spcp.factory', () => {
     )
     const fetchLoginPageResult = await SpcpFactory.fetchLoginPage('')
     const validateLoginPageResult = SpcpFactory.validateLoginPage('')
-    const extractJwtPayloadResult = await SpcpFactory.extractJwtPayload(
+    const extractSingpassJwtPayloadResult = await SpcpFactory.extractSingpassJwtPayload(
+      '',
+    )
+    const extractCorppassJwtPayloadResult = await SpcpFactory.extractCorppassJwtPayload(
       '',
-      AuthType.SP,
     )
     const parseOOBParamsResult = SpcpFactory.parseOOBParams('', '', AuthType.SP)
     const getSpcpAttributesResult = await SpcpFactory.getSpcpAttributes(
@@ -51,7 +53,8 @@ describe('spcp.factory', () => {
     expect(createRedirectUrlResult._unsafeUnwrapErr()).toEqual(error)
     expect(fetchLoginPageResult._unsafeUnwrapErr()).toEqual(error)
     expect(validateLoginPageResult._unsafeUnwrapErr()).toEqual(error)
-    expect(extractJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
+    expect(extractSingpassJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
+    expect(extractCorppassJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
     expect(parseOOBParamsResult._unsafeUnwrapErr()).toEqual(error)
     expect(getSpcpAttributesResult._unsafeUnwrapErr()).toEqual(error)
     expect(createJWTResult._unsafeUnwrapErr()).toEqual(error)
@@ -74,9 +77,11 @@ describe('spcp.factory', () => {
     )
     const fetchLoginPageResult = await SpcpFactory.fetchLoginPage('')
     const validateLoginPageResult = SpcpFactory.validateLoginPage('')
-    const extractJwtPayloadResult = await SpcpFactory.extractJwtPayload(
+    const extractSingpassJwtPayloadResult = await SpcpFactory.extractSingpassJwtPayload(
+      '',
+    )
+    const extractCorppassJwtPayloadResult = await SpcpFactory.extractCorppassJwtPayload(
       '',
-      AuthType.SP,
     )
     const parseOOBParamsResult = SpcpFactory.parseOOBParams('', '', AuthType.SP)
     const getSpcpAttributesResult = await SpcpFactory.getSpcpAttributes(
@@ -98,7 +103,8 @@ describe('spcp.factory', () => {
     expect(createRedirectUrlResult._unsafeUnwrapErr()).toEqual(error)
     expect(fetchLoginPageResult._unsafeUnwrapErr()).toEqual(error)
     expect(validateLoginPageResult._unsafeUnwrapErr()).toEqual(error)
-    expect(extractJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
+    expect(extractSingpassJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
+    expect(extractCorppassJwtPayloadResult._unsafeUnwrapErr()).toEqual(error)
     expect(parseOOBParamsResult._unsafeUnwrapErr()).toEqual(error)
     expect(getSpcpAttributesResult._unsafeUnwrapErr()).toEqual(error)
     expect(createJWTResult._unsafeUnwrapErr()).toEqual(error)
diff --git a/src/app/modules/spcp/__tests__/spcp.service.spec.ts b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
index 43746bbcf4..dc20f58a5f 100644
--- a/src/app/modules/spcp/__tests__/spcp.service.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
@@ -215,7 +215,7 @@ describe('spcp.service', () => {
     })
   })
 
-  describe('extractJwtPayload', () => {
+  describe('extractSingpassJwtPayload', () => {
     it('should return the correct payload for Singpass when JWT is valid', async () => {
       const spcpService = new SpcpService(MOCK_PARAMS)
       // Assumes that SP auth client was instantiated first
@@ -223,7 +223,7 @@ describe('spcp.service', () => {
       mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
         cb(null, MOCK_SP_JWT_PAYLOAD),
       )
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.SP)
+      const result = await spcpService.extractSingpassJwtPayload(MOCK_JWT)
       expect(result._unsafeUnwrap()).toEqual(MOCK_SP_JWT_PAYLOAD)
     })
 
@@ -234,7 +234,7 @@ describe('spcp.service', () => {
       mockClient.verifyJWT.mockImplementationOnce((_jwt, cb) =>
         cb(new Error(), null),
       )
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.SP)
+      const result = await spcpService.extractSingpassJwtPayload(MOCK_JWT)
       expect(result._unsafeUnwrapErr()).toEqual(new VerifyJwtError())
     })
 
@@ -247,12 +247,14 @@ describe('spcp.service', () => {
       const expected = new InvalidJwtError()
 
       // Act
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.SP)
+      const result = await spcpService.extractSingpassJwtPayload(MOCK_JWT)
 
       // Assert
       expect(result._unsafeUnwrapErr()).toEqual(expected)
     })
+  })
 
+  describe('extractCorppassJwtPayload', () => {
     it('should return the correct payload for Corppass when JWT is valid', async () => {
       const spcpService = new SpcpService(MOCK_PARAMS)
       // Assumes that SP auth client was instantiated first
@@ -260,7 +262,7 @@ describe('spcp.service', () => {
       mockClient.verifyJWT.mockImplementationOnce((jwt, cb) =>
         cb(null, MOCK_CP_JWT_PAYLOAD),
       )
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.CP)
+      const result = await spcpService.extractCorppassJwtPayload(MOCK_JWT)
       expect(result._unsafeUnwrap()).toEqual(MOCK_CP_JWT_PAYLOAD)
     })
 
@@ -271,7 +273,7 @@ describe('spcp.service', () => {
       mockClient.verifyJWT.mockImplementationOnce((_jwt, cb) =>
         cb(new Error(), null),
       )
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.CP)
+      const result = await spcpService.extractCorppassJwtPayload(MOCK_JWT)
       expect(result._unsafeUnwrapErr()).toEqual(new VerifyJwtError())
     })
 
@@ -284,7 +286,7 @@ describe('spcp.service', () => {
       const expected = new InvalidJwtError()
 
       // Act
-      const result = await spcpService.extractJwtPayload(MOCK_JWT, AuthType.CP)
+      const result = await spcpService.extractCorppassJwtPayload(MOCK_JWT)
 
       // Assert
       expect(result._unsafeUnwrapErr()).toEqual(expected)
diff --git a/src/app/modules/spcp/spcp.controller.ts b/src/app/modules/spcp/spcp.controller.ts
index 42f7f57b3f..77f7c6c082 100644
--- a/src/app/modules/spcp/spcp.controller.ts
+++ b/src/app/modules/spcp/spcp.controller.ts
@@ -4,7 +4,7 @@ import { StatusCodes } from 'http-status-codes'
 
 import config from '../../../config/config'
 import { createLoggerWithLabel } from '../../../config/logger'
-import { AuthType, WithForm } from '../../../types'
+import { AuthType } from '../../../types'
 import { createReqMeta } from '../../utils/request'
 import { BillingFactory } from '../billing/billing.factory'
 import * as FormService from '../form/form.service'
@@ -90,42 +90,6 @@ export const handleValidate: RequestHandler<
     })
 }
 
-/**
- * Adds session to returned JSON if form-filler is SPCP Authenticated
- * @param req - Express request object
- * @param res - Express response object
- * @param next - Express next middleware function
- */
-export const addSpcpSessionInfo: RequestHandler<ParamsDictionary> = async (
-  req,
-  res,
-  next,
-) => {
-  const { authType } = (req as WithForm<typeof req>).form
-  if (authType !== AuthType.SP && authType !== AuthType.CP) return next()
-
-  const jwtResult = SpcpFactory.extractJwt(req.cookies, authType)
-  // No action needed if JWT is missing, just means user is not logged in
-  if (jwtResult.isErr()) return next()
-
-  return SpcpFactory.extractJwtPayload(jwtResult.value, authType)
-    .map(({ userName }) => {
-      res.locals.spcpSession = { userName }
-      return next()
-    })
-    .mapErr((error) => {
-      logger.error({
-        message: 'Failed to verify JWT with auth client',
-        meta: {
-          action: 'addSpcpSessionInfo',
-          ...createReqMeta(req),
-        },
-        error,
-      })
-      return next()
-    })
-}
-
 /**
  * Higher-order function which returns an Express handler to handle Singpass
  * and Corppass login requests.
diff --git a/src/app/modules/spcp/spcp.factory.ts b/src/app/modules/spcp/spcp.factory.ts
index 69cc2c031c..5df9aaf191 100644
--- a/src/app/modules/spcp/spcp.factory.ts
+++ b/src/app/modules/spcp/spcp.factory.ts
@@ -13,7 +13,8 @@ interface ISpcpFactory {
   fetchLoginPage: SpcpService['fetchLoginPage']
   validateLoginPage: SpcpService['validateLoginPage']
   extractJwt: SpcpService['extractJwt']
-  extractJwtPayload: SpcpService['extractJwtPayload']
+  extractSingpassJwtPayload: SpcpService['extractSingpassJwtPayload']
+  extractCorppassJwtPayload: SpcpService['extractCorppassJwtPayload']
   parseOOBParams: SpcpService['parseOOBParams']
   getSpcpAttributes: SpcpService['getSpcpAttributes']
   createJWT: SpcpService['createJWT']
@@ -32,7 +33,8 @@ export const createSpcpFactory = ({
       createRedirectUrl: () => err(error),
       fetchLoginPage: () => errAsync(error),
       validateLoginPage: () => err(error),
-      extractJwtPayload: () => errAsync(error),
+      extractSingpassJwtPayload: () => errAsync(error),
+      extractCorppassJwtPayload: () => errAsync(error),
       extractJwt: () => err(error),
       parseOOBParams: () => err(error),
       getSpcpAttributes: () => errAsync(error),
diff --git a/src/app/modules/spcp/spcp.service.ts b/src/app/modules/spcp/spcp.service.ts
index 74911cdbda..81e353c2a0 100644
--- a/src/app/modules/spcp/spcp.service.ts
+++ b/src/app/modules/spcp/spcp.service.ts
@@ -22,11 +22,13 @@ import {
 } from './spcp.errors'
 import {
   CorppassAttributes,
+  CorppassJwtPayload,
   JwtName,
   JwtPayload,
   LoginPageValidationResult,
   ParsedSpcpParams,
   SingpassAttributes,
+  SingpassJwtPayload,
   SpcpCookies,
   SpcpDomainSettings,
 } from './spcp.types'
@@ -34,7 +36,8 @@ import {
   extractFormId,
   getAttributesPromise,
   getSubstringBetween,
-  isJwtPayload,
+  isCorppassJwtPayload,
+  isSingpassJwtPayload,
   isValidAuthenticationQuery,
   verifyJwtPromise,
 } from './spcp.util'
@@ -205,19 +208,16 @@ export class SpcpService {
   }
 
   /**
-   * Verifies a JWT and extracts its payload.
+   * Verifies a Singpass JWT and extracts its payload.
    * @param jwt The contents of the JWT cookie
-   * @param authType 'SP' or 'CP'
    */
-  extractJwtPayload(
+  extractSingpassJwtPayload(
     jwt: string,
-    authType: AuthType.SP | AuthType.CP,
-  ): ResultAsync<JwtPayload, VerifyJwtError | InvalidJwtError> {
+  ): ResultAsync<SingpassJwtPayload, VerifyJwtError | InvalidJwtError> {
     const logMeta = {
-      action: 'extractJwtPayload',
-      authType,
+      action: 'extractSingpassJwtPayload',
     }
-    const authClient = this.getAuthClient(authType)
+    const authClient = this.getAuthClient(AuthType.SP)
     return ResultAsync.fromPromise(
       verifyJwtPromise(authClient, jwt),
       (error) => {
@@ -229,7 +229,47 @@ export class SpcpService {
         return new VerifyJwtError()
       },
     ).andThen((payload) => {
-      if (isJwtPayload(payload, authType)) {
+      if (isSingpassJwtPayload(payload)) {
+        return okAsync(payload)
+      }
+      const payloadIsDefined = !!payload
+      const payloadKeys =
+        typeof payload === 'object' && !!payload && Object.keys(payload)
+      logger.error({
+        message: 'JWT has incorrect shape',
+        meta: {
+          ...logMeta,
+          payloadIsDefined,
+          payloadKeys,
+        },
+      })
+      return errAsync(new InvalidJwtError())
+    })
+  }
+
+  /**
+   * Verifies a Corppass JWT and extracts its payload.
+   * @param jwt The contents of the JWT cookie
+   */
+  extractCorppassJwtPayload(
+    jwt: string,
+  ): ResultAsync<CorppassJwtPayload, VerifyJwtError | InvalidJwtError> {
+    const logMeta = {
+      action: 'extractCorppassJwtPayload',
+    }
+    const authClient = this.getAuthClient(AuthType.CP)
+    return ResultAsync.fromPromise(
+      verifyJwtPromise(authClient, jwt),
+      (error) => {
+        logger.error({
+          message: 'Failed to verify JWT with auth client',
+          meta: logMeta,
+          error,
+        })
+        return new VerifyJwtError()
+      },
+    ).andThen((payload) => {
+      if (isCorppassJwtPayload(payload)) {
         return okAsync(payload)
       }
       const payloadIsDefined = !!payload
@@ -408,8 +448,13 @@ export class SpcpService {
     JwtPayload,
     VerifyJwtError | InvalidJwtError | MissingJwtError
   > {
-    return this.extractJwt(cookies, authType).asyncAndThen((jwtResult) =>
-      this.extractJwtPayload(jwtResult, authType),
-    )
+    return this.extractJwt(cookies, authType).asyncAndThen((jwtResult) => {
+      switch (authType) {
+        case AuthType.SP:
+          return this.extractSingpassJwtPayload(jwtResult)
+        case AuthType.CP:
+          return this.extractCorppassJwtPayload(jwtResult)
+      }
+    })
   }
 }
diff --git a/src/app/modules/spcp/spcp.types.ts b/src/app/modules/spcp/spcp.types.ts
index 2eb486174e..a13976278a 100644
--- a/src/app/modules/spcp/spcp.types.ts
+++ b/src/app/modules/spcp/spcp.types.ts
@@ -9,12 +9,19 @@ export type LoginPageValidationResult =
 
 export type SpcpCookies = Partial<Record<JwtName, string>>
 
-export type JwtPayload = {
+export type SingpassJwtPayload = {
   userName: string
-  userInfo?: string
   rememberMe: boolean
 }
 
+export type CorppassJwtPayload = {
+  userName: string
+  userInfo: string
+  rememberMe: boolean
+}
+
+export type JwtPayload = SingpassJwtPayload | CorppassJwtPayload
+
 export interface SingpassAttributes {
   UserName?: string
 }
diff --git a/src/app/modules/spcp/spcp.util.ts b/src/app/modules/spcp/spcp.util.ts
index fc7bf12568..9c12577194 100644
--- a/src/app/modules/spcp/spcp.util.ts
+++ b/src/app/modules/spcp/spcp.util.ts
@@ -3,12 +3,8 @@ import crypto from 'crypto'
 import { StatusCodes } from 'http-status-codes'
 
 import { createLoggerWithLabel } from '../../../config/logger'
-import {
-  AuthType,
-  BasicField,
-  MapRouteError,
-  SPCPFieldTitle,
-} from '../../../types'
+import { BasicField, MapRouteError, SPCPFieldTitle } from '../../../types'
+import { hasProp } from '../../utils/has-prop'
 import { MissingFeatureError } from '../core/core.errors'
 import { ProcessedSingleAnswerResponse } from '../submission/submission.types'
 
@@ -20,7 +16,7 @@ import {
   MissingJwtError,
   VerifyJwtError,
 } from './spcp.errors'
-import { JwtPayload } from './spcp.types'
+import { CorppassJwtPayload, SingpassJwtPayload } from './spcp.types'
 
 const logger = createLoggerWithLabel(module)
 const DESTINATION_REGEX = /^\/([\w]+)\/?/
@@ -138,27 +134,35 @@ export const verifyJwtPromise = (
 }
 
 /**
- * Typeguard for JWT payload.
+ * Typeguard for SingPass JWT payload.
  * @param payload Payload decrypted from JWT
  */
-export const isJwtPayload = (
+export const isSingpassJwtPayload = (
   payload: unknown,
-  authType: AuthType.SP | AuthType.CP,
-): payload is JwtPayload => {
-  if (authType === AuthType.SP) {
-    return (
-      !!payload &&
-      typeof payload === 'object' &&
-      typeof (payload as Record<string, unknown>).userName === 'string'
-    )
-  } else {
-    return (
-      !!payload &&
-      typeof payload === 'object' &&
-      typeof (payload as Record<string, unknown>).userName === 'string' &&
-      typeof (payload as Record<string, unknown>).userInfo === 'string'
-    )
-  }
+): payload is SingpassJwtPayload => {
+  return (
+    typeof payload === 'object' &&
+    !!payload &&
+    hasProp(payload, 'userName') &&
+    typeof payload.userName === 'string'
+  )
+}
+
+/**
+ * Typeguard for Corppass JWT payload.
+ * @param payload Payload decrypted from JWT
+ */
+export const isCorppassJwtPayload = (
+  payload: unknown,
+): payload is CorppassJwtPayload => {
+  return (
+    typeof payload === 'object' &&
+    !!payload &&
+    hasProp(payload, 'userName') &&
+    typeof payload.userName === 'string' &&
+    hasProp(payload, 'userInfo') &&
+    typeof payload.userInfo === 'string'
+  )
 }
 
 /**
diff --git a/src/app/modules/submission/email-submission/email-submission.controller.ts b/src/app/modules/submission/email-submission/email-submission.controller.ts
index 248da53408..bc751f0c92 100644
--- a/src/app/modules/submission/email-submission/email-submission.controller.ts
+++ b/src/app/modules/submission/email-submission/email-submission.controller.ts
@@ -126,64 +126,92 @@ export const handleEmailSubmission: RequestHandler<
 
   // Handle SingPass, CorpPass and MyInfo authentication and validation
   const { authType } = form
-  if (authType === AuthType.SP || authType === AuthType.CP) {
-    // Verify NRIC and/or UEN
-    const jwtPayloadResult = await SpcpFactory.extractJwt(
-      req.cookies,
-      authType,
-    ).asyncAndThen((jwt) => SpcpFactory.extractJwtPayload(jwt, authType))
-    if (jwtPayloadResult.isErr()) {
-      logger.error({
-        message: 'Failed to verify JWT with auth client',
-        meta: logMeta,
-        error: jwtPayloadResult.error,
-      })
-      const { errorMessage, statusCode } = mapRouteError(jwtPayloadResult.error)
-      return res
-        .status(statusCode)
-        .json({ message: errorMessage, spcpSubmissionFailure: true })
-    }
-    const { userName: uinFin, userInfo } = jwtPayloadResult.value
-
-    // Append SingPass/CorpPass info to responses
-    if (authType === AuthType.SP) {
-      parsedResponses.push(...createSingpassParsedResponses(uinFin))
-    } else if (authType === AuthType.CP) {
-      // TODO (#317): remove usage of non-null assertion with better typing of JWT payload
-      parsedResponses.push(...createCorppassParsedResponses(uinFin, userInfo!))
+  switch (authType) {
+    case AuthType.SP: {
+      // Verify NRIC
+      const jwtPayloadResult = await SpcpFactory.extractJwt(
+        req.cookies,
+        authType,
+      ).asyncAndThen((jwt) => SpcpFactory.extractSingpassJwtPayload(jwt))
+      if (jwtPayloadResult.isErr()) {
+        logger.error({
+          message: 'Failed to verify Singpass JWT with auth client',
+          meta: logMeta,
+          error: jwtPayloadResult.error,
+        })
+        const { errorMessage, statusCode } = mapRouteError(
+          jwtPayloadResult.error,
+        )
+        return res
+          .status(statusCode)
+          .json({ message: errorMessage, spcpSubmissionFailure: true })
+      }
+      parsedResponses.push(
+        ...createSingpassParsedResponses(jwtPayloadResult.value.userName),
+      )
+      break
     }
-  } else if (authType === AuthType.MyInfo) {
-    const uinFinResult = MyInfoUtil.extractMyInfoCookie(req.cookies)
-      .andThen(MyInfoUtil.extractAccessTokenFromCookie)
-      .andThen((accessToken) => MyInfoFactory.extractUinFin(accessToken))
-    if (uinFinResult.isErr()) {
-      const { errorMessage, statusCode } = mapRouteError(uinFinResult.error)
-      return res
-        .status(statusCode)
-        .json({ message: errorMessage, spcpSubmissionFailure: true })
+    case AuthType.CP: {
+      // Verify NRIC and UEN
+      const jwtPayloadResult = await SpcpFactory.extractJwt(
+        req.cookies,
+        authType,
+      ).asyncAndThen((jwt) => SpcpFactory.extractCorppassJwtPayload(jwt))
+      if (jwtPayloadResult.isErr()) {
+        logger.error({
+          message: 'Failed to verify Corppass JWT with auth client',
+          meta: logMeta,
+          error: jwtPayloadResult.error,
+        })
+        const { errorMessage, statusCode } = mapRouteError(
+          jwtPayloadResult.error,
+        )
+        return res
+          .status(statusCode)
+          .json({ message: errorMessage, spcpSubmissionFailure: true })
+      }
+      parsedResponses.push(
+        ...createCorppassParsedResponses(
+          jwtPayloadResult.value.userName,
+          jwtPayloadResult.value.userInfo,
+        ),
+      )
+      break
     }
-    const uinFin = uinFinResult.value
-    const verifyMyInfoResult = await MyInfoFactory.fetchMyInfoHashes(
-      uinFin,
-      formId,
-    ).andThen((hashes) =>
-      MyInfoFactory.checkMyInfoHashes(parsedResponses, hashes),
-    )
-    if (verifyMyInfoResult.isErr()) {
-      logger.error({
-        message: 'Error verifying MyInfo hashes',
-        meta: logMeta,
-        error: verifyMyInfoResult.error,
-      })
-      const { errorMessage, statusCode } = mapRouteError(
-        verifyMyInfoResult.error,
+    case AuthType.MyInfo: {
+      const uinFinResult = MyInfoUtil.extractMyInfoCookie(req.cookies)
+        .andThen(MyInfoUtil.extractAccessTokenFromCookie)
+        .andThen((accessToken) => MyInfoFactory.extractUinFin(accessToken))
+      if (uinFinResult.isErr()) {
+        const { errorMessage, statusCode } = mapRouteError(uinFinResult.error)
+        return res
+          .status(statusCode)
+          .json({ message: errorMessage, spcpSubmissionFailure: true })
+      }
+      const uinFin = uinFinResult.value
+      const verifyMyInfoResult = await MyInfoFactory.fetchMyInfoHashes(
+        uinFin,
+        formId,
+      ).andThen((hashes) =>
+        MyInfoFactory.checkMyInfoHashes(parsedResponses, hashes),
       )
-      return res
-        .status(statusCode)
-        .json({ message: errorMessage, spcpSubmissionFailure: true })
+      if (verifyMyInfoResult.isErr()) {
+        logger.error({
+          message: 'Error verifying MyInfo hashes',
+          meta: logMeta,
+          error: verifyMyInfoResult.error,
+        })
+        const { errorMessage, statusCode } = mapRouteError(
+          verifyMyInfoResult.error,
+        )
+        return res
+          .status(statusCode)
+          .json({ message: errorMessage, spcpSubmissionFailure: true })
+      }
+      hashedFields = verifyMyInfoResult.value
+      parsedResponses.push(...createSingpassParsedResponses(uinFin))
+      break
     }
-    hashedFields = verifyMyInfoResult.value
-    parsedResponses.push(...createSingpassParsedResponses(uinFin))
   }
 
   // Create data for response email as well as email confirmation
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index c640efbbb0..75fe9dc5e1 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -9,8 +9,6 @@ import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   AuthType,
   EncryptedSubmissionDto,
-  ResWithHashedFields,
-  ResWithUinFin,
   SubmissionMetadataList,
 } from '../../../../types'
 import { EncryptSubmissionDto, ErrorDto } from '../../../../types/api'
@@ -19,12 +17,13 @@ import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import { checkIsEncryptedEncoding } from '../../../utils/encryption'
 import { createReqMeta, getRequestIp } from '../../../utils/request'
 import { getFormAfterPermissionChecks } from '../../auth/auth.service'
-import { MissingFeatureError } from '../../core/core.errors'
+import {
+  MalformedParametersError,
+  MissingFeatureError,
+} from '../../core/core.errors'
 import { PermissionLevel } from '../../form/admin-form/admin-form.types'
 import * as FormService from '../../form/form.service'
 import { isFormEncryptMode } from '../../form/form.utils'
-import { MyInfoFactory } from '../../myinfo/myinfo.factory'
-import { mapVerifyMyInfoError } from '../../myinfo/myinfo.util'
 import { SpcpFactory } from '../../spcp/spcp.factory'
 import { getPopulatedUserById } from '../../user/user.service'
 import { VerifiedContentFactory } from '../../verified-content/verified-content.factory'
@@ -168,62 +167,65 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
 
   // Checks if user is SPCP-authenticated before allowing submission
   const { authType } = form
-  if (authType === AuthType.SP || authType === AuthType.CP) {
-    const spcpResult = await SpcpFactory.extractJwt(
-      req.cookies,
-      authType,
-    ).asyncAndThen((jwt) => SpcpFactory.extractJwtPayload(jwt, authType))
-    if (spcpResult.isErr()) {
-      const { statusCode, errorMessage } = mapRouteError(spcpResult.error)
+  switch (authType) {
+    case AuthType.MyInfo: {
       logger.error({
-        message: 'Failed to verify JWT with auth client',
+        message:
+          'Storage mode form is not allowed to have MyInfo authorisation',
         meta: logMeta,
-        error: spcpResult.error,
-      })
-      return res.status(statusCode).json({
-        message: errorMessage,
-        spcpSubmissionFailure: true,
       })
+      const { errorMessage, statusCode } = mapRouteError(
+        new MalformedParametersError(
+          'Storage mode form is not allowed to have MyInfo authType',
+        ),
+      )
+      return res.status(statusCode).json({ message: errorMessage })
     }
-    res.locals.uinFin = spcpResult.value.userName
-    res.locals.userInfo = spcpResult.value.userInfo
-  }
-
-  // validating that submitted MyInfo field values match the values
-  // originally retrieved from MyInfo.
-  // TODO(frankchn): Roll into a single service call as part of internal refactoring
-  const uinFin = (res as ResWithUinFin<typeof res>).locals.uinFin
-  const requestedAttributes = form.getUniqueMyInfoAttrs()
-  if (authType === AuthType.SP && requestedAttributes.length > 0) {
-    if (!uinFin) {
-      return res.status(StatusCodes.UNAUTHORIZED).send({
-        message: 'Please log in to SingPass and try again.',
-        spcpSubmissionFailure: true,
-      })
+    case AuthType.SP: {
+      const jwtPayloadResult = await SpcpFactory.extractJwt(
+        req.cookies,
+        authType,
+      ).asyncAndThen((jwt) => SpcpFactory.extractSingpassJwtPayload(jwt))
+      if (jwtPayloadResult.isErr()) {
+        const { statusCode, errorMessage } = mapRouteError(
+          jwtPayloadResult.error,
+        )
+        logger.error({
+          message: 'Failed to verify Singpass JWT with auth client',
+          meta: logMeta,
+          error: jwtPayloadResult.error,
+        })
+        return res.status(statusCode).json({
+          message: errorMessage,
+          spcpSubmissionFailure: true,
+        })
+      }
+      res.locals.uinFin = jwtPayloadResult.value.userName
+      break
     }
-    const myinfoResult = await MyInfoFactory.fetchMyInfoHashes(
-      uinFin,
-      formId,
-    ).andThen((hashes) =>
-      MyInfoFactory.checkMyInfoHashes(processedResponses, hashes),
-    )
-    if (myinfoResult.isErr()) {
-      logger.error({
-        message: 'Error verifying MyInfo hashes',
-        meta: logMeta,
-        error: myinfoResult.error,
-      })
-      const { statusCode, errorMessage } = mapVerifyMyInfoError(
-        myinfoResult.error,
-      )
-      return res.status(statusCode).send({
-        message: errorMessage,
-        spcpSubmissionFailure: true,
-      })
+    case AuthType.CP: {
+      const jwtPayloadResult = await SpcpFactory.extractJwt(
+        req.cookies,
+        authType,
+      ).asyncAndThen((jwt) => SpcpFactory.extractCorppassJwtPayload(jwt))
+      if (jwtPayloadResult.isErr()) {
+        const { statusCode, errorMessage } = mapRouteError(
+          jwtPayloadResult.error,
+        )
+        logger.error({
+          message: 'Failed to verify Corppass JWT with auth client',
+          meta: logMeta,
+          error: jwtPayloadResult.error,
+        })
+        return res.status(statusCode).json({
+          message: errorMessage,
+          spcpSubmissionFailure: true,
+        })
+      }
+      res.locals.uinFin = jwtPayloadResult.value.userName
+      res.locals.userInfo = jwtPayloadResult.value.userInfo
+      break
     }
-    // eslint-disable-next-line @typescript-eslint/no-extra-semi
-    ;(res as ResWithHashedFields<typeof res>).locals.hashedFields =
-      myinfoResult.value
   }
 
   // Encrypt Verified SPCP Fields
diff --git a/src/app/utils/encryption.ts b/src/app/utils/encryption.ts
index 080d469fab..a8f22b1723 100644
--- a/src/app/utils/encryption.ts
+++ b/src/app/utils/encryption.ts
@@ -6,11 +6,6 @@ import { InvalidEncodingError } from '../modules/submission/submission.errors'
 export const checkIsEncryptedEncoding = (
   encryptedStr: string,
 ): Result<true, InvalidEncodingError> => {
-  // TODO (#42): Remove this type check once whole backend is in TypeScript.
-  if (typeof encryptedStr !== 'string') {
-    return err(new InvalidEncodingError('encryptedStr is not of type `string`'))
-  }
-
   const [submissionPublicKey, nonceEncrypted] = encryptedStr.split(';')
 
   if (!nonceEncrypted) {
diff --git a/src/app/utils/limit-rate.ts b/src/app/utils/limit-rate.ts
index 073b45a863..9a97358882 100644
--- a/src/app/utils/limit-rate.ts
+++ b/src/app/utils/limit-rate.ts
@@ -12,9 +12,8 @@ import { createReqMeta } from './request'
 const logger = createLoggerWithLabel(module)
 
 /**
- * Returns a middleware which logs a message if the rate of requests
+ * Returns a middleware which logs a message and returns 429 if the rate of requests
  * to an API endpoint exceeds a given rate.
- * TODO (private #49): update this documentation.
  * @param options Custom options to be passed to RateLimit
  * @return Rate-limiting middleware
  */
diff --git a/src/config/config.ts b/src/config/config.ts
index e20ad2654e..79f63c4581 100644
--- a/src/config/config.ts
+++ b/src/config/config.ts
@@ -84,7 +84,7 @@ const awsConfig: AwsConfig = {
   s3,
 }
 
-let dbUri
+let dbUri: string | undefined
 if (isDev) {
   if (basicVars.core.nodeEnv === Environment.Dev && prodOnlyVars.dbHost) {
     dbUri = prodOnlyVars.dbHost
@@ -98,8 +98,7 @@ if (isDev) {
 }
 
 const dbConfig: DbConfig = {
-  // TODO (#317): remove usage of non-null assertion
-  uri: dbUri!,
+  uri: dbUri ?? '',
   options: {
     user: '',
     pass: '',
diff --git a/src/config/logger.ts b/src/config/logger.ts
index b3a793e822..91fa4c319b 100644
--- a/src/config/logger.ts
+++ b/src/config/logger.ts
@@ -1,5 +1,4 @@
 import hasAnsi from 'has-ansi'
-import { isEmpty } from 'lodash'
 import omit from 'lodash/omit'
 import logform from 'logform'
 import path from 'path'
@@ -187,55 +186,27 @@ const getModuleLabel = (callingModule: NodeModule) => {
 /**
  * Overrides the given winston logger with a new signature, so as to enforce a
  * log format.
- * TODO(#42): Remove try catch blocks when application is 100% TypeScript.
  * @param logger the logger to override
  */
 const createCustomLogger = (logger: Logger) => {
   return {
     info: (params: Omit<CustomLoggerParams, 'error'>) => {
-      try {
-        const { message, meta } = params
-        // Not the expected shape, throw to catch block.
-        if (!message || isEmpty(meta)) {
-          //eslint-disable-next-line
-          throw new Error('Wrong shape')
-        }
-        return logger.info(message, { meta })
-      } catch {
-        return logger.info(params)
-      }
+      const { message, meta } = params
+      return logger.info(message, { meta })
     },
     warn: (params: CustomLoggerParams) => {
-      try {
-        const { message, meta, error } = params
-        // Not the expected shape, throw to catch block.
-        if (!message || isEmpty(meta)) {
-          //eslint-disable-next-line
-          throw new Error('Wrong shape')
-        }
-        if (error) {
-          return logger.warn(message, { meta }, error)
-        }
-        return logger.warn(message, { meta })
-      } catch {
-        return logger.warn(params)
+      const { message, meta, error } = params
+      if (error) {
+        return logger.warn(message, { meta }, error)
       }
+      return logger.warn(message, { meta })
     },
     error: (params: CustomLoggerParams) => {
-      try {
-        const { message, meta, error } = params
-        // Not the expected shape, throw to catch block.
-        if (!message || isEmpty(meta)) {
-          //eslint-disable-next-line
-          throw new Error('Wrong shape')
-        }
-        if (error) {
-          return logger.error(message, { meta }, error)
-        }
-        return logger.error(message, { meta })
-      } catch {
-        return logger.error(params)
+      const { message, meta, error } = params
+      if (error) {
+        return logger.error(message, { meta }, error)
       }
+      return logger.error(message, { meta })
     },
   }
 }
diff --git a/src/loaders/mongoose.ts b/src/loaders/mongoose.ts
index 6c135111af..0ac7dbdde4 100644
--- a/src/loaders/mongoose.ts
+++ b/src/loaders/mongoose.ts
@@ -43,8 +43,7 @@ export default async (): Promise<Connection> => {
 
   // Actually connect to the database
   function connect() {
-    // TODO (#317): remove usage of non-null assertion
-    return mongoose.connect(config.db.uri!, config.db.options)
+    return mongoose.connect(config.db.uri, config.db.options)
   }
 
   // Only required for initial connection errors, reconnect on error.
diff --git a/src/shared/util/logic.ts b/src/shared/util/logic.ts
index 2685a1501b..96b182111a 100644
--- a/src/shared/util/logic.ts
+++ b/src/shared/util/logic.ts
@@ -128,13 +128,15 @@ export const getLogicUnitPreventingSubmit = (
   form: IFormDocument,
   visibleFieldIds?: FieldIdSet,
 ): IPreventSubmitLogicSchema | undefined => {
-  if (!visibleFieldIds) {
-    visibleFieldIds = getVisibleFieldIds(submission, form)
-  }
+  const definedVisibleFieldIds =
+    visibleFieldIds ?? getVisibleFieldIds(submission, form)
   const preventSubmitConditions = getPreventSubmitConditions(form)
   return preventSubmitConditions.find((logicUnit) =>
-    // TODO (#317): remove usage of non-null assertion
-    isLogicUnitSatisfied(submission, logicUnit.conditions, visibleFieldIds!),
+    isLogicUnitSatisfied(
+      submission,
+      logicUnit.conditions,
+      definedVisibleFieldIds,
+    ),
   )
 }
 
diff --git a/src/types/express.locals.ts b/src/types/email_mode_data.ts
similarity index 59%
rename from src/types/express.locals.ts
rename to src/types/email_mode_data.ts
index cdd69b5b92..9f3d951c9f 100644
--- a/src/types/express.locals.ts
+++ b/src/types/email_mode_data.ts
@@ -1,30 +1,4 @@
-// TODO (#42): remove these types when migrating away from middleware pattern
-import { LeanDocument } from 'mongoose'
-
-import { ProcessedFieldResponse } from '../app/modules/submission/submission.types'
-
 import { BasicField } from './field'
-import { IPopulatedForm } from './form'
-
-export type WithForm<T> = T & {
-  form: IPopulatedForm
-}
-
-export type WithJsonForm<T> = T & {
-  form: LeanDocument<IPopulatedForm>
-}
-
-export type WithParsedResponses<T> = T & {
-  parsedResponses: ProcessedFieldResponse[]
-}
-
-export type ResWithUinFin<T> = T & {
-  uinFin?: string
-}
-
-export type ResWithHashedFields<T> = T & {
-  locals: { hashedFields?: Set<string> }
-}
 
 export type EmailRespondentConfirmationField = {
   question: string
diff --git a/src/types/index.ts b/src/types/index.ts
index 6874ade633..4cf095bc06 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -18,4 +18,4 @@ export * from './admin_verification'
 export * from './config'
 export * from './spcp'
 export * from './routing'
-export * from './express.locals'
+export * from './email_mode_data'

From 7a60f4b1a763469831d55a6e516d749088b35ae4 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Fri, 9 Apr 2021 10:59:38 +0800
Subject: [PATCH 35/75] test: fix flakiness (again) by hardcoding created dates
 (#1604)

* test: fix flakiness (again) by hardcoding created dates

instead of using relative dates, which may behave differently in
different machines (like CI/CD)

* test: assign date strings to constants for clarity
---
 .../__tests__/admin-form.routes.spec.ts           | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index 47bbf64f93..c23c34ab4b 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -4719,7 +4719,6 @@ describe('admin-form.routes', () => {
 
     it('should return 200 with stream of encrypted responses between given query.startDate and query.endDate', async () => {
       // Arrange
-      const now = new Date()
       const submissions = await Promise.all(
         times(5, (count) =>
           createSubmission({
@@ -4730,13 +4729,15 @@ describe('admin-form.routes', () => {
               ['fieldId1', `some.attachment.url.${count}`],
               ['fieldId2', `some.other.attachment.url.${count}`],
             ]),
-            created: now,
           }),
         ),
       )
-      // Set 2 submissions to be submitted 3-4 days ago.
-      submissions[2].created = subDays(now, 3)
-      submissions[4].created = subDays(now, 4)
+
+      const startDateStr = '2020-02-03'
+      const endDateStr = '2020-02-04'
+      // Set 2 submissions to be submitted with specific date
+      submissions[2].created = new Date(startDateStr)
+      submissions[4].created = new Date(endDateStr)
       await submissions[2].save()
       await submissions[4].save()
       const expectedSubmissionIds = [
@@ -4748,8 +4749,8 @@ describe('admin-form.routes', () => {
       const response = await request
         .get(`/${defaultForm._id}/adminform/submissions/download`)
         .query({
-          startDate: format(subDays(now, 4), 'yyyy-MM-dd'),
-          endDate: format(subDays(now, 3), 'yyyy-MM-dd'),
+          startDate: startDateStr,
+          endDate: endDateStr,
         })
         .buffer()
         .parse((res, cb) => {

From ca91610517053033a42d0ada01caf0c9e1be4e0a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 03:45:04 +0000
Subject: [PATCH 36/75] chore(deps-dev): bump @babel/core from 7.13.14 to
 7.13.15 (#1600)

Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.13.14 to 7.13.15.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.13.15/packages/babel-core)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 60 +++++++++++++++++++++++------------------------
 package.json      |  2 +-
 2 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 095f804a6e..0eefae4570 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,9 +20,9 @@
       "dev": true
     },
     "@babel/core": {
-      "version": "7.13.14",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.13.14.tgz",
-      "integrity": "sha512-wZso/vyF4ki0l0znlgM4inxbdrUvCb+cVz8grxDq+6C9k6qbqoIJteQOKicaKjCipU3ISV+XedCqpL2RJJVehA==",
+      "version": "7.13.15",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.13.15.tgz",
+      "integrity": "sha512-6GXmNYeNjS2Uz+uls5jalOemgIhnTMeaXo+yBUA72kC2uX/8VW6XyhVIo2L8/q0goKQA3EVKx0KOQpVKSeWadQ==",
       "dev": true,
       "requires": {
         "@babel/code-frame": "^7.12.13",
@@ -30,9 +30,9 @@
         "@babel/helper-compilation-targets": "^7.13.13",
         "@babel/helper-module-transforms": "^7.13.14",
         "@babel/helpers": "^7.13.10",
-        "@babel/parser": "^7.13.13",
+        "@babel/parser": "^7.13.15",
         "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.13.13",
+        "@babel/traverse": "^7.13.15",
         "@babel/types": "^7.13.14",
         "convert-source-map": "^1.7.0",
         "debug": "^4.1.0",
@@ -52,9 +52,9 @@
           }
         },
         "@babel/compat-data": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.12.tgz",
-          "integrity": "sha512-3eJJ841uKxeV8dcN/2yGEUy+RfgQspPEgQat85umsE1rotuquQ2AbIub4S6j7c50a2d+4myc+zSlnXeIHrOnhQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.15.tgz",
+          "integrity": "sha512-ltnibHKR1VnrU4ymHyQ/CXtNXI6yZC0oJThyW78Hft8XndANwi+9H+UIklBDraIjFEJzw8wmcM427oDd9KS5wA==",
           "dev": true
         },
         "@babel/generator": {
@@ -191,9 +191,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.13",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.13.tgz",
-          "integrity": "sha512-OhsyMrqygfk5v8HmWwOzlYjJrtLaFhF34MrfG/Z73DgYCI6ojNUTUp2TYbtnjo8PegeJp12eamsNettCQjKjVw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -208,17 +208,17 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.13",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.13.tgz",
-          "integrity": "sha512-CblEcwmXKR6eP43oQGG++0QMTtCjAsa3frUuzHoiIJWpaIIi8dwMyEFUJoXRLxagGqCK+jALRwIO+o3R9p/uUg==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
             "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.13",
-            "@babel/types": "^7.13.13",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
             "globals": "^11.1.0"
           }
@@ -248,9 +248,9 @@
           }
         },
         "caniuse-lite": {
-          "version": "1.0.30001204",
-          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001204.tgz",
-          "integrity": "sha512-JUdjWpcxfJ9IPamy2f5JaRDCaqJOxDzOSKtbdx4rH9VivMd1vIzoPumsJa9LoMIi4Fx2BV2KZOxWhNkBjaYivQ==",
+          "version": "1.0.30001208",
+          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001208.tgz",
+          "integrity": "sha512-OE5UE4+nBOro8Dyvv0lfx+SRtfVIOM9uhKqFmJeUbGriqhhStgp1A0OyBpgy3OUF8AhYCT+PVwPC1gMl2ZcQMA==",
           "dev": true
         },
         "debug": {
@@ -263,9 +263,9 @@
           }
         },
         "electron-to-chromium": {
-          "version": "1.3.701",
-          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.701.tgz",
-          "integrity": "sha512-Zd9ofdIMYHYhG1gvnejQDvC/kqSeXQvtXF0yRURGxgwGqDZm9F9Fm3dYFnm5gyuA7xpXfBlzVLN1sz0FjxpKfw==",
+          "version": "1.3.711",
+          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.711.tgz",
+          "integrity": "sha512-XbklBVCDiUeho0PZQCjC25Ha6uBwqqJeyDhPLwLwfWRAo4x+FZFsmu1pPPkXT+B4MQMQoQULfyaMltDopfeiHQ==",
           "dev": true
         },
         "json5": {
@@ -1539,9 +1539,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.13",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.13.tgz",
-          "integrity": "sha512-OhsyMrqygfk5v8HmWwOzlYjJrtLaFhF34MrfG/Z73DgYCI6ojNUTUp2TYbtnjo8PegeJp12eamsNettCQjKjVw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -1556,17 +1556,17 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.13",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.13.tgz",
-          "integrity": "sha512-CblEcwmXKR6eP43oQGG++0QMTtCjAsa3frUuzHoiIJWpaIIi8dwMyEFUJoXRLxagGqCK+jALRwIO+o3R9p/uUg==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
             "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.13",
-            "@babel/types": "^7.13.13",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
             "globals": "^11.1.0"
           }
diff --git a/package.json b/package.json
index 4376bf685b..6a709f490c 100644
--- a/package.json
+++ b/package.json
@@ -156,7 +156,7 @@
     "winston-cloudwatch": "^2.5.0"
   },
   "devDependencies": {
-    "@babel/core": "^7.13.14",
+    "@babel/core": "^7.13.15",
     "@babel/plugin-transform-runtime": "^7.13.10",
     "@babel/preset-env": "^7.13.12",
     "@opengovsg/mockpass": "^2.6.8",

From 1da978238f87c2a6ab3f56a73237f284af085bb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 04:00:28 +0000
Subject: [PATCH 37/75] fix(deps): bump twilio from 3.59.0 to 3.60.0 (#1601)

Bumps [twilio](https://github.com/twilio/twilio-node) from 3.59.0 to 3.60.0.
- [Release notes](https://github.com/twilio/twilio-node/releases)
- [Changelog](https://github.com/twilio/twilio-node/blob/main/CHANGES.md)
- [Commits](https://github.com/twilio/twilio-node/compare/3.59.0...3.60.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0eefae4570..c293c6fe63 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24090,9 +24090,9 @@
       "integrity": "sha512-RKJBIj8lySrShN4w6i/BonWp2Z/uxwC3h4y7xsRrpP59ZboCd0GpEVsOnMDYLMmKBpYhb5TgHzZXy7wTfYFBRw=="
     },
     "twilio": {
-      "version": "3.59.0",
-      "resolved": "https://registry.npmjs.org/twilio/-/twilio-3.59.0.tgz",
-      "integrity": "sha512-2pRNZXBYm+8e2TrljE3xkUs8YSamX9RGhO9TLN+OjbxYNOXybviM+SQ+FZyHVJdoYlbu68/iF2fUkg6DLCQGeA==",
+      "version": "3.60.0",
+      "resolved": "https://registry.npmjs.org/twilio/-/twilio-3.60.0.tgz",
+      "integrity": "sha512-f8Ts9rfrkycjgnlmu1TzLigoAbrAsIoEnfPoZl+kf94FbBI3QXTUVWhvYj+NrCwLjOewDxrV8qIea1IcyVbG2Q==",
       "requires": {
         "axios": "^0.21.1",
         "dayjs": "^1.8.29",
diff --git a/package.json b/package.json
index 6a709f490c..5b923e6186 100644
--- a/package.json
+++ b/package.json
@@ -145,7 +145,7 @@
     "toastr": "^2.1.4",
     "triple-beam": "^1.3.0",
     "tweetnacl": "^1.0.1",
-    "twilio": "^3.59.0",
+    "twilio": "^3.60.0",
     "ui-select": "^0.19.8",
     "uid-generator": "^2.0.0",
     "uuid": "^8.3.2",

From 978480c20ad8250d6dbb367093666e63eaa35551 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 04:43:00 +0000
Subject: [PATCH 38/75] chore(deps-dev): bump @babel/plugin-transform-runtime
 (#1602)

Bumps [@babel/plugin-transform-runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-runtime) from 7.13.10 to 7.13.15.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.13.15/packages/babel-plugin-transform-runtime)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 243 ++++++++++++++++++++++++++++++++++++++++++++--
 package.json      |   2 +-
 2 files changed, 237 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c293c6fe63..4d4f24b59a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2900,25 +2900,254 @@
       }
     },
     "@babel/plugin-transform-runtime": {
-      "version": "7.13.10",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.13.10.tgz",
-      "integrity": "sha512-Y5k8ipgfvz5d/76tx7JYbKQTcgFSU6VgJ3kKQv4zGTKr+a9T/KBvfRvGtSFgKDQGt/DBykQixV0vNWKIdzWErA==",
+      "version": "7.13.15",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.13.15.tgz",
+      "integrity": "sha512-d+ezl76gx6Jal08XngJUkXM4lFXK/5Ikl9Mh4HKDxSfGJXmZ9xG64XT2oivBzfxb/eQ62VfvoMkaCZUKJMVrBA==",
       "dev": true,
       "requires": {
-        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/helper-module-imports": "^7.13.12",
         "@babel/helper-plugin-utils": "^7.13.0",
-        "babel-plugin-polyfill-corejs2": "^0.1.4",
-        "babel-plugin-polyfill-corejs3": "^0.1.3",
-        "babel-plugin-polyfill-regenerator": "^0.1.2",
+        "babel-plugin-polyfill-corejs2": "^0.2.0",
+        "babel-plugin-polyfill-corejs3": "^0.2.0",
+        "babel-plugin-polyfill-regenerator": "^0.2.0",
         "semver": "^6.3.0"
       },
       "dependencies": {
+        "@babel/code-frame": {
+          "version": "7.12.13",
+          "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.13.tgz",
+          "integrity": "sha512-HV1Cm0Q3ZrpCR93tkWOYiuYIgLxZXZFVG2VgK+MBWjUqZTundupbfx2aXarXuw5Ko5aMcjtJgbSs4vUGBS5v6g==",
+          "dev": true,
+          "requires": {
+            "@babel/highlight": "^7.12.13"
+          }
+        },
+        "@babel/compat-data": {
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.15.tgz",
+          "integrity": "sha512-ltnibHKR1VnrU4ymHyQ/CXtNXI6yZC0oJThyW78Hft8XndANwi+9H+UIklBDraIjFEJzw8wmcM427oDd9KS5wA==",
+          "dev": true
+        },
+        "@babel/generator": {
+          "version": "7.13.9",
+          "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.13.9.tgz",
+          "integrity": "sha512-mHOOmY0Axl/JCTkxTU6Lf5sWOg/v8nUa+Xkt4zMTftX0wqmb6Sh7J8gvcehBw7q0AhrhAR+FDacKjCZ2X8K+Sw==",
+          "dev": true,
+          "requires": {
+            "@babel/types": "^7.13.0",
+            "jsesc": "^2.5.1",
+            "source-map": "^0.5.0"
+          }
+        },
+        "@babel/helper-define-polyfill-provider": {
+          "version": "0.2.0",
+          "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.2.0.tgz",
+          "integrity": "sha512-JT8tHuFjKBo8NnaUbblz7mIu1nnvUDiHVjXXkulZULyidvo/7P6TY7+YqpV37IfF+KUFxmlK04elKtGKXaiVgw==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-compilation-targets": "^7.13.0",
+            "@babel/helper-module-imports": "^7.12.13",
+            "@babel/helper-plugin-utils": "^7.13.0",
+            "@babel/traverse": "^7.13.0",
+            "debug": "^4.1.1",
+            "lodash.debounce": "^4.0.8",
+            "resolve": "^1.14.2",
+            "semver": "^6.1.2"
+          }
+        },
+        "@babel/helper-function-name": {
+          "version": "7.12.13",
+          "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.12.13.tgz",
+          "integrity": "sha512-TZvmPn0UOqmvi5G4vvw0qZTpVptGkB1GL61R6lKvrSdIxGm5Pky7Q3fpKiIkQCAtRCBUwB0PaThlx9vebCDSwA==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-get-function-arity": "^7.12.13",
+            "@babel/template": "^7.12.13",
+            "@babel/types": "^7.12.13"
+          }
+        },
+        "@babel/helper-get-function-arity": {
+          "version": "7.12.13",
+          "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.12.13.tgz",
+          "integrity": "sha512-DjEVzQNz5LICkzN0REdpD5prGoidvbdYk1BVgRUOINaWJP2t6avB27X1guXK1kXNrX0WMfsrm1A/ZBthYuIMQg==",
+          "dev": true,
+          "requires": {
+            "@babel/types": "^7.12.13"
+          }
+        },
+        "@babel/helper-module-imports": {
+          "version": "7.13.12",
+          "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.13.12.tgz",
+          "integrity": "sha512-4cVvR2/1B693IuOvSI20xqqa/+bl7lqAMR59R4iu39R9aOX8/JoYY1sFaNvUMyMBGnHdwvJgUrzNLoUZxXypxA==",
+          "dev": true,
+          "requires": {
+            "@babel/types": "^7.13.12"
+          }
+        },
         "@babel/helper-plugin-utils": {
           "version": "7.13.0",
           "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.13.0.tgz",
           "integrity": "sha512-ZPafIPSwzUlAoWT8DKs1W2VyF2gOWthGd5NGFMsBcMMol+ZhK+EQY/e6V96poa6PA/Bh+C9plWN0hXO1uB8AfQ==",
           "dev": true
         },
+        "@babel/helper-split-export-declaration": {
+          "version": "7.12.13",
+          "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.12.13.tgz",
+          "integrity": "sha512-tCJDltF83htUtXx5NLcaDqRmknv652ZWCHyoTETf1CXYJdPC7nohZohjUgieXhv0hTJdRf2FjDueFehdNucpzg==",
+          "dev": true,
+          "requires": {
+            "@babel/types": "^7.12.13"
+          }
+        },
+        "@babel/helper-validator-identifier": {
+          "version": "7.12.11",
+          "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.12.11.tgz",
+          "integrity": "sha512-np/lG3uARFybkoHokJUmf1QfEvRVCPbmQeUQpKow5cQ3xWrV9i3rUHodKDJPQfTVX61qKi+UdYk8kik84n7XOw==",
+          "dev": true
+        },
+        "@babel/highlight": {
+          "version": "7.13.10",
+          "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.13.10.tgz",
+          "integrity": "sha512-5aPpe5XQPzflQrFwL1/QoeHkP2MsA4JCntcXHRhEsdsfPVkvPi2w7Qix4iV7t5S/oC9OodGrggd8aco1g3SZFg==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-validator-identifier": "^7.12.11",
+            "chalk": "^2.0.0",
+            "js-tokens": "^4.0.0"
+          }
+        },
+        "@babel/parser": {
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
+          "dev": true
+        },
+        "@babel/template": {
+          "version": "7.12.13",
+          "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.12.13.tgz",
+          "integrity": "sha512-/7xxiGA57xMo/P2GVvdEumr8ONhFOhfgq2ihK3h1e6THqzTAkHbkXgB0xI9yeTfIUoH3+oAeHhqm/I43OTbbjA==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@babel/parser": "^7.12.13",
+            "@babel/types": "^7.12.13"
+          }
+        },
+        "@babel/traverse": {
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@babel/generator": "^7.13.9",
+            "@babel/helper-function-name": "^7.12.13",
+            "@babel/helper-split-export-declaration": "^7.12.13",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
+            "debug": "^4.1.0",
+            "globals": "^11.1.0"
+          }
+        },
+        "@babel/types": {
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-validator-identifier": "^7.12.11",
+            "lodash": "^4.17.19",
+            "to-fast-properties": "^2.0.0"
+          }
+        },
+        "babel-plugin-polyfill-corejs2": {
+          "version": "0.2.0",
+          "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.2.0.tgz",
+          "integrity": "sha512-9bNwiR0dS881c5SHnzCmmGlMkJLl0OUZvxrxHo9w/iNoRuqaPjqlvBf4HrovXtQs/au5yKkpcdgfT1cC5PAZwg==",
+          "dev": true,
+          "requires": {
+            "@babel/compat-data": "^7.13.11",
+            "@babel/helper-define-polyfill-provider": "^0.2.0",
+            "semver": "^6.1.1"
+          }
+        },
+        "babel-plugin-polyfill-corejs3": {
+          "version": "0.2.0",
+          "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.2.0.tgz",
+          "integrity": "sha512-zZyi7p3BCUyzNxLx8KV61zTINkkV65zVkDAFNZmrTCRVhjo1jAS+YLvDJ9Jgd/w2tsAviCwFHReYfxO3Iql8Yg==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-define-polyfill-provider": "^0.2.0",
+            "core-js-compat": "^3.9.1"
+          }
+        },
+        "babel-plugin-polyfill-regenerator": {
+          "version": "0.2.0",
+          "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.2.0.tgz",
+          "integrity": "sha512-J7vKbCuD2Xi/eEHxquHN14bXAW9CXtecwuLrOIDJtcZzTaPzV1VdEfoUf9AzcRBMolKUQKM9/GVojeh0hFiqMg==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-define-polyfill-provider": "^0.2.0"
+          }
+        },
+        "browserslist": {
+          "version": "4.16.3",
+          "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.16.3.tgz",
+          "integrity": "sha512-vIyhWmIkULaq04Gt93txdh+j02yX/JzlyhLYbV3YQCn/zvES3JnY7TifHHvvr1w5hTDluNKMkV05cs4vy8Q7sw==",
+          "dev": true,
+          "requires": {
+            "caniuse-lite": "^1.0.30001181",
+            "colorette": "^1.2.1",
+            "electron-to-chromium": "^1.3.649",
+            "escalade": "^3.1.1",
+            "node-releases": "^1.1.70"
+          }
+        },
+        "caniuse-lite": {
+          "version": "1.0.30001208",
+          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001208.tgz",
+          "integrity": "sha512-OE5UE4+nBOro8Dyvv0lfx+SRtfVIOM9uhKqFmJeUbGriqhhStgp1A0OyBpgy3OUF8AhYCT+PVwPC1gMl2ZcQMA==",
+          "dev": true
+        },
+        "core-js-compat": {
+          "version": "3.10.1",
+          "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.10.1.tgz",
+          "integrity": "sha512-ZHQTdTPkqvw2CeHiZC970NNJcnwzT6YIueDMASKt+p3WbZsLXOcoD392SkcWhkC0wBBHhlfhqGKKsNCQUozYtg==",
+          "dev": true,
+          "requires": {
+            "browserslist": "^4.16.3",
+            "semver": "7.0.0"
+          },
+          "dependencies": {
+            "semver": {
+              "version": "7.0.0",
+              "resolved": "https://registry.npmjs.org/semver/-/semver-7.0.0.tgz",
+              "integrity": "sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A==",
+              "dev": true
+            }
+          }
+        },
+        "debug": {
+          "version": "4.3.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
+          "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
+          "dev": true,
+          "requires": {
+            "ms": "2.1.2"
+          }
+        },
+        "electron-to-chromium": {
+          "version": "1.3.711",
+          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.711.tgz",
+          "integrity": "sha512-XbklBVCDiUeho0PZQCjC25Ha6uBwqqJeyDhPLwLwfWRAo4x+FZFsmu1pPPkXT+B4MQMQoQULfyaMltDopfeiHQ==",
+          "dev": true
+        },
+        "node-releases": {
+          "version": "1.1.71",
+          "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.71.tgz",
+          "integrity": "sha512-zR6HoT6LrLCRBwukmrVbHv0EpEQjksO6GmFcZQQuCAy139BEsoVKPYnf3jongYW83fAa1torLGYwxxky/p28sg==",
+          "dev": true
+        },
         "semver": {
           "version": "6.3.0",
           "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
diff --git a/package.json b/package.json
index 5b923e6186..9ded51b95f 100644
--- a/package.json
+++ b/package.json
@@ -157,7 +157,7 @@
   },
   "devDependencies": {
     "@babel/core": "^7.13.15",
-    "@babel/plugin-transform-runtime": "^7.13.10",
+    "@babel/plugin-transform-runtime": "^7.13.15",
     "@babel/preset-env": "^7.13.12",
     "@opengovsg/mockpass": "^2.6.8",
     "@types/bcrypt": "^3.0.0",

From ed74bbe120023b3670aa69fdb2b3d26fe86e3761 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 05:17:22 +0000
Subject: [PATCH 39/75] fix(deps): bump aws-sdk from 2.882.0 to 2.883.0 (#1609)

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.882.0 to 2.883.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.882.0...v2.883.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4d4f24b59a..37e99512c1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6485,9 +6485,9 @@
       "integrity": "sha512-24q5Rh3bno7ldoyCq99d6hpnLI+PAMocdeVaaGt/5BTQMprvDwQToHfNnruqN11odCHZZIQbRBw+nZo1lTCH9g=="
     },
     "aws-sdk": {
-      "version": "2.882.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.882.0.tgz",
-      "integrity": "sha512-MC1tKQdvIBmSQmyFmS6McGGPrN6yvHmhP0SS0ovx+zF/BbvHPTpi5hIgqPSAkdb8/s0I16QtbwiLQgPT2pf1tA==",
+      "version": "2.883.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.883.0.tgz",
+      "integrity": "sha512-S+SS4h0P5gQchIpbJfaVlAvbZGBeFO1nzj9as/phbcLKRqxJyzaDT/Qx1xrT/hORUd+rY4njkuyapeIIzmnVKA==",
       "requires": {
         "buffer": "4.9.2",
         "events": "1.1.1",
diff --git a/package.json b/package.json
index 9ded51b95f..2835945d7c 100644
--- a/package.json
+++ b/package.json
@@ -83,7 +83,7 @@
     "angular-ui-bootstrap": "~2.5.6",
     "angular-ui-router": "~1.0.29",
     "aws-info": "^1.2.0",
-    "aws-sdk": "^2.882.0",
+    "aws-sdk": "^2.883.0",
     "axios": "^0.21.1",
     "bcrypt": "^5.0.1",
     "bluebird": "^3.5.2",

From ea1e157fd18195186a597eba4a2bdbe4a0c9df59 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 05:26:48 +0000
Subject: [PATCH 40/75] chore(deps-dev): bump @babel/preset-env from 7.13.12 to
 7.13.15 (#1599)

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.13.12 to 7.13.15.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.13.15/packages/babel-preset-env)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 407 +++++++++++++++++++++-------------------------
 package.json      |   2 +-
 2 files changed, 187 insertions(+), 222 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 37e99512c1..8ec7eb3db1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -583,9 +583,9 @@
           "dev": true
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -607,9 +607,9 @@
       }
     },
     "@babel/helper-define-polyfill-provider": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.1.4.tgz",
-      "integrity": "sha512-K5V2GaQZ1gpB+FTXM4AFVG2p1zzhm67n9wrQCJYNzvuLzQybhJyftW7qeDd2uUxPDNdl5Rkon1rOAeUeNDZ28Q==",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.2.0.tgz",
+      "integrity": "sha512-JT8tHuFjKBo8NnaUbblz7mIu1nnvUDiHVjXXkulZULyidvo/7P6TY7+YqpV37IfF+KUFxmlK04elKtGKXaiVgw==",
       "dev": true,
       "requires": {
         "@babel/helper-compilation-targets": "^7.13.0",
@@ -631,12 +631,6 @@
             "@babel/highlight": "^7.12.13"
           }
         },
-        "@babel/compat-data": {
-          "version": "7.13.8",
-          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.8.tgz",
-          "integrity": "sha512-EaI33z19T4qN3xLXsGf48M2cDqa6ei9tPZlfLdb2HC+e/cFtREiRd8hdSqDbwdLB0/+gLwqJmCYASH0z2bUdog==",
-          "dev": true
-        },
         "@babel/generator": {
           "version": "7.13.9",
           "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.13.9.tgz",
@@ -648,18 +642,6 @@
             "source-map": "^0.5.0"
           }
         },
-        "@babel/helper-compilation-targets": {
-          "version": "7.13.8",
-          "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.13.8.tgz",
-          "integrity": "sha512-pBljUGC1y3xKLn1nrx2eAhurLMA8OqBtBP/JwG4U8skN7kf8/aqwwxpV1N6T0e7r6+7uNitIa/fUxPFagSXp3A==",
-          "dev": true,
-          "requires": {
-            "@babel/compat-data": "^7.13.8",
-            "@babel/helper-validator-option": "^7.12.17",
-            "browserslist": "^4.14.5",
-            "semver": "^6.3.0"
-          }
-        },
         "@babel/helper-function-name": {
           "version": "7.12.13",
           "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.12.13.tgz",
@@ -702,9 +684,9 @@
           "dev": true
         },
         "@babel/highlight": {
-          "version": "7.13.8",
-          "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.13.8.tgz",
-          "integrity": "sha512-4vrIhfJyfNf+lCtXC2ck1rKSzDwciqF7IWFhXXrSOUC2O5DrVp+w4c6ed4AllTxhTkUP5x2tYj41VaxdVMMRDw==",
+          "version": "7.13.10",
+          "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.13.10.tgz",
+          "integrity": "sha512-5aPpe5XQPzflQrFwL1/QoeHkP2MsA4JCntcXHRhEsdsfPVkvPi2w7Qix4iV7t5S/oC9OodGrggd8aco1g3SZFg==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -713,9 +695,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.9",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.9.tgz",
-          "integrity": "sha512-nEUfRiARCcaVo3ny3ZQjURjHQZUo/JkEw7rLlSZy/psWGnvwXFtPcr6jb7Yb41DVW5LTe6KRq9LGleRNsg1Frw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -730,26 +712,25 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.0.tgz",
-          "integrity": "sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
-            "@babel/generator": "^7.13.0",
+            "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.0",
-            "@babel/types": "^7.13.0",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
-            "globals": "^11.1.0",
-            "lodash": "^4.17.19"
+            "globals": "^11.1.0"
           }
         },
         "@babel/types": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.0.tgz",
-          "integrity": "sha512-hE+HE8rnG1Z6Wzo+MhaKE5lM5eMx71T4EHJgku2E3xIfaULhDcxiiRxUYgwX8qwP1BBSlag+TdGOt6JAidIZTA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -757,25 +738,6 @@
             "to-fast-properties": "^2.0.0"
           }
         },
-        "browserslist": {
-          "version": "4.16.3",
-          "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.16.3.tgz",
-          "integrity": "sha512-vIyhWmIkULaq04Gt93txdh+j02yX/JzlyhLYbV3YQCn/zvES3JnY7TifHHvvr1w5hTDluNKMkV05cs4vy8Q7sw==",
-          "dev": true,
-          "requires": {
-            "caniuse-lite": "^1.0.30001181",
-            "colorette": "^1.2.1",
-            "electron-to-chromium": "^1.3.649",
-            "escalade": "^3.1.1",
-            "node-releases": "^1.1.70"
-          }
-        },
-        "caniuse-lite": {
-          "version": "1.0.30001192",
-          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001192.tgz",
-          "integrity": "sha512-63OrUnwJj5T1rUmoyqYTdRWBqFFxZFlyZnRRjDR8NSUQFB6A+j/uBORU/SyJ5WzDLg4SPiZH40hQCBNdZ/jmAw==",
-          "dev": true
-        },
         "debug": {
           "version": "4.3.1",
           "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
@@ -785,18 +747,6 @@
             "ms": "2.1.2"
           }
         },
-        "electron-to-chromium": {
-          "version": "1.3.676",
-          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.676.tgz",
-          "integrity": "sha512-t0eEgYCP+XEbH/KwxWYZDY0XKwzmokDAsjFJ2rBstp2XuwuBCUZ+ni5qXI6XDRNkvDpVJcAOp2aJxkSkshKkmw==",
-          "dev": true
-        },
-        "node-releases": {
-          "version": "1.1.71",
-          "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.71.tgz",
-          "integrity": "sha512-zR6HoT6LrLCRBwukmrVbHv0EpEQjksO6GmFcZQQuCAy139BEsoVKPYnf3jongYW83fAa1torLGYwxxky/p28sg==",
-          "dev": true
-        },
         "semver": {
           "version": "6.3.0",
           "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
@@ -930,9 +880,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.12.tgz",
-          "integrity": "sha512-4T7Pb244rxH24yR116LAuJ+adxXXnHhZaLJjegJVKSdoNCe4x1eDBaud5YIcQFcqzsaD5BHvJw5BQ0AZapdCRw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -947,26 +897,25 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.0.tgz",
-          "integrity": "sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
-            "@babel/generator": "^7.13.0",
+            "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.0",
-            "@babel/types": "^7.13.0",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
-            "globals": "^11.1.0",
-            "lodash": "^4.17.19"
+            "globals": "^11.1.0"
           }
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -1023,20 +972,19 @@
       }
     },
     "@babel/helper-module-transforms": {
-      "version": "7.13.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.13.0.tgz",
-      "integrity": "sha512-Ls8/VBwH577+pw7Ku1QkUWIyRRNHpYlts7+qSqBBFCW3I8QteB9DxfcZ5YJpOwH6Ihe/wn8ch7fMGOP1OhEIvw==",
+      "version": "7.13.14",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.13.14.tgz",
+      "integrity": "sha512-QuU/OJ0iAOSIatyVZmfqB0lbkVP0kDRiKj34xy+QNsnVZi/PA6BoSoreeqnxxa9EHFAIL0R9XOaAR/G9WlIy5g==",
       "dev": true,
       "requires": {
-        "@babel/helper-module-imports": "^7.12.13",
-        "@babel/helper-replace-supers": "^7.13.0",
-        "@babel/helper-simple-access": "^7.12.13",
+        "@babel/helper-module-imports": "^7.13.12",
+        "@babel/helper-replace-supers": "^7.13.12",
+        "@babel/helper-simple-access": "^7.13.12",
         "@babel/helper-split-export-declaration": "^7.12.13",
         "@babel/helper-validator-identifier": "^7.12.11",
         "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.13.0",
-        "@babel/types": "^7.13.0",
-        "lodash": "^4.17.19"
+        "@babel/traverse": "^7.13.13",
+        "@babel/types": "^7.13.14"
       },
       "dependencies": {
         "@babel/code-frame": {
@@ -1080,12 +1028,21 @@
           }
         },
         "@babel/helper-member-expression-to-functions": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.13.0.tgz",
-          "integrity": "sha512-yvRf8Ivk62JwisqV1rFRMxiSMDGnN6KH1/mDMmIrij4jztpQNRoHqqMG3U6apYbGRPJpgPalhva9Yd06HlUxJQ==",
+          "version": "7.13.12",
+          "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.13.12.tgz",
+          "integrity": "sha512-48ql1CLL59aKbU94Y88Xgb2VFy7a95ykGRbJJaaVv+LX5U8wFpLfiGXJJGUozsmA1oEh/o5Bp60Voq7ACyA/Sw==",
           "dev": true,
           "requires": {
-            "@babel/types": "^7.13.0"
+            "@babel/types": "^7.13.12"
+          }
+        },
+        "@babel/helper-module-imports": {
+          "version": "7.13.12",
+          "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.13.12.tgz",
+          "integrity": "sha512-4cVvR2/1B693IuOvSI20xqqa/+bl7lqAMR59R4iu39R9aOX8/JoYY1sFaNvUMyMBGnHdwvJgUrzNLoUZxXypxA==",
+          "dev": true,
+          "requires": {
+            "@babel/types": "^7.13.12"
           }
         },
         "@babel/helper-optimise-call-expression": {
@@ -1098,15 +1055,15 @@
           }
         },
         "@babel/helper-replace-supers": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.13.0.tgz",
-          "integrity": "sha512-Segd5me1+Pz+rmN/NFBOplMbZG3SqRJOBlY+mA0SxAv6rjj7zJqr1AVr3SfzUVTLCv7ZLU5FycOM/SBGuLPbZw==",
+          "version": "7.13.12",
+          "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.13.12.tgz",
+          "integrity": "sha512-Gz1eiX+4yDO8mT+heB94aLVNCL+rbuT2xy4YfyNqu8F+OI6vMvJK891qGBTqL9Uc8wxEvRW92Id6G7sDen3fFw==",
           "dev": true,
           "requires": {
-            "@babel/helper-member-expression-to-functions": "^7.13.0",
+            "@babel/helper-member-expression-to-functions": "^7.13.12",
             "@babel/helper-optimise-call-expression": "^7.12.13",
             "@babel/traverse": "^7.13.0",
-            "@babel/types": "^7.13.0"
+            "@babel/types": "^7.13.12"
           }
         },
         "@babel/helper-split-export-declaration": {
@@ -1125,9 +1082,9 @@
           "dev": true
         },
         "@babel/highlight": {
-          "version": "7.13.8",
-          "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.13.8.tgz",
-          "integrity": "sha512-4vrIhfJyfNf+lCtXC2ck1rKSzDwciqF7IWFhXXrSOUC2O5DrVp+w4c6ed4AllTxhTkUP5x2tYj41VaxdVMMRDw==",
+          "version": "7.13.10",
+          "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.13.10.tgz",
+          "integrity": "sha512-5aPpe5XQPzflQrFwL1/QoeHkP2MsA4JCntcXHRhEsdsfPVkvPi2w7Qix4iV7t5S/oC9OodGrggd8aco1g3SZFg==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -1136,9 +1093,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.9",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.9.tgz",
-          "integrity": "sha512-nEUfRiARCcaVo3ny3ZQjURjHQZUo/JkEw7rLlSZy/psWGnvwXFtPcr6jb7Yb41DVW5LTe6KRq9LGleRNsg1Frw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -1153,26 +1110,25 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.0.tgz",
-          "integrity": "sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
-            "@babel/generator": "^7.13.0",
+            "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.0",
-            "@babel/types": "^7.13.0",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
-            "globals": "^11.1.0",
-            "lodash": "^4.17.19"
+            "globals": "^11.1.0"
           }
         },
         "@babel/types": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.0.tgz",
-          "integrity": "sha512-hE+HE8rnG1Z6Wzo+MhaKE5lM5eMx71T4EHJgku2E3xIfaULhDcxiiRxUYgwX8qwP1BBSlag+TdGOt6JAidIZTA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -1373,12 +1329,12 @@
       }
     },
     "@babel/helper-simple-access": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.12.13.tgz",
-      "integrity": "sha512-0ski5dyYIHEfwpWGx5GPWhH35j342JaflmCeQmsPWcrOQDtCN6C1zKAVRFVbK53lPW2c9TsuLLSUDf0tIGJ5hA==",
+      "version": "7.13.12",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.13.12.tgz",
+      "integrity": "sha512-7FEjbrx5SL9cWvXioDbnlYTppcZGuCY6ow3/D5vMggb2Ywgu4dMrpTJX0JdQAIcRRUElOIxF3yEooa9gUb9ZbA==",
       "dev": true,
       "requires": {
-        "@babel/types": "^7.12.13"
+        "@babel/types": "^7.13.12"
       },
       "dependencies": {
         "@babel/helper-validator-identifier": {
@@ -1388,9 +1344,9 @@
           "dev": true
         },
         "@babel/types": {
-          "version": "7.12.13",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.12.13.tgz",
-          "integrity": "sha512-oKrdZTld2im1z8bDwTOQvUbxKwE+854zc16qWZQlcTqMN00pWxHQ4ZeOq0yDMnisOpRykH2/5Qqcrk/OlbAjiQ==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -1416,9 +1372,9 @@
           "dev": true
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -2372,9 +2328,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.12.tgz",
-          "integrity": "sha512-4T7Pb244rxH24yR116LAuJ+adxXXnHhZaLJjegJVKSdoNCe4x1eDBaud5YIcQFcqzsaD5BHvJw5BQ0AZapdCRw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -2389,9 +2345,9 @@
           }
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -2658,9 +2614,9 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.12.tgz",
-          "integrity": "sha512-4T7Pb244rxH24yR116LAuJ+adxXXnHhZaLJjegJVKSdoNCe4x1eDBaud5YIcQFcqzsaD5BHvJw5BQ0AZapdCRw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
         "@babel/template": {
@@ -2675,26 +2631,25 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.0.tgz",
-          "integrity": "sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
-            "@babel/generator": "^7.13.0",
+            "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.0",
-            "@babel/types": "^7.13.0",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
-            "globals": "^11.1.0",
-            "lodash": "^4.17.19"
+            "globals": "^11.1.0"
           }
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -2874,9 +2829,9 @@
       }
     },
     "@babel/plugin-transform-regenerator": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.12.13.tgz",
-      "integrity": "sha512-lxb2ZAvSLyJ2PEe47hoGWPmW22v7CtSl9jW8mingV4H2sEX/JOcrAj2nPuGWi56ERUm2bUpjKzONAuT6HCn2EA==",
+      "version": "7.13.15",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.13.15.tgz",
+      "integrity": "sha512-Bk9cOLSz8DiurcMETZ8E2YtIVJbFCPGW28DJWUakmyVWtQSm6Wsf0p4B4BfEr/eL2Nkhe/CICiUiMOCi1TPhuQ==",
       "dev": true,
       "requires": {
         "regenerator-transform": "^0.14.2"
@@ -3278,17 +3233,17 @@
       }
     },
     "@babel/preset-env": {
-      "version": "7.13.12",
-      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.13.12.tgz",
-      "integrity": "sha512-JzElc6jk3Ko6zuZgBtjOd01pf9yYDEIH8BcqVuYIuOkzOwDesoa/Nz4gIo4lBG6K861KTV9TvIgmFuT6ytOaAA==",
+      "version": "7.13.15",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.13.15.tgz",
+      "integrity": "sha512-D4JAPMXcxk69PKe81jRJ21/fP/uYdcTZ3hJDF5QX2HSI9bBxxYw/dumdR6dGumhjxlprHPE4XWoPaqzZUVy2MA==",
       "dev": true,
       "requires": {
-        "@babel/compat-data": "^7.13.12",
-        "@babel/helper-compilation-targets": "^7.13.10",
+        "@babel/compat-data": "^7.13.15",
+        "@babel/helper-compilation-targets": "^7.13.13",
         "@babel/helper-plugin-utils": "^7.13.0",
         "@babel/helper-validator-option": "^7.12.17",
         "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.13.12",
-        "@babel/plugin-proposal-async-generator-functions": "^7.13.8",
+        "@babel/plugin-proposal-async-generator-functions": "^7.13.15",
         "@babel/plugin-proposal-class-properties": "^7.13.0",
         "@babel/plugin-proposal-dynamic-import": "^7.13.8",
         "@babel/plugin-proposal-export-namespace-from": "^7.12.13",
@@ -3336,7 +3291,7 @@
         "@babel/plugin-transform-object-super": "^7.12.13",
         "@babel/plugin-transform-parameters": "^7.13.0",
         "@babel/plugin-transform-property-literals": "^7.12.13",
-        "@babel/plugin-transform-regenerator": "^7.12.13",
+        "@babel/plugin-transform-regenerator": "^7.13.15",
         "@babel/plugin-transform-reserved-words": "^7.12.13",
         "@babel/plugin-transform-shorthand-properties": "^7.12.13",
         "@babel/plugin-transform-spread": "^7.13.0",
@@ -3346,10 +3301,10 @@
         "@babel/plugin-transform-unicode-escapes": "^7.12.13",
         "@babel/plugin-transform-unicode-regex": "^7.12.13",
         "@babel/preset-modules": "^0.1.4",
-        "@babel/types": "^7.13.12",
-        "babel-plugin-polyfill-corejs2": "^0.1.4",
-        "babel-plugin-polyfill-corejs3": "^0.1.3",
-        "babel-plugin-polyfill-regenerator": "^0.1.2",
+        "@babel/types": "^7.13.14",
+        "babel-plugin-polyfill-corejs2": "^0.2.0",
+        "babel-plugin-polyfill-corejs3": "^0.2.0",
+        "babel-plugin-polyfill-regenerator": "^0.2.0",
         "core-js-compat": "^3.9.0",
         "semver": "^6.3.0"
       },
@@ -3364,9 +3319,9 @@
           }
         },
         "@babel/compat-data": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.12.tgz",
-          "integrity": "sha512-3eJJ841uKxeV8dcN/2yGEUy+RfgQspPEgQat85umsE1rotuquQ2AbIub4S6j7c50a2d+4myc+zSlnXeIHrOnhQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.15.tgz",
+          "integrity": "sha512-ltnibHKR1VnrU4ymHyQ/CXtNXI6yZC0oJThyW78Hft8XndANwi+9H+UIklBDraIjFEJzw8wmcM427oDd9KS5wA==",
           "dev": true
         },
         "@babel/generator": {
@@ -3390,12 +3345,12 @@
           }
         },
         "@babel/helper-compilation-targets": {
-          "version": "7.13.10",
-          "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.13.10.tgz",
-          "integrity": "sha512-/Xju7Qg1GQO4mHZ/Kcs6Au7gfafgZnwm+a7sy/ow/tV1sHeraRUHbjdat8/UvDor4Tez+siGKDk6zIKtCPKVJA==",
+          "version": "7.13.13",
+          "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.13.13.tgz",
+          "integrity": "sha512-q1kcdHNZehBwD9jYPh3WyXcsFERi39X4I59I3NadciWtNDyZ6x+GboOxncFK0kXlKIv6BJm5acncehXWUjWQMQ==",
           "dev": true,
           "requires": {
-            "@babel/compat-data": "^7.13.8",
+            "@babel/compat-data": "^7.13.12",
             "@babel/helper-validator-option": "^7.12.17",
             "browserslist": "^4.14.5",
             "semver": "^6.3.0"
@@ -3484,11 +3439,22 @@
           }
         },
         "@babel/parser": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.12.tgz",
-          "integrity": "sha512-4T7Pb244rxH24yR116LAuJ+adxXXnHhZaLJjegJVKSdoNCe4x1eDBaud5YIcQFcqzsaD5BHvJw5BQ0AZapdCRw==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.13.15.tgz",
+          "integrity": "sha512-b9COtcAlVEQljy/9fbcMHpG+UIW9ReF+gpaxDHTlZd0c6/UU9ng8zdySAW9sRTzpvcdCHn6bUcbuYUgGzLAWVQ==",
           "dev": true
         },
+        "@babel/plugin-proposal-async-generator-functions": {
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.13.15.tgz",
+          "integrity": "sha512-VapibkWzFeoa6ubXy/NgV5U2U4MVnUlvnx6wo1XhlsaTrLYWE0UFpDQsVrmn22q5CzeloqJ8gEMHSKxuee6ZdA==",
+          "dev": true,
+          "requires": {
+            "@babel/helper-plugin-utils": "^7.13.0",
+            "@babel/helper-remap-async-to-generator": "^7.13.0",
+            "@babel/plugin-syntax-async-generators": "^7.8.4"
+          }
+        },
         "@babel/plugin-syntax-class-properties": {
           "version": "7.12.13",
           "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
@@ -3561,26 +3527,25 @@
           }
         },
         "@babel/traverse": {
-          "version": "7.13.0",
-          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.0.tgz",
-          "integrity": "sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.13.15.tgz",
+          "integrity": "sha512-/mpZMNvj6bce59Qzl09fHEs8Bt8NnpEDQYleHUPZQ3wXUMvXi+HJPLars68oAbmp839fGoOkv2pSL2z9ajCIaQ==",
           "dev": true,
           "requires": {
             "@babel/code-frame": "^7.12.13",
-            "@babel/generator": "^7.13.0",
+            "@babel/generator": "^7.13.9",
             "@babel/helper-function-name": "^7.12.13",
             "@babel/helper-split-export-declaration": "^7.12.13",
-            "@babel/parser": "^7.13.0",
-            "@babel/types": "^7.13.0",
+            "@babel/parser": "^7.13.15",
+            "@babel/types": "^7.13.14",
             "debug": "^4.1.0",
-            "globals": "^11.1.0",
-            "lodash": "^4.17.19"
+            "globals": "^11.1.0"
           }
         },
         "@babel/types": {
-          "version": "7.13.12",
-          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.12.tgz",
-          "integrity": "sha512-K4nY2xFN4QMvQwkQ+zmBDp6ANMbVNw6BbxWmYA4qNjhR9W+Lj/8ky5MEY2Me5r+B2c6/v6F53oMndG+f9s3IiA==",
+          "version": "7.13.14",
+          "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.13.14.tgz",
+          "integrity": "sha512-A2aa3QTkWoyqsZZFl56MLUsfmh7O0gN41IPvXAE/++8ojpbz12SszD7JEGYVdn4f9Kt4amIei07swF1h4AqmmQ==",
           "dev": true,
           "requires": {
             "@babel/helper-validator-identifier": "^7.12.11",
@@ -3602,9 +3567,9 @@
           }
         },
         "caniuse-lite": {
-          "version": "1.0.30001204",
-          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001204.tgz",
-          "integrity": "sha512-JUdjWpcxfJ9IPamy2f5JaRDCaqJOxDzOSKtbdx4rH9VivMd1vIzoPumsJa9LoMIi4Fx2BV2KZOxWhNkBjaYivQ==",
+          "version": "1.0.30001208",
+          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001208.tgz",
+          "integrity": "sha512-OE5UE4+nBOro8Dyvv0lfx+SRtfVIOM9uhKqFmJeUbGriqhhStgp1A0OyBpgy3OUF8AhYCT+PVwPC1gMl2ZcQMA==",
           "dev": true
         },
         "debug": {
@@ -3617,9 +3582,9 @@
           }
         },
         "electron-to-chromium": {
-          "version": "1.3.698",
-          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.698.tgz",
-          "integrity": "sha512-VEXDzYblnlT+g8Q3gedwzgKOso1evkeJzV8lih7lV8mL8eAnGVnKyC3KsFT6S+R5PQO4ffdr1PI16/ElibY/kQ==",
+          "version": "1.3.711",
+          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.711.tgz",
+          "integrity": "sha512-XbklBVCDiUeho0PZQCjC25Ha6uBwqqJeyDhPLwLwfWRAo4x+FZFsmu1pPPkXT+B4MQMQoQULfyaMltDopfeiHQ==",
           "dev": true
         },
         "node-releases": {
@@ -6833,20 +6798,20 @@
       }
     },
     "babel-plugin-polyfill-corejs2": {
-      "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.1.8.tgz",
-      "integrity": "sha512-kB5/xNR9GYDuRmVlL9EGfdKBSUVI/9xAU7PCahA/1hbC2Jbmks9dlBBYjHF9IHMNY2jV/G2lIG7z0tJIW27Rog==",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.2.0.tgz",
+      "integrity": "sha512-9bNwiR0dS881c5SHnzCmmGlMkJLl0OUZvxrxHo9w/iNoRuqaPjqlvBf4HrovXtQs/au5yKkpcdgfT1cC5PAZwg==",
       "dev": true,
       "requires": {
-        "@babel/compat-data": "^7.13.0",
-        "@babel/helper-define-polyfill-provider": "^0.1.4",
+        "@babel/compat-data": "^7.13.11",
+        "@babel/helper-define-polyfill-provider": "^0.2.0",
         "semver": "^6.1.1"
       },
       "dependencies": {
         "@babel/compat-data": {
-          "version": "7.13.8",
-          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.8.tgz",
-          "integrity": "sha512-EaI33z19T4qN3xLXsGf48M2cDqa6ei9tPZlfLdb2HC+e/cFtREiRd8hdSqDbwdLB0/+gLwqJmCYASH0z2bUdog==",
+          "version": "7.13.15",
+          "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.13.15.tgz",
+          "integrity": "sha512-ltnibHKR1VnrU4ymHyQ/CXtNXI6yZC0oJThyW78Hft8XndANwi+9H+UIklBDraIjFEJzw8wmcM427oDd9KS5wA==",
           "dev": true
         },
         "semver": {
@@ -6858,22 +6823,22 @@
       }
     },
     "babel-plugin-polyfill-corejs3": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.1.6.tgz",
-      "integrity": "sha512-IkYhCxPrjrUWigEmkMDXYzM5iblzKCdCD8cZrSAkQOyhhJm26DcG+Mxbx13QT//Olkpkg/AlRdT2L+Ww4Ciphw==",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.2.0.tgz",
+      "integrity": "sha512-zZyi7p3BCUyzNxLx8KV61zTINkkV65zVkDAFNZmrTCRVhjo1jAS+YLvDJ9Jgd/w2tsAviCwFHReYfxO3Iql8Yg==",
       "dev": true,
       "requires": {
-        "@babel/helper-define-polyfill-provider": "^0.1.4",
-        "core-js-compat": "^3.8.1"
+        "@babel/helper-define-polyfill-provider": "^0.2.0",
+        "core-js-compat": "^3.9.1"
       }
     },
     "babel-plugin-polyfill-regenerator": {
-      "version": "0.1.5",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.1.5.tgz",
-      "integrity": "sha512-EyhBA6uN94W97lR7ecQVTvH9F5tIIdEw3ZqHuU4zekMlW82k5cXNXniiB7PRxQm06BqAjVr4sDT1mOy4RcphIA==",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.2.0.tgz",
+      "integrity": "sha512-J7vKbCuD2Xi/eEHxquHN14bXAW9CXtecwuLrOIDJtcZzTaPzV1VdEfoUf9AzcRBMolKUQKM9/GVojeh0hFiqMg==",
       "dev": true,
       "requires": {
-        "@babel/helper-define-polyfill-provider": "^0.1.4"
+        "@babel/helper-define-polyfill-provider": "^0.2.0"
       }
     },
     "babel-plugin-syntax-trailing-function-commas": {
@@ -8848,9 +8813,9 @@
       "dev": true
     },
     "core-js-compat": {
-      "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.9.0.tgz",
-      "integrity": "sha512-YK6fwFjCOKWwGnjFUR3c544YsnA/7DoLL0ysncuOJ4pwbriAtOpvM2bygdlcXbvQCQZ7bBU9CL4t7tGl7ETRpQ==",
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.10.1.tgz",
+      "integrity": "sha512-ZHQTdTPkqvw2CeHiZC970NNJcnwzT6YIueDMASKt+p3WbZsLXOcoD392SkcWhkC0wBBHhlfhqGKKsNCQUozYtg==",
       "dev": true,
       "requires": {
         "browserslist": "^4.16.3",
@@ -8871,21 +8836,21 @@
           }
         },
         "caniuse-lite": {
-          "version": "1.0.30001189",
-          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001189.tgz",
-          "integrity": "sha512-BSfxClP/UWCD0RX1h1L+vLDexNSJY7SfOtbJtW10bcnatfj3BcoietUFYNwWreOCk+SNvGUaNapGqUNPiGAiSA==",
+          "version": "1.0.30001208",
+          "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001208.tgz",
+          "integrity": "sha512-OE5UE4+nBOro8Dyvv0lfx+SRtfVIOM9uhKqFmJeUbGriqhhStgp1A0OyBpgy3OUF8AhYCT+PVwPC1gMl2ZcQMA==",
           "dev": true
         },
         "electron-to-chromium": {
-          "version": "1.3.669",
-          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.669.tgz",
-          "integrity": "sha512-VNj10fmGC6SbE7s4tKG7y2OopVXYoTIfjE1MetflPd77KmeRuHtkl+HYsfF00BGg5hyaorTUn6lTToEHaciOSw==",
+          "version": "1.3.711",
+          "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.711.tgz",
+          "integrity": "sha512-XbklBVCDiUeho0PZQCjC25Ha6uBwqqJeyDhPLwLwfWRAo4x+FZFsmu1pPPkXT+B4MQMQoQULfyaMltDopfeiHQ==",
           "dev": true
         },
         "node-releases": {
-          "version": "1.1.70",
-          "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.70.tgz",
-          "integrity": "sha512-Slf2s69+2/uAD79pVVQo8uSiC34+g8GWY8UH2Qtqv34ZfhYrxpYpfzs9Js9d6O0mbDmALuxaTlplnBTnSELcrw==",
+          "version": "1.1.71",
+          "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.71.tgz",
+          "integrity": "sha512-zR6HoT6LrLCRBwukmrVbHv0EpEQjksO6GmFcZQQuCAy139BEsoVKPYnf3jongYW83fAa1torLGYwxxky/p28sg==",
           "dev": true
         },
         "semver": {
diff --git a/package.json b/package.json
index 2835945d7c..141f6362ff 100644
--- a/package.json
+++ b/package.json
@@ -158,7 +158,7 @@
   "devDependencies": {
     "@babel/core": "^7.13.15",
     "@babel/plugin-transform-runtime": "^7.13.15",
-    "@babel/preset-env": "^7.13.12",
+    "@babel/preset-env": "^7.13.15",
     "@opengovsg/mockpass": "^2.6.8",
     "@types/bcrypt": "^3.0.0",
     "@types/bluebird": "^3.5.33",

From 871037a13036bbe860bbbbba9b6c5411d06592ea Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 05:40:46 +0000
Subject: [PATCH 41/75] chore(deps-dev): bump core-js from 3.9.1 to 3.10.1
 (#1608)

Bumps [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) from 3.9.1 to 3.10.1.
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.10.1/packages/core-js)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8ec7eb3db1..a12decb1e1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8807,9 +8807,9 @@
       }
     },
     "core-js": {
-      "version": "3.9.1",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.9.1.tgz",
-      "integrity": "sha512-gSjRvzkxQc1zjM/5paAmL4idJBFzuJoo+jDjF1tStYFMV2ERfD02HhahhCGXUyHxQRG4yFKVSdO6g62eoRMcDg==",
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.10.1.tgz",
+      "integrity": "sha512-pwCxEXnj27XG47mu7SXAwhLP3L5CrlvCB91ANUkIz40P27kUcvNfSdvyZJ9CLHiVoKSp+TTChMQMSKQEH/IQxA==",
       "dev": true
     },
     "core-js-compat": {
diff --git a/package.json b/package.json
index 141f6362ff..1a2e1228c0 100644
--- a/package.json
+++ b/package.json
@@ -198,7 +198,7 @@
     "babel-loader": "^8.2.2",
     "concurrently": "^6.0.1",
     "copy-webpack-plugin": "^6.0.2",
-    "core-js": "^3.9.1",
+    "core-js": "^3.10.1",
     "coveralls": "^3.1.0",
     "css-loader": "^2.1.1",
     "csv-parse": "^4.15.3",

From 328428a92dd4f8da9adc66f94f1d4ef44fca6960 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Apr 2021 06:07:17 +0000
Subject: [PATCH 42/75] chore(deps-dev): bump date-fns from 2.19.0 to 2.20.0
 (#1607)

Bumps [date-fns](https://github.com/date-fns/date-fns) from 2.19.0 to 2.20.0.
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md)
- [Commits](https://github.com/date-fns/date-fns/compare/v2.19.0...v2.20.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a12decb1e1..c8e4ab46ca 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9384,9 +9384,9 @@
       }
     },
     "date-fns": {
-      "version": "2.19.0",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.19.0.tgz",
-      "integrity": "sha512-X3bf2iTPgCAQp9wvjOQytnf5vO5rESYRXlPIVcgSbtT5OTScPcsf9eZU+B/YIkKAtYr5WeCii58BgATrNitlWg==",
+      "version": "2.20.0",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.0.tgz",
+      "integrity": "sha512-nmA7y6aDH5+fknfJ0G77HQzUSfTPpq4ifq+c9blP9d+X9zs3kNjxC+t3pcbBMGTp262a6PJB3RVjLlxIgoMI+Q==",
       "dev": true
     },
     "dateformat": {
diff --git a/package.json b/package.json
index 1a2e1228c0..6c688ed9f6 100644
--- a/package.json
+++ b/package.json
@@ -202,7 +202,7 @@
     "coveralls": "^3.1.0",
     "css-loader": "^2.1.1",
     "csv-parse": "^4.15.3",
-    "date-fns": "^2.19.0",
+    "date-fns": "^2.20.0",
     "env-cmd": "^10.1.0",
     "eslint": "^7.23.0",
     "eslint-config-prettier": "^8.1.0",

From 14104245370bde032a7836bf76dca3f6f921ed5c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 17:35:29 +0000
Subject: [PATCH 43/75] fix(deps): bump winston-cloudwatch from 2.5.0 to 2.5.1
 (#1614)

Bumps [winston-cloudwatch](https://github.com/lazywithclass/winston-cloudwatch) from 2.5.0 to 2.5.1.
- [Release notes](https://github.com/lazywithclass/winston-cloudwatch/releases)
- [Changelog](https://github.com/lazywithclass/winston-cloudwatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lazywithclass/winston-cloudwatch/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c8e4ab46ca..0f46e6da05 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -25735,9 +25735,9 @@
       }
     },
     "winston-cloudwatch": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/winston-cloudwatch/-/winston-cloudwatch-2.5.0.tgz",
-      "integrity": "sha512-J1h7f1uY+gghyYVYG6SjheIrXvnGbhFUFIyXHQ34cWl1hXUWGu6u7Kik1DpUCkTlZ0sWowVc2Sh+ZI9PEvaZNw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/winston-cloudwatch/-/winston-cloudwatch-2.5.1.tgz",
+      "integrity": "sha512-QETQ1sipe9hcqODMTfWG6PzcwGNN/d8c+xdgyILi2DX+EoGzfsW3U+6EBf98f+uIsC+bVz1zmb6OAfgRQx/afw==",
       "requires": {
         "async": "^3.1.0",
         "aws-sdk": "^2.553.0",
diff --git a/package.json b/package.json
index 6c688ed9f6..a80a3a50a2 100644
--- a/package.json
+++ b/package.json
@@ -153,7 +153,7 @@
     "web-streams-polyfill": "^3.0.2",
     "whatwg-fetch": "^3.6.2",
     "winston": "^3.3.3",
-    "winston-cloudwatch": "^2.5.0"
+    "winston-cloudwatch": "^2.5.1"
   },
   "devDependencies": {
     "@babel/core": "^7.13.15",

From 715d2a708addef51c8230b3bdc94099e3c50e78e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 17:54:22 +0000
Subject: [PATCH 44/75] chore(deps-dev): bump eslint-plugin-jest from 24.3.4 to
 24.3.5 (#1616)

Bumps [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) from 24.3.4 to 24.3.5.
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jest-community/eslint-plugin-jest/compare/v24.3.4...v24.3.5)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0f46e6da05..7d662a1f02 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11031,9 +11031,9 @@
       }
     },
     "eslint-plugin-jest": {
-      "version": "24.3.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-24.3.4.tgz",
-      "integrity": "sha512-3n5oY1+fictanuFkTWPwSlehugBTAgwLnYLFsCllzE3Pl1BwywHl5fL0HFxmMjoQY8xhUDk8uAWc3S4JOHGh3A==",
+      "version": "24.3.5",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-24.3.5.tgz",
+      "integrity": "sha512-XG4rtxYDuJykuqhsOqokYIR84/C8pRihRtEpVskYLbIIKGwPNW2ySxdctuVzETZE+MbF/e7wmsnbNVpzM0rDug==",
       "dev": true,
       "requires": {
         "@typescript-eslint/experimental-utils": "^4.0.1"
diff --git a/package.json b/package.json
index a80a3a50a2..c81f5345d6 100644
--- a/package.json
+++ b/package.json
@@ -208,7 +208,7 @@
     "eslint-config-prettier": "^8.1.0",
     "eslint-plugin-angular": "^4.0.1",
     "eslint-plugin-import": "^2.22.1",
-    "eslint-plugin-jest": "^24.3.4",
+    "eslint-plugin-jest": "^24.3.5",
     "eslint-plugin-prettier": "^3.3.1",
     "eslint-plugin-simple-import-sort": "^7.0.0",
     "eslint-plugin-typesafe": "^0.5.2",

From fedad9f55e2a9b8f9194bf619fdabf4ae5a735c3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 18:04:40 +0000
Subject: [PATCH 45/75] chore(deps-dev): bump date-fns from 2.20.0 to 2.20.1
 (#1617)

Bumps [date-fns](https://github.com/date-fns/date-fns) from 2.20.0 to 2.20.1.
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md)
- [Commits](https://github.com/date-fns/date-fns/compare/v2.20.0...v2.20.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7d662a1f02..1418ed6316 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9384,9 +9384,9 @@
       }
     },
     "date-fns": {
-      "version": "2.20.0",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.0.tgz",
-      "integrity": "sha512-nmA7y6aDH5+fknfJ0G77HQzUSfTPpq4ifq+c9blP9d+X9zs3kNjxC+t3pcbBMGTp262a6PJB3RVjLlxIgoMI+Q==",
+      "version": "2.20.1",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.1.tgz",
+      "integrity": "sha512-8P5M8Kxbnovd0zfvOs7ipkiVJ3/zZQ0F/nrBW4x5E+I0uAZVZ80h6CKd24fSXQ5TLK5hXMtI4yb2O5rEZdUt2A==",
       "dev": true
     },
     "dateformat": {
diff --git a/package.json b/package.json
index c81f5345d6..083ae1314c 100644
--- a/package.json
+++ b/package.json
@@ -202,7 +202,7 @@
     "coveralls": "^3.1.0",
     "css-loader": "^2.1.1",
     "csv-parse": "^4.15.3",
-    "date-fns": "^2.20.0",
+    "date-fns": "^2.20.1",
     "env-cmd": "^10.1.0",
     "eslint": "^7.23.0",
     "eslint-config-prettier": "^8.1.0",

From 10197d79836f7ece609b05dc06e566d85054adc9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 18:19:18 +0000
Subject: [PATCH 46/75] fix(deps): bump aws-sdk from 2.883.0 to 2.884.0 (#1615)

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.883.0 to 2.884.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.883.0...v2.884.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1418ed6316..4c27c663b3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6450,9 +6450,9 @@
       "integrity": "sha512-24q5Rh3bno7ldoyCq99d6hpnLI+PAMocdeVaaGt/5BTQMprvDwQToHfNnruqN11odCHZZIQbRBw+nZo1lTCH9g=="
     },
     "aws-sdk": {
-      "version": "2.883.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.883.0.tgz",
-      "integrity": "sha512-S+SS4h0P5gQchIpbJfaVlAvbZGBeFO1nzj9as/phbcLKRqxJyzaDT/Qx1xrT/hORUd+rY4njkuyapeIIzmnVKA==",
+      "version": "2.884.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.884.0.tgz",
+      "integrity": "sha512-+rhzq7zmntsj4VJRUf0v6ri9vw3dYroy9BbRtbxLHILdnSFPkoqMcodr/pwcUSO5kYEYbCG7mxr5/R2a+cfbxQ==",
       "requires": {
         "buffer": "4.9.2",
         "events": "1.1.1",
diff --git a/package.json b/package.json
index 083ae1314c..5bd1b46db2 100644
--- a/package.json
+++ b/package.json
@@ -83,7 +83,7 @@
     "angular-ui-bootstrap": "~2.5.6",
     "angular-ui-router": "~1.0.29",
     "aws-info": "^1.2.0",
-    "aws-sdk": "^2.883.0",
+    "aws-sdk": "^2.884.0",
     "axios": "^0.21.1",
     "bcrypt": "^5.0.1",
     "bluebird": "^3.5.2",

From 73a30626d205f1ee15ae368b1eab3b91a48fef79 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 18:26:56 +0000
Subject: [PATCH 47/75] fix(deps): bump web-streams-polyfill from 3.0.2 to
 3.0.3 (#1618)

Bumps [web-streams-polyfill](https://github.com/MattiasBuelens/web-streams-polyfill) from 3.0.2 to 3.0.3.
- [Release notes](https://github.com/MattiasBuelens/web-streams-polyfill/releases)
- [Changelog](https://github.com/MattiasBuelens/web-streams-polyfill/blob/master/CHANGELOG.md)
- [Commits](https://github.com/MattiasBuelens/web-streams-polyfill/compare/v3.0.2...v3.0.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4c27c663b3..67ca8d2167 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -25166,9 +25166,9 @@
       "integrity": "sha1-eWkVhNmGB/UHC9O3CkDmuyLkAes="
     },
     "web-streams-polyfill": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.0.2.tgz",
-      "integrity": "sha512-JTNkNbAKoSo8NKiqu2UUaqRFCDWWZaCOsXuJEsToWopikTA0YHKKUf91GNkS/SnD8JixOkJjVsiacNlrFnRECA=="
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.0.3.tgz",
+      "integrity": "sha512-d2H/t0eqRNM4w2WvmTdoeIvzAUSpK7JmATB8Nr2lb7nQ9BTIJVjbQ/TRFVEh2gUH1HwclPdoPtfMoFfetXaZnA=="
     },
     "webauth": {
       "version": "1.1.0",
diff --git a/package.json b/package.json
index 5bd1b46db2..29f9741d35 100644
--- a/package.json
+++ b/package.json
@@ -150,7 +150,7 @@
     "uid-generator": "^2.0.0",
     "uuid": "^8.3.2",
     "validator": "^13.5.2",
-    "web-streams-polyfill": "^3.0.2",
+    "web-streams-polyfill": "^3.0.3",
     "whatwg-fetch": "^3.6.2",
     "winston": "^3.3.3",
     "winston-cloudwatch": "^2.5.1"

From 40df7d3fd9cdc0833515b42d1bacd4a206f8193a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Apr 2021 18:46:03 +0000
Subject: [PATCH 48/75] chore(deps-dev): bump eslint from 7.23.0 to 7.24.0
 (#1613)

Bumps [eslint](https://github.com/eslint/eslint) from 7.23.0 to 7.24.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.23.0...v7.24.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 12 ++++++------
 package.json      |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 67ca8d2167..e4283583f4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10553,9 +10553,9 @@
       }
     },
     "eslint": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.23.0.tgz",
-      "integrity": "sha512-kqvNVbdkjzpFy0XOszNwjkKzZ+6TcwCQ/h+ozlcIWwaimBBuhlQ4nN6kbiM2L+OjDcznkTJxzYfRFH92sx4a0Q==",
+      "version": "7.24.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.24.0.tgz",
+      "integrity": "sha512-k9gaHeHiFmGCDQ2rEfvULlSLruz6tgfA8DEn+rY9/oYPFFTlz55mM/Q/Rij1b2Y42jwZiK3lXvNTw6w6TXzcKQ==",
       "dev": true,
       "requires": {
         "@babel/code-frame": "7.12.11",
@@ -10741,9 +10741,9 @@
           }
         },
         "globals": {
-          "version": "13.7.0",
-          "resolved": "https://registry.npmjs.org/globals/-/globals-13.7.0.tgz",
-          "integrity": "sha512-Aipsz6ZKRxa/xQkZhNg0qIWXT6x6rD46f6x/PCnBomlttdIyAPak4YD9jTmKpZ72uROSMU87qJtcgpgHaVchiA==",
+          "version": "13.8.0",
+          "resolved": "https://registry.npmjs.org/globals/-/globals-13.8.0.tgz",
+          "integrity": "sha512-rHtdA6+PDBIjeEvA91rpqzEvk/k3/i7EeNQiryiWuJH0Hw9cpyJMAt2jtbAwUaRdhD+573X4vWw6IcjKPasi9Q==",
           "dev": true,
           "requires": {
             "type-fest": "^0.20.2"
diff --git a/package.json b/package.json
index 29f9741d35..ea15253799 100644
--- a/package.json
+++ b/package.json
@@ -204,7 +204,7 @@
     "csv-parse": "^4.15.3",
     "date-fns": "^2.20.1",
     "env-cmd": "^10.1.0",
-    "eslint": "^7.23.0",
+    "eslint": "^7.24.0",
     "eslint-config-prettier": "^8.1.0",
     "eslint-plugin-angular": "^4.0.1",
     "eslint-plugin-import": "^2.22.1",

From 02fd44232f291ddbb9f3c429961c8572ec4a4591 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 02:03:14 +0000
Subject: [PATCH 49/75] chore(deps-dev): bump @types/bcrypt from 3.0.0 to 3.0.1
 (#1619)

Bumps [@types/bcrypt](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bcrypt) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bcrypt)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e4283583f4..3c972a9c06 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4818,9 +4818,9 @@
       }
     },
     "@types/bcrypt": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@types/bcrypt/-/bcrypt-3.0.0.tgz",
-      "integrity": "sha512-nohgNyv+1ViVcubKBh0+XiNJ3dO8nYu///9aJ4cgSqv70gBL+94SNy/iC2NLzKPT2Zt/QavrOkBVbZRLZmw6NQ==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/bcrypt/-/bcrypt-3.0.1.tgz",
+      "integrity": "sha512-SwBrq5wb6jXP0o3O3jStdPWbKpimTImfdFD/OZE3uW+jhGpds/l5wMX9lfYOTDOa5Bod2QmOgo9ln+tMp2XP/w==",
       "dev": true
     },
     "@types/bluebird": {
diff --git a/package.json b/package.json
index ea15253799..9f228dfa82 100644
--- a/package.json
+++ b/package.json
@@ -160,7 +160,7 @@
     "@babel/plugin-transform-runtime": "^7.13.15",
     "@babel/preset-env": "^7.13.15",
     "@opengovsg/mockpass": "^2.6.8",
-    "@types/bcrypt": "^3.0.0",
+    "@types/bcrypt": "^3.0.1",
     "@types/bluebird": "^3.5.33",
     "@types/busboy": "^0.2.3",
     "@types/compression": "^1.7.0",

From 04c2eedefcf314a8e46409feb46a93d7e000d808 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Mon, 12 Apr 2021 10:56:53 +0800
Subject: [PATCH 50/75] chore: uninstall sinon and ts-mock-imports (forreal)
 (#1611)

* test: replace usages of ts-mock-imports with jest mocks

apparently unneeded

* chore: remove sinon and ts-mock-imports
---
 package-lock.json                             | 105 ------------------
 package.json                                  |   2 -
 .../auth/__tests__/auth.service.spec.ts       |  10 +-
 .../user/__tests__/user.service.spec.ts       |  75 +++++--------
 .../mail/__tests__/mail.service.spec.ts       |  12 +-
 5 files changed, 37 insertions(+), 167 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8e2d0cc901..42f3e523c2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4716,23 +4716,6 @@
         "@sinonjs/commons": "^1.7.0"
       }
     },
-    "@sinonjs/samsam": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/samsam/-/samsam-5.3.1.tgz",
-      "integrity": "sha512-1Hc0b1TtyfBu8ixF/tpfSHTVWKwCBLY4QJbkgnE7HcwyvT2xArDxb4K7dMgqRm3szI+LJbzmW/s4xxEhv6hwDg==",
-      "dev": true,
-      "requires": {
-        "@sinonjs/commons": "^1.6.0",
-        "lodash.get": "^4.4.2",
-        "type-detect": "^4.0.8"
-      }
-    },
-    "@sinonjs/text-encoding": {
-      "version": "0.7.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/text-encoding/-/text-encoding-0.7.1.tgz",
-      "integrity": "sha512-+iTbntw2IZPb/anVDbypzfQa+ay64MW0Zo8aJ8gZPWMMK6/OubMVb6lUPMagqjOPnmtauXnFCACVl3O7ogjeqQ==",
-      "dev": true
-    },
     "@stablelib/base64": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.0.tgz",
@@ -15822,12 +15805,6 @@
         "set-immediate-shim": "~1.0.1"
       }
     },
-    "just-extend": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/just-extend/-/just-extend-4.1.1.tgz",
-      "integrity": "sha512-aWgeGFW67BP3e5181Ep1Fv2v8z//iBJfrvyTnq8wG86vEESwmonn1zPBJ0VfmT9CJq2FIT0VsETtrNFm2a+SHA==",
-      "dev": true
-    },
     "jwa": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/jwa/-/jwa-1.4.1.tgz",
@@ -16346,12 +16323,6 @@
       "resolved": "https://registry.npmjs.org/lodash.find/-/lodash.find-4.6.0.tgz",
       "integrity": "sha1-ywcE1Hq3F4n/oN6Ll92Sb7iLE7E="
     },
-    "lodash.get": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
-      "integrity": "sha1-LRd/ZS+jHpObRDjVNBSZ36OCXpk=",
-      "dev": true
-    },
     "lodash.includes": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -17883,36 +17854,6 @@
       "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
       "dev": true
     },
-    "nise": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/nise/-/nise-4.1.0.tgz",
-      "integrity": "sha512-eQMEmGN/8arp0xsvGoQ+B1qvSkR73B1nWSCh7nOt5neMCtwcQVYQGdzQMhcNscktTsWB54xnlSQFzOAPJD8nXA==",
-      "dev": true,
-      "requires": {
-        "@sinonjs/commons": "^1.7.0",
-        "@sinonjs/fake-timers": "^6.0.0",
-        "@sinonjs/text-encoding": "^0.7.1",
-        "just-extend": "^4.0.2",
-        "path-to-regexp": "^1.7.0"
-      },
-      "dependencies": {
-        "isarray": {
-          "version": "0.0.1",
-          "resolved": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz",
-          "integrity": "sha1-ihis/Kmo9Bd+Cav8YDiTmwXR7t8=",
-          "dev": true
-        },
-        "path-to-regexp": {
-          "version": "1.8.0",
-          "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz",
-          "integrity": "sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA==",
-          "dev": true,
-          "requires": {
-            "isarray": "0.0.1"
-          }
-        }
-      }
-    },
     "no-case": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/no-case/-/no-case-2.3.2.tgz",
@@ -21203,46 +21144,6 @@
         "is-arrayish": "^0.3.1"
       }
     },
-    "sinon": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-10.0.0.tgz",
-      "integrity": "sha512-XAn5DxtGVJBlBWYrcYKEhWCz7FLwZGdyvANRyK06419hyEpdT0dMc5A8Vcxg5SCGHc40CsqoKsc1bt1CbJPfNw==",
-      "dev": true,
-      "requires": {
-        "@sinonjs/commons": "^1.8.1",
-        "@sinonjs/fake-timers": "^6.0.1",
-        "@sinonjs/samsam": "^5.3.1",
-        "diff": "^4.0.2",
-        "nise": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "dependencies": {
-        "@sinonjs/commons": {
-          "version": "1.8.2",
-          "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.2.tgz",
-          "integrity": "sha512-sruwd86RJHdsVf/AtBoijDmUqJp3B6hF/DGC23C+JaegnDHaZyewCjoVGTdg3J0uz3Zs7NnIT05OBOmML72lQw==",
-          "dev": true,
-          "requires": {
-            "type-detect": "4.0.8"
-          }
-        },
-        "has-flag": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "7.2.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^4.0.0"
-          }
-        }
-      }
-    },
     "sisteransi": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
@@ -24165,12 +24066,6 @@
         }
       }
     },
-    "ts-mock-imports": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/ts-mock-imports/-/ts-mock-imports-1.3.3.tgz",
-      "integrity": "sha512-zCAcb89Y+f3Bhw5VaHrHMh5tiuwAQEl5D3e0r5ELCdLl9EnZpb8Oeei/S60Qf4LORIfmJEXb3TpR5kxtL6j2cg==",
-      "dev": true
-    },
     "ts-node": {
       "version": "9.1.1",
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-9.1.1.tgz",
diff --git a/package.json b/package.json
index 5d1f92cfef..43dea6acfc 100644
--- a/package.json
+++ b/package.json
@@ -232,7 +232,6 @@
     "proxyquire": "^2.1.3",
     "regenerator": "^0.14.4",
     "rimraf": "^3.0.2",
-    "sinon": "^10.0.0",
     "stylelint": "^13.12.0",
     "stylelint-config-prettier": "^8.0.2",
     "stylelint-config-standard": "^21.0.0",
@@ -244,7 +243,6 @@
     "ts-essentials": "^7.0.1",
     "ts-jest": "^26.5.4",
     "ts-loader": "^7.0.5",
-    "ts-mock-imports": "^1.3.3",
     "ts-node": "^9.1.1",
     "ts-node-dev": "^1.1.6",
     "type-fest": "^0.20.2",
diff --git a/src/app/modules/auth/__tests__/auth.service.spec.ts b/src/app/modules/auth/__tests__/auth.service.spec.ts
index 8557464bd9..a84e3c4551 100644
--- a/src/app/modules/auth/__tests__/auth.service.spec.ts
+++ b/src/app/modules/auth/__tests__/auth.service.spec.ts
@@ -2,14 +2,13 @@ import { ObjectId } from 'bson-ext'
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
-import { ImportMock } from 'ts-mock-imports'
 
 import getTokenModel from 'src/app/models/token.server.model'
-import * as OtpUtils from 'src/app/utils/otp'
 import { IAgencySchema, IPopulatedForm, IPopulatedUser } from 'src/types'
 
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
+import * as OtpUtils from '../../../utils/otp'
 import { DatabaseError } from '../../core/core.errors'
 import { PermissionLevel } from '../../form/admin-form/admin-form.types'
 import * as AdminFormUtils from '../../form/admin-form/admin-form.utils'
@@ -34,9 +33,6 @@ const VALID_EMAIL_DOMAIN = 'test.gov.sg'
 const VALID_EMAIL = `valid@${VALID_EMAIL_DOMAIN}`
 const MOCK_OTP = '123456'
 
-// All calls to generateOtp will return MOCK_OTP.
-ImportMock.mockFunction(OtpUtils, 'generateOtp', MOCK_OTP)
-
 describe('auth.service', () => {
   let defaultAgency: IAgencySchema
 
@@ -50,7 +46,7 @@ describe('auth.service', () => {
   // Only need to clear Token collection, and ignore other collections.
   beforeEach(async () => {
     await dbHandler.clearCollection(TokenModel.collection.collectionName)
-    jest.resetAllMocks()
+    jest.clearAllMocks()
   })
 
   afterAll(async () => await dbHandler.closeDatabase())
@@ -97,6 +93,7 @@ describe('auth.service', () => {
       // Arrange
       // Should have no documents prior to this.
       await expect(TokenModel.countDocuments()).resolves.toEqual(0)
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValueOnce(MOCK_OTP)
 
       // Act
       const actualResult = await AuthService.createLoginOtp(VALID_EMAIL)
@@ -124,6 +121,7 @@ describe('auth.service', () => {
   describe('verifyLoginOtp', () => {
     it('should successfully return true and delete Token document when OTP hash matches', async () => {
       // Arrange
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValueOnce(MOCK_OTP)
       // Add a Token document to verify against.
       await AuthService.createLoginOtp(VALID_EMAIL)
       await expect(TokenModel.countDocuments()).resolves.toEqual(1)
diff --git a/src/app/modules/user/__tests__/user.service.spec.ts b/src/app/modules/user/__tests__/user.service.spec.ts
index 66f84e0824..91b86e802c 100644
--- a/src/app/modules/user/__tests__/user.service.spec.ts
+++ b/src/app/modules/user/__tests__/user.service.spec.ts
@@ -3,7 +3,6 @@ import { zipWith } from 'lodash'
 import MockDate from 'mockdate'
 import mongoose, { Query } from 'mongoose'
 import { errAsync, okAsync } from 'neverthrow'
-import { ImportMock } from 'ts-mock-imports'
 
 import getAdminVerificationModel from 'src/app/models/admin_verification.server.model'
 import getUserModel from 'src/app/models/user.server.model'
@@ -37,7 +36,6 @@ describe('user.service', () => {
 
   beforeAll(async () => {
     await dbHandler.connect()
-    ImportMock.mockFunction(OtpUtils, 'generateOtp', MOCK_OTP)
   })
   beforeEach(async () => {
     // Insert user into collections.
@@ -46,8 +44,8 @@ describe('user.service', () => {
       mailDomain: ALLOWED_DOMAIN,
     })
 
-    defaultAgency = agency.toObject()
-    defaultUser = user.toObject()
+    defaultAgency = agency
+    defaultUser = user
   })
   afterEach(async () => {
     await dbHandler.clearDatabase()
@@ -93,6 +91,7 @@ describe('user.service', () => {
     it('should create a new AdminVerification document and return otp', async () => {
       // Arrange
       // Should have no documents prior to this.
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValueOnce(MOCK_OTP)
       await expect(AdminVerification.countDocuments()).resolves.toEqual(0)
 
       // Act
@@ -149,6 +148,7 @@ describe('user.service', () => {
   describe('verifyContactOtp', () => {
     it('should successfully verify otp', async () => {
       // Arrange
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValueOnce(MOCK_OTP)
       // Add a AdminVerification document to verify against.
       await UserService.createContactOtp(USER_ID, MOCK_CONTACT)
       await expect(AdminVerification.countDocuments()).resolves.toEqual(1)
@@ -248,6 +248,7 @@ describe('user.service', () => {
 
     it('should return InvalidOtpError when contact hash does not match', async () => {
       // Arrange
+      jest.spyOn(OtpUtils, 'generateOtp').mockReturnValueOnce(MOCK_OTP)
       // Insert new AdminVerification document.
       await UserService.createContactOtp(USER_ID, MOCK_CONTACT)
       const invalidContact = '123456'
@@ -291,7 +292,7 @@ describe('user.service', () => {
       const actualUser = actualResult._unsafeUnwrap()
       expect(actualUser.contact).toEqual(MOCK_CONTACT)
       // Returned document's agency should be populated.
-      expect(actualUser.agency.toObject()).toEqual(defaultAgency)
+      expect(actualUser.agency.toObject()).toEqual(defaultAgency.toObject())
     })
 
     it('should return MissingUserError if userId is invalid', async () => {
@@ -314,8 +315,8 @@ describe('user.service', () => {
     it('should return populated user successfully', async () => {
       // Arrange
       const expected = {
-        ...defaultUser,
-        agency: defaultAgency,
+        ...defaultUser.toObject(),
+        agency: defaultAgency.toObject(),
       }
 
       // Act
@@ -369,7 +370,7 @@ describe('user.service', () => {
 
       // Assert
       const expectedUser: Partial<IPopulatedUser> = {
-        agency: defaultAgency,
+        agency: defaultAgency.toObject() as IAgencySchema,
         email: newUserEmail,
         lastAccessed: MOCKED_DATE,
       }
@@ -395,8 +396,8 @@ describe('user.service', () => {
 
       // Assert
       const expectedUser: Partial<IPopulatedUser> = {
-        ...defaultUser,
-        agency: defaultAgency,
+        ...defaultUser.toObject(),
+        agency: defaultAgency.toObject() as IAgencySchema,
         lastAccessed: MOCKED_DATE,
       }
       expect(actualResult.isOk()).toBe(true)
@@ -412,12 +413,9 @@ describe('user.service', () => {
     it('should return admin successfully', async () => {
       // Arrange
       const mockUserId = new ObjectID().toHexString()
-      const findSpy = jest.spyOn(UserModel, 'findById').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockResolvedValue(defaultUser),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findById').mockReturnValueOnce(({
+        exec: jest.fn().mockResolvedValue(defaultUser),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserById(mockUserId)
@@ -431,12 +429,9 @@ describe('user.service', () => {
     it('should return DatabaseError when query throws an error', async () => {
       // Arrange
       const mockUserId = new ObjectID().toHexString()
-      const findSpy = jest.spyOn(UserModel, 'findById').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockRejectedValue(new Error('database bad!')),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findById').mockReturnValueOnce(({
+        exec: jest.fn().mockRejectedValue(new Error('database bad')),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserById(mockUserId)
@@ -450,12 +445,9 @@ describe('user.service', () => {
     it('should return MissingUserError when query returns null', async () => {
       // Arrange
       const mockUserId = new ObjectID().toHexString()
-      const findSpy = jest.spyOn(UserModel, 'findById').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockResolvedValue(null),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findById').mockReturnValueOnce(({
+        exec: jest.fn().mockResolvedValue(null),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserById(mockUserId)
@@ -471,12 +463,9 @@ describe('user.service', () => {
     it('should return admin successfully', async () => {
       // Arrange
       const mockEmail = 'someemail@example.com'
-      const findSpy = jest.spyOn(UserModel, 'findOne').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockResolvedValue(defaultUser),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findOne').mockReturnValueOnce(({
+        exec: jest.fn().mockResolvedValue(defaultUser),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserByEmail(mockEmail)
@@ -490,12 +479,9 @@ describe('user.service', () => {
     it('should return DatabaseError when query throws an error', async () => {
       // Arrange
       const mockEmail = 'another@example.com'
-      const findSpy = jest.spyOn(UserModel, 'findOne').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockRejectedValue(new Error('database bad!')),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findOne').mockReturnValueOnce(({
+        exec: jest.fn().mockRejectedValue(new Error('database bad!')),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserByEmail(mockEmail)
@@ -509,12 +495,9 @@ describe('user.service', () => {
     it('should return MissingUserError when query returns null', async () => {
       // Arrange
       const mockEmail = 'mockEmail@example.com'
-      const findSpy = jest.spyOn(UserModel, 'findOne').mockImplementationOnce(
-        () =>
-          (({
-            exec: jest.fn().mockResolvedValue(null),
-          } as unknown) as Query<any>),
-      )
+      const findSpy = jest.spyOn(UserModel, 'findOne').mockReturnValueOnce(({
+        exec: jest.fn().mockResolvedValue(null),
+      } as unknown) as Query<IUserSchema | null, IUserSchema, unknown>)
 
       // Act
       const actualResult = await UserService.findUserByEmail(mockEmail)
diff --git a/src/app/services/mail/__tests__/mail.service.spec.ts b/src/app/services/mail/__tests__/mail.service.spec.ts
index accab8108c..e2d107a784 100644
--- a/src/app/services/mail/__tests__/mail.service.spec.ts
+++ b/src/app/services/mail/__tests__/mail.service.spec.ts
@@ -2,7 +2,6 @@ import { cloneDeep } from 'lodash'
 import moment from 'moment-timezone'
 import { err, ok, okAsync } from 'neverthrow'
 import Mail, { Attachment } from 'nodemailer/lib/mailer'
-import { ImportMock } from 'ts-mock-imports'
 
 import { MailSendError } from 'src/app/services/mail/mail.errors'
 import { MailService } from 'src/app/services/mail/mail.service'
@@ -23,7 +22,7 @@ const MOCK_SENDER_EMAIL = 'from@example.com'
 const MOCK_APP_NAME = 'mockApp'
 const MOCK_APP_URL = 'mockApp.example.com'
 const MOCK_SENDER_STRING = `${MOCK_APP_NAME} <${MOCK_SENDER_EMAIL}>`
-const MOCK_PDF = 'fake pdf'
+const MOCK_PDF = Buffer.from('fake pdf')
 
 const MOCK_RETRY_COUNT = 10
 
@@ -35,14 +34,11 @@ describe('mail.service', () => {
 
   // Set up mocks for MailUtils
   beforeAll(() => {
-    ImportMock.mockFunction(
-      MailUtils,
-      'generateAutoreplyPdf',
-      okAsync(MOCK_PDF),
-    )
+    jest
+      .spyOn(MailUtils, 'generateAutoreplyPdf')
+      .mockReturnValue(okAsync(MOCK_PDF))
   })
   beforeEach(() => sendMailSpy.mockReset())
-  afterAll(() => ImportMock.restore())
 
   const mailService = new MailService({
     transporter: mockTransporter,

From 079789921bcbabbf7135ca8ab2a8ebfa59f65cda Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Mon, 12 Apr 2021 11:21:32 +0800
Subject: [PATCH 51/75] chore: rearrange directory structure (#1606)

* chore: inline model tests

* chore: rename frontend.server.* to frontend.*

* chore: inline field validator tests

* chore: inline app/utils tests

* chore: move loaders and config into src/app

* chore: fix mock paths

* docs: update ARCHITECTURE.md

* chore: move shared tests into shared
---
 docs/ARCHITECTURE.md                          |  9 ++---
 src/{ => app}/config/config.ts                |  8 +++-
 .../feature-manager/aggregate-stats.config.ts |  0
 .../config/feature-manager/captcha.config.ts  |  0
 .../google-analytics.config.ts                |  0
 src/{ => app}/config/feature-manager/index.ts |  0
 .../config/feature-manager/intranet.config.ts |  0
 .../config/feature-manager/sentry.config.ts   |  0
 .../config/feature-manager/sms.config.ts      |  0
 .../feature-manager/spcp-myinfo.config.ts     |  0
 src/{ => app}/config/feature-manager/types.ts |  0
 .../util/FeatureManager.class.ts              |  0
 .../feature-manager/verified-fields.config.ts |  0
 .../webhook-verified-content.config.ts        |  0
 src/{ => app}/config/formsg-sdk.ts            |  2 +-
 src/{ => app}/config/logger.ts                |  2 +-
 src/{ => app}/config/ndi-config.ts            |  0
 src/{ => app}/config/schema.ts                |  2 +-
 .../loaders/express/__tests__/helmet.spec.ts  |  8 ++--
 .../loaders/express/error-handler.ts          |  0
 src/{ => app}/loaders/express/helmet.ts       |  0
 src/{ => app}/loaders/express/index.ts        | 36 ++++++++---------
 src/{ => app}/loaders/express/locals.ts       |  0
 src/{ => app}/loaders/express/logging.ts      |  2 +-
 src/{ => app}/loaders/express/parser.ts       |  0
 src/{ => app}/loaders/express/sentry.ts       |  0
 src/{ => app}/loaders/express/session.ts      |  0
 src/{ => app}/loaders/index.ts                |  0
 src/{ => app}/loaders/mongoose.ts             |  0
 .../admin_verification.server.model.spec.ts   |  5 +--
 .../__tests__}/agency.server.model.spec.ts    |  2 +-
 .../encrypt-submission.server.model.spec.ts   | 40 +++++++++----------
 .../__tests__}/form.server.model.spec.ts      |  2 +-
 .../form_feedback.server.model.spec.ts        |  2 +-
 .../__tests__}/form_fields.schema.spec.ts     |  2 +-
 ...form_statistics_total.server.model.spec.ts |  2 +-
 .../__tests__}/login.server.model.spec.ts     |  2 +-
 .../submission.server.model.spec.ts           |  3 +-
 .../__tests__}/user.server.model.spec.ts      |  2 +-
 src/app/models/field/imageField.ts            |  2 +-
 .../modules/analytics/analytics.controller.ts |  2 +-
 .../modules/analytics/analytics.service.ts    |  4 +-
 src/app/modules/auth/auth.controller.ts       |  2 +-
 src/app/modules/auth/auth.routes.ts           |  2 +-
 src/app/modules/auth/auth.service.ts          |  4 +-
 src/app/modules/auth/auth.utils.ts            |  2 +-
 .../billing/__tests__/billing.factory.spec.ts |  2 +-
 src/app/modules/billing/billing.controller.ts |  2 +-
 src/app/modules/billing/billing.factory.ts    |  4 +-
 src/app/modules/billing/billing.service.ts    |  2 +-
 .../bounce/__tests__/bounce.service.spec.ts   |  4 +-
 src/app/modules/bounce/bounce.controller.ts   |  2 +-
 src/app/modules/bounce/bounce.model.ts        |  2 +-
 src/app/modules/bounce/bounce.service.ts      |  8 ++--
 src/app/modules/core/core.errors.ts           |  2 +-
 .../__tests__/examples.factory.spec.ts        |  2 +-
 .../modules/examples/examples.controller.ts   |  2 +-
 src/app/modules/examples/examples.factory.ts  |  2 +-
 src/app/modules/examples/examples.service.ts  |  2 +-
 src/app/modules/examples/examples.utils.ts    |  2 +-
 src/app/modules/feedback/feedback.service.ts  |  2 +-
 .../__tests__/admin-form.routes.spec.ts       |  2 +-
 .../__tests__/admin-form.service.spec.ts      |  2 +-
 .../form/admin-form/admin-form.controller.ts  |  2 +-
 .../form/admin-form/admin-form.service.ts     |  4 +-
 .../form/admin-form/admin-form.utils.ts       |  2 +-
 src/app/modules/form/form.service.ts          |  2 +-
 .../__tests__/public-form.controller.spec.ts  |  2 +-
 .../public-form/public-form.controller.ts     |  2 +-
 .../form/public-form/public-form.service.ts   |  2 +-
 .../form/public-form/public-form.utils.ts     |  2 +-
 ...er.spec.ts => frontend.controller.spec.ts} |  2 +-
 .../google-analytics.factory.spec.ts          |  2 +-
 ...r.controller.ts => frontend.controller.ts} |  4 +-
 ...nd.server.routes.ts => frontend.routes.ts} |  2 +-
 .../frontend/google-analytics.factory.ts      |  4 +-
 .../myinfo/__tests__/myinfo.factory.spec.ts   |  6 +--
 .../myinfo/__tests__/myinfo.test.constants.ts |  2 +-
 .../__tests__/myinfo_hash.model.spec.ts       |  4 +-
 src/app/modules/myinfo/myinfo.constants.ts    |  2 +-
 src/app/modules/myinfo/myinfo.controller.ts   |  2 +-
 src/app/modules/myinfo/myinfo.factory.ts      | 10 ++---
 src/app/modules/myinfo/myinfo.format.ts       |  2 +-
 src/app/modules/myinfo/myinfo.service.ts      |  2 +-
 src/app/modules/myinfo/myinfo.types.ts        |  2 +-
 src/app/modules/myinfo/myinfo.util.ts         |  2 +-
 src/app/modules/myinfo/myinfo_hash.model.ts   |  2 +-
 .../spcp/__tests__/spcp.controller.spec.ts    |  4 +-
 .../spcp/__tests__/spcp.factory.spec.ts       |  2 +-
 .../spcp/__tests__/spcp.service.spec.ts       |  2 +-
 .../spcp/__tests__/spcp.test.constants.ts     |  2 +-
 src/app/modules/spcp/spcp.controller.ts       |  4 +-
 src/app/modules/spcp/spcp.factory.ts          |  2 +-
 src/app/modules/spcp/spcp.service.ts          |  4 +-
 src/app/modules/spcp/spcp.util.ts             |  2 +-
 .../email-submission.controller.ts            |  2 +-
 .../email-submission.middleware.ts            |  2 +-
 .../email-submission.receiver.ts              |  2 +-
 .../email-submission.routes.ts                |  2 +-
 .../email-submission.service.ts               |  2 +-
 .../email-submission/email-submission.util.ts |  2 +-
 .../encrypt-submission.service.spec.ts        |  2 +-
 .../encrypt-submission.controller.ts          |  2 +-
 .../encrypt-submission.routes.ts              |  2 +-
 .../encrypt-submission.service.ts             |  4 +-
 .../encrypt-submission.utils.ts               |  2 +-
 .../modules/submission/submission.service.ts  |  2 +-
 src/app/modules/user/user.controller.ts       |  2 +-
 src/app/modules/user/user.service.ts          |  4 +-
 src/app/modules/user/user.utils.ts            |  2 +-
 .../__tests__/verification.factory.spec.ts    |  2 +-
 .../__tests__/verification.service.spec.ts    |  4 +-
 .../verification/verification.controller.ts   |  2 +-
 .../verification/verification.factory.ts      |  2 +-
 .../verification/verification.service.ts      |  4 +-
 .../modules/verification/verification.util.ts |  2 +-
 .../verified-content.factory.spec.ts          |  2 +-
 .../verified-content.service.spec.ts          |  2 +-
 .../verified-content.factory.ts               |  2 +-
 .../verified-content.service.ts               |  4 +-
 .../webhook/__tests__/webhook.service.spec.ts |  2 +-
 .../__tests__/webhook.validation.spec.ts      |  4 +-
 src/app/modules/webhook/webhook.factory.ts    |  2 +-
 src/app/modules/webhook/webhook.service.ts    |  4 +-
 src/app/modules/webhook/webhook.validation.ts |  2 +-
 src/app/routes/api/v3/auth/auth.routes.ts     |  2 +-
 src/app/services/captcha/captcha.factory.ts   |  2 +-
 src/app/services/captcha/captcha.service.ts   |  2 +-
 src/app/services/captcha/captcha.util.ts      |  2 +-
 .../__tests__/intranet.factory.spec.ts        |  2 +-
 src/app/services/intranet/intranet.factory.ts |  2 +-
 .../services/intranet/intranet.middleware.ts  |  2 +-
 src/app/services/intranet/intranet.service.ts |  4 +-
 src/app/services/mail/mail.service.ts         |  4 +-
 src/app/services/mail/mail.utils.ts           |  4 +-
 .../sms/__tests__/sms.factory.spec.ts         |  4 +-
 src/app/services/sms/sms.factory.ts           |  2 +-
 src/app/services/sms/sms.service.ts           |  4 +-
 .../app/utils/__tests__}/date.spec.ts         |  0
 .../__tests__}/handle-mongo-error.spec.ts     |  0
 .../utils/__tests__}/stringify-safe.spec.ts   |  0
 src/app/utils/field-validation/index.ts       |  2 +-
 .../__tests__}/attachment-validation.spec.ts  |  2 +-
 .../__tests__}/checkbox-validation.spec.ts    |  2 +-
 .../__tests__}/date-validation.spec.ts        |  2 +-
 .../__tests__}/decimal-validation.spec.ts     |  2 +-
 .../__tests__}/dropdown-validation.spec.ts    |  2 +-
 .../__tests__}/email-validation.spec.ts       |  2 +-
 .../__tests__}/home-num-validation.spec.ts    |  2 +-
 .../__tests__}/mobile-num-validation.spec.ts  |  4 +-
 .../__tests__}/nric-validation.spec.ts        |  2 +-
 .../__tests__}/number-validation.spec.ts      |  2 +-
 .../radio-button-validation.spec.ts           |  2 +-
 .../__tests__}/rating-validation.spec.ts      |  2 +-
 .../__tests__}/table-validation.spec.ts       |  2 +-
 .../__tests__}/text-validator.spec.ts         |  2 +-
 .../__tests__}/yesno-validation.spec.ts       |  2 +-
 .../field-validation/validators/common.ts     |  2 +-
 src/app/utils/hash.ts                         |  2 +-
 src/app/utils/limit-rate.ts                   |  2 +-
 src/server.ts                                 |  6 +--
 .../util/__tests__}/file-validation.spec.ts   |  0
 .../shared/util/__tests__}/logic.spec.ts      |  0
 tests/integration/helpers/express-setup.ts    |  8 ++--
 164 files changed, 224 insertions(+), 223 deletions(-)
 rename src/{ => app}/config/config.ts (98%)
 rename src/{ => app}/config/feature-manager/aggregate-stats.config.ts (100%)
 rename src/{ => app}/config/feature-manager/captcha.config.ts (100%)
 rename src/{ => app}/config/feature-manager/google-analytics.config.ts (100%)
 rename src/{ => app}/config/feature-manager/index.ts (100%)
 rename src/{ => app}/config/feature-manager/intranet.config.ts (100%)
 rename src/{ => app}/config/feature-manager/sentry.config.ts (100%)
 rename src/{ => app}/config/feature-manager/sms.config.ts (100%)
 rename src/{ => app}/config/feature-manager/spcp-myinfo.config.ts (100%)
 rename src/{ => app}/config/feature-manager/types.ts (100%)
 rename src/{ => app}/config/feature-manager/util/FeatureManager.class.ts (100%)
 rename src/{ => app}/config/feature-manager/verified-fields.config.ts (100%)
 rename src/{ => app}/config/feature-manager/webhook-verified-content.config.ts (100%)
 rename src/{ => app}/config/formsg-sdk.ts (91%)
 rename src/{ => app}/config/logger.ts (99%)
 rename src/{ => app}/config/ndi-config.ts (100%)
 rename src/{ => app}/config/schema.ts (99%)
 rename src/{ => app}/loaders/express/__tests__/helmet.spec.ts (96%)
 rename src/{ => app}/loaders/express/error-handler.ts (100%)
 rename src/{ => app}/loaders/express/helmet.ts (100%)
 rename src/{ => app}/loaders/express/index.ts (79%)
 rename src/{ => app}/loaders/express/locals.ts (100%)
 rename src/{ => app}/loaders/express/logging.ts (97%)
 rename src/{ => app}/loaders/express/parser.ts (100%)
 rename src/{ => app}/loaders/express/sentry.ts (100%)
 rename src/{ => app}/loaders/express/session.ts (100%)
 rename src/{ => app}/loaders/index.ts (100%)
 rename src/{ => app}/loaders/mongoose.ts (100%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/admin_verification.server.model.spec.ts (98%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/agency.server.model.spec.ts (94%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/encrypt-submission.server.model.spec.ts (94%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/form.server.model.spec.ts (99%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/form_feedback.server.model.spec.ts (98%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/form_fields.schema.spec.ts (98%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/form_statistics_total.server.model.spec.ts (97%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/login.server.model.spec.ts (99%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/submission.server.model.spec.ts (99%)
 rename {tests/unit/backend/models => src/app/models/__tests__}/user.server.model.spec.ts (99%)
 rename src/app/modules/frontend/__tests__/{frontend.server.controller.spec.ts => frontend.controller.spec.ts} (97%)
 rename src/app/modules/frontend/{frontend.server.controller.ts => frontend.controller.ts} (96%)
 rename src/app/modules/frontend/{frontend.server.routes.ts => frontend.routes.ts} (95%)
 rename {tests/unit/backend/utils => src/app/utils/__tests__}/date.spec.ts (100%)
 rename {tests/unit/backend/utils => src/app/utils/__tests__}/handle-mongo-error.spec.ts (100%)
 rename {tests/unit/backend/utils => src/app/utils/__tests__}/stringify-safe.spec.ts (100%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/attachment-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/checkbox-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/date-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/decimal-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/dropdown-validation.spec.ts (98%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/email-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/home-num-validation.spec.ts (98%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/mobile-num-validation.spec.ts (98%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/nric-validation.spec.ts (98%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/number-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/radio-button-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/rating-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/table-validation.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/text-validator.spec.ts (99%)
 rename {tests/unit/backend/utils/field-validation => src/app/utils/field-validation/validators/__tests__}/yesno-validation.spec.ts (98%)
 rename {tests/unit/backend/utils => src/shared/util/__tests__}/file-validation.spec.ts (100%)
 rename {tests/unit/backend/utils => src/shared/util/__tests__}/logic.spec.ts (100%)

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 3b6a7679d0..1ff2eb9229 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -13,12 +13,9 @@ identities, and E-mail servers hosted in Government Data Centres.
 
 ## Backend
 
-FormSG is currently in the process of migrating its backend to TypeScript, so you will find
-a mixture of `.js` and `.ts` files in the backend.
-
-The backend for FormSG is bootstrapped using `src/server.ts` and `src/loaders`.
-It sets up express.js routes defined in `src/app/routes/*.(j|t)s`, with business logic
-defined in `src/app/controllers/*.(j|t)s` and mongoose models defined in `src/app/models/*.(j|t)s`.
+The backend for FormSG is bootstrapped using `src/server.ts` and `src/app/loaders`.
+It sets up express.js routes defined in `src/app/**/*.routes.ts`, with business logic
+defined in `src/app/**/*.controller.ts` and mongoose models defined in `src/app/**/*.model.ts`.
 
 ### Security
 
diff --git a/src/config/config.ts b/src/app/config/config.ts
similarity index 98%
rename from src/config/config.ts
rename to src/app/config/config.ts
index 79f63c4581..9834219462 100644
--- a/src/config/config.ts
+++ b/src/app/config/config.ts
@@ -6,7 +6,13 @@ import nodemailer from 'nodemailer'
 import Mail from 'nodemailer/lib/mailer'
 import SMTPPool from 'nodemailer/lib/smtp-pool'
 
-import { AwsConfig, Config, DbConfig, Environment, MailConfig } from '../types'
+import {
+  AwsConfig,
+  Config,
+  DbConfig,
+  Environment,
+  MailConfig,
+} from '../../types'
 
 import {
   compulsoryVarsSchema,
diff --git a/src/config/feature-manager/aggregate-stats.config.ts b/src/app/config/feature-manager/aggregate-stats.config.ts
similarity index 100%
rename from src/config/feature-manager/aggregate-stats.config.ts
rename to src/app/config/feature-manager/aggregate-stats.config.ts
diff --git a/src/config/feature-manager/captcha.config.ts b/src/app/config/feature-manager/captcha.config.ts
similarity index 100%
rename from src/config/feature-manager/captcha.config.ts
rename to src/app/config/feature-manager/captcha.config.ts
diff --git a/src/config/feature-manager/google-analytics.config.ts b/src/app/config/feature-manager/google-analytics.config.ts
similarity index 100%
rename from src/config/feature-manager/google-analytics.config.ts
rename to src/app/config/feature-manager/google-analytics.config.ts
diff --git a/src/config/feature-manager/index.ts b/src/app/config/feature-manager/index.ts
similarity index 100%
rename from src/config/feature-manager/index.ts
rename to src/app/config/feature-manager/index.ts
diff --git a/src/config/feature-manager/intranet.config.ts b/src/app/config/feature-manager/intranet.config.ts
similarity index 100%
rename from src/config/feature-manager/intranet.config.ts
rename to src/app/config/feature-manager/intranet.config.ts
diff --git a/src/config/feature-manager/sentry.config.ts b/src/app/config/feature-manager/sentry.config.ts
similarity index 100%
rename from src/config/feature-manager/sentry.config.ts
rename to src/app/config/feature-manager/sentry.config.ts
diff --git a/src/config/feature-manager/sms.config.ts b/src/app/config/feature-manager/sms.config.ts
similarity index 100%
rename from src/config/feature-manager/sms.config.ts
rename to src/app/config/feature-manager/sms.config.ts
diff --git a/src/config/feature-manager/spcp-myinfo.config.ts b/src/app/config/feature-manager/spcp-myinfo.config.ts
similarity index 100%
rename from src/config/feature-manager/spcp-myinfo.config.ts
rename to src/app/config/feature-manager/spcp-myinfo.config.ts
diff --git a/src/config/feature-manager/types.ts b/src/app/config/feature-manager/types.ts
similarity index 100%
rename from src/config/feature-manager/types.ts
rename to src/app/config/feature-manager/types.ts
diff --git a/src/config/feature-manager/util/FeatureManager.class.ts b/src/app/config/feature-manager/util/FeatureManager.class.ts
similarity index 100%
rename from src/config/feature-manager/util/FeatureManager.class.ts
rename to src/app/config/feature-manager/util/FeatureManager.class.ts
diff --git a/src/config/feature-manager/verified-fields.config.ts b/src/app/config/feature-manager/verified-fields.config.ts
similarity index 100%
rename from src/config/feature-manager/verified-fields.config.ts
rename to src/app/config/feature-manager/verified-fields.config.ts
diff --git a/src/config/feature-manager/webhook-verified-content.config.ts b/src/app/config/feature-manager/webhook-verified-content.config.ts
similarity index 100%
rename from src/config/feature-manager/webhook-verified-content.config.ts
rename to src/app/config/feature-manager/webhook-verified-content.config.ts
diff --git a/src/config/formsg-sdk.ts b/src/app/config/formsg-sdk.ts
similarity index 91%
rename from src/config/formsg-sdk.ts
rename to src/app/config/formsg-sdk.ts
index 5dda108394..180ef78761 100644
--- a/src/config/formsg-sdk.ts
+++ b/src/app/config/formsg-sdk.ts
@@ -1,7 +1,7 @@
 import formsgSdkPackage from '@opengovsg/formsg-sdk'
 import { get } from 'lodash'
 
-import * as vfnConstants from '../shared/util/verification'
+import * as vfnConstants from '../../shared/util/verification'
 
 import { formsgSdkMode } from './config'
 import featureManager, { FeatureNames } from './feature-manager'
diff --git a/src/config/logger.ts b/src/app/config/logger.ts
similarity index 99%
rename from src/config/logger.ts
rename to src/app/config/logger.ts
index 91fa4c319b..fe7455aa66 100644
--- a/src/config/logger.ts
+++ b/src/app/config/logger.ts
@@ -8,7 +8,7 @@ import { v4 as uuidv4 } from 'uuid'
 import { format, Logger, LoggerOptions, loggers, transports } from 'winston'
 import WinstonCloudWatch from 'winston-cloudwatch'
 
-import { Environment } from '../types'
+import { Environment } from '../../types'
 
 import { aws, customCloudWatchGroup, isDev, nodeEnv } from './config'
 
diff --git a/src/config/ndi-config.ts b/src/app/config/ndi-config.ts
similarity index 100%
rename from src/config/ndi-config.ts
rename to src/app/config/ndi-config.ts
diff --git a/src/config/schema.ts b/src/app/config/schema.ts
similarity index 99%
rename from src/config/schema.ts
rename to src/app/config/schema.ts
index 34308b7dc8..68a57683f6 100644
--- a/src/config/schema.ts
+++ b/src/app/config/schema.ts
@@ -12,7 +12,7 @@ import {
   ICompulsoryVarsSchema,
   IOptionalVarsSchema,
   IProdOnlyVarsSchema,
-} from '../types'
+} from '../../types'
 
 convict.addFormat(url)
 convict.addFormat(email)
diff --git a/src/loaders/express/__tests__/helmet.spec.ts b/src/app/loaders/express/__tests__/helmet.spec.ts
similarity index 96%
rename from src/loaders/express/__tests__/helmet.spec.ts
rename to src/app/loaders/express/__tests__/helmet.spec.ts
index fc9a57a612..e41cf98247 100644
--- a/src/loaders/express/__tests__/helmet.spec.ts
+++ b/src/app/loaders/express/__tests__/helmet.spec.ts
@@ -1,8 +1,8 @@
 import helmet from 'helmet'
 import { mocked } from 'ts-jest/utils'
 
-import config from 'src/config/config'
-import featureManager from 'src/config/feature-manager'
+import config from 'src/app/config/config'
+import featureManager from 'src/app/config/feature-manager'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
@@ -11,9 +11,9 @@ import helmetMiddlewares from '../helmet'
 describe('helmetMiddlewares', () => {
   jest.mock('helmet')
   const mockHelmet = mocked(helmet, true)
-  jest.mock('src/config/feature-manager')
+  jest.mock('src/app/config/feature-manager')
   const mockFeatureManager = mocked(featureManager, true)
-  jest.mock('src/config/config')
+  jest.mock('src/app/config/config')
   const mockConfig = mocked(config, true)
 
   const cspCoreDirectives = {
diff --git a/src/loaders/express/error-handler.ts b/src/app/loaders/express/error-handler.ts
similarity index 100%
rename from src/loaders/express/error-handler.ts
rename to src/app/loaders/express/error-handler.ts
diff --git a/src/loaders/express/helmet.ts b/src/app/loaders/express/helmet.ts
similarity index 100%
rename from src/loaders/express/helmet.ts
rename to src/app/loaders/express/helmet.ts
diff --git a/src/loaders/express/index.ts b/src/app/loaders/express/index.ts
similarity index 79%
rename from src/loaders/express/index.ts
rename to src/app/loaders/express/index.ts
index 1acdd06314..fe2b264ee1 100644
--- a/src/loaders/express/index.ts
+++ b/src/app/loaders/express/index.ts
@@ -8,28 +8,28 @@ import nocache from 'nocache'
 import path from 'path'
 import url from 'url'
 
-import { AnalyticsRouter } from '../../app/modules/analytics/analytics.routes'
-import { AuthRouter } from '../../app/modules/auth/auth.routes'
-import { BillingRouter } from '../../app/modules/billing/billing.routes'
-import { BounceRouter } from '../../app/modules/bounce/bounce.routes'
-import { ExamplesRouter } from '../../app/modules/examples/examples.routes'
-import { AdminFormsRouter } from '../../app/modules/form/admin-form/admin-form.routes'
-import { PublicFormRouter } from '../../app/modules/form/public-form/public-form.routes'
-import { FrontendRouter } from '../../app/modules/frontend/frontend.server.routes'
-import { HomeRouter } from '../../app/modules/home/home.routes'
-import { MYINFO_ROUTER_PREFIX } from '../../app/modules/myinfo/myinfo.constants'
-import { MyInfoRouter } from '../../app/modules/myinfo/myinfo.routes'
+import config from '../../config/config'
+import { AnalyticsRouter } from '../../modules/analytics/analytics.routes'
+import { AuthRouter } from '../../modules/auth/auth.routes'
+import { BillingRouter } from '../../modules/billing/billing.routes'
+import { BounceRouter } from '../../modules/bounce/bounce.routes'
+import { ExamplesRouter } from '../../modules/examples/examples.routes'
+import { AdminFormsRouter } from '../../modules/form/admin-form/admin-form.routes'
+import { PublicFormRouter } from '../../modules/form/public-form/public-form.routes'
+import { FrontendRouter } from '../../modules/frontend/frontend.routes'
+import { HomeRouter } from '../../modules/home/home.routes'
+import { MYINFO_ROUTER_PREFIX } from '../../modules/myinfo/myinfo.constants'
+import { MyInfoRouter } from '../../modules/myinfo/myinfo.routes'
 import {
   CorppassLoginRouter,
   SingpassLoginRouter,
   SpcpRouter,
-} from '../../app/modules/spcp/spcp.routes'
-import { SubmissionRouter } from '../../app/modules/submission/submission.routes'
-import UserRouter from '../../app/modules/user/user.routes'
-import { VfnRouter } from '../../app/modules/verification/verification.routes'
-import { ApiRouter } from '../../app/routes/api'
-import * as IntranetMiddleware from '../../app/services/intranet/intranet.middleware'
-import config from '../../config/config'
+} from '../../modules/spcp/spcp.routes'
+import { SubmissionRouter } from '../../modules/submission/submission.routes'
+import UserRouter from '../../modules/user/user.routes'
+import { VfnRouter } from '../../modules/verification/verification.routes'
+import { ApiRouter } from '../../routes/api'
+import * as IntranetMiddleware from '../../services/intranet/intranet.middleware'
 
 import errorHandlerMiddlewares from './error-handler'
 import helmetMiddlewares from './helmet'
diff --git a/src/loaders/express/locals.ts b/src/app/loaders/express/locals.ts
similarity index 100%
rename from src/loaders/express/locals.ts
rename to src/app/loaders/express/locals.ts
diff --git a/src/loaders/express/logging.ts b/src/app/loaders/express/logging.ts
similarity index 97%
rename from src/loaders/express/logging.ts
rename to src/app/loaders/express/logging.ts
index 1c3461be9c..fcfaee6440 100644
--- a/src/loaders/express/logging.ts
+++ b/src/app/loaders/express/logging.ts
@@ -2,9 +2,9 @@ import expressWinston from 'express-winston'
 import get from 'lodash/get'
 import winston from 'winston'
 
-import { getRequestIp, getTrace } from '../../app/utils/request'
 import config from '../../config/config'
 import { customFormat } from '../../config/logger'
+import { getRequestIp, getTrace } from '../../utils/request'
 
 const LOGGER_LABEL = 'network'
 
diff --git a/src/loaders/express/parser.ts b/src/app/loaders/express/parser.ts
similarity index 100%
rename from src/loaders/express/parser.ts
rename to src/app/loaders/express/parser.ts
diff --git a/src/loaders/express/sentry.ts b/src/app/loaders/express/sentry.ts
similarity index 100%
rename from src/loaders/express/sentry.ts
rename to src/app/loaders/express/sentry.ts
diff --git a/src/loaders/express/session.ts b/src/app/loaders/express/session.ts
similarity index 100%
rename from src/loaders/express/session.ts
rename to src/app/loaders/express/session.ts
diff --git a/src/loaders/index.ts b/src/app/loaders/index.ts
similarity index 100%
rename from src/loaders/index.ts
rename to src/app/loaders/index.ts
diff --git a/src/loaders/mongoose.ts b/src/app/loaders/mongoose.ts
similarity index 100%
rename from src/loaders/mongoose.ts
rename to src/app/loaders/mongoose.ts
diff --git a/tests/unit/backend/models/admin_verification.server.model.spec.ts b/src/app/models/__tests__/admin_verification.server.model.spec.ts
similarity index 98%
rename from tests/unit/backend/models/admin_verification.server.model.spec.ts
rename to src/app/models/__tests__/admin_verification.server.model.spec.ts
index 5476933b23..250cc50e50 100644
--- a/tests/unit/backend/models/admin_verification.server.model.spec.ts
+++ b/src/app/models/__tests__/admin_verification.server.model.spec.ts
@@ -7,7 +7,7 @@ import {
   UpsertOtpParams,
 } from 'src/types/admin_verification'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const AdminVerification = getAdminVerificationModel(mongoose)
 
@@ -87,7 +87,6 @@ describe('AdminVerification Model', () => {
       }
 
       // Act
-      // @ts-ignore
       const actualPromise = AdminVerification.create(missingContactParams)
 
       // Assert
@@ -104,7 +103,6 @@ describe('AdminVerification Model', () => {
       }
 
       // Act
-      // @ts-ignore
       const actualPromise = AdminVerification.create(missingOtpParams)
 
       // Assert
@@ -121,7 +119,6 @@ describe('AdminVerification Model', () => {
       }
 
       // Act
-      // @ts-ignore
       const actualPromise = AdminVerification.create(missingExpireParams)
 
       // Assert
diff --git a/tests/unit/backend/models/agency.server.model.spec.ts b/src/app/models/__tests__/agency.server.model.spec.ts
similarity index 94%
rename from tests/unit/backend/models/agency.server.model.spec.ts
rename to src/app/models/__tests__/agency.server.model.spec.ts
index 65b73f73b8..40a7a2bf1d 100644
--- a/tests/unit/backend/models/agency.server.model.spec.ts
+++ b/src/app/models/__tests__/agency.server.model.spec.ts
@@ -5,7 +5,7 @@ import getAgencyModel, {
   AGENCY_PUBLIC_FIELDS,
 } from 'src/app/models/agency.server.model'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const Agency = getAgencyModel(mongoose)
 
diff --git a/tests/unit/backend/models/encrypt-submission.server.model.spec.ts b/src/app/models/__tests__/encrypt-submission.server.model.spec.ts
similarity index 94%
rename from tests/unit/backend/models/encrypt-submission.server.model.spec.ts
rename to src/app/models/__tests__/encrypt-submission.server.model.spec.ts
index fb28541361..e182bcfe1b 100644
--- a/tests/unit/backend/models/encrypt-submission.server.model.spec.ts
+++ b/src/app/models/__tests__/encrypt-submission.server.model.spec.ts
@@ -14,7 +14,7 @@ import {
   SubmissionType,
 } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const Submission = getSubmissionModel(mongoose)
 const EncryptSubmission = getEncryptSubmissionModel(mongoose)
@@ -33,16 +33,16 @@ describe('Encrypt Submission Model', () => {
         const validFormId = new ObjectId().toHexString()
         const createdDate = new Date()
         // Add valid encrypt submission.
-        const validSubmission = await Submission.create<
-          IEncryptedSubmissionSchema
-        >({
-          form: validFormId,
-          myInfoFields: [],
-          submissionType: SubmissionType.Encrypt,
-          encryptedContent: MOCK_ENCRYPTED_CONTENT,
-          version: 1,
-          created: createdDate,
-        })
+        const validSubmission = await Submission.create<IEncryptedSubmissionSchema>(
+          {
+            form: validFormId,
+            myInfoFields: [],
+            submissionType: SubmissionType.Encrypt,
+            encryptedContent: MOCK_ENCRYPTED_CONTENT,
+            version: 1,
+            created: createdDate,
+          },
+        )
 
         // Act
         const result = await EncryptSubmission.findSingleMetadata(
@@ -391,15 +391,15 @@ describe('Encrypt Submission Model', () => {
       it('should return null when type of submission with given id is not SubmissionType.Encrypt', async () => {
         // Arrange
         const validFormId = new ObjectId().toHexString()
-        const validEmailSubmission = await Submission.create<
-          IEmailSubmissionSchema
-        >({
-          submissionType: SubmissionType.Email,
-          form: validFormId,
-          recipientEmails: ['any@example.com'],
-          responseHash: 'any hash',
-          responseSalt: 'any salt',
-        })
+        const validEmailSubmission = await Submission.create<IEmailSubmissionSchema>(
+          {
+            submissionType: SubmissionType.Email,
+            form: validFormId,
+            recipientEmails: ['any@example.com'],
+            responseHash: 'any hash',
+            responseSalt: 'any salt',
+          },
+        )
 
         // Act
         const actual = await EncryptSubmission.findEncryptedSubmissionById(
diff --git a/tests/unit/backend/models/form.server.model.spec.ts b/src/app/models/__tests__/form.server.model.spec.ts
similarity index 99%
rename from tests/unit/backend/models/form.server.model.spec.ts
rename to src/app/models/__tests__/form.server.model.spec.ts
index fada279002..bd303f59af 100644
--- a/tests/unit/backend/models/form.server.model.spec.ts
+++ b/src/app/models/__tests__/form.server.model.spec.ts
@@ -16,7 +16,7 @@ import {
   Status,
 } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const Form = getFormModel(mongoose)
 const EncryptedForm = getEncryptedFormModel(mongoose)
diff --git a/tests/unit/backend/models/form_feedback.server.model.spec.ts b/src/app/models/__tests__/form_feedback.server.model.spec.ts
similarity index 98%
rename from tests/unit/backend/models/form_feedback.server.model.spec.ts
rename to src/app/models/__tests__/form_feedback.server.model.spec.ts
index b794c0e2a7..444a73dfc3 100644
--- a/tests/unit/backend/models/form_feedback.server.model.spec.ts
+++ b/src/app/models/__tests__/form_feedback.server.model.spec.ts
@@ -5,7 +5,7 @@ import mongoose from 'mongoose'
 import getFormFeedbackModel from 'src/app/models/form_feedback.server.model'
 import { IFormFeedback } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const FeedbackModel = getFormFeedbackModel(mongoose)
 
diff --git a/tests/unit/backend/models/form_fields.schema.spec.ts b/src/app/models/__tests__/form_fields.schema.spec.ts
similarity index 98%
rename from tests/unit/backend/models/form_fields.schema.spec.ts
rename to src/app/models/__tests__/form_fields.schema.spec.ts
index 04f96228b2..1cc017bd58 100644
--- a/tests/unit/backend/models/form_fields.schema.spec.ts
+++ b/src/app/models/__tests__/form_fields.schema.spec.ts
@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import getFormModel from 'src/app/models/form.server.model'
 import { BasicField, IFieldSchema, ResponseMode } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const Form = getFormModel(mongoose)
 
diff --git a/tests/unit/backend/models/form_statistics_total.server.model.spec.ts b/src/app/models/__tests__/form_statistics_total.server.model.spec.ts
similarity index 97%
rename from tests/unit/backend/models/form_statistics_total.server.model.spec.ts
rename to src/app/models/__tests__/form_statistics_total.server.model.spec.ts
index 5cb9b8d46b..7163dacca7 100644
--- a/tests/unit/backend/models/form_statistics_total.server.model.spec.ts
+++ b/src/app/models/__tests__/form_statistics_total.server.model.spec.ts
@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import getFormStatisticsTotalModel from 'src/app/models/form_statistics_total.server.model'
 import { AggregateFormCountResult, IFormStatisticsTotalSchema } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const FormStatsModel = getFormStatisticsTotalModel(mongoose)
 
diff --git a/tests/unit/backend/models/login.server.model.spec.ts b/src/app/models/__tests__/login.server.model.spec.ts
similarity index 99%
rename from tests/unit/backend/models/login.server.model.spec.ts
rename to src/app/models/__tests__/login.server.model.spec.ts
index c7020fdb9c..64ce5e53cd 100644
--- a/tests/unit/backend/models/login.server.model.spec.ts
+++ b/src/app/models/__tests__/login.server.model.spec.ts
@@ -13,7 +13,7 @@ import {
   IUserSchema,
 } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const LoginModel = getLoginModel(mongoose)
 
diff --git a/tests/unit/backend/models/submission.server.model.spec.ts b/src/app/models/__tests__/submission.server.model.spec.ts
similarity index 99%
rename from tests/unit/backend/models/submission.server.model.spec.ts
rename to src/app/models/__tests__/submission.server.model.spec.ts
index 666fa26042..766a4cb86b 100644
--- a/tests/unit/backend/models/submission.server.model.spec.ts
+++ b/src/app/models/__tests__/submission.server.model.spec.ts
@@ -6,13 +6,14 @@ import getSubmissionModel, {
   getEncryptSubmissionModel,
 } from 'src/app/models/submission.server.model'
 
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
 import {
   AuthType,
   ISubmissionSchema,
   IWebhookResponse,
   SubmissionType,
 } from '../../../../src/types'
-import dbHandler from '../helpers/jest-db'
 
 const Submission = getSubmissionModel(mongoose)
 const EncryptedSubmission = getEncryptSubmissionModel(mongoose)
diff --git a/tests/unit/backend/models/user.server.model.spec.ts b/src/app/models/__tests__/user.server.model.spec.ts
similarity index 99%
rename from tests/unit/backend/models/user.server.model.spec.ts
rename to src/app/models/__tests__/user.server.model.spec.ts
index 96a7b28e12..ea4c3cf7b0 100644
--- a/tests/unit/backend/models/user.server.model.spec.ts
+++ b/src/app/models/__tests__/user.server.model.spec.ts
@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import getUserModel from 'src/app/models/user.server.model'
 import { IAgencySchema, IUser, IUserSchema } from 'src/types'
 
-import dbHandler from '../helpers/jest-db'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 const User = getUserModel(mongoose)
 
diff --git a/src/app/models/field/imageField.ts b/src/app/models/field/imageField.ts
index f03a6fab3b..c2084fb7a5 100644
--- a/src/app/models/field/imageField.ts
+++ b/src/app/models/field/imageField.ts
@@ -1,8 +1,8 @@
 import { Schema } from 'mongoose'
 import validator from 'validator'
 
-import { isDev } from '../../../config/config'
 import { IImageFieldSchema } from '../../../types'
+import { isDev } from '../../config/config'
 
 const createImageFieldSchema = () => {
   return new Schema<IImageFieldSchema>({
diff --git a/src/app/modules/analytics/analytics.controller.ts b/src/app/modules/analytics/analytics.controller.ts
index f42aaf21da..3609266d51 100644
--- a/src/app/modules/analytics/analytics.controller.ts
+++ b/src/app/modules/analytics/analytics.controller.ts
@@ -6,7 +6,7 @@ import { StatusCodes } from 'http-status-codes'
 
 import { AnalyticStatsDto } from 'src/types/analytics'
 
-import { createLoggerWithLabel } from '../../../config/logger'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 
 import {
diff --git a/src/app/modules/analytics/analytics.service.ts b/src/app/modules/analytics/analytics.service.ts
index a36b35037b..9fa29d75a0 100644
--- a/src/app/modules/analytics/analytics.service.ts
+++ b/src/app/modules/analytics/analytics.service.ts
@@ -2,8 +2,8 @@ import * as TE from 'fp-ts/TaskEither'
 import mongoose from 'mongoose'
 
 import { getMongoErrorMessage } from '../../../app/utils/handle-mongo-error'
-import { submissionsTopUp } from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
+import { submissionsTopUp } from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 import getFormModel from '../../models/form.server.model'
 import getSubmissionModel from '../../models/submission.server.model'
 import getUserModel from '../../models/user.server.model'
diff --git a/src/app/modules/auth/auth.controller.ts b/src/app/modules/auth/auth.controller.ts
index 99839c600b..8eae149063 100644
--- a/src/app/modules/auth/auth.controller.ts
+++ b/src/app/modules/auth/auth.controller.ts
@@ -3,8 +3,8 @@ import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 import { isEmpty } from 'lodash'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { LINKS } from '../../../shared/constants'
+import { createLoggerWithLabel } from '../../config/logger'
 import MailService from '../../services/mail/mail.service'
 import { createReqMeta, getRequestIp } from '../../utils/request'
 import * as UserService from '../user/user.service'
diff --git a/src/app/modules/auth/auth.routes.ts b/src/app/modules/auth/auth.routes.ts
index 3ef281e026..bd1d343669 100644
--- a/src/app/modules/auth/auth.routes.ts
+++ b/src/app/modules/auth/auth.routes.ts
@@ -1,7 +1,7 @@
 import { celebrate, Joi, Segments } from 'celebrate'
 import { Router } from 'express'
 
-import { rateLimitConfig } from '../../../config/config'
+import { rateLimitConfig } from '../../config/config'
 import { limitRate } from '../../utils/limit-rate'
 
 import * as AuthController from './auth.controller'
diff --git a/src/app/modules/auth/auth.service.ts b/src/app/modules/auth/auth.service.ts
index c1d4946cd3..9bda20eb17 100644
--- a/src/app/modules/auth/auth.service.ts
+++ b/src/app/modules/auth/auth.service.ts
@@ -2,8 +2,6 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 import validator from 'validator'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { LINKS } from '../../../shared/constants'
 import {
   IAgencySchema,
@@ -11,6 +9,8 @@ import {
   ITokenSchema,
   IUserSchema,
 } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 import getAgencyModel from '../../models/agency.server.model'
 import getTokenModel from '../../models/token.server.model'
 import { compareHash, HashingError } from '../../utils/hash'
diff --git a/src/app/modules/auth/auth.utils.ts b/src/app/modules/auth/auth.utils.ts
index 9985679382..b6de7e1d51 100644
--- a/src/app/modules/auth/auth.utils.ts
+++ b/src/app/modules/auth/auth.utils.ts
@@ -1,7 +1,7 @@
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { MapRouteError } from '../../../types/routing'
+import { createLoggerWithLabel } from '../../config/logger'
 import * as MailErrors from '../../services/mail/mail.errors'
 import { HashingError } from '../../utils/hash'
 import * as CoreErrors from '../core/core.errors'
diff --git a/src/app/modules/billing/__tests__/billing.factory.spec.ts b/src/app/modules/billing/__tests__/billing.factory.spec.ts
index e9ad83aebf..247ace448c 100644
--- a/src/app/modules/billing/__tests__/billing.factory.spec.ts
+++ b/src/app/modules/billing/__tests__/billing.factory.spec.ts
@@ -5,7 +5,7 @@ import {
   FeatureNames,
   ISpcpMyInfo,
   RegisteredFeature,
-} from 'src/config/feature-manager'
+} from 'src/app/config/feature-manager'
 import {
   AuthType,
   ILoginSchema,
diff --git a/src/app/modules/billing/billing.controller.ts b/src/app/modules/billing/billing.controller.ts
index 77d9e6fb3b..2d2886501c 100644
--- a/src/app/modules/billing/billing.controller.ts
+++ b/src/app/modules/billing/billing.controller.ts
@@ -3,8 +3,8 @@ import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 import moment from 'moment-timezone'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { BillingInfoDto, BillingQueryDto, ErrorDto } from '../../../types/api'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 
 import { BillingFactory } from './billing.factory'
diff --git a/src/app/modules/billing/billing.factory.ts b/src/app/modules/billing/billing.factory.ts
index dd5b0cdd14..9414cf225e 100644
--- a/src/app/modules/billing/billing.factory.ts
+++ b/src/app/modules/billing/billing.factory.ts
@@ -1,10 +1,10 @@
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 
+import { ILoginSchema, IPopulatedForm } from '../../../types'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
-import { ILoginSchema, IPopulatedForm } from '../../../types'
+} from '../../config/feature-manager'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 
 import { FormHasNoAuthError } from './billing.errors'
diff --git a/src/app/modules/billing/billing.service.ts b/src/app/modules/billing/billing.service.ts
index 2d50279c7e..6045e9b3c6 100644
--- a/src/app/modules/billing/billing.service.ts
+++ b/src/app/modules/billing/billing.service.ts
@@ -7,13 +7,13 @@
 import mongoose from 'mongoose'
 import { errAsync, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   AuthType,
   ILoginSchema,
   IPopulatedForm,
   LoginStatistic,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import getLoginModel from '../../models/login.server.model'
 import { getMongoErrorMessage } from '../../utils/handle-mongo-error'
 import { DatabaseError } from '../core/core.errors'
diff --git a/src/app/modules/bounce/__tests__/bounce.service.spec.ts b/src/app/modules/bounce/__tests__/bounce.service.spec.ts
index 8e5e773660..b04642b9dc 100644
--- a/src/app/modules/bounce/__tests__/bounce.service.spec.ts
+++ b/src/app/modules/bounce/__tests__/bounce.service.spec.ts
@@ -8,12 +8,12 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
+import * as LoggerModule from 'src/app/config/logger'
 import getFormModel from 'src/app/models/form.server.model'
 import * as UserService from 'src/app/modules/user/user.service'
 import { EMAIL_HEADERS, EmailType } from 'src/app/services/mail/mail.constants'
 import MailService from 'src/app/services/mail/mail.service'
 import { SmsFactory } from 'src/app/services/sms/sms.factory'
-import * as LoggerModule from 'src/config/logger'
 import {
   BounceType,
   IPopulatedForm,
@@ -31,7 +31,7 @@ import { makeBounceNotification, MOCK_SNS_BODY } from './bounce-test-helpers'
 
 jest.mock('axios')
 const mockAxios = mocked(axios, true)
-jest.mock('src/config/logger')
+jest.mock('src/app/config/logger')
 const MockLoggerModule = mocked(LoggerModule, true)
 jest.mock('src/app/services/mail/mail.service')
 const MockMailService = mocked(MailService, true)
diff --git a/src/app/modules/bounce/bounce.controller.ts b/src/app/modules/bounce/bounce.controller.ts
index 074be5ff54..5bffc1b6de 100644
--- a/src/app/modules/bounce/bounce.controller.ts
+++ b/src/app/modules/bounce/bounce.controller.ts
@@ -1,8 +1,8 @@
 import { RequestHandler } from 'express'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { ISnsNotification } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { EmailType } from '../../services/mail/mail.constants'
 import { DatabaseConflictError } from '../core/core.errors'
 import * as FormService from '../form/form.service'
diff --git a/src/app/modules/bounce/bounce.model.ts b/src/app/modules/bounce/bounce.model.ts
index de7d7f4d47..da20085f46 100644
--- a/src/app/modules/bounce/bounce.model.ts
+++ b/src/app/modules/bounce/bounce.model.ts
@@ -2,7 +2,6 @@ import { keyBy } from 'lodash'
 import { Model, Mongoose, Schema } from 'mongoose'
 import validator from 'validator'
 
-import { bounceLifeSpan } from '../../../config/config'
 import {
   BounceType,
   IBounceSchema,
@@ -10,6 +9,7 @@ import {
   ISingleBounce,
   UserContactView,
 } from '../../../types'
+import { bounceLifeSpan } from '../../config/config'
 import { FORM_SCHEMA_ID } from '../../models/form.server.model'
 
 import { hasEmailBeenDelivered, hasEmailBounced } from './bounce.util'
diff --git a/src/app/modules/bounce/bounce.service.ts b/src/app/modules/bounce/bounce.service.ts
index 78d9173bb6..fa31c17aba 100644
--- a/src/app/modules/bounce/bounce.service.ts
+++ b/src/app/modules/bounce/bounce.service.ts
@@ -10,10 +10,6 @@ import {
   ResultAsync,
 } from 'neverthrow'
 
-import {
-  createCloudWatchLogger,
-  createLoggerWithLabel,
-} from '../../../config/logger'
 import {
   BounceType,
   IBounceSchema,
@@ -21,6 +17,10 @@ import {
   IPopulatedForm,
   ISnsNotification,
 } from '../../../types'
+import {
+  createCloudWatchLogger,
+  createLoggerWithLabel,
+} from '../../config/logger'
 import { EMAIL_HEADERS, EmailType } from '../../services/mail/mail.constants'
 import MailService from '../../services/mail/mail.service'
 import { SmsFactory } from '../../services/sms/sms.factory'
diff --git a/src/app/modules/core/core.errors.ts b/src/app/modules/core/core.errors.ts
index 95282fd36e..9bf9e2ae45 100644
--- a/src/app/modules/core/core.errors.ts
+++ b/src/app/modules/core/core.errors.ts
@@ -1,4 +1,4 @@
-import { FeatureNames } from 'src/config/feature-manager'
+import { FeatureNames } from '../../config/feature-manager'
 
 /**
  * A custom base error class that encapsulates the name, message, status code,
diff --git a/src/app/modules/examples/__tests__/examples.factory.spec.ts b/src/app/modules/examples/__tests__/examples.factory.spec.ts
index f2e5c8d083..21089076a3 100644
--- a/src/app/modules/examples/__tests__/examples.factory.spec.ts
+++ b/src/app/modules/examples/__tests__/examples.factory.spec.ts
@@ -4,7 +4,7 @@ import {
   FeatureNames,
   IAggregateStats,
   RegisteredFeature,
-} from 'src/config/feature-manager'
+} from 'src/app/config/feature-manager'
 
 import { createExamplesFactory } from '../examples.factory'
 import * as ExamplesService from '../examples.service'
diff --git a/src/app/modules/examples/examples.controller.ts b/src/app/modules/examples/examples.controller.ts
index df080efa23..b1586aa833 100644
--- a/src/app/modules/examples/examples.controller.ts
+++ b/src/app/modules/examples/examples.controller.ts
@@ -2,13 +2,13 @@ import { RequestHandler } from 'express'
 import { ParamsDictionary, Query } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   ErrorDto,
   ExampleFormsQueryDto,
   ExampleFormsResult,
   ExampleSingleFormResult,
 } from '../../../types/api'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 
 import { ExamplesFactory } from './examples.factory'
diff --git a/src/app/modules/examples/examples.factory.ts b/src/app/modules/examples/examples.factory.ts
index 34677052ba..44ea0cfa3b 100644
--- a/src/app/modules/examples/examples.factory.ts
+++ b/src/app/modules/examples/examples.factory.ts
@@ -1,7 +1,7 @@
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 
 import * as ExamplesService from './examples.service'
 import { RetrievalType } from './examples.types'
diff --git a/src/app/modules/examples/examples.service.ts b/src/app/modules/examples/examples.service.ts
index 3ca8f7ba31..52fbc4c3a0 100644
--- a/src/app/modules/examples/examples.service.ts
+++ b/src/app/modules/examples/examples.service.ts
@@ -3,7 +3,7 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 import { Except, Merge } from 'type-fest'
 
-import { createLoggerWithLabel } from '../../../config/logger'
+import { createLoggerWithLabel } from '../../config/logger'
 import getFormModel from '../../models/form.server.model'
 import getFormStatisticsTotalModel from '../../models/form_statistics_total.server.model'
 import getSubmissionModel from '../../models/submission.server.model'
diff --git a/src/app/modules/examples/examples.utils.ts b/src/app/modules/examples/examples.utils.ts
index d6d02ee753..5024e043fb 100644
--- a/src/app/modules/examples/examples.utils.ts
+++ b/src/app/modules/examples/examples.utils.ts
@@ -1,8 +1,8 @@
 import { StatusCodes } from 'http-status-codes'
 import moment from 'moment-timezone'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { MapRouteError } from '../../../types/routing'
+import { createLoggerWithLabel } from '../../config/logger'
 import { DatabaseError } from '../core/core.errors'
 
 import { ResultsNotFoundError } from './examples.errors'
diff --git a/src/app/modules/feedback/feedback.service.ts b/src/app/modules/feedback/feedback.service.ts
index 8156a8624d..919dde1860 100644
--- a/src/app/modules/feedback/feedback.service.ts
+++ b/src/app/modules/feedback/feedback.service.ts
@@ -3,8 +3,8 @@ import moment from 'moment-timezone'
 import mongoose from 'mongoose'
 import { ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { IFormFeedbackSchema } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import getFormFeedbackModel from '../../models/form_feedback.server.model'
 import { getMongoErrorMessage } from '../../utils/handle-mongo-error'
 import { DatabaseError } from '../core/core.errors'
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index c23c34ab4b..e5760e47a4 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -7,6 +7,7 @@ import { errAsync, okAsync } from 'neverthrow'
 import SparkMD5 from 'spark-md5'
 import supertest, { Session } from 'supertest-session'
 
+import { aws } from 'src/app/config/config'
 import getFormModel, {
   getEmailFormModel,
   getEncryptedFormModel,
@@ -35,7 +36,6 @@ import {
 } from 'src/app/modules/submission/email-submission/__tests__/email-submission.test.constants'
 import { saveSubmissionMetadata } from 'src/app/modules/submission/email-submission/email-submission.service'
 import { SubmissionHash } from 'src/app/modules/submission/email-submission/email-submission.types'
-import { aws } from 'src/config/config'
 import { EditFieldActions, VALID_UPLOAD_FILE_TYPES } from 'src/shared/constants'
 import {
   BasicField,
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.service.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.service.spec.ts
index f24f930260..db632f7da3 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.service.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.service.spec.ts
@@ -5,6 +5,7 @@ import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
+import { aws } from 'src/app/config/config'
 import getFormModel, {
   getEmailFormModel,
   getEncryptedFormModel,
@@ -18,7 +19,6 @@ import {
 import { MissingUserError } from 'src/app/modules/user/user.errors'
 import * as UserService from 'src/app/modules/user/user.service'
 import { formatErrorRecoveryMessage } from 'src/app/utils/handle-mongo-error'
-import { aws } from 'src/config/config'
 import { EditFieldActions, VALID_UPLOAD_FILE_TYPES } from 'src/shared/constants'
 import {
   AuthType,
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 95516eb76b..5f1e409225 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -4,7 +4,6 @@ import { StatusCodes } from 'http-status-codes'
 import JSONStream from 'JSONStream'
 import { ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   AuthType,
   FieldResponse,
@@ -17,6 +16,7 @@ import {
   ErrorDto,
   SettingsUpdateDto,
 } from '../../../../types/api'
+import { createLoggerWithLabel } from '../../../config/logger'
 import MailService from '../../../services/mail/mail.service'
 import { checkIsEncryptedEncoding } from '../../../utils/encryption'
 import { createReqMeta } from '../../../utils/request'
diff --git a/src/app/modules/form/admin-form/admin-form.service.ts b/src/app/modules/form/admin-form/admin-form.service.ts
index cac0f76728..461bc64906 100644
--- a/src/app/modules/form/admin-form/admin-form.service.ts
+++ b/src/app/modules/form/admin-form/admin-form.service.ts
@@ -4,8 +4,6 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 import { Except, Merge } from 'type-fest'
 
-import { aws as AwsConfig } from '../../../../config/config'
-import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   MAX_UPLOAD_FILE_SIZE,
   VALID_UPLOAD_FILE_TYPES,
@@ -22,6 +20,8 @@ import {
   IUserSchema,
 } from '../../../../types'
 import { SettingsUpdateDto } from '../../../../types/api'
+import { aws as AwsConfig } from '../../../config/config'
+import { createLoggerWithLabel } from '../../../config/logger'
 import getFormModel from '../../../models/form.server.model'
 import { dotifyObject } from '../../../utils/dotify-object'
 import {
diff --git a/src/app/modules/form/admin-form/admin-form.utils.ts b/src/app/modules/form/admin-form/admin-form.utils.ts
index 957ccfd7f7..6f6009a3b4 100644
--- a/src/app/modules/form/admin-form/admin-form.utils.ts
+++ b/src/app/modules/form/admin-form/admin-form.utils.ts
@@ -1,7 +1,6 @@
 import { StatusCodes } from 'http-status-codes'
 import { err, ok, Result } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { EditFieldActions } from '../../../../shared/constants'
 import {
   IFieldSchema,
@@ -9,6 +8,7 @@ import {
   ResponseMode,
   Status,
 } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { reorder, replaceAt } from '../../../utils/immutable-array-fns'
 import {
   ApplicationError,
diff --git a/src/app/modules/form/form.service.ts b/src/app/modules/form/form.service.ts
index 5ff5e62333..dd668230a7 100644
--- a/src/app/modules/form/form.service.ts
+++ b/src/app/modules/form/form.service.ts
@@ -1,7 +1,6 @@
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   AuthType,
   IEmailFormModel,
@@ -11,6 +10,7 @@ import {
   ResponseMode,
   Status,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import getFormModel, {
   getEmailFormModel,
   getEncryptedFormModel,
diff --git a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
index e18cce6cdd..2d592f65e1 100644
--- a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
+++ b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
@@ -6,6 +6,7 @@ import { err, errAsync, ok, okAsync } from 'neverthrow'
 import querystring from 'querystring'
 import { mocked } from 'ts-jest/utils'
 
+import { FeatureNames } from 'src/app/config/feature-manager/types'
 import getFormFeedbackModel from 'src/app/models/form_feedback.server.model'
 import {
   DatabaseError,
@@ -20,7 +21,6 @@ import {
 } from 'src/app/modules/myinfo/myinfo.errors'
 import { MyInfoCookieState } from 'src/app/modules/myinfo/myinfo.types'
 import { JwtPayload } from 'src/app/modules/spcp/spcp.types'
-import { FeatureNames } from 'src/config/feature-manager/types'
 import {
   AuthType,
   IPopulatedForm,
diff --git a/src/app/modules/form/public-form/public-form.controller.ts b/src/app/modules/form/public-form/public-form.controller.ts
index 90034261da..52d0fab2f0 100644
--- a/src/app/modules/form/public-form/public-form.controller.ts
+++ b/src/app/modules/form/public-form/public-form.controller.ts
@@ -3,9 +3,9 @@ import { StatusCodes } from 'http-status-codes'
 import querystring from 'querystring'
 import { UnreachableCaseError } from 'ts-essentials'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { AuthType } from '../../../../types'
 import { ErrorDto } from '../../../../types/api'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { isMongoError } from '../../../utils/handle-mongo-error'
 import { createReqMeta, getRequestIp } from '../../../utils/request'
 import { getFormIfPublic } from '../../auth/auth.service'
diff --git a/src/app/modules/form/public-form/public-form.service.ts b/src/app/modules/form/public-form/public-form.service.ts
index 6d924cea1d..4548f2146a 100644
--- a/src/app/modules/form/public-form/public-form.service.ts
+++ b/src/app/modules/form/public-form/public-form.service.ts
@@ -1,8 +1,8 @@
 import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { IFormFeedbackSchema } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import getFormModel from '../../../models/form.server.model'
 import getFormFeedbackModel from '../../../models/form_feedback.server.model'
 import { DatabaseError } from '../../core/core.errors'
diff --git a/src/app/modules/form/public-form/public-form.utils.ts b/src/app/modules/form/public-form/public-form.utils.ts
index f1d6326b9b..bf7b73f574 100644
--- a/src/app/modules/form/public-form/public-form.utils.ts
+++ b/src/app/modules/form/public-form/public-form.utils.ts
@@ -1,6 +1,6 @@
 import { getReasonPhrase, StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { ApplicationError, DatabaseError } from '../../core/core.errors'
 import { ErrorResponseData } from '../../core/core.types'
 import * as FormErrors from '../form.errors'
diff --git a/src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts b/src/app/modules/frontend/__tests__/frontend.controller.spec.ts
similarity index 97%
rename from src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts
rename to src/app/modules/frontend/__tests__/frontend.controller.spec.ts
index 05ce6016a2..3b853c0d23 100644
--- a/src/app/modules/frontend/__tests__/frontend.server.controller.spec.ts
+++ b/src/app/modules/frontend/__tests__/frontend.controller.spec.ts
@@ -2,7 +2,7 @@ import { StatusCodes } from 'http-status-codes'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
-import * as FrontendServerController from '../frontend.server.controller'
+import * as FrontendServerController from '../frontend.controller'
 
 describe('frontend.server.controller', () => {
   afterEach(() => jest.clearAllMocks())
diff --git a/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts b/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
index a868f00c09..a25e3d1ec1 100644
--- a/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
+++ b/src/app/modules/frontend/__tests__/google-analytics.factory.spec.ts
@@ -1,6 +1,6 @@
 import { StatusCodes } from 'http-status-codes'
 
-import { FeatureNames, RegisteredFeature } from 'src/config/feature-manager'
+import { FeatureNames, RegisteredFeature } from 'src/app/config/feature-manager'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
 
diff --git a/src/app/modules/frontend/frontend.server.controller.ts b/src/app/modules/frontend/frontend.controller.ts
similarity index 96%
rename from src/app/modules/frontend/frontend.server.controller.ts
rename to src/app/modules/frontend/frontend.controller.ts
index 32f54e6a02..0f5351210e 100644
--- a/src/app/modules/frontend/frontend.server.controller.ts
+++ b/src/app/modules/frontend/frontend.controller.ts
@@ -3,8 +3,8 @@ import { RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
-import featureManager from '../../../config/feature-manager'
-import { createLoggerWithLabel } from '../../../config/logger'
+import featureManager from '../../config/feature-manager'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 
 const logger = createLoggerWithLabel(module)
diff --git a/src/app/modules/frontend/frontend.server.routes.ts b/src/app/modules/frontend/frontend.routes.ts
similarity index 95%
rename from src/app/modules/frontend/frontend.server.routes.ts
rename to src/app/modules/frontend/frontend.routes.ts
index 0038ce44d0..4e823f2967 100644
--- a/src/app/modules/frontend/frontend.server.routes.ts
+++ b/src/app/modules/frontend/frontend.routes.ts
@@ -1,7 +1,7 @@
 import { celebrate, Joi, Segments } from 'celebrate'
 import { Router } from 'express'
 
-import * as FrontendServerController from './frontend.server.controller'
+import * as FrontendServerController from './frontend.controller'
 import { GoogleAnalyticsFactory } from './google-analytics.factory'
 
 export const FrontendRouter = Router()
diff --git a/src/app/modules/frontend/google-analytics.factory.ts b/src/app/modules/frontend/google-analytics.factory.ts
index 1273dec4e6..9132d32f92 100644
--- a/src/app/modules/frontend/google-analytics.factory.ts
+++ b/src/app/modules/frontend/google-analytics.factory.ts
@@ -5,9 +5,9 @@ import { StatusCodes } from 'http-status-codes'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 
-import * as FrontendServerController from './frontend.server.controller'
+import * as FrontendServerController from './frontend.controller'
 
 interface IGoogleAnalyticsFactory {
   addGoogleAnalyticsData: RequestHandler<
diff --git a/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts b/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
index 932d5200ca..0c87e6b5c9 100644
--- a/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo.factory.spec.ts
@@ -1,7 +1,7 @@
 import { mocked } from 'ts-jest/utils'
 
-import config from 'src/config/config'
-import { ISpcpMyInfo } from 'src/config/feature-manager'
+import config from 'src/app/config/config'
+import { ISpcpMyInfo } from 'src/app/config/feature-manager'
 import { Environment, IPopulatedForm } from 'src/types'
 
 import { MyInfoData } from '../myinfo.adapter'
@@ -15,7 +15,7 @@ jest.mock('../myinfo.service', () => ({
   MyInfoService: jest.fn(),
 }))
 const MockMyInfoService = mocked(MyInfoServiceModule, true)
-jest.mock('src/config/config')
+jest.mock('src/app/config/config')
 const MockConfig = mocked(config, true)
 MockConfig.nodeEnv = MOCK_NODE_ENV as Environment
 MockConfig.app = {
diff --git a/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts b/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
index 033b77af50..2056029180 100644
--- a/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo.test.constants.ts
@@ -7,7 +7,7 @@ import {
 import { ObjectId } from 'bson'
 import { merge, omit, zipWith } from 'lodash'
 
-import { ISpcpMyInfo } from 'src/config/feature-manager'
+import { ISpcpMyInfo } from 'src/app/config/feature-manager'
 import { AuthType, Environment, IFormSchema, MyInfoAttribute } from 'src/types'
 
 import {
diff --git a/src/app/modules/myinfo/__tests__/myinfo_hash.model.spec.ts b/src/app/modules/myinfo/__tests__/myinfo_hash.model.spec.ts
index da1d754444..c09a9df56d 100644
--- a/src/app/modules/myinfo/__tests__/myinfo_hash.model.spec.ts
+++ b/src/app/modules/myinfo/__tests__/myinfo_hash.model.spec.ts
@@ -4,11 +4,11 @@ import { omit, pick } from 'lodash'
 import mongoose from 'mongoose'
 import { mocked } from 'ts-jest/utils'
 
-import config from 'src/config/config'
+import config from 'src/app/config/config'
 
 import dbHandler from '../../../../../tests/unit/backend/helpers/jest-db'
 
-jest.mock('src/config/config')
+jest.mock('src/app/config/config')
 const MockConfig = mocked(config, true)
 
 // eslint-disable-next-line import/first
diff --git a/src/app/modules/myinfo/myinfo.constants.ts b/src/app/modules/myinfo/myinfo.constants.ts
index 389062ef15..5b8b61e206 100644
--- a/src/app/modules/myinfo/myinfo.constants.ts
+++ b/src/app/modules/myinfo/myinfo.constants.ts
@@ -1,4 +1,4 @@
-import config from '../../../config/config'
+import config from '../../config/config'
 
 /**
  * Top-level router prefix to be used for MyInfo routes.
diff --git a/src/app/modules/myinfo/myinfo.controller.ts b/src/app/modules/myinfo/myinfo.controller.ts
index f19fd923a6..84ab16abfe 100644
--- a/src/app/modules/myinfo/myinfo.controller.ts
+++ b/src/app/modules/myinfo/myinfo.controller.ts
@@ -3,8 +3,8 @@ import { Request } from 'express'
 import { Query, RequestHandler } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { AuthType } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 import { BillingFactory } from '../billing/billing.factory'
 import * as FormService from '../form/form.service'
diff --git a/src/app/modules/myinfo/myinfo.factory.ts b/src/app/modules/myinfo/myinfo.factory.ts
index d7f51b04b6..479e4113e9 100644
--- a/src/app/modules/myinfo/myinfo.factory.ts
+++ b/src/app/modules/myinfo/myinfo.factory.ts
@@ -1,17 +1,17 @@
 import { LeanDocument } from 'mongoose'
 import { err, errAsync, Result, ResultAsync } from 'neverthrow'
 
-import config from '../../../config/config'
-import FeatureManager, {
-  FeatureNames,
-  RegisteredFeature,
-} from '../../../config/feature-manager'
 import {
   IFieldSchema,
   IHashes,
   IMyInfoHashSchema,
   IPopulatedForm,
 } from '../../../types'
+import config from '../../config/config'
+import FeatureManager, {
+  FeatureNames,
+  RegisteredFeature,
+} from '../../config/feature-manager'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { ProcessedFieldResponse } from '../submission/submission.types'
 
diff --git a/src/app/modules/myinfo/myinfo.format.ts b/src/app/modules/myinfo/myinfo.format.ts
index 126522ed47..899c5281a1 100644
--- a/src/app/modules/myinfo/myinfo.format.ts
+++ b/src/app/modules/myinfo/myinfo.format.ts
@@ -10,7 +10,7 @@ import {
   MyInfoVehicle,
 } from '@opengovsg/myinfo-gov-client'
 
-import { createLoggerWithLabel } from '../../../config/logger'
+import { createLoggerWithLabel } from '../../config/logger'
 
 const logger = createLoggerWithLabel(module)
 
diff --git a/src/app/modules/myinfo/myinfo.service.ts b/src/app/modules/myinfo/myinfo.service.ts
index 99e5062269..020aeb4543 100644
--- a/src/app/modules/myinfo/myinfo.service.ts
+++ b/src/app/modules/myinfo/myinfo.service.ts
@@ -10,7 +10,6 @@ import mongoose, { LeanDocument } from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 import CircuitBreaker from 'opossum'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   Environment,
   IFieldSchema,
@@ -19,6 +18,7 @@ import {
   IPopulatedForm,
   MyInfoAttribute,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { ProcessedFieldResponse } from '../submission/submission.types'
 
diff --git a/src/app/modules/myinfo/myinfo.types.ts b/src/app/modules/myinfo/myinfo.types.ts
index 2be487cad8..d472230e07 100644
--- a/src/app/modules/myinfo/myinfo.types.ts
+++ b/src/app/modules/myinfo/myinfo.types.ts
@@ -1,6 +1,5 @@
 import { LeanDocument } from 'mongoose'
 
-import { ISpcpMyInfo } from '../../../config/feature-manager'
 import {
   AuthType,
   Environment,
@@ -9,6 +8,7 @@ import {
   IMyInfo,
   MyInfoAttribute,
 } from '../../../types'
+import { ISpcpMyInfo } from '../../config/feature-manager'
 import { ProcessedFieldResponse } from '../submission/submission.types'
 
 export interface IMyInfoServiceConfig {
diff --git a/src/app/modules/myinfo/myinfo.util.ts b/src/app/modules/myinfo/myinfo.util.ts
index 4f5ef51a33..87629fa864 100644
--- a/src/app/modules/myinfo/myinfo.util.ts
+++ b/src/app/modules/myinfo/myinfo.util.ts
@@ -5,7 +5,6 @@ import mongoose from 'mongoose'
 import { err, ok, Result } from 'neverthrow'
 import { v4 as uuidv4, validate as validateUUID } from 'uuid'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { types as myInfoTypes } from '../../../shared/resources/myinfo'
 import {
   AuthType,
@@ -16,6 +15,7 @@ import {
   IPopulatedForm,
   MapRouteError,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { hasProp } from '../../utils/has-prop'
 import { DatabaseError, MissingFeatureError } from '../core/core.errors'
 import { FormNotFoundError } from '../form/form.errors'
diff --git a/src/app/modules/myinfo/myinfo_hash.model.ts b/src/app/modules/myinfo/myinfo_hash.model.ts
index 03f95905f9..bf4c168a8c 100644
--- a/src/app/modules/myinfo/myinfo_hash.model.ts
+++ b/src/app/modules/myinfo/myinfo_hash.model.ts
@@ -1,8 +1,8 @@
 import crypto from 'crypto'
 import { Mongoose, Schema } from 'mongoose'
 
-import { sessionSecret } from '../../../config/config'
 import { IHashes, IMyInfoHashModel, IMyInfoHashSchema } from '../../../types'
+import { sessionSecret } from '../../config/config'
 import { FORM_SCHEMA_ID } from '../../models/form.server.model'
 
 export const MYINFO_HASH_SCHEMA_ID = 'MyInfoHash'
diff --git a/src/app/modules/spcp/__tests__/spcp.controller.spec.ts b/src/app/modules/spcp/__tests__/spcp.controller.spec.ts
index aed79f1e3f..31c07bdc37 100644
--- a/src/app/modules/spcp/__tests__/spcp.controller.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.controller.spec.ts
@@ -1,9 +1,9 @@
 import { err, errAsync, ok, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
+import config from 'src/app/config/config'
 import * as FormService from 'src/app/modules/form/form.service'
 import { MOCK_COOKIE_AGE } from 'src/app/modules/myinfo/__tests__/myinfo.test.constants'
-import config from 'src/config/config'
 import { AuthType } from 'src/types'
 
 import expressHandler from 'tests/unit/backend/helpers/jest-express'
@@ -48,7 +48,7 @@ jest.mock('../../billing/billing.factory')
 const MockBillingFactory = mocked(BillingFactory, true)
 jest.mock('src/app/modules/form/form.service')
 const MockFormService = mocked(FormService, true)
-jest.mock('src/config/config')
+jest.mock('src/app/config/config')
 const MockConfig = mocked(config, true)
 MockConfig.isDev = false
 
diff --git a/src/app/modules/spcp/__tests__/spcp.factory.spec.ts b/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
index 7d8903e1dc..b7fb6db682 100644
--- a/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.factory.spec.ts
@@ -1,6 +1,6 @@
 import { mocked } from 'ts-jest/utils'
 
-import { FeatureNames, ISpcpMyInfo } from 'src/config/feature-manager'
+import { FeatureNames, ISpcpMyInfo } from 'src/app/config/feature-manager'
 import { AuthType } from 'src/types'
 
 import { MissingFeatureError } from '../../core/core.errors'
diff --git a/src/app/modules/spcp/__tests__/spcp.service.spec.ts b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
index dc20f58a5f..2d72705590 100644
--- a/src/app/modules/spcp/__tests__/spcp.service.spec.ts
+++ b/src/app/modules/spcp/__tests__/spcp.service.spec.ts
@@ -4,8 +4,8 @@ import fs from 'fs'
 import { omit } from 'lodash'
 import { mocked } from 'ts-jest/utils'
 
+import { ISpcpMyInfo } from 'src/app/config/feature-manager'
 import { MOCK_COOKIE_AGE } from 'src/app/modules/myinfo/__tests__/myinfo.test.constants'
-import { ISpcpMyInfo } from 'src/config/feature-manager'
 import { AuthType } from 'src/types'
 
 import dbHandler from 'tests/unit/backend/helpers/jest-db'
diff --git a/src/app/modules/spcp/__tests__/spcp.test.constants.ts b/src/app/modules/spcp/__tests__/spcp.test.constants.ts
index 2a036f4a12..10dbe981c8 100644
--- a/src/app/modules/spcp/__tests__/spcp.test.constants.ts
+++ b/src/app/modules/spcp/__tests__/spcp.test.constants.ts
@@ -3,7 +3,7 @@ import { ObjectId } from 'bson'
 import crypto from 'crypto'
 import _ from 'lodash'
 
-import { ISpcpMyInfo } from 'src/config/feature-manager'
+import { ISpcpMyInfo } from 'src/app/config/feature-manager'
 import { ILoginSchema, IPopulatedForm } from 'src/types'
 
 import { JwtName } from '../spcp.types'
diff --git a/src/app/modules/spcp/spcp.controller.ts b/src/app/modules/spcp/spcp.controller.ts
index 77f7c6c082..4e747b9f98 100644
--- a/src/app/modules/spcp/spcp.controller.ts
+++ b/src/app/modules/spcp/spcp.controller.ts
@@ -2,9 +2,9 @@ import { RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { AuthType } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta } from '../../utils/request'
 import { BillingFactory } from '../billing/billing.factory'
 import * as FormService from '../form/form.service'
diff --git a/src/app/modules/spcp/spcp.factory.ts b/src/app/modules/spcp/spcp.factory.ts
index 5df9aaf191..0b5efb3437 100644
--- a/src/app/modules/spcp/spcp.factory.ts
+++ b/src/app/modules/spcp/spcp.factory.ts
@@ -3,7 +3,7 @@ import { err, errAsync } from 'neverthrow'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../core/core.errors'
 
 import { SpcpService } from './spcp.service'
diff --git a/src/app/modules/spcp/spcp.service.ts b/src/app/modules/spcp/spcp.service.ts
index 81e353c2a0..468b544aac 100644
--- a/src/app/modules/spcp/spcp.service.ts
+++ b/src/app/modules/spcp/spcp.service.ts
@@ -4,9 +4,9 @@ import fs from 'fs'
 import { StatusCodes } from 'http-status-codes'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
-import { ISpcpMyInfo } from '../../../config/feature-manager'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { AuthType } from '../../../types'
+import { ISpcpMyInfo } from '../../config/feature-manager'
+import { createLoggerWithLabel } from '../../config/logger'
 import { ApplicationError } from '../core/core.errors'
 
 import {
diff --git a/src/app/modules/spcp/spcp.util.ts b/src/app/modules/spcp/spcp.util.ts
index 9c12577194..c802aded61 100644
--- a/src/app/modules/spcp/spcp.util.ts
+++ b/src/app/modules/spcp/spcp.util.ts
@@ -2,8 +2,8 @@ import SPCPAuthClient from '@opengovsg/spcp-auth-client'
 import crypto from 'crypto'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { BasicField, MapRouteError, SPCPFieldTitle } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { hasProp } from '../../utils/has-prop'
 import { MissingFeatureError } from '../core/core.errors'
 import { ProcessedSingleAnswerResponse } from '../submission/submission.types'
diff --git a/src/app/modules/submission/email-submission/email-submission.controller.ts b/src/app/modules/submission/email-submission/email-submission.controller.ts
index bc751f0c92..87af5cbe68 100644
--- a/src/app/modules/submission/email-submission/email-submission.controller.ts
+++ b/src/app/modules/submission/email-submission/email-submission.controller.ts
@@ -1,7 +1,7 @@
 import { Request, RequestHandler } from 'express'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { AuthType, FieldResponse } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import MailService from '../../../services/mail/mail.service'
 import { createReqMeta, getRequestIp } from '../../../utils/request'
diff --git a/src/app/modules/submission/email-submission/email-submission.middleware.ts b/src/app/modules/submission/email-submission/email-submission.middleware.ts
index 8c85e8acd6..89d5ec2acb 100644
--- a/src/app/modules/submission/email-submission/email-submission.middleware.ts
+++ b/src/app/modules/submission/email-submission/email-submission.middleware.ts
@@ -2,8 +2,8 @@ import { celebrate, Joi } from 'celebrate'
 import { RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { BasicField, FieldResponse } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { createReqMeta } from '../../../utils/request'
 
 import * as EmailSubmissionReceiver from './email-submission.receiver'
diff --git a/src/app/modules/submission/email-submission/email-submission.receiver.ts b/src/app/modules/submission/email-submission/email-submission.receiver.ts
index bc741651b3..47d2c2c7a7 100644
--- a/src/app/modules/submission/email-submission/email-submission.receiver.ts
+++ b/src/app/modules/submission/email-submission/email-submission.receiver.ts
@@ -2,8 +2,8 @@ import Busboy from 'busboy'
 import { IncomingHttpHeaders } from 'http'
 import { err, ok, Result, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { IAttachmentInfo } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { MB } from '../../../constants/filesize'
 
 import {
diff --git a/src/app/modules/submission/email-submission/email-submission.routes.ts b/src/app/modules/submission/email-submission/email-submission.routes.ts
index 8827e849a9..c3c833b77e 100644
--- a/src/app/modules/submission/email-submission/email-submission.routes.ts
+++ b/src/app/modules/submission/email-submission/email-submission.routes.ts
@@ -1,6 +1,6 @@
 import { Router } from 'express'
 
-import { rateLimitConfig } from '../../../../config/config'
+import { rateLimitConfig } from '../../../config/config'
 import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import { limitRate } from '../../../utils/limit-rate'
 
diff --git a/src/app/modules/submission/email-submission/email-submission.service.ts b/src/app/modules/submission/email-submission/email-submission.service.ts
index 90c3d30408..3cce3c4b53 100644
--- a/src/app/modules/submission/email-submission/email-submission.service.ts
+++ b/src/app/modules/submission/email-submission/email-submission.service.ts
@@ -2,7 +2,6 @@ import crypto from 'crypto'
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   BasicField,
   EmailAdminDataField,
@@ -14,6 +13,7 @@ import {
   ResponseMode,
   SubmissionType,
 } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { getEmailSubmissionModel } from '../../../models/submission.server.model'
 import { DatabaseError } from '../../core/core.errors'
 import { isEmailModeForm, transformEmails } from '../../form/form.utils'
diff --git a/src/app/modules/submission/email-submission/email-submission.util.ts b/src/app/modules/submission/email-submission/email-submission.util.ts
index c327a93fa6..710d183df4 100644
--- a/src/app/modules/submission/email-submission/email-submission.util.ts
+++ b/src/app/modules/submission/email-submission/email-submission.util.ts
@@ -1,7 +1,6 @@
 import { StatusCodes } from 'http-status-codes'
 import { compact, flattenDeep, sumBy } from 'lodash'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { FilePlatforms } from '../../../../shared/constants'
 import * as FileValidation from '../../../../shared/util/file-validation'
 import {
@@ -18,6 +17,7 @@ import {
   MapRouteError,
   SPCPFieldTitle,
 } from '../../../../types'
+import { createLoggerWithLabel } from '../../../config/logger'
 import {
   CaptchaConnectionError,
   MissingCaptchaError,
diff --git a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
index 65fb082ccf..e993724b43 100644
--- a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
+++ b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.service.spec.ts
@@ -4,6 +4,7 @@ import { clone } from 'lodash'
 import mongoose from 'mongoose'
 import { PassThrough, Transform } from 'stream'
 
+import { aws } from 'src/app/config/config'
 import { getEncryptSubmissionModel } from 'src/app/models/submission.server.model'
 import {
   DatabaseError,
@@ -11,7 +12,6 @@ import {
 } from 'src/app/modules/core/core.errors'
 import { CreatePresignedUrlError } from 'src/app/modules/form/admin-form/admin-form.errors'
 import { formatErrorRecoveryMessage } from 'src/app/utils/handle-mongo-error'
-import { aws } from 'src/config/config'
 import {
   IPopulatedEncryptedForm,
   SubmissionCursorData,
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 75fe9dc5e1..63d178911e 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -5,13 +5,13 @@ import JSONStream from 'JSONStream'
 import mongoose from 'mongoose'
 import { SetOptional } from 'type-fest'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   AuthType,
   EncryptedSubmissionDto,
   SubmissionMetadataList,
 } from '../../../../types'
 import { EncryptSubmissionDto, ErrorDto } from '../../../../types/api'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { getEncryptSubmissionModel } from '../../../models/submission.server.model'
 import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import { checkIsEncryptedEncoding } from '../../../utils/encryption'
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
index f9a6a80fbe..2d70d01df6 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.routes.ts
@@ -1,6 +1,6 @@
 import { Router } from 'express'
 
-import { rateLimitConfig } from '../../../../config/config'
+import { rateLimitConfig } from '../../../config/config'
 import { CaptchaFactory } from '../../../services/captcha/captcha.factory'
 import { limitRate } from '../../../utils/limit-rate'
 
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
index 1784312fa9..2ef8cc81f6 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.service.ts
@@ -5,8 +5,6 @@ import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 import { Transform } from 'stream'
 
-import { aws as AwsConfig } from '../../../../config/config'
-import { createLoggerWithLabel } from '../../../../config/logger'
 import {
   IEncryptedSubmissionSchema,
   IPopulatedEncryptedForm,
@@ -17,6 +15,8 @@ import {
   SubmissionMetadata,
   SubmissionMetadataList,
 } from '../../../../types'
+import { aws as AwsConfig } from '../../../config/config'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { getEncryptSubmissionModel } from '../../../models/submission.server.model'
 import { isMalformedDate } from '../../../utils/date'
 import { getMongoErrorMessage } from '../../../utils/handle-mongo-error'
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
index 4117ae9edd..c1f99b8203 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.utils.ts
@@ -1,9 +1,9 @@
 import { StatusCodes } from 'http-status-codes'
 import moment from 'moment-timezone'
 
-import { createLoggerWithLabel } from '../../../../config/logger'
 import { EncryptedSubmissionDto, SubmissionData } from '../../../../types'
 import { MapRouteError } from '../../../../types/routing'
+import { createLoggerWithLabel } from '../../../config/logger'
 import { MalformedVerifiedContentError } from '../../../modules/verified-content/verified-content.errors'
 import {
   CaptchaConnectionError,
diff --git a/src/app/modules/submission/submission.service.ts b/src/app/modules/submission/submission.service.ts
index 50619491c7..ac4447eb25 100644
--- a/src/app/modules/submission/submission.service.ts
+++ b/src/app/modules/submission/submission.service.ts
@@ -2,7 +2,6 @@ import _ from 'lodash'
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   getLogicUnitPreventingSubmit,
   getVisibleFieldIds,
@@ -17,6 +16,7 @@ import {
   ISubmissionSchema,
   ResponseMode,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import getSubmissionModel from '../../models/submission.server.model'
 import MailService from '../../services/mail/mail.service'
 import { createQueryWithDateParam, isMalformedDate } from '../../utils/date'
diff --git a/src/app/modules/user/user.controller.ts b/src/app/modules/user/user.controller.ts
index 2e32d23057..6789c5c390 100644
--- a/src/app/modules/user/user.controller.ts
+++ b/src/app/modules/user/user.controller.ts
@@ -2,8 +2,8 @@ import { RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { IPopulatedUser } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { SmsFactory } from '../../services/sms/sms.factory'
 import { getRequestIp } from '../../utils/request'
 import { getUserIdFromSession } from '../auth/auth.utils'
diff --git a/src/app/modules/user/user.service.ts b/src/app/modules/user/user.service.ts
index a65e1c80ee..1d4d6e0aa7 100644
--- a/src/app/modules/user/user.service.ts
+++ b/src/app/modules/user/user.service.ts
@@ -2,8 +2,6 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 import validator from 'validator'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   IAdminVerificationDoc,
   IAgencySchema,
@@ -12,6 +10,8 @@ import {
   UpsertOtpParams,
   UserContactView,
 } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 import getAdminVerificationModel from '../../models/admin_verification.server.model'
 import { AGENCY_SCHEMA_ID } from '../../models/agency.server.model'
 import getUserModel from '../../models/user.server.model'
diff --git a/src/app/modules/user/user.utils.ts b/src/app/modules/user/user.utils.ts
index d9026359e6..75f7d92c28 100644
--- a/src/app/modules/user/user.utils.ts
+++ b/src/app/modules/user/user.utils.ts
@@ -1,7 +1,7 @@
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { UserContactView } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import * as SmsErrors from '../../services/sms/sms.errors'
 import { HashingError } from '../../utils/hash'
 import * as CoreErrors from '../core/core.errors'
diff --git a/src/app/modules/verification/__tests__/verification.factory.spec.ts b/src/app/modules/verification/__tests__/verification.factory.spec.ts
index 0065a23922..40b39c6fb6 100644
--- a/src/app/modules/verification/__tests__/verification.factory.spec.ts
+++ b/src/app/modules/verification/__tests__/verification.factory.spec.ts
@@ -1,7 +1,7 @@
 import { mocked } from 'ts-jest/utils'
 
+import { FeatureNames } from 'src/app/config/feature-manager'
 import { MissingFeatureError } from 'src/app/modules/core/core.errors'
-import { FeatureNames } from 'src/config/feature-manager'
 
 import { createVerificationFactory } from '../verification.factory'
 import * as VerificationService from '../verification.service'
diff --git a/src/app/modules/verification/__tests__/verification.service.spec.ts b/src/app/modules/verification/__tests__/verification.service.spec.ts
index 5a7b7f1d28..12558383ea 100644
--- a/src/app/modules/verification/__tests__/verification.service.spec.ts
+++ b/src/app/modules/verification/__tests__/verification.service.spec.ts
@@ -4,13 +4,13 @@ import mongoose from 'mongoose'
 import { errAsync, okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
+import formsgSdk from 'src/app/config/formsg-sdk'
 import * as FormService from 'src/app/modules/form/form.service'
 import { MailSendError } from 'src/app/services/mail/mail.errors'
 import MailService from 'src/app/services/mail/mail.service'
 import { SmsSendError } from 'src/app/services/sms/sms.errors'
 import { SmsFactory } from 'src/app/services/sms/sms.factory'
 import * as HashUtils from 'src/app/utils/hash'
-import formsgSdk from 'src/config/formsg-sdk'
 import {
   BasicField,
   IFormSchema,
@@ -47,7 +47,7 @@ import {
 const VerificationModel = getVerificationModel(mongoose)
 
 // Set up mocks
-jest.mock('src/config/formsg-sdk')
+jest.mock('src/app/config/formsg-sdk')
 const MockFormsgSdk = mocked(formsgSdk, true)
 jest.mock('src/app/services/sms/sms.factory')
 const MockSmsFactory = mocked(SmsFactory, true)
diff --git a/src/app/modules/verification/verification.controller.ts b/src/app/modules/verification/verification.controller.ts
index a829d760b7..b60b7abf6b 100644
--- a/src/app/modules/verification/verification.controller.ts
+++ b/src/app/modules/verification/verification.controller.ts
@@ -1,10 +1,10 @@
 import { RequestHandler } from 'express'
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { SALT_ROUNDS } from '../../../shared/util/verification'
 import { PublicTransaction } from '../../../types'
 import { ErrorDto } from '../../../types/api'
+import { createLoggerWithLabel } from '../../config/logger'
 import { generateOtpWithHash } from '../../utils/otp'
 import { createReqMeta } from '../../utils/request'
 
diff --git a/src/app/modules/verification/verification.factory.ts b/src/app/modules/verification/verification.factory.ts
index 65c9047827..f1cfa91e33 100644
--- a/src/app/modules/verification/verification.factory.ts
+++ b/src/app/modules/verification/verification.factory.ts
@@ -3,7 +3,7 @@ import { errAsync } from 'neverthrow'
 import featureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../core/core.errors'
 
 import * as VerificationService from './verification.service'
diff --git a/src/app/modules/verification/verification.service.ts b/src/app/modules/verification/verification.service.ts
index f128c7804b..d1f48041d8 100644
--- a/src/app/modules/verification/verification.service.ts
+++ b/src/app/modules/verification/verification.service.ts
@@ -1,8 +1,6 @@
 import mongoose from 'mongoose'
 import { err, errAsync, ok, okAsync, Result, ResultAsync } from 'neverthrow'
 
-import formsgSdk from '../../../config/formsg-sdk'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { NUM_OTP_RETRIES } from '../../../shared/util/verification'
 import {
   BasicField,
@@ -10,6 +8,8 @@ import {
   IVerificationSchema,
   PublicTransaction,
 } from '../../../types'
+import formsgSdk from '../../config/formsg-sdk'
+import { createLoggerWithLabel } from '../../config/logger'
 import { MailSendError } from '../../services/mail/mail.errors'
 import MailService from '../../services/mail/mail.service'
 import { InvalidNumberError, SmsSendError } from '../../services/sms/sms.errors'
diff --git a/src/app/modules/verification/verification.util.ts b/src/app/modules/verification/verification.util.ts
index 43167dea9d..eac730fa75 100644
--- a/src/app/modules/verification/verification.util.ts
+++ b/src/app/modules/verification/verification.util.ts
@@ -1,6 +1,5 @@
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   HASH_EXPIRE_AFTER_SECONDS,
   VERIFIED_FIELDTYPES,
@@ -11,6 +10,7 @@ import {
   IVerificationSchema,
   MapRouteError,
 } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { MailSendError } from '../../services/mail/mail.errors'
 import { InvalidNumberError, SmsSendError } from '../../services/sms/sms.errors'
 import { HashingError } from '../../utils/hash'
diff --git a/src/app/modules/verified-content/__tests__/verified-content.factory.spec.ts b/src/app/modules/verified-content/__tests__/verified-content.factory.spec.ts
index 26c983afb2..188bd48b2a 100644
--- a/src/app/modules/verified-content/__tests__/verified-content.factory.spec.ts
+++ b/src/app/modules/verified-content/__tests__/verified-content.factory.spec.ts
@@ -1,7 +1,7 @@
 import { ok } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 
-import { FeatureNames, RegisteredFeature } from 'src/config/feature-manager'
+import { FeatureNames, RegisteredFeature } from 'src/app/config/feature-manager'
 
 import { MissingFeatureError } from '../../core/core.errors'
 import { createVerifiedContentFactory } from '../verified-content.factory'
diff --git a/src/app/modules/verified-content/__tests__/verified-content.service.spec.ts b/src/app/modules/verified-content/__tests__/verified-content.service.spec.ts
index 390ccf6bda..0ee60d6895 100644
--- a/src/app/modules/verified-content/__tests__/verified-content.service.spec.ts
+++ b/src/app/modules/verified-content/__tests__/verified-content.service.spec.ts
@@ -1,4 +1,4 @@
-import formsgSdk from 'src/config/formsg-sdk'
+import formsgSdk from 'src/app/config/formsg-sdk'
 import { AuthType } from 'src/types'
 
 import {
diff --git a/src/app/modules/verified-content/verified-content.factory.ts b/src/app/modules/verified-content/verified-content.factory.ts
index 63344ff3aa..cfc4efe651 100644
--- a/src/app/modules/verified-content/verified-content.factory.ts
+++ b/src/app/modules/verified-content/verified-content.factory.ts
@@ -3,7 +3,7 @@ import { err } from 'neverthrow'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../core/core.errors'
 
 import {
diff --git a/src/app/modules/verified-content/verified-content.service.ts b/src/app/modules/verified-content/verified-content.service.ts
index a137423133..e3afd21627 100644
--- a/src/app/modules/verified-content/verified-content.service.ts
+++ b/src/app/modules/verified-content/verified-content.service.ts
@@ -1,8 +1,8 @@
 import { err, ok, Result } from 'neverthrow'
 
-import formsgSdk from '../../../config/formsg-sdk'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { AuthType } from '../../../types'
+import formsgSdk from '../../config/formsg-sdk'
+import { createLoggerWithLabel } from '../../config/logger'
 
 import { EncryptVerifiedContentError } from './verified-content.errors'
 import {
diff --git a/src/app/modules/webhook/__tests__/webhook.service.spec.ts b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
index a1b74c5952..03be2ea88d 100644
--- a/src/app/modules/webhook/__tests__/webhook.service.spec.ts
+++ b/src/app/modules/webhook/__tests__/webhook.service.spec.ts
@@ -3,13 +3,13 @@ import { ObjectID } from 'bson'
 import mongoose from 'mongoose'
 import { mocked } from 'ts-jest/utils'
 
+import formsgSdk from 'src/app/config/formsg-sdk'
 import getFormModel from 'src/app/models/form.server.model'
 import { getEncryptSubmissionModel } from 'src/app/models/submission.server.model'
 import { WebhookValidationError } from 'src/app/modules/webhook/webhook.errors'
 import * as WebhookValidationModule from 'src/app/modules/webhook/webhook.validation'
 import { transformMongoError } from 'src/app/utils/handle-mongo-error'
 import * as HasPropModule from 'src/app/utils/has-prop'
-import formsgSdk from 'src/config/formsg-sdk'
 import {
   IEncryptedSubmissionSchema,
   IWebhookResponse,
diff --git a/src/app/modules/webhook/__tests__/webhook.validation.spec.ts b/src/app/modules/webhook/__tests__/webhook.validation.spec.ts
index eec2425228..bb237dfea8 100644
--- a/src/app/modules/webhook/__tests__/webhook.validation.spec.ts
+++ b/src/app/modules/webhook/__tests__/webhook.validation.spec.ts
@@ -1,9 +1,9 @@
 import { promises as dns } from 'dns'
 import { mocked } from 'ts-jest/utils'
 
+import config from 'src/app/config/config'
 import { WebhookValidationError } from 'src/app/modules/webhook/webhook.errors'
 import { validateWebhookUrl } from 'src/app/modules/webhook/webhook.validation'
-import config from 'src/config/config'
 
 jest.mock('dns', () => ({
   promises: {
@@ -13,7 +13,7 @@ jest.mock('dns', () => ({
 const MockDns = mocked(dns, true)
 
 const MOCK_APP_URL = 'https://example.com'
-jest.mock('src/config/config')
+jest.mock('src/app/config/config')
 const MockConfig = mocked(config, true)
 MockConfig.app.appUrl = MOCK_APP_URL
 
diff --git a/src/app/modules/webhook/webhook.factory.ts b/src/app/modules/webhook/webhook.factory.ts
index dc974b6011..9e2db715d3 100644
--- a/src/app/modules/webhook/webhook.factory.ts
+++ b/src/app/modules/webhook/webhook.factory.ts
@@ -3,7 +3,7 @@ import { errAsync } from 'neverthrow'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../core/core.errors'
 
 import * as WebhookService from './webhook.service'
diff --git a/src/app/modules/webhook/webhook.service.ts b/src/app/modules/webhook/webhook.service.ts
index 682501d96b..5632573728 100644
--- a/src/app/modules/webhook/webhook.service.ts
+++ b/src/app/modules/webhook/webhook.service.ts
@@ -3,13 +3,13 @@ import { get } from 'lodash'
 import mongoose from 'mongoose'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 
-import formsgSdk from '../../../config/formsg-sdk'
-import { createLoggerWithLabel } from '../../../config/logger'
 import {
   IEncryptedSubmissionSchema,
   ISubmissionSchema,
   IWebhookResponse,
 } from '../../../types'
+import formsgSdk from '../../config/formsg-sdk'
+import { createLoggerWithLabel } from '../../config/logger'
 import { getEncryptSubmissionModel } from '../../models/submission.server.model'
 import { transformMongoError } from '../../utils/handle-mongo-error'
 import { hasProp } from '../../utils/has-prop'
diff --git a/src/app/modules/webhook/webhook.validation.ts b/src/app/modules/webhook/webhook.validation.ts
index 5e355927d6..b899efe0c3 100644
--- a/src/app/modules/webhook/webhook.validation.ts
+++ b/src/app/modules/webhook/webhook.validation.ts
@@ -1,8 +1,8 @@
 import { promises as dns } from 'dns'
 import ip from 'ip'
 
-import config from '../../../config/config'
 import { isValidHttpsUrl } from '../../../shared/util/url-validation'
+import config from '../../config/config'
 
 import { WebhookValidationError } from './webhook.errors'
 
diff --git a/src/app/routes/api/v3/auth/auth.routes.ts b/src/app/routes/api/v3/auth/auth.routes.ts
index b931d9d6fb..bf144dc9fb 100644
--- a/src/app/routes/api/v3/auth/auth.routes.ts
+++ b/src/app/routes/api/v3/auth/auth.routes.ts
@@ -1,7 +1,7 @@
 import { celebrate, Joi, Segments } from 'celebrate'
 import { Router } from 'express'
 
-import { rateLimitConfig } from '../../../../../config/config'
+import { rateLimitConfig } from '../../../../config/config'
 import * as AuthController from '../../../../modules/auth/auth.controller'
 import { limitRate } from '../../../../utils/limit-rate'
 
diff --git a/src/app/services/captcha/captcha.factory.ts b/src/app/services/captcha/captcha.factory.ts
index 87d4c55caf..95d9f59f2c 100644
--- a/src/app/services/captcha/captcha.factory.ts
+++ b/src/app/services/captcha/captcha.factory.ts
@@ -5,7 +5,7 @@ import { okAsync, ResultAsync } from 'neverthrow'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../../modules/core/core.errors'
 
 import {
diff --git a/src/app/services/captcha/captcha.service.ts b/src/app/services/captcha/captcha.service.ts
index bea868387e..a29c4865d9 100644
--- a/src/app/services/captcha/captcha.service.ts
+++ b/src/app/services/captcha/captcha.service.ts
@@ -1,7 +1,7 @@
 import axios from 'axios'
 import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../../config/logger'
+import { createLoggerWithLabel } from '../../config/logger'
 
 import { GOOGLE_RECAPTCHA_URL } from './captcha.constants'
 import {
diff --git a/src/app/services/captcha/captcha.util.ts b/src/app/services/captcha/captcha.util.ts
index 3ec3bd64b6..9edb7f0add 100644
--- a/src/app/services/captcha/captcha.util.ts
+++ b/src/app/services/captcha/captcha.util.ts
@@ -1,7 +1,7 @@
 import { StatusCodes } from 'http-status-codes'
 
-import { createLoggerWithLabel } from '../../../config/logger'
 import { MapRouteError } from '../../../types'
+import { createLoggerWithLabel } from '../../config/logger'
 import { MissingFeatureError } from '../../modules/core/core.errors'
 
 import {
diff --git a/src/app/services/intranet/__tests__/intranet.factory.spec.ts b/src/app/services/intranet/__tests__/intranet.factory.spec.ts
index 74991e0b8f..83669d3d01 100644
--- a/src/app/services/intranet/__tests__/intranet.factory.spec.ts
+++ b/src/app/services/intranet/__tests__/intranet.factory.spec.ts
@@ -1,7 +1,7 @@
 import { mocked } from 'ts-jest/utils'
 
+import { FeatureNames } from 'src/app/config/feature-manager'
 import { MissingFeatureError } from 'src/app/modules/core/core.errors'
-import { FeatureNames } from 'src/config/feature-manager'
 
 import { createIntranetFactory } from '../intranet.factory'
 import { IntranetService } from '../intranet.service'
diff --git a/src/app/services/intranet/intranet.factory.ts b/src/app/services/intranet/intranet.factory.ts
index 32860b2eea..97c8cdd92b 100644
--- a/src/app/services/intranet/intranet.factory.ts
+++ b/src/app/services/intranet/intranet.factory.ts
@@ -3,7 +3,7 @@ import { err, ok, Result } from 'neverthrow'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../../modules/core/core.errors'
 
 import { IntranetService } from './intranet.service'
diff --git a/src/app/services/intranet/intranet.middleware.ts b/src/app/services/intranet/intranet.middleware.ts
index fd9ea74409..679ae3f2ec 100644
--- a/src/app/services/intranet/intranet.middleware.ts
+++ b/src/app/services/intranet/intranet.middleware.ts
@@ -1,6 +1,6 @@
 import { RequestHandler } from 'express-serve-static-core'
 
-import { createLoggerWithLabel } from '../../../config/logger'
+import { createLoggerWithLabel } from '../../config/logger'
 import { createReqMeta, getRequestIp } from '../../utils/request'
 
 import { IntranetFactory } from './intranet.factory'
diff --git a/src/app/services/intranet/intranet.service.ts b/src/app/services/intranet/intranet.service.ts
index 91d957231b..d38e5db6f2 100644
--- a/src/app/services/intranet/intranet.service.ts
+++ b/src/app/services/intranet/intranet.service.ts
@@ -1,7 +1,7 @@
 import fs from 'fs'
 
-import { IIntranet } from '../../../config/feature-manager'
-import { createLoggerWithLabel } from '../../../config/logger'
+import { IIntranet } from '../../config/feature-manager'
+import { createLoggerWithLabel } from '../../config/logger'
 
 const logger = createLoggerWithLabel(module)
 
diff --git a/src/app/services/mail/mail.service.ts b/src/app/services/mail/mail.service.ts
index 03bff3b4a6..5275dfd913 100644
--- a/src/app/services/mail/mail.service.ts
+++ b/src/app/services/mail/mail.service.ts
@@ -5,8 +5,6 @@ import Mail from 'nodemailer/lib/mailer'
 import promiseRetry from 'promise-retry'
 import validator from 'validator'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { HASH_EXPIRE_AFTER_SECONDS } from '../../../shared/util/verification'
 import {
   BounceType,
@@ -14,6 +12,8 @@ import {
   IEmailFormSchema,
   ISubmissionSchema,
 } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 
 import { EMAIL_HEADERS, EmailType } from './mail.constants'
 import { MailGenerationError, MailSendError } from './mail.errors'
diff --git a/src/app/services/mail/mail.utils.ts b/src/app/services/mail/mail.utils.ts
index b24caaa360..d6df270e53 100644
--- a/src/app/services/mail/mail.utils.ts
+++ b/src/app/services/mail/mail.utils.ts
@@ -5,9 +5,9 @@ import { ResultAsync } from 'neverthrow'
 import puppeteer from 'puppeteer-core'
 import validator from 'validator'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { BounceType } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 
 import { MailGenerationError, MailSendError } from './mail.errors'
 import {
diff --git a/src/app/services/sms/__tests__/sms.factory.spec.ts b/src/app/services/sms/__tests__/sms.factory.spec.ts
index 42b7ead403..ff9945ef15 100644
--- a/src/app/services/sms/__tests__/sms.factory.spec.ts
+++ b/src/app/services/sms/__tests__/sms.factory.spec.ts
@@ -3,12 +3,12 @@ import { okAsync } from 'neverthrow'
 import { mocked } from 'ts-jest/utils'
 import Twilio from 'twilio'
 
-import { MissingFeatureError } from 'src/app/modules/core/core.errors'
 import {
   FeatureNames,
   ISms,
   RegisteredFeature,
-} from 'src/config/feature-manager'
+} from 'src/app/config/feature-manager'
+import { MissingFeatureError } from 'src/app/modules/core/core.errors'
 
 import { createSmsFactory } from '../sms.factory'
 import * as SmsService from '../sms.service'
diff --git a/src/app/services/sms/sms.factory.ts b/src/app/services/sms/sms.factory.ts
index 6f2ee6c7c8..737f430ada 100644
--- a/src/app/services/sms/sms.factory.ts
+++ b/src/app/services/sms/sms.factory.ts
@@ -4,7 +4,7 @@ import Twilio from 'twilio'
 import FeatureManager, {
   FeatureNames,
   RegisteredFeature,
-} from '../../../config/feature-manager'
+} from '../../config/feature-manager'
 import { MissingFeatureError } from '../../modules/core/core.errors'
 
 import {
diff --git a/src/app/services/sms/sms.service.ts b/src/app/services/sms/sms.service.ts
index 0e9e03ce7b..95fd568f8b 100644
--- a/src/app/services/sms/sms.service.ts
+++ b/src/app/services/sms/sms.service.ts
@@ -4,10 +4,10 @@ import { errAsync, okAsync, ResultAsync } from 'neverthrow'
 import NodeCache from 'node-cache'
 import Twilio from 'twilio'
 
-import config from '../../../config/config'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { isPhoneNumber } from '../../../shared/util/phone-num-validation'
 import { AdminContactOtpData, FormOtpData } from '../../../types'
+import config from '../../config/config'
+import { createLoggerWithLabel } from '../../config/logger'
 import getFormModel from '../../models/form.server.model'
 import {
   DatabaseError,
diff --git a/tests/unit/backend/utils/date.spec.ts b/src/app/utils/__tests__/date.spec.ts
similarity index 100%
rename from tests/unit/backend/utils/date.spec.ts
rename to src/app/utils/__tests__/date.spec.ts
diff --git a/tests/unit/backend/utils/handle-mongo-error.spec.ts b/src/app/utils/__tests__/handle-mongo-error.spec.ts
similarity index 100%
rename from tests/unit/backend/utils/handle-mongo-error.spec.ts
rename to src/app/utils/__tests__/handle-mongo-error.spec.ts
diff --git a/tests/unit/backend/utils/stringify-safe.spec.ts b/src/app/utils/__tests__/stringify-safe.spec.ts
similarity index 100%
rename from tests/unit/backend/utils/stringify-safe.spec.ts
rename to src/app/utils/__tests__/stringify-safe.spec.ts
diff --git a/src/app/utils/field-validation/index.ts b/src/app/utils/field-validation/index.ts
index 2ae3bc4366..cd553dda5d 100644
--- a/src/app/utils/field-validation/index.ts
+++ b/src/app/utils/field-validation/index.ts
@@ -8,11 +8,11 @@ import {
   ProcessedSingleAnswerResponse,
   ProcessedTableResponse,
 } from '../../../app/modules/submission/submission.types'
-import { createLoggerWithLabel } from '../../../config/logger'
 import { FIELDS_TO_REJECT } from '../../../shared/resources/basic'
 import { IFieldSchema, ITableFieldSchema } from '../../../types/field'
 import { isTableField } from '../../../types/field/utils/guards'
 import { ResponseValidator } from '../../../types/field/utils/validation'
+import { createLoggerWithLabel } from '../../config/logger'
 import { ValidateFieldError } from '../../modules/submission/submission.errors'
 
 import {
diff --git a/tests/unit/backend/utils/field-validation/attachment-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/attachment-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/attachment-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/attachment-validation.spec.ts
index 70b75d0d43..554632f230 100644
--- a/tests/unit/backend/utils/field-validation/attachment-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/attachment-validation.spec.ts
@@ -7,7 +7,7 @@ import { AttachmentSize, BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewAttachmentResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Attachment validation', () => {
   const formId = new ObjectId().toHexString()
diff --git a/tests/unit/backend/utils/field-validation/checkbox-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/checkbox-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/checkbox-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/checkbox-validation.spec.ts
index d053427703..2977a26414 100644
--- a/tests/unit/backend/utils/field-validation/checkbox-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/checkbox-validation.spec.ts
@@ -7,7 +7,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewCheckboxResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Checkbox validation', () => {
   const formId = new ObjectId().toHexString()
diff --git a/tests/unit/backend/utils/field-validation/date-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/date-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/date-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/date-validation.spec.ts
index 55384322ed..8368f2cc89 100644
--- a/tests/unit/backend/utils/field-validation/date-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/date-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Date field validation', () => {
   beforeAll(() => {
diff --git a/tests/unit/backend/utils/field-validation/decimal-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/decimal-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/decimal-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/decimal-validation.spec.ts
index cf5359fc84..543e706c03 100644
--- a/tests/unit/backend/utils/field-validation/decimal-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/decimal-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Decimal Validation', () => {
   it('should allow decimal with valid maximum', () => {
diff --git a/tests/unit/backend/utils/field-validation/dropdown-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/dropdown-validation.spec.ts
similarity index 98%
rename from tests/unit/backend/utils/field-validation/dropdown-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/dropdown-validation.spec.ts
index 09b2191235..5c0ff431f1 100644
--- a/tests/unit/backend/utils/field-validation/dropdown-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/dropdown-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Dropdown validation', () => {
   it('should allow valid option', () => {
diff --git a/tests/unit/backend/utils/field-validation/email-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/email-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/email-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/email-validation.spec.ts
index 764b083ad0..1a29fb2a9d 100644
--- a/tests/unit/backend/utils/field-validation/email-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/email-validation.spec.ts
@@ -1,7 +1,7 @@
+import formsgSdk from 'src/app/config/formsg-sdk'
 import { ValidateFieldError } from 'src/app/modules/submission/submission.errors'
 import { ProcessedFieldResponse } from 'src/app/modules/submission/submission.types'
 import { validateField } from 'src/app/utils/field-validation'
-import formsgSdk from 'src/config/formsg-sdk'
 import { IFieldSchema } from 'src/types'
 import { BasicField } from 'src/types/field/fieldTypes'
 import { ISingleAnswerResponse } from 'src/types/response'
diff --git a/tests/unit/backend/utils/field-validation/home-num-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/home-num-validation.spec.ts
similarity index 98%
rename from tests/unit/backend/utils/field-validation/home-num-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/home-num-validation.spec.ts
index 5ba51d60e4..853b6ece21 100644
--- a/tests/unit/backend/utils/field-validation/home-num-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/home-num-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Home phone number validation tests', () => {
   it('should allow empty answer for required logic field that is not visible', () => {
diff --git a/tests/unit/backend/utils/field-validation/mobile-num-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/mobile-num-validation.spec.ts
similarity index 98%
rename from tests/unit/backend/utils/field-validation/mobile-num-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/mobile-num-validation.spec.ts
index e9d727ec74..ccb9fdd978 100644
--- a/tests/unit/backend/utils/field-validation/mobile-num-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/mobile-num-validation.spec.ts
@@ -1,13 +1,13 @@
+import formsgSdk from 'src/app/config/formsg-sdk'
 import { ValidateFieldError } from 'src/app/modules/submission/submission.errors'
 import { validateField } from 'src/app/utils/field-validation'
-import formsgSdk from 'src/config/formsg-sdk'
 import { IFieldSchema } from 'src/types'
 import { BasicField } from 'src/types/field/fieldTypes'
 
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 type VerificationMock = {
   authenticate: () => boolean
diff --git a/tests/unit/backend/utils/field-validation/nric-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/nric-validation.spec.ts
similarity index 98%
rename from tests/unit/backend/utils/field-validation/nric-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/nric-validation.spec.ts
index c762c12002..1a0de0c34c 100644
--- a/tests/unit/backend/utils/field-validation/nric-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/nric-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('NRIC field validation', () => {
   it('should allow valid NRIC with S prefix', () => {
diff --git a/tests/unit/backend/utils/field-validation/number-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/number-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/number-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/number-validation.spec.ts
index 50a0a12a87..5df3bd3bec 100644
--- a/tests/unit/backend/utils/field-validation/number-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/number-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField, NumberSelectedValidation } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Number field validation', () => {
   it('should allow number with valid maximum', () => {
diff --git a/tests/unit/backend/utils/field-validation/radio-button-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/radio-button-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/radio-button-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/radio-button-validation.spec.ts
index 96ee953ad7..4dab0be12c 100644
--- a/tests/unit/backend/utils/field-validation/radio-button-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/radio-button-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Radio button validation', () => {
   it('should allow valid option', () => {
diff --git a/tests/unit/backend/utils/field-validation/rating-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/rating-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/rating-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/rating-validation.spec.ts
index eee084e01c..53fee4103a 100644
--- a/tests/unit/backend/utils/field-validation/rating-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/rating-validation.spec.ts
@@ -6,7 +6,7 @@ import { RatingShape } from 'src/types/field/ratingField'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Rating field validation', () => {
   it('should allow answer within range', () => {
diff --git a/tests/unit/backend/utils/field-validation/table-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/table-validation.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/table-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/table-validation.spec.ts
index 2ee0ca27ad..576a20600b 100644
--- a/tests/unit/backend/utils/field-validation/table-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/table-validation.spec.ts
@@ -9,7 +9,7 @@ import {
   generateNewTableResponse,
   generateTableDropdownColumn,
   generateTableShortTextColumn,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Table validation', () => {
   const formId = new ObjectId().toHexString()
diff --git a/tests/unit/backend/utils/field-validation/text-validator.spec.ts b/src/app/utils/field-validation/validators/__tests__/text-validator.spec.ts
similarity index 99%
rename from tests/unit/backend/utils/field-validation/text-validator.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/text-validator.spec.ts
index 4690e27ec2..ab60ce4a27 100644
--- a/tests/unit/backend/utils/field-validation/text-validator.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/text-validator.spec.ts
@@ -5,7 +5,7 @@ import { BasicField, TextSelectedValidation } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Text validation', () => {
   describe('Short text', () => {
diff --git a/tests/unit/backend/utils/field-validation/yesno-validation.spec.ts b/src/app/utils/field-validation/validators/__tests__/yesno-validation.spec.ts
similarity index 98%
rename from tests/unit/backend/utils/field-validation/yesno-validation.spec.ts
rename to src/app/utils/field-validation/validators/__tests__/yesno-validation.spec.ts
index 5fec5bbf59..358dbfd4de 100644
--- a/tests/unit/backend/utils/field-validation/yesno-validation.spec.ts
+++ b/src/app/utils/field-validation/validators/__tests__/yesno-validation.spec.ts
@@ -5,7 +5,7 @@ import { BasicField } from 'src/types'
 import {
   generateDefaultField,
   generateNewSingleAnswerResponse,
-} from '../../helpers/generate-form-data'
+} from 'tests/unit/backend/helpers/generate-form-data'
 
 describe('Yes/No field validation', () => {
   it('should allow yes', () => {
diff --git a/src/app/utils/field-validation/validators/common.ts b/src/app/utils/field-validation/validators/common.ts
index 14778c1c18..9b130b512f 100644
--- a/src/app/utils/field-validation/validators/common.ts
+++ b/src/app/utils/field-validation/validators/common.ts
@@ -4,7 +4,7 @@ import { ProcessedSingleAnswerResponse } from 'src/app/modules/submission/submis
 import { IEmailFieldSchema, IMobileFieldSchema } from 'src/types/field'
 import { ResponseValidator } from 'src/types/field/utils/validation'
 
-import formsgSdk from '../../../../config/formsg-sdk'
+import formsgSdk from '../../../config/formsg-sdk'
 
 /**
  * A function which returns a validator to check if single answer has a non-empty response
diff --git a/src/app/utils/hash.ts b/src/app/utils/hash.ts
index 7f1a7bfcd8..4e4e840375 100644
--- a/src/app/utils/hash.ts
+++ b/src/app/utils/hash.ts
@@ -1,7 +1,7 @@
 import bcrypt from 'bcrypt'
 import { ResultAsync } from 'neverthrow'
 
-import { createLoggerWithLabel } from '../../config/logger'
+import { createLoggerWithLabel } from '../config/logger'
 import { ApplicationError } from '../modules/core/core.errors'
 
 const logger = createLoggerWithLabel(module)
diff --git a/src/app/utils/limit-rate.ts b/src/app/utils/limit-rate.ts
index 9a97358882..c11ca9e95e 100644
--- a/src/app/utils/limit-rate.ts
+++ b/src/app/utils/limit-rate.ts
@@ -5,7 +5,7 @@ import RateLimit, {
 import { StatusCodes } from 'http-status-codes'
 import { merge } from 'lodash'
 
-import { createLoggerWithLabel } from '../../config/logger'
+import { createLoggerWithLabel } from '../config/logger'
 
 import { createReqMeta } from './request'
 
diff --git a/src/server.ts b/src/server.ts
index 9b3de0eabd..b72a87aa7b 100755
--- a/src/server.ts
+++ b/src/server.ts
@@ -1,6 +1,6 @@
-import config from './config/config'
-import { createLoggerWithLabel } from './config/logger'
-import loadApp from './loaders'
+import config from './app/config/config'
+import { createLoggerWithLabel } from './app/config/logger'
+import loadApp from './app/loaders'
 
 const logger = createLoggerWithLabel(module)
 
diff --git a/tests/unit/backend/utils/file-validation.spec.ts b/src/shared/util/__tests__/file-validation.spec.ts
similarity index 100%
rename from tests/unit/backend/utils/file-validation.spec.ts
rename to src/shared/util/__tests__/file-validation.spec.ts
diff --git a/tests/unit/backend/utils/logic.spec.ts b/src/shared/util/__tests__/logic.spec.ts
similarity index 100%
rename from tests/unit/backend/utils/logic.spec.ts
rename to src/shared/util/__tests__/logic.spec.ts
diff --git a/tests/integration/helpers/express-setup.ts b/tests/integration/helpers/express-setup.ts
index e51319da6a..943592354d 100644
--- a/tests/integration/helpers/express-setup.ts
+++ b/tests/integration/helpers/express-setup.ts
@@ -4,11 +4,11 @@ import express, { Express, Router } from 'express'
 import session from 'express-session'
 import nocache from 'nocache'
 
+import errorHandlerMiddlewares from 'src/app/loaders/express/error-handler'
+import helmetMiddlewares from 'src/app/loaders/express/helmet'
+import loggingMiddleware from 'src/app/loaders/express/logging'
+import parserMiddlewares from 'src/app/loaders/express/parser'
 import { AuthRouter } from 'src/app/modules/auth/auth.routes'
-import errorHandlerMiddlewares from 'src/loaders/express/error-handler'
-import helmetMiddlewares from 'src/loaders/express/helmet'
-import loggingMiddleware from 'src/loaders/express/logging'
-import parserMiddlewares from 'src/loaders/express/parser'
 
 // Special session middleware that only uses the memory store.
 const testSessionMiddlewares = () => {

From f36a7f47e744c958bd9822adf5f8cae69bf6cb8e Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Mon, 12 Apr 2021 11:33:17 +0800
Subject: [PATCH 52/75] refactor(misc-api): duplicate misc endpoints to new
 /api/v3 router (#1573)

* refactor(misc-api): duplicate misc endpoints to new /api/v3 router

- duplicate bounce notifications, analytics and billing endpoints functionality
and update them to use the new api v3 routes
- update v3 router to use new endpoints
- update frontend api calls to use new endpoints

* refactor(files): organise misc-api folders and routers

- rename billing to billings for clarity
- add notifications router between v3 and bounce for clarity
- update router responsibilities for clarity

* refactor(misc-api): update file and router names

* fix(billings-tests): update billings tests to match merged changes
---
 .../api/v3/analytics/analytics.routes.ts      |  13 +
 src/app/routes/api/v3/analytics/index.ts      |   1 +
 .../__tests__/billings.routes.spec.ts         | 274 ++++++++++++++++++
 .../routes/api/v3/billings/billings.routes.ts |  34 +++
 src/app/routes/api/v3/billings/index.ts       |   1 +
 .../notifications/bounces/bounces.routes.ts   |  16 +
 .../api/v3/notifications/bounces/index.ts     |   1 +
 src/app/routes/api/v3/notifications/index.ts  |   1 +
 .../v3/notifications/notifications.routes.ts  |   7 +
 src/app/routes/api/v3/v3.routes.ts            |   6 +
 .../users/config/users.client.routes.js       |   2 +-
 src/public/services/AnalyticsService.ts       |   2 +-
 src/public/services/BillingService.ts         |   2 +-
 13 files changed, 357 insertions(+), 3 deletions(-)
 create mode 100644 src/app/routes/api/v3/analytics/analytics.routes.ts
 create mode 100644 src/app/routes/api/v3/analytics/index.ts
 create mode 100644 src/app/routes/api/v3/billings/__tests__/billings.routes.spec.ts
 create mode 100644 src/app/routes/api/v3/billings/billings.routes.ts
 create mode 100644 src/app/routes/api/v3/billings/index.ts
 create mode 100644 src/app/routes/api/v3/notifications/bounces/bounces.routes.ts
 create mode 100644 src/app/routes/api/v3/notifications/bounces/index.ts
 create mode 100644 src/app/routes/api/v3/notifications/index.ts
 create mode 100644 src/app/routes/api/v3/notifications/notifications.routes.ts

diff --git a/src/app/routes/api/v3/analytics/analytics.routes.ts b/src/app/routes/api/v3/analytics/analytics.routes.ts
new file mode 100644
index 0000000000..cf924f0ee1
--- /dev/null
+++ b/src/app/routes/api/v3/analytics/analytics.routes.ts
@@ -0,0 +1,13 @@
+import { Router } from 'express'
+
+import * as AnalyticsController from '../../../../modules/analytics/analytics.controller'
+
+export const AnalyticsRouter = Router()
+
+/**
+ * Retrieves the total number of users, forms and submissions of forms across the application.
+ * @route GET /api/v3/analytics/statistics
+ * @group analytics - FormSG usage statistics
+ * @returns 200
+ */
+AnalyticsRouter.get('/statistics', AnalyticsController.handleGetStatistics)
diff --git a/src/app/routes/api/v3/analytics/index.ts b/src/app/routes/api/v3/analytics/index.ts
new file mode 100644
index 0000000000..304fab6a0f
--- /dev/null
+++ b/src/app/routes/api/v3/analytics/index.ts
@@ -0,0 +1 @@
+export { AnalyticsRouter } from './analytics.routes'
diff --git a/src/app/routes/api/v3/billings/__tests__/billings.routes.spec.ts b/src/app/routes/api/v3/billings/__tests__/billings.routes.spec.ts
new file mode 100644
index 0000000000..0fd696d66f
--- /dev/null
+++ b/src/app/routes/api/v3/billings/__tests__/billings.routes.spec.ts
@@ -0,0 +1,274 @@
+import { flatten, sortBy, times } from 'lodash'
+import mongoose from 'mongoose'
+import { errAsync } from 'neverthrow'
+import supertest, { Session } from 'supertest-session'
+
+import getFormModel from 'src/app/models/form.server.model'
+import getLoginModel from 'src/app/models/login.server.model'
+import { AuthType, IUserSchema, ResponseMode } from 'src/types'
+
+import { createAuthedSession } from 'tests/integration/helpers/express-auth'
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
+import { BillingFactory } from '../../../../../modules/billing/billing.factory'
+import { DatabaseError } from '../../../../../modules/core/core.errors'
+import { BillingsRouter } from '../billings.routes'
+
+const app = setupApp('/billings', BillingsRouter, {
+  setupWithAuth: true,
+})
+
+const FormModel = getFormModel(mongoose)
+const LoginModel = getLoginModel(mongoose)
+
+describe('billings.routes', () => {
+  let request: Session
+  let defaultUser: IUserSchema
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+    const { user } = await dbHandler.insertFormCollectionReqs()
+    defaultUser = user
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('GET /billings', () => {
+    const VALID_ESRVCID_1 = 'mockEsrvcId1'
+    const VALID_ESRVCID_2 = 'mockEsrvcId2'
+    const INVALID_ESRVCID = 'invalidEsrvcId'
+    const VALID_QUERY_YR = new Date().getFullYear()
+    const VALID_QUERY_MTH = new Date().getMonth()
+
+    it('should return 200 with array of results of form SPCP logins of the given esrvcId', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+      // Generate login statistics.
+      const {
+        generatedLoginTimes,
+        generatedForms,
+      } = await generateLoginStatistics({
+        user: defaultUser,
+        esrvcIdToCheck: VALID_ESRVCID_1,
+        altEsrvcId: VALID_ESRVCID_2,
+      })
+
+      // Act
+      const response = await session.get('/billings').query({
+        esrvcId: VALID_ESRVCID_1,
+        yr: VALID_QUERY_YR,
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      // Only first two forms returned, as those have logins with
+      // VALID_ESRVCID_1.
+      // Should not contain third form with VALID_ESRVCID_2.
+      const expectedStats = [
+        {
+          adminEmail: defaultUser.email,
+          formName: generatedForms[0].title,
+          total: generatedLoginTimes[0],
+          formId: String(generatedForms[0]._id),
+          authType: AuthType.SP,
+        },
+        {
+          adminEmail: defaultUser.email,
+          formName: generatedForms[1].title,
+          total: generatedLoginTimes[1],
+          formId: String(generatedForms[1]._id),
+          authType: AuthType.SP,
+        },
+      ]
+      expect(response.status).toEqual(200)
+      // Check shape.
+      expect(response.body).toEqual({
+        loginStats: expect.any(Array),
+      })
+      // Sort by total and compare.
+      expect(sortBy(response.body.loginStats, ['total'])).toEqual(
+        sortBy(expectedStats, ['total']),
+      )
+    })
+
+    it('should return 200 with empty array when no esrvcId matches logins', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.get('/billings').query({
+        esrvcId: INVALID_ESRVCID,
+        yr: VALID_QUERY_YR,
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({ loginStats: [] })
+    })
+
+    it('should return 400 when query.esrvcId is not provided', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.get('/billings').query({
+        // No esrvcId provided.
+        yr: VALID_QUERY_YR,
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ query: { key: 'esrvcId' } }),
+      )
+    })
+
+    it('should return 400 when query.yr is not provided', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.get('/billings').query({
+        esrvcId: VALID_ESRVCID_1,
+        // No yr provided.
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ query: { key: 'yr' } }),
+      )
+    })
+
+    it('should return 400 when query.mth is not provided', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Act
+      const response = await session.get('/billings').query({
+        esrvcId: VALID_ESRVCID_1,
+        yr: VALID_QUERY_YR,
+        // No mth provided.
+      })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({ query: { key: 'mth' } }),
+      )
+    })
+
+    it('should return 401 when user session does not exist', async () => {
+      // Act
+      // Call endpoint directly without first logging in.
+      const response = await request.get('/billings').query({
+        esrvcId: VALID_ESRVCID_1,
+        yr: VALID_QUERY_YR,
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 500 when error occurs whilst querying the database', async () => {
+      // Arrange
+      // Log in user.
+      const session = await createAuthedSession(defaultUser.email, request)
+
+      // Mock database error from service call.
+      const retrieveStatsSpy = jest
+        .spyOn(BillingFactory, 'getSpLoginStats')
+        .mockReturnValueOnce(errAsync(new DatabaseError()))
+
+      // Act
+      const response = await session.get('/billings').query({
+        esrvcId: VALID_ESRVCID_1,
+        yr: VALID_QUERY_YR,
+        mth: VALID_QUERY_MTH,
+      })
+
+      // Assert
+      expect(retrieveStatsSpy).toBeCalled()
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Error in retrieving billing records',
+      })
+    })
+  })
+})
+
+/**
+ * Helper method to generate login statistics for testing.
+ */
+const generateLoginStatistics = async ({
+  user,
+  esrvcIdToCheck,
+  altEsrvcId,
+}: {
+  user: IUserSchema
+  esrvcIdToCheck: string
+  altEsrvcId: string
+}) => {
+  // Generate login statistics.
+  // Create 3 random forms.
+  const formPromises = times(3, (idx) =>
+    FormModel.create({
+      title: `example form title ${idx}`,
+      admin: user._id,
+      responseMode: ResponseMode.Email,
+      emails: [user.email],
+    }),
+  )
+  const forms = await Promise.all(formPromises)
+
+  // Login to first two forms a set number of times with the same esrvcId.
+  const esrvc1LoginTimes = [4, 2]
+  const loginPromises = flatten(
+    forms.map((form, idx) =>
+      times(esrvc1LoginTimes[idx], () =>
+        LoginModel.create({
+          form: form._id,
+          admin: user._id,
+          agency: user.agency,
+          authType: AuthType.SP,
+          esrvcId: esrvcIdToCheck,
+        }),
+      ),
+    ),
+  )
+  // Login to third form with a different esrvcId.
+  loginPromises.push(
+    ...times(5, () =>
+      LoginModel.create({
+        form: forms[2]._id,
+        admin: user._id,
+        agency: user.agency,
+        authType: AuthType.SP,
+        esrvcId: altEsrvcId,
+      }),
+    ),
+  )
+
+  await Promise.all(loginPromises)
+
+  return {
+    generatedLoginTimes: esrvc1LoginTimes,
+    generatedForms: forms,
+  }
+}
diff --git a/src/app/routes/api/v3/billings/billings.routes.ts b/src/app/routes/api/v3/billings/billings.routes.ts
new file mode 100644
index 0000000000..91f3b2d5f2
--- /dev/null
+++ b/src/app/routes/api/v3/billings/billings.routes.ts
@@ -0,0 +1,34 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import { withUserAuthentication } from '../../../../modules/auth/auth.middlewares'
+import * as BillingController from '../../../../modules/billing/billing.controller'
+
+export const BillingsRouter = Router()
+
+// All routes in this router are protected.
+BillingsRouter.use(withUserAuthentication)
+
+/**
+ * Lists the SingPass/CorpPass (SPCP) logins made to forms
+ * created by the user's agency, serving as the basis for billing
+ * @security session
+ * @route GET /api/v3/billings
+ * @param query.esrvcId the esrvcId to retrieve SingPass login stats for
+ * @param query.yr the year to query
+ * @param query.mth the month of the given year to query
+ * @return 200 with an array of SPCP logins made to forms owned by the user's agency, ie, what the user's agency will be billed for
+ * @return 401 when request does not contain a user session
+ * @return 500 when error occurs whilst querying database
+ */
+BillingsRouter.get(
+  '/',
+  celebrate({
+    [Segments.QUERY]: Joi.object({
+      esrvcId: Joi.string().required(),
+      yr: Joi.number().integer().min(2019).required(),
+      mth: Joi.number().integer().min(0).max(11).required(),
+    }),
+  }),
+  BillingController.handleGetBillInfo,
+)
diff --git a/src/app/routes/api/v3/billings/index.ts b/src/app/routes/api/v3/billings/index.ts
new file mode 100644
index 0000000000..ed08f3e873
--- /dev/null
+++ b/src/app/routes/api/v3/billings/index.ts
@@ -0,0 +1 @@
+export { BillingsRouter } from './billings.routes'
diff --git a/src/app/routes/api/v3/notifications/bounces/bounces.routes.ts b/src/app/routes/api/v3/notifications/bounces/bounces.routes.ts
new file mode 100644
index 0000000000..065481c8a3
--- /dev/null
+++ b/src/app/routes/api/v3/notifications/bounces/bounces.routes.ts
@@ -0,0 +1,16 @@
+import { Router } from 'express'
+
+import { handleSns } from '../../../../../modules/bounce/bounce.controller'
+
+export const BouncesRouter = Router()
+
+/**
+ * When email bounces, SNS calls this function to mark the
+ * submission as having bounced.
+ *
+ * Note that if anything errors in between, just return a 200
+ * to SNS, as the error code to them doesn't really matter.
+ *
+ * @route POST /api/v3/notifications/bounce/email
+ */
+BouncesRouter.post('/email', handleSns)
diff --git a/src/app/routes/api/v3/notifications/bounces/index.ts b/src/app/routes/api/v3/notifications/bounces/index.ts
new file mode 100644
index 0000000000..41aca0bd31
--- /dev/null
+++ b/src/app/routes/api/v3/notifications/bounces/index.ts
@@ -0,0 +1 @@
+export { BouncesRouter } from './bounces.routes'
diff --git a/src/app/routes/api/v3/notifications/index.ts b/src/app/routes/api/v3/notifications/index.ts
new file mode 100644
index 0000000000..9f4e13233c
--- /dev/null
+++ b/src/app/routes/api/v3/notifications/index.ts
@@ -0,0 +1 @@
+export { NotificationsRouter } from './notifications.routes'
diff --git a/src/app/routes/api/v3/notifications/notifications.routes.ts b/src/app/routes/api/v3/notifications/notifications.routes.ts
new file mode 100644
index 0000000000..82c0104ef7
--- /dev/null
+++ b/src/app/routes/api/v3/notifications/notifications.routes.ts
@@ -0,0 +1,7 @@
+import { Router } from 'express'
+
+import { BouncesRouter } from './bounces'
+
+export const NotificationsRouter = Router()
+
+NotificationsRouter.use('/bounces', BouncesRouter)
diff --git a/src/app/routes/api/v3/v3.routes.ts b/src/app/routes/api/v3/v3.routes.ts
index 1349a2ed96..3c27d4270e 100644
--- a/src/app/routes/api/v3/v3.routes.ts
+++ b/src/app/routes/api/v3/v3.routes.ts
@@ -1,7 +1,10 @@
 import { Router } from 'express'
 
 import { AdminRouter } from './admin'
+import { AnalyticsRouter } from './analytics'
 import { AuthRouter } from './auth'
+import { BillingsRouter } from './billings'
+import { NotificationsRouter } from './notifications'
 import { UserRouter } from './user'
 
 export const V3Router = Router()
@@ -9,3 +12,6 @@ export const V3Router = Router()
 V3Router.use('/admin', AdminRouter)
 V3Router.use('/user', UserRouter)
 V3Router.use('/auth', AuthRouter)
+V3Router.use('/notifications', NotificationsRouter)
+V3Router.use('/billings', BillingsRouter)
+V3Router.use('/analytics', AnalyticsRouter)
diff --git a/src/public/modules/users/config/users.client.routes.js b/src/public/modules/users/config/users.client.routes.js
index a8ae515790..a83c148736 100755
--- a/src/public/modules/users/config/users.client.routes.js
+++ b/src/public/modules/users/config/users.client.routes.js
@@ -43,7 +43,7 @@ angular.module('users').config([
         controllerAs: 'vm',
       })
       .state('billing', {
-        url: '/billing',
+        url: '/api/v3/billings',
         templateUrl: 'modules/users/views/billing.client.view.html',
         controller: 'BillingController',
         controllerAs: 'vm',
diff --git a/src/public/services/AnalyticsService.ts b/src/public/services/AnalyticsService.ts
index 3579a57ab6..ffa25fdc5d 100644
--- a/src/public/services/AnalyticsService.ts
+++ b/src/public/services/AnalyticsService.ts
@@ -7,5 +7,5 @@ import { AnalyticStatsDto } from '../../types/analytics'
  */
 export const getLandingPageStatistics = async (): Promise<AnalyticStatsDto> =>
   axios
-    .get<AnalyticStatsDto>('/analytics/statistics')
+    .get<AnalyticStatsDto>('/api/v3/analytics/statistics')
     .then((response) => response.data)
diff --git a/src/public/services/BillingService.ts b/src/public/services/BillingService.ts
index 1a77743300..34093d7ad1 100644
--- a/src/public/services/BillingService.ts
+++ b/src/public/services/BillingService.ts
@@ -3,7 +3,7 @@ import axios from 'axios'
 import { BillingInfoDto, BillingQueryDto } from '../../types/api/billing'
 
 // Exported for testing
-export const BILLING_ENDPOINT = '/billing'
+export const BILLING_ENDPOINT = '/api/v3/billings'
 
 /**
  * Gets the billing information for the given month and year

From 6748bba647cdd35418689ced63e3ac4b66b7a6cb Mon Sep 17 00:00:00 2001
From: Frank Chen <frankchn@gmail.com>
Date: Sun, 11 Apr 2021 22:34:56 -0700
Subject: [PATCH 53/75] refactor: Minor cleanup to avoid using res.locals
 (#1621)

---
 .../encrypt-submission.controller.ts               | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 63d178911e..91b2bdd24d 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -166,6 +166,8 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
   delete (req.body as SetOptional<EncryptSubmissionDto, 'responses'>).responses
 
   // Checks if user is SPCP-authenticated before allowing submission
+  let uinFin
+  let userInfo
   const { authType } = form
   switch (authType) {
     case AuthType.MyInfo: {
@@ -200,7 +202,7 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
           spcpSubmissionFailure: true,
         })
       }
-      res.locals.uinFin = jwtPayloadResult.value.userName
+      uinFin = jwtPayloadResult.value.userName
       break
     }
     case AuthType.CP: {
@@ -222,8 +224,8 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
           spcpSubmissionFailure: true,
         })
       }
-      res.locals.uinFin = jwtPayloadResult.value.userName
-      res.locals.userInfo = jwtPayloadResult.value.userInfo
+      uinFin = jwtPayloadResult.value.userName
+      userInfo = jwtPayloadResult.value.userInfo
       break
     }
   }
@@ -241,9 +243,10 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
     })
   }
 
+  let verified
   if (form.authType === AuthType.SP || form.authType === AuthType.CP) {
     const encryptVerifiedContentResult = VerifiedContentFactory.getVerifiedContent(
-      { type: form.authType, data: res.locals },
+      { type: form.authType, data: { uinFin, userInfo } },
     ).andThen((verifiedContent) =>
       VerifiedContentFactory.encryptVerifiedContent({
         verifiedContent,
@@ -267,13 +270,12 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
       }
     } else {
       // No errors, set local variable to the encrypted string.
-      res.locals.verified = encryptVerifiedContentResult.value
+      verified = encryptVerifiedContentResult.value
     }
   }
 
   // Save Responses to Database
   const formData = req.body.encryptedContent
-  const { verified } = res.locals
   let attachmentMetadata = new Map<string, string>()
 
   if (req.body.attachments) {

From 6f6580ef965b8df0c3b20b5d98d5c7516c7357e2 Mon Sep 17 00:00:00 2001
From: seaerchin <44049504+seaerchin@users.noreply.github.com>
Date: Mon, 12 Apr 2021 13:40:46 +0800
Subject: [PATCH 54/75] Test: publicform integration tests (#1572)

* feat(helpers/jest-db): adds util methods to get/update form while testing

* test(public-form/routes): adds integration tests for public-form

* chore(helpers/jest-db): removed unused helper method

* fix(public-form/controller): fixed regression issues where certain fields were missed

* test(public-form): fixed tests so that privateFormError is checked correctly
---
 .../__tests__/public-form.controller.spec.ts  |   5 +-
 .../__tests__/public-form.routes.spec.ts      | 280 ++++++++++++++++++
 .../public-form/public-form.controller.ts     |  17 +-
 src/types/api/core.ts                         |   7 +-
 tests/unit/backend/helpers/jest-db.ts         |   8 +-
 5 files changed, 312 insertions(+), 5 deletions(-)
 create mode 100644 src/app/modules/form/public-form/__tests__/public-form.routes.spec.ts

diff --git a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
index 2d592f65e1..980fa978ed 100644
--- a/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
+++ b/src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts
@@ -952,10 +952,11 @@ describe('public-form.controller', () => {
         // Arrange
         // 1. Mock the response
         const mockRes = expressHandler.mockResponse()
+        const MOCK_FORM_TITLE = 'private form'
 
         // 2. Mock the call to retrieve the form
         MockAuthService.getFormIfPublic.mockReturnValueOnce(
-          errAsync(new PrivateFormError(MOCK_ERROR_STRING, 'private form')),
+          errAsync(new PrivateFormError(MOCK_ERROR_STRING, MOCK_FORM_TITLE)),
         )
 
         // Act
@@ -977,6 +978,8 @@ describe('public-form.controller', () => {
         expect(mockRes.status).toHaveBeenCalledWith(404)
         expect(mockRes.json).toHaveBeenCalledWith({
           message: MOCK_ERROR_STRING,
+          formTitle: MOCK_FORM_TITLE,
+          isPageFound: true,
         })
       })
     })
diff --git a/src/app/modules/form/public-form/__tests__/public-form.routes.spec.ts b/src/app/modules/form/public-form/__tests__/public-form.routes.spec.ts
new file mode 100644
index 0000000000..ddc33e7bc2
--- /dev/null
+++ b/src/app/modules/form/public-form/__tests__/public-form.routes.spec.ts
@@ -0,0 +1,280 @@
+import SPCPAuthClient from '@opengovsg/spcp-auth-client'
+import { ObjectId } from 'bson-ext'
+import { errAsync } from 'neverthrow'
+import supertest, { Session } from 'supertest-session'
+import { mocked } from 'ts-jest/utils'
+
+import { DatabaseError } from 'src/app/modules/core/core.errors'
+import { MYINFO_COOKIE_NAME } from 'src/app/modules/myinfo/myinfo.constants'
+import { MyInfoCookieState } from 'src/app/modules/myinfo/myinfo.types'
+import { AuthType, Status } from 'src/types'
+
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+
+import * as AuthService from '../../../auth/auth.service'
+import { PublicFormRouter } from '../public-form.routes'
+
+jest.mock('@opengovsg/myinfo-gov-client', () => ({
+  MyInfoGovClient: jest.fn().mockImplementation(() => ({
+    getPerson: jest.fn().mockReturnValue({ uinFin: 'S1234567A' }),
+    extractUinFin: jest.fn().mockReturnValue('S1234567A'),
+  })),
+  MyInfoMode: jest.requireActual('@opengovsg/myinfo-gov-client').MyInfoMode,
+  MyInfoSource: jest.requireActual('@opengovsg/myinfo-gov-client').MyInfoSource,
+  MyInfoAddressType: jest.requireActual('@opengovsg/myinfo-gov-client')
+    .MyInfoAddressType,
+  MyInfoAttribute: jest.requireActual('@opengovsg/myinfo-gov-client')
+    .MyInfoAttribute,
+}))
+
+jest.mock('@opengovsg/spcp-auth-client')
+const MockSpcpAuthClient = mocked(SPCPAuthClient, true)
+
+const app = setupApp('/', PublicFormRouter, {
+  setupWithAuth: false,
+})
+
+describe('public-form.routes', () => {
+  let request: Session
+  const mockSpClient = mocked(MockSpcpAuthClient.mock.instances[0], true)
+  const mockCpClient = mocked(MockSpcpAuthClient.mock.instances[1], true)
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('GET /:formId/publicform', () => {
+    const MOCK_COOKIE_PAYLOAD = {
+      userName: 'mock',
+      rememberMe: false,
+    }
+
+    it('should return 200 with public form when form has AuthType.NIL and valid formId', async () => {
+      // Arrange
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: { status: Status.Public },
+      })
+      // NOTE: This is needed to inject admin info into the form
+      const fullForm = await dbHandler.getFullFormById(form._id)
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          form: fullForm.getPublicView(),
+          isIntranetUser: false,
+        }),
+      )
+
+      // Act
+      const actualResponse = await request.get(`/${form._id}/publicform`)
+
+      // Assert
+      expect(actualResponse.status).toEqual(200)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+
+    it('should return 200 with public form when form has AuthType.SP and valid formId', async () => {
+      // Arrange
+      mockSpClient.verifyJWT.mockImplementationOnce((_jwt, cb) =>
+        cb(null, {
+          userName: MOCK_COOKIE_PAYLOAD.userName,
+        }),
+      )
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          esrvcId: 'mockEsrvcId',
+          authType: AuthType.SP,
+          hasCaptcha: false,
+          status: Status.Public,
+        },
+      })
+      const formId = form._id
+      // NOTE: This is needed to inject admin info into the form
+      const fullForm = await dbHandler.getFullFormById(formId)
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          form: fullForm?.getPublicView(),
+          spcpSession: { userName: MOCK_COOKIE_PAYLOAD.userName },
+          isIntranetUser: false,
+        }),
+      )
+
+      // Act
+      // Set cookie on request
+      const actualResponse = await request
+        .get(`/${formId}/publicform`)
+        .set('Cookie', ['jwtSp=mockJwt'])
+
+      // Assert
+      expect(actualResponse.status).toEqual(200)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+    it('should return 200 with public form when form has AuthType.CP and valid formId', async () => {
+      // Arrange
+      mockCpClient.verifyJWT.mockImplementationOnce((_jwt, cb) =>
+        cb(null, {
+          userName: MOCK_COOKIE_PAYLOAD.userName,
+          userInfo: 'MyCorpPassUEN',
+        }),
+      )
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          esrvcId: 'mockEsrvcId',
+          authType: AuthType.CP,
+          hasCaptcha: false,
+          status: Status.Public,
+        },
+      })
+      const formId = form._id
+      // NOTE: This is needed to inject admin info into the form
+      const fullForm = await dbHandler.getFullFormById(formId)
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          form: fullForm?.getPublicView(),
+          spcpSession: { userName: MOCK_COOKIE_PAYLOAD.userName },
+          isIntranetUser: false,
+        }),
+      )
+
+      // Act
+      // Set cookie on request
+      const actualResponse = await request
+        .get(`/${formId}/publicform`)
+        .set('Cookie', ['jwtCp=mockJwt'])
+
+      // Assert
+      expect(actualResponse.status).toEqual(200)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+    it('should return 200 with public form when form has AuthType.MyInfo and valid formId', async () => {
+      // Arrange
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: {
+          esrvcId: 'mockEsrvcId',
+          authType: AuthType.MyInfo,
+          hasCaptcha: false,
+          status: Status.Public,
+        },
+      })
+      // NOTE: This is needed to inject admin info into the form
+      const fullForm = await dbHandler.getFullFormById(form._id)
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          form: fullForm.getPublicView(),
+          spcpSession: { userName: 'S1234567A' },
+          isIntranetUser: false,
+        }),
+      )
+      const cookie = JSON.stringify({
+        accessToken: 'mockAccessToken',
+        usedCount: 0,
+        state: MyInfoCookieState.Success,
+      })
+
+      // Act
+      const actualResponse = await request
+        .get(`/${form._id}/publicform`)
+        .set('Cookie', [
+          // The j: indicates that the cookie is in JSON
+          `${MYINFO_COOKIE_NAME}=j:${encodeURIComponent(cookie)}`,
+        ])
+
+      // Assert
+      expect(actualResponse.status).toEqual(200)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+
+    it('should return 404 if the form does not exist', async () => {
+      // Arrange
+      const cookie = JSON.stringify({
+        accessToken: 'mockAccessToken',
+        usedCount: 0,
+        state: MyInfoCookieState.Success,
+      })
+      const MOCK_FORM_ID = new ObjectId().toHexString()
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          message: 'Form not found',
+        }),
+      )
+
+      // Act
+      const actualResponse = await request
+        .get(`/${MOCK_FORM_ID}/publicform`)
+        .set('Cookie', [
+          // The j: indicates that the cookie is in JSON
+          `${MYINFO_COOKIE_NAME}=j:${encodeURIComponent(cookie)}`,
+        ])
+
+      // Assert
+      expect(actualResponse.status).toEqual(404)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+
+    it('should return 404 if the form is private', async () => {
+      // Arrange
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: { status: Status.Private },
+      })
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          message: form.inactiveMessage,
+          formTitle: form.title,
+          isPageFound: true,
+        }),
+      )
+
+      // Act
+      const actualResponse = await request.get(`/${form._id}/publicform`)
+
+      // Assert
+      expect(actualResponse.status).toEqual(404)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+
+    it('should return 410 if the form has been archived', async () => {
+      // Arrange
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: { status: Status.Archived },
+      })
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({
+          message: 'Gone',
+        }),
+      )
+
+      // Act
+      const actualResponse = await request.get(`/${form._id}/publicform`)
+
+      // Assert
+      expect(actualResponse.status).toEqual(410)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+
+    it('should return 500 if a database error occurs', async () => {
+      // Arrange
+      const { form } = await dbHandler.insertEmailForm({
+        formOptions: { status: Status.Public },
+      })
+      const expectedError = new DatabaseError('all your base are belong to us')
+      const expectedResponseBody = JSON.parse(
+        JSON.stringify({ message: expectedError.message }),
+      )
+      jest
+        .spyOn(AuthService, 'getFormIfPublic')
+        .mockReturnValueOnce(errAsync(expectedError))
+
+      // Act
+      const actualResponse = await request.get(`/${form._id}/publicform`)
+
+      // Assert
+      expect(actualResponse.status).toEqual(500)
+      expect(actualResponse.body).toEqual(expectedResponseBody)
+    })
+  })
+})
diff --git a/src/app/modules/form/public-form/public-form.controller.ts b/src/app/modules/form/public-form/public-form.controller.ts
index 52d0fab2f0..97237031bb 100644
--- a/src/app/modules/form/public-form/public-form.controller.ts
+++ b/src/app/modules/form/public-form/public-form.controller.ts
@@ -4,7 +4,7 @@ import querystring from 'querystring'
 import { UnreachableCaseError } from 'ts-essentials'
 
 import { AuthType } from '../../../../types'
-import { ErrorDto } from '../../../../types/api'
+import { ErrorDto, PrivateFormErrorDto } from '../../../../types/api'
 import { createLoggerWithLabel } from '../../../config/logger'
 import { isMongoError } from '../../../utils/handle-mongo-error'
 import { createReqMeta, getRequestIp } from '../../../utils/request'
@@ -188,7 +188,7 @@ export const handleRedirect: RequestHandler<
  */
 export const handleGetPublicForm: RequestHandler<
   { formId: string },
-  PublicFormViewDto | ErrorDto
+  PublicFormViewDto | ErrorDto | PrivateFormErrorDto
 > = async (req, res) => {
   const { formId } = req.params
   const logMeta = {
@@ -214,6 +214,19 @@ export const handleGetPublicForm: RequestHandler<
       })
     }
     const { errorMessage, statusCode } = mapRouteError(error)
+
+    // Specialized error response for PrivateFormError.
+    // This is to maintain backwards compatibility with the middleware implementation
+    if (error instanceof PrivateFormError) {
+      return res.status(statusCode).json({
+        message: error.message,
+        // Flag to prevent default 404 subtext ("please check link") from
+        // showing.
+        isPageFound: true,
+        formTitle: error.formTitle,
+      })
+    }
+
     return res.status(statusCode).json({ message: errorMessage })
   }
 
diff --git a/src/types/api/core.ts b/src/types/api/core.ts
index e12011e17f..3aec7b4572 100644
--- a/src/types/api/core.ts
+++ b/src/types/api/core.ts
@@ -1,3 +1,8 @@
-export type ErrorDto = {
+export interface ErrorDto {
   message: string
 }
+
+export interface PrivateFormErrorDto extends ErrorDto {
+  isPageFound: true
+  formTitle: string
+}
diff --git a/tests/unit/backend/helpers/jest-db.ts b/tests/unit/backend/helpers/jest-db.ts
index 356c5aa3c9..751ca8d169 100644
--- a/tests/unit/backend/helpers/jest-db.ts
+++ b/tests/unit/backend/helpers/jest-db.ts
@@ -11,6 +11,7 @@ import {
   IAgencySchema,
   IEmailFormSchema,
   IEncryptedFormSchema,
+  IPopulatedForm,
   IUserSchema,
   ResponseMode,
 } from 'src/types'
@@ -153,7 +154,6 @@ const insertEmailForm = async ({
   })
 
   const EmailFormModel = getEmailFormModel(mongoose)
-
   const form = await EmailFormModel.create({
     title: 'example form title',
     admin: user._id,
@@ -214,6 +214,11 @@ const insertEncryptForm = async ({
   }
 }
 
+const getFullFormById = async (
+  formId: string,
+): Promise<IPopulatedForm | null> =>
+  await getEmailFormModel(mongoose).getFullFormById(formId)
+
 const dbHandler = {
   connect,
   closeDatabase,
@@ -224,6 +229,7 @@ const dbHandler = {
   clearCollection,
   insertEmailForm,
   insertEncryptForm,
+  getFullFormById,
 }
 
 export default dbHandler

From 38dd487a753f13319077b711f6733457cdfd7862 Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Mon, 12 Apr 2021 14:06:07 +0800
Subject: [PATCH 55/75] test: fix flaky form feedback test (#1620)

* test: fix flaky form feedback test

* ref: use compareAsc from date-fns
---
 .../__tests__/feedback.service.spec.ts        | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/src/app/modules/feedback/__tests__/feedback.service.spec.ts b/src/app/modules/feedback/__tests__/feedback.service.spec.ts
index 242d133c21..8c2e8620a8 100644
--- a/src/app/modules/feedback/__tests__/feedback.service.spec.ts
+++ b/src/app/modules/feedback/__tests__/feedback.service.spec.ts
@@ -1,4 +1,5 @@
 import { ObjectId } from 'bson-ext'
+import compareAsc from 'date-fns/compareAsc'
 import { times } from 'lodash'
 import moment from 'moment-timezone'
 import mongoose from 'mongoose'
@@ -125,15 +126,17 @@ describe('feedback.service', () => {
         rating: 1,
       })
       const expectedCreatedFbs = await Promise.all(expectedFbPromises)
-      const expectedFeedbackList = expectedCreatedFbs.map((fb, idx) => ({
-        index: idx + 1,
-        timestamp: moment(fb.created).valueOf(),
-        rating: fb.rating,
-        comment: fb.comment,
-        date: moment(fb.created).tz('Asia/Singapore').format('D MMM YYYY'),
-        dateShort: moment(fb.created).tz('Asia/Singapore').format('D MMM'),
-      }))
-
+      const expectedFeedbackList = expectedCreatedFbs
+        // Feedback is returned in date order
+        .sort((a, b) => compareAsc(a.created!, b.created!))
+        .map((fb, idx) => ({
+          index: idx + 1,
+          timestamp: moment(fb.created).valueOf(),
+          rating: fb.rating,
+          comment: fb.comment,
+          date: moment(fb.created).tz('Asia/Singapore').format('D MMM YYYY'),
+          dateShort: moment(fb.created).tz('Asia/Singapore').format('D MMM'),
+        }))
       // Act
       const actualResult = await FeedbackService.getFormFeedbacks(mockFormId)
 

From 765c642b19d4836dc87ea044980d1cc3b9481b16 Mon Sep 17 00:00:00 2001
From: seaerchin <44049504+seaerchin@users.noreply.github.com>
Date: Mon, 12 Apr 2021 14:34:43 +0800
Subject: [PATCH 56/75] refactor(admin-form/controller): changed if-else in
 admin-form controller into chains (#1622)

---
 .../form/admin-form/admin-form.controller.ts  | 102 +++++++++---------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 5f1e409225..03d4ccefab 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -7,6 +7,7 @@ import { ResultAsync } from 'neverthrow'
 import {
   AuthType,
   FieldResponse,
+  FormMetaView,
   FormSettings,
   IForm,
   IPopulatedForm,
@@ -68,7 +69,10 @@ const logger = createLoggerWithLabel(module)
  * @returns 422 when user of given id cannnot be found in the database
  * @returns 500 when database errors occur
  */
-export const handleListDashboardForms: RequestHandler = async (req, res) => {
+export const handleListDashboardForms: RequestHandler<
+  unknown,
+  FormMetaView[] | ErrorDto
+> = async (req, res) => {
   const authedUserId = (req.session as Express.AuthedSession).user._id
 
   return AdminFormService.getDashboardForms(authedUserId)
@@ -1042,7 +1046,8 @@ export const handleEncryptPreviewSubmission: RequestHandler<
     formId,
   }
 
-  const formResult = await UserService.getPopulatedUserById(sessionUserId)
+  // eslint-disable-next-line typesafe/no-await-without-trycatch
+  return UserService.getPopulatedUserById(sessionUserId)
     .andThen((user) =>
       // Step 2: Retrieve form with write permission check.
       AuthService.getFormAfterPermissionChecks({
@@ -1051,57 +1056,56 @@ export const handleEncryptPreviewSubmission: RequestHandler<
         level: PermissionLevel.Read,
       }),
     )
-    .andThen(EncryptSubmissionService.checkFormIsEncryptMode)
-  if (formResult.isErr()) {
-    logger.error({
-      message: 'Error while retrieving form for preview submission',
-      meta: logMeta,
-      error: formResult.error,
-    })
-    const { errorMessage, statusCode } = mapEncryptSubmissionError(
-      formResult.error,
+    .andThen((form) =>
+      EncryptSubmissionService.checkFormIsEncryptMode(form).mapErr((error) => {
+        logger.error({
+          message: 'Error while retrieving form for preview submission',
+          meta: logMeta,
+          error,
+        })
+        return error
+      }),
     )
-    return res.status(statusCode).json({ message: errorMessage })
-  }
-  const form = formResult.value
-
-  const parsedResponsesResult = checkIsEncryptedEncoding(
-    encryptedContent,
-  ).andThen(() => SubmissionService.getProcessedResponses(form, responses))
-  if (parsedResponsesResult.isErr()) {
-    logger.error({
-      message: 'Error while parsing responses for preview submission',
-      meta: logMeta,
-      error: parsedResponsesResult.error,
-    })
-    const { errorMessage, statusCode } = mapEncryptSubmissionError(
-      parsedResponsesResult.error,
+    .andThen((form) =>
+      checkIsEncryptedEncoding(encryptedContent)
+        .andThen(() => SubmissionService.getProcessedResponses(form, responses))
+        .map((parsedResponses) => ({ parsedResponses, form }))
+        .mapErr((error) => {
+          logger.error({
+            message: 'Error while parsing responses for preview submission',
+            meta: logMeta,
+            error,
+          })
+          return error
+        }),
     )
-    return res.status(statusCode).json({ message: errorMessage })
-  }
-  const parsedResponses = parsedResponsesResult.value
-
-  const submission = EncryptSubmissionService.createEncryptSubmissionWithoutSave(
-    {
-      form,
-      encryptedContent,
-      // Don't bother encrypting and signing mock variables for previews
-      verifiedContent: '',
-      version,
-    },
-  )
+    .map(({ parsedResponses, form }) => {
+      const submission = EncryptSubmissionService.createEncryptSubmissionWithoutSave(
+        {
+          form,
+          encryptedContent,
+          // Don't bother encrypting and signing mock variables for previews
+          verifiedContent: '',
+          version,
+        },
+      )
 
-  // Don't await on email confirmations
-  void SubmissionService.sendEmailConfirmations({
-    form,
-    parsedResponses,
-    submission,
-  })
+      void SubmissionService.sendEmailConfirmations({
+        form,
+        parsedResponses,
+        submission,
+      })
 
-  return res.json({
-    message: 'Form submission successful.',
-    submissionId: submission._id,
-  })
+      // Return the reply early to the submitter
+      return res.json({
+        message: 'Form submission successful.',
+        submissionId: submission._id,
+      })
+    })
+    .mapErr((error) => {
+      const { errorMessage, statusCode } = mapEncryptSubmissionError(error)
+      return res.status(statusCode).json({ message: errorMessage })
+    })
 }
 
 /**

From 150b6c68956d77944ed0a579aab520bd847a7634 Mon Sep 17 00:00:00 2001
From: Antariksh Mahajan <antarikshmahajan@gmail.com>
Date: Mon, 12 Apr 2021 16:17:58 +0800
Subject: [PATCH 57/75] chore: disable no-await-without-trycatch in backend
 (#1623)

---
 .eslintrc                                                        | 1 -
 .../encrypt-submission/encrypt-submission.controller.ts          | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.eslintrc b/.eslintrc
index 87b14ecf6e..06e385d6c3 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -68,7 +68,6 @@
       "files": ["*.ts", "*.js"],
       "excludedFiles": ["**/*.spec.ts", "**/.spec.js", "**/__tests__/**/*.ts"],
       "rules": {
-        "typesafe/no-await-without-trycatch": "warn",
         "@typescript-eslint/no-non-null-assertion": "error"
       }
     }
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 91b2bdd24d..9daeafb4c0 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -392,7 +392,6 @@ export const handleStreamEncryptedResponses: RequestHandler<
   const { startDate, endDate } = req.query
 
   // Step 1: Retrieve currently logged in user.
-  // eslint-disable-next-line typesafe/no-await-without-trycatch
   const cursorResult = await getPopulatedUserById(sessionUserId)
     .andThen((user) =>
       // Step 2: Check whether user has read permissions to form

From 806321f1025f317c98efe286661739efed5a8692 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 17:29:01 +0000
Subject: [PATCH 58/75] chore(deps-dev): bump typescript from 4.1.5 to 4.2.4
 (#1624)

Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.1.5 to 4.2.4.
- [Release notes](https://github.com/Microsoft/TypeScript/releases)
- [Commits](https://github.com/Microsoft/TypeScript/compare/v4.1.5...v4.2.4)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 42f3e523c2..6e70e04cad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24281,9 +24281,9 @@
       }
     },
     "typescript": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.1.5.tgz",
-      "integrity": "sha512-6OSu9PTIzmn9TCDiovULTnET6BgXtDYL4Gg4szY+cGsc3JP1dQL8qvE8kShTRx1NIw4Q9IBHlwODjkjWEtMUyA==",
+      "version": "4.2.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.2.4.tgz",
+      "integrity": "sha512-V+evlYHZnQkaz8TRBuxTA92yZBPotr5H+WhQ7bD3hZUndx5tGOa1fuCgeSjxAzM1RiN5IzvadIXTVefuuwZCRg==",
       "dev": true
     },
     "uglify-js": {
diff --git a/package.json b/package.json
index 43dea6acfc..9c48c78b26 100644
--- a/package.json
+++ b/package.json
@@ -246,7 +246,7 @@
     "ts-node": "^9.1.1",
     "ts-node-dev": "^1.1.6",
     "type-fest": "^0.20.2",
-    "typescript": "^4.1.5",
+    "typescript": "^4.2.4",
     "url-loader": "^1.1.2",
     "webpack": "^4.46.0",
     "webpack-cli": "^3.3.12",

From 62b8f906bddc064eb8d780d7dff54bae6429f572 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 17:39:24 +0000
Subject: [PATCH 59/75] chore(deps-dev): bump @typescript-eslint/eslint-plugin
 (#1625)

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 4.21.0 to 4.22.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.22.0/packages/eslint-plugin)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 56 +++++++++++++++++++++++------------------------
 package.json      |  2 +-
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6e70e04cad..fec13778c9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5346,13 +5346,13 @@
       }
     },
     "@typescript-eslint/eslint-plugin": {
-      "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.21.0.tgz",
-      "integrity": "sha512-FPUyCPKZbVGexmbCFI3EQHzCZdy2/5f+jv6k2EDljGdXSRc0cKvbndd2nHZkSLqCNOPk0jB6lGzwIkglXcYVsQ==",
+      "version": "4.22.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.22.0.tgz",
+      "integrity": "sha512-U8SP9VOs275iDXaL08Ln1Fa/wLXfj5aTr/1c0t0j6CdbOnxh+TruXu1p4I0NAvdPBQgoPjHsgKn28mOi0FzfoA==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/experimental-utils": "4.21.0",
-        "@typescript-eslint/scope-manager": "4.21.0",
+        "@typescript-eslint/experimental-utils": "4.22.0",
+        "@typescript-eslint/scope-manager": "4.22.0",
         "debug": "^4.1.1",
         "functional-red-black-tree": "^1.0.1",
         "lodash": "^4.17.15",
@@ -5362,43 +5362,43 @@
       },
       "dependencies": {
         "@typescript-eslint/experimental-utils": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.21.0.tgz",
-          "integrity": "sha512-cEbgosW/tUFvKmkg3cU7LBoZhvUs+ZPVM9alb25XvR0dal4qHL3SiUqHNrzoWSxaXA9gsifrYrS1xdDV6w/gIA==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.22.0.tgz",
+          "integrity": "sha512-xJXHHl6TuAxB5AWiVrGhvbGL8/hbiCQ8FiWwObO3r0fnvBdrbWEDy1hlvGQOAWc6qsCWuWMKdVWlLAEMpxnddg==",
           "dev": true,
           "requires": {
             "@types/json-schema": "^7.0.3",
-            "@typescript-eslint/scope-manager": "4.21.0",
-            "@typescript-eslint/types": "4.21.0",
-            "@typescript-eslint/typescript-estree": "4.21.0",
+            "@typescript-eslint/scope-manager": "4.22.0",
+            "@typescript-eslint/types": "4.22.0",
+            "@typescript-eslint/typescript-estree": "4.22.0",
             "eslint-scope": "^5.0.0",
             "eslint-utils": "^2.0.0"
           }
         },
         "@typescript-eslint/scope-manager": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.21.0.tgz",
-          "integrity": "sha512-kfOjF0w1Ix7+a5T1knOw00f7uAP9Gx44+OEsNQi0PvvTPLYeXJlsCJ4tYnDj5PQEYfpcgOH5yBlw7K+UEI9Agw==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.22.0.tgz",
+          "integrity": "sha512-OcCO7LTdk6ukawUM40wo61WdeoA7NM/zaoq1/2cs13M7GyiF+T4rxuA4xM+6LeHWjWbss7hkGXjFDRcKD4O04Q==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
-            "@typescript-eslint/visitor-keys": "4.21.0"
+            "@typescript-eslint/types": "4.22.0",
+            "@typescript-eslint/visitor-keys": "4.22.0"
           }
         },
         "@typescript-eslint/types": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.21.0.tgz",
-          "integrity": "sha512-+OQaupjGVVc8iXbt6M1oZMwyKQNehAfLYJJ3SdvnofK2qcjfor9pEM62rVjBknhowTkh+2HF+/KdRAc/wGBN2w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.22.0.tgz",
+          "integrity": "sha512-sW/BiXmmyMqDPO2kpOhSy2Py5w6KvRRsKZnV0c4+0nr4GIcedJwXAq+RHNK4lLVEZAJYFltnnk1tJSlbeS9lYA==",
           "dev": true
         },
         "@typescript-eslint/typescript-estree": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.21.0.tgz",
-          "integrity": "sha512-ZD3M7yLaVGVYLw4nkkoGKumb7Rog7QID9YOWobFDMQKNl+vPxqVIW/uDk+MDeGc+OHcoG2nJ2HphwiPNajKw3w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.22.0.tgz",
+          "integrity": "sha512-TkIFeu5JEeSs5ze/4NID+PIcVjgoU3cUQUIZnH3Sb1cEn1lBo7StSV5bwPuJQuoxKXlzAObjYTilOEKRuhR5yg==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
-            "@typescript-eslint/visitor-keys": "4.21.0",
+            "@typescript-eslint/types": "4.22.0",
+            "@typescript-eslint/visitor-keys": "4.22.0",
             "debug": "^4.1.1",
             "globby": "^11.0.1",
             "is-glob": "^4.0.1",
@@ -5407,12 +5407,12 @@
           }
         },
         "@typescript-eslint/visitor-keys": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.21.0.tgz",
-          "integrity": "sha512-dH22dROWGi5Z6p+Igc8bLVLmwy7vEe8r+8c+raPQU0LxgogPUrRAtRGtvBWmlr9waTu3n+QLt/qrS/hWzk1x5w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.22.0.tgz",
+          "integrity": "sha512-nnMu4F+s4o0sll6cBSsTeVsT4cwxB7zECK3dFxzEjPBii9xLpq4yqqsy/FU5zMfan6G60DKZSCXAa3sHJZrcYw==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/types": "4.22.0",
             "eslint-visitor-keys": "^2.0.0"
           }
         },
diff --git a/package.json b/package.json
index 9c48c78b26..48eb194e34 100644
--- a/package.json
+++ b/package.json
@@ -191,7 +191,7 @@
     "@types/uid-generator": "^2.0.2",
     "@types/uuid": "^8.3.0",
     "@types/validator": "^13.1.3",
-    "@typescript-eslint/eslint-plugin": "^4.21.0",
+    "@typescript-eslint/eslint-plugin": "^4.22.0",
     "@typescript-eslint/parser": "^4.21.0",
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",

From fde813cf4152fa2ecaf910b056d3fdc673b0fe75 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 18:09:53 +0000
Subject: [PATCH 60/75] chore(deps-dev): bump date-fns from 2.20.1 to 2.20.2
 (#1628)

Bumps [date-fns](https://github.com/date-fns/date-fns) from 2.20.1 to 2.20.2.
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md)
- [Commits](https://github.com/date-fns/date-fns/compare/v2.20.1...v2.20.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fec13778c9..e510bb0549 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9367,9 +9367,9 @@
       }
     },
     "date-fns": {
-      "version": "2.20.1",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.1.tgz",
-      "integrity": "sha512-8P5M8Kxbnovd0zfvOs7ipkiVJ3/zZQ0F/nrBW4x5E+I0uAZVZ80h6CKd24fSXQ5TLK5hXMtI4yb2O5rEZdUt2A==",
+      "version": "2.20.2",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.2.tgz",
+      "integrity": "sha512-QS0Z8SD/ALhKFvhtU4Fhz+1crsI7fPzBquXmdWay33KJPEU7btro2hnmmErpQRmt2D624B1lbjXQKDUMLnQTmQ==",
       "dev": true
     },
     "dateformat": {
diff --git a/package.json b/package.json
index 48eb194e34..2bfa567406 100644
--- a/package.json
+++ b/package.json
@@ -202,7 +202,7 @@
     "coveralls": "^3.1.0",
     "css-loader": "^2.1.1",
     "csv-parse": "^4.15.3",
-    "date-fns": "^2.20.1",
+    "date-fns": "^2.20.2",
     "env-cmd": "^10.1.0",
     "eslint": "^7.24.0",
     "eslint-config-prettier": "^8.1.0",

From e2e674a8c88d0a60f068c1977500b989f038bc14 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Apr 2021 18:35:10 +0000
Subject: [PATCH 61/75] chore(deps-dev): bump @typescript-eslint/parser from
 4.21.0 to 4.22.0 (#1627)

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 4.21.0 to 4.22.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v4.22.0/packages/parser)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 46 +++++++++++++++++++++++-----------------------
 package.json      |  2 +-
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e510bb0549..d7b8aa1dcb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5472,41 +5472,41 @@
       }
     },
     "@typescript-eslint/parser": {
-      "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.21.0.tgz",
-      "integrity": "sha512-eyNf7QmE5O/l1smaQgN0Lj2M/1jOuNg2NrBm1dqqQN0sVngTLyw8tdCbih96ixlhbF1oINoN8fDCyEH9SjLeIA==",
+      "version": "4.22.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.22.0.tgz",
+      "integrity": "sha512-z/bGdBJJZJN76nvAY9DkJANYgK3nlRstRRi74WHm3jjgf2I8AglrSY+6l7ogxOmn55YJ6oKZCLLy+6PW70z15Q==",
       "dev": true,
       "requires": {
-        "@typescript-eslint/scope-manager": "4.21.0",
-        "@typescript-eslint/types": "4.21.0",
-        "@typescript-eslint/typescript-estree": "4.21.0",
+        "@typescript-eslint/scope-manager": "4.22.0",
+        "@typescript-eslint/types": "4.22.0",
+        "@typescript-eslint/typescript-estree": "4.22.0",
         "debug": "^4.1.1"
       },
       "dependencies": {
         "@typescript-eslint/scope-manager": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.21.0.tgz",
-          "integrity": "sha512-kfOjF0w1Ix7+a5T1knOw00f7uAP9Gx44+OEsNQi0PvvTPLYeXJlsCJ4tYnDj5PQEYfpcgOH5yBlw7K+UEI9Agw==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.22.0.tgz",
+          "integrity": "sha512-OcCO7LTdk6ukawUM40wo61WdeoA7NM/zaoq1/2cs13M7GyiF+T4rxuA4xM+6LeHWjWbss7hkGXjFDRcKD4O04Q==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
-            "@typescript-eslint/visitor-keys": "4.21.0"
+            "@typescript-eslint/types": "4.22.0",
+            "@typescript-eslint/visitor-keys": "4.22.0"
           }
         },
         "@typescript-eslint/types": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.21.0.tgz",
-          "integrity": "sha512-+OQaupjGVVc8iXbt6M1oZMwyKQNehAfLYJJ3SdvnofK2qcjfor9pEM62rVjBknhowTkh+2HF+/KdRAc/wGBN2w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.22.0.tgz",
+          "integrity": "sha512-sW/BiXmmyMqDPO2kpOhSy2Py5w6KvRRsKZnV0c4+0nr4GIcedJwXAq+RHNK4lLVEZAJYFltnnk1tJSlbeS9lYA==",
           "dev": true
         },
         "@typescript-eslint/typescript-estree": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.21.0.tgz",
-          "integrity": "sha512-ZD3M7yLaVGVYLw4nkkoGKumb7Rog7QID9YOWobFDMQKNl+vPxqVIW/uDk+MDeGc+OHcoG2nJ2HphwiPNajKw3w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.22.0.tgz",
+          "integrity": "sha512-TkIFeu5JEeSs5ze/4NID+PIcVjgoU3cUQUIZnH3Sb1cEn1lBo7StSV5bwPuJQuoxKXlzAObjYTilOEKRuhR5yg==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
-            "@typescript-eslint/visitor-keys": "4.21.0",
+            "@typescript-eslint/types": "4.22.0",
+            "@typescript-eslint/visitor-keys": "4.22.0",
             "debug": "^4.1.1",
             "globby": "^11.0.1",
             "is-glob": "^4.0.1",
@@ -5515,12 +5515,12 @@
           }
         },
         "@typescript-eslint/visitor-keys": {
-          "version": "4.21.0",
-          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.21.0.tgz",
-          "integrity": "sha512-dH22dROWGi5Z6p+Igc8bLVLmwy7vEe8r+8c+raPQU0LxgogPUrRAtRGtvBWmlr9waTu3n+QLt/qrS/hWzk1x5w==",
+          "version": "4.22.0",
+          "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.22.0.tgz",
+          "integrity": "sha512-nnMu4F+s4o0sll6cBSsTeVsT4cwxB7zECK3dFxzEjPBii9xLpq4yqqsy/FU5zMfan6G60DKZSCXAa3sHJZrcYw==",
           "dev": true,
           "requires": {
-            "@typescript-eslint/types": "4.21.0",
+            "@typescript-eslint/types": "4.22.0",
             "eslint-visitor-keys": "^2.0.0"
           }
         },
diff --git a/package.json b/package.json
index 2bfa567406..c7281697f9 100644
--- a/package.json
+++ b/package.json
@@ -192,7 +192,7 @@
     "@types/uuid": "^8.3.0",
     "@types/validator": "^13.1.3",
     "@typescript-eslint/eslint-plugin": "^4.22.0",
-    "@typescript-eslint/parser": "^4.21.0",
+    "@typescript-eslint/parser": "^4.22.0",
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",
     "babel-loader": "^8.2.2",

From 37cb185d293cea2fe6636ee9b1a11c8349334075 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 13 Apr 2021 01:56:51 +0000
Subject: [PATCH 62/75] fix(deps): bump winston-cloudwatch from 2.5.1 to 2.5.2
 (#1626)

Bumps [winston-cloudwatch](https://github.com/lazywithclass/winston-cloudwatch) from 2.5.1 to 2.5.2.
- [Release notes](https://github.com/lazywithclass/winston-cloudwatch/releases)
- [Changelog](https://github.com/lazywithclass/winston-cloudwatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lazywithclass/winston-cloudwatch/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 296 +++++++++++++++++++++++++---------------------
 package.json      |   2 +-
 2 files changed, 163 insertions(+), 135 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d7b8aa1dcb..7abaf6e42a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6330,7 +6330,8 @@
     "ast-types": {
       "version": "0.9.6",
       "resolved": "https://registry.npmjs.org/ast-types/-/ast-types-0.9.6.tgz",
-      "integrity": "sha1-ECyenpAF0+fjgpvwxPok7oYu6bk="
+      "integrity": "sha1-ECyenpAF0+fjgpvwxPok7oYu6bk=",
+      "dev": true
     },
     "astral-regex": {
       "version": "2.0.0",
@@ -8087,7 +8088,8 @@
     "co": {
       "version": "4.6.0",
       "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
-      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ="
+      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
+      "dev": true
     },
     "coa": {
       "version": "2.0.2",
@@ -9351,9 +9353,9 @@
       }
     },
     "data-uri-to-buffer": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-1.2.0.tgz",
-      "integrity": "sha512-vKQ9DTQPN1FLYiiEEOQ6IBGFqvjCa5rSK3cWMy/Nespm5d/x3dGFT9UBZnkLxCwua/IXBi2TYnwTEpsOvhC4UQ=="
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-3.0.1.tgz",
+      "integrity": "sha512-WboRycPNsVw3B3TL559F7kuBUM4d8CgMEvk6xEJlOp7OBPjt6G7z8WMWlD2rOFZLk6OYfFIUGsCOWzcQH9K2og=="
     },
     "data-urls": {
       "version": "2.0.0",
@@ -9764,13 +9766,33 @@
       "dev": true
     },
     "degenerator": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-1.0.4.tgz",
-      "integrity": "sha1-/PSQo37OJmRk2cxDGrmMWBnO0JU=",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-2.2.0.tgz",
+      "integrity": "sha512-aiQcQowF01RxFI4ZLFMpzyotbQonhNpBao6dkI8JPk5a+hmSjR5ErHp2CQySmQe8os3VBqLCIh87nDBgZXvsmg==",
       "requires": {
-        "ast-types": "0.x.x",
-        "escodegen": "1.x.x",
-        "esprima": "3.x.x"
+        "ast-types": "^0.13.2",
+        "escodegen": "^1.8.1",
+        "esprima": "^4.0.0"
+      },
+      "dependencies": {
+        "ast-types": {
+          "version": "0.13.4",
+          "resolved": "https://registry.npmjs.org/ast-types/-/ast-types-0.13.4.tgz",
+          "integrity": "sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w==",
+          "requires": {
+            "tslib": "^2.0.1"
+          }
+        },
+        "esprima": {
+          "version": "4.0.1",
+          "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+          "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="
+        },
+        "tslib": {
+          "version": "2.2.0",
+          "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.2.0.tgz",
+          "integrity": "sha512-gS9GVHRU+RGn5KQM2rllAlR3dU6m7AcpJKdtH8gFvQiC4Otgk98XnmMU+nZenHt/+VhnBPWwgrJsyrdcw6i23w=="
+        }
       }
     },
     "del": {
@@ -10476,14 +10498,6 @@
       "resolved": "https://registry.npmjs.org/es6-promise/-/es6-promise-4.2.8.tgz",
       "integrity": "sha512-HJDGx5daxeIvxdBxvG2cb9g4tEvwIk3i8+nhX0yGrYmZUzbkdg8QbDevheDB8gd0//uPj4c1EQua8Q+MViT0/w=="
     },
-    "es6-promisify": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/es6-promisify/-/es6-promisify-5.0.0.tgz",
-      "integrity": "sha1-UQnWLz5W6pZ8S2NQWu8IKRyKUgM=",
-      "requires": {
-        "es6-promise": "^4.0.3"
-      }
-    },
     "es6-templates": {
       "version": "0.2.3",
       "resolved": "https://registry.npmjs.org/es6-templates/-/es6-templates-0.2.3.tgz",
@@ -12056,6 +12070,16 @@
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
       "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
     },
+    "fs-extra": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
+      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
+      "requires": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
+      }
+    },
     "fs-minipass": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
@@ -12207,30 +12231,30 @@
       }
     },
     "get-uri": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-2.0.4.tgz",
-      "integrity": "sha512-v7LT/s8kVjs+Tx0ykk1I+H/rbpzkHvuIq87LmeXptcf5sNWm9uQiwjNAt94SJPA1zOlCntmnOlJvVWKmzsxG8Q==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-3.0.2.tgz",
+      "integrity": "sha512-+5s0SJbGoyiJTZZ2JTpFPLMPSch72KEqGOTvQsBqg0RBWvwhWUSYZFAtz3TPW0GXJuLBJPts1E241iHg+VRfhg==",
       "requires": {
-        "data-uri-to-buffer": "1",
-        "debug": "2",
-        "extend": "~3.0.2",
-        "file-uri-to-path": "1",
-        "ftp": "~0.3.10",
-        "readable-stream": "2"
+        "@tootallnate/once": "1",
+        "data-uri-to-buffer": "3",
+        "debug": "4",
+        "file-uri-to-path": "2",
+        "fs-extra": "^8.1.0",
+        "ftp": "^0.3.10"
       },
       "dependencies": {
         "debug": {
-          "version": "2.6.9",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "version": "4.3.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
+          "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
           "requires": {
-            "ms": "2.0.0"
+            "ms": "2.1.2"
           }
         },
-        "ms": {
+        "file-uri-to-path": {
           "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-          "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
+          "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-2.0.0.tgz",
+          "integrity": "sha512-hjPFI8oE/2iQPVe4gbrJ73Pp+Xfub2+WI2LlXDbsaJBwT5wuMh35WNWVYYTpnz895shtwfyutMFLFywpQAFdLg=="
         }
       }
     },
@@ -12572,8 +12596,7 @@
     "graceful-fs": {
       "version": "4.2.4",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.4.tgz",
-      "integrity": "sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==",
-      "dev": true
+      "integrity": "sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw=="
     },
     "graphlib": {
       "version": "2.1.8",
@@ -13098,20 +13121,29 @@
       }
     },
     "http-proxy-agent": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-2.1.0.tgz",
-      "integrity": "sha512-qwHbBLV7WviBl0rQsOzH6o5lwyOIvwp/BdFnvVxXORldu5TmjFfjzBcWUWS5kWAZhmv+JtiDhSuQCp4sBfbIgg==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
       "requires": {
-        "agent-base": "4",
-        "debug": "3.1.0"
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4"
       },
       "dependencies": {
         "agent-base": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.3.0.tgz",
-          "integrity": "sha512-salcGninV0nPrwpGNn4VTXBb1SOuXQBiqbrNXoeizJsHrsL6ERFM2Ne3JUSBWRE6aeNJI2ROP/WEEIDUiDe3cg==",
+          "version": "6.0.2",
+          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+          "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
           "requires": {
-            "es6-promisify": "^5.0.0"
+            "debug": "4"
+          }
+        },
+        "debug": {
+          "version": "4.3.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
+          "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
+          "requires": {
+            "ms": "2.1.2"
           }
         }
       }
@@ -15761,6 +15793,14 @@
         "minimist": "^1.2.0"
       }
     },
+    "jsonfile": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
+      "integrity": "sha1-h3Gq4HmbZAdrdmQPygWPnBDjPss=",
+      "requires": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
     "jsonparse": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
@@ -17790,9 +17830,9 @@
       "dev": true
     },
     "netmask": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/netmask/-/netmask-1.0.6.tgz",
-      "integrity": "sha1-ICl+idhvb2QA8lDZ9Pa0wZRfzTU="
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.0.2.tgz",
+      "integrity": "sha512-dBpDMdxv9Irdq66304OLfEmQ9tbNRFnFTuZiLo+bD+r332bBmMJ8GBLXklIXXgxd3+v9+KUnZaUR5PJMa75Gsg=="
     },
     "neverthrow": {
       "version": "4.2.1",
@@ -18501,26 +18541,27 @@
       "dev": true
     },
     "pac-proxy-agent": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-3.0.1.tgz",
-      "integrity": "sha512-44DUg21G/liUZ48dJpUSjZnFfZro/0K5JTyFYLBcmh9+T6Ooi4/i4efwUiEy0+4oQusCBqWdhv16XohIj1GqnQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-4.1.0.tgz",
+      "integrity": "sha512-ejNgYm2HTXSIYX9eFlkvqFp8hyJ374uDf0Zq5YUAifiSh1D6fo+iBivQZirGvVv8dCYUsLhmLBRhlAYvBKI5+Q==",
       "requires": {
-        "agent-base": "^4.2.0",
-        "debug": "^4.1.1",
-        "get-uri": "^2.0.0",
-        "http-proxy-agent": "^2.1.0",
-        "https-proxy-agent": "^3.0.0",
-        "pac-resolver": "^3.0.0",
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4",
+        "get-uri": "3",
+        "http-proxy-agent": "^4.0.1",
+        "https-proxy-agent": "5",
+        "pac-resolver": "^4.1.0",
         "raw-body": "^2.2.0",
-        "socks-proxy-agent": "^4.0.1"
+        "socks-proxy-agent": "5"
       },
       "dependencies": {
         "agent-base": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.3.0.tgz",
-          "integrity": "sha512-salcGninV0nPrwpGNn4VTXBb1SOuXQBiqbrNXoeizJsHrsL6ERFM2Ne3JUSBWRE6aeNJI2ROP/WEEIDUiDe3cg==",
+          "version": "6.0.2",
+          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+          "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
           "requires": {
-            "es6-promisify": "^5.0.0"
+            "debug": "4"
           }
         },
         "debug": {
@@ -18532,36 +18573,24 @@
           }
         },
         "https-proxy-agent": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-3.0.1.tgz",
-          "integrity": "sha512-+ML2Rbh6DAuee7d07tYGEKOEi2voWPUGan+ExdPbPW6Z3svq+JCqr0v8WmKPOkz1vOVykPCBSuobe7G8GJUtVg==",
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz",
+          "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
           "requires": {
-            "agent-base": "^4.3.0",
-            "debug": "^3.1.0"
-          },
-          "dependencies": {
-            "debug": {
-              "version": "3.2.7",
-              "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-              "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-              "requires": {
-                "ms": "^2.1.1"
-              }
-            }
+            "agent-base": "6",
+            "debug": "4"
           }
         }
       }
     },
     "pac-resolver": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-3.0.0.tgz",
-      "integrity": "sha512-tcc38bsjuE3XZ5+4vP96OfhOugrX+JcnpUbhfuc4LuXBLQhoTthOstZeoQJBDnQUDYzYmdImKsbz0xSl1/9qeA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-4.2.0.tgz",
+      "integrity": "sha512-rPACZdUyuxT5Io/gFKUeeZFfE5T7ve7cAkE5TUZRRfuKP0u5Hocwe48X7ZEm6mYB+bTB0Qf+xlVlA/RM/i6RCQ==",
       "requires": {
-        "co": "^4.6.0",
-        "degenerator": "^1.0.4",
+        "degenerator": "^2.2.0",
         "ip": "^1.1.5",
-        "netmask": "^1.0.6",
-        "thunkify": "^2.1.2"
+        "netmask": "^2.0.1"
       }
     },
     "pako": {
@@ -19646,26 +19675,26 @@
       }
     },
     "proxy-agent": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-3.1.1.tgz",
-      "integrity": "sha512-WudaR0eTsDx33O3EJE16PjBRZWcX8GqCEeERw1W3hZJgH/F2a46g7jty6UGty6NeJ4CKQy8ds2CJPMiyeqaTvw==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-ODnQnW2jc/FUVwHHuaZEfN5otg/fMbvMxz9nMSUQfJ9JU7q2SZvSULSsjLloVgJOiv9yhc8GlNMKc4GkFmcVEA==",
       "requires": {
-        "agent-base": "^4.2.0",
+        "agent-base": "^6.0.0",
         "debug": "4",
-        "http-proxy-agent": "^2.1.0",
-        "https-proxy-agent": "^3.0.0",
+        "http-proxy-agent": "^4.0.0",
+        "https-proxy-agent": "^5.0.0",
         "lru-cache": "^5.1.1",
-        "pac-proxy-agent": "^3.0.1",
+        "pac-proxy-agent": "^4.1.0",
         "proxy-from-env": "^1.0.0",
-        "socks-proxy-agent": "^4.0.1"
+        "socks-proxy-agent": "^5.0.0"
       },
       "dependencies": {
         "agent-base": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.3.0.tgz",
-          "integrity": "sha512-salcGninV0nPrwpGNn4VTXBb1SOuXQBiqbrNXoeizJsHrsL6ERFM2Ne3JUSBWRE6aeNJI2ROP/WEEIDUiDe3cg==",
+          "version": "6.0.2",
+          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+          "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
           "requires": {
-            "es6-promisify": "^5.0.0"
+            "debug": "4"
           }
         },
         "debug": {
@@ -19677,22 +19706,12 @@
           }
         },
         "https-proxy-agent": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-3.0.1.tgz",
-          "integrity": "sha512-+ML2Rbh6DAuee7d07tYGEKOEi2voWPUGan+ExdPbPW6Z3svq+JCqr0v8WmKPOkz1vOVykPCBSuobe7G8GJUtVg==",
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz",
+          "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
           "requires": {
-            "agent-base": "^4.3.0",
-            "debug": "^3.1.0"
-          },
-          "dependencies": {
-            "debug": {
-              "version": "3.2.7",
-              "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-              "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-              "requires": {
-                "ms": "^2.1.1"
-              }
-            }
+            "agent-base": "6",
+            "debug": "4"
           }
         },
         "lru-cache": {
@@ -21448,29 +21467,38 @@
       }
     },
     "socks": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.3.3.tgz",
-      "integrity": "sha512-o5t52PCNtVdiOvzMry7wU4aOqYWL0PeCXRWBEiJow4/i/wr+wpsJQ9awEu1EonLIqsfGd5qSgDdxEOvCdmBEpA==",
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.6.0.tgz",
+      "integrity": "sha512-mNmr9owlinMplev0Wd7UHFlqI4ofnBnNzFuzrm63PPaHgbkqCFe4T5LzwKmtQ/f2tX0NTpcdVLyD/FHxFBstYw==",
       "requires": {
-        "ip": "1.1.5",
+        "ip": "^1.1.5",
         "smart-buffer": "^4.1.0"
       }
     },
     "socks-proxy-agent": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-4.0.2.tgz",
-      "integrity": "sha512-NT6syHhI9LmuEMSK6Kd2V7gNv5KFZoLE7V5udWmn0de+3Mkj3UMA/AJPLyeNUVmElCurSHtUdM3ETpR3z770Wg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-5.0.0.tgz",
+      "integrity": "sha512-lEpa1zsWCChxiynk+lCycKuC502RxDWLKJZoIhnxrWNjLSDGYRFflHA1/228VkRcnv9TIb8w98derGbpKxJRgA==",
       "requires": {
-        "agent-base": "~4.2.1",
-        "socks": "~2.3.2"
+        "agent-base": "6",
+        "debug": "4",
+        "socks": "^2.3.3"
       },
       "dependencies": {
         "agent-base": {
-          "version": "4.2.1",
-          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.2.1.tgz",
-          "integrity": "sha512-JVwXMr9nHYTUXsBFKUqhJwvlcYU/blreOEUkhNR2eXZIvwd+c+o5V4MgDPKWnMS/56awN3TRzIP+KoPn+roQtg==",
+          "version": "6.0.2",
+          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+          "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+          "requires": {
+            "debug": "4"
+          }
+        },
+        "debug": {
+          "version": "4.3.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
+          "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
           "requires": {
-            "es6-promisify": "^5.0.0"
+            "ms": "2.1.2"
           }
         }
       }
@@ -23740,11 +23768,6 @@
         "xtend": "~4.0.1"
       }
     },
-    "thunkify": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/thunkify/-/thunkify-2.1.2.tgz",
-      "integrity": "sha1-+qDp0jDFGsyVyhOjYawFyn4EVT0="
-    },
     "time-limit-promise": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/time-limit-promise/-/time-limit-promise-1.0.4.tgz",
@@ -24451,6 +24474,11 @@
         "@types/unist": "^2.0.2"
       }
     },
+    "universalify": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
+      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="
+    },
     "unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
@@ -25630,9 +25658,9 @@
       }
     },
     "winston-cloudwatch": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/winston-cloudwatch/-/winston-cloudwatch-2.5.1.tgz",
-      "integrity": "sha512-QETQ1sipe9hcqODMTfWG6PzcwGNN/d8c+xdgyILi2DX+EoGzfsW3U+6EBf98f+uIsC+bVz1zmb6OAfgRQx/afw==",
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/winston-cloudwatch/-/winston-cloudwatch-2.5.2.tgz",
+      "integrity": "sha512-8HcDE6ey546Vb26gV/YPNFOrzff/RCPwbhVnV7e8oPW5c0JU8g8j1OLChmOpqgUEz3EA7RQAkYHjK0DkvKvyQQ==",
       "requires": {
         "async": "^3.1.0",
         "aws-sdk": "^2.553.0",
@@ -25642,7 +25670,7 @@
         "lodash.find": "^4.6.0",
         "lodash.isempty": "^4.4.0",
         "lodash.iserror": "^3.1.1",
-        "proxy-agent": "^3.1.1"
+        "proxy-agent": "^4.0.1"
       },
       "dependencies": {
         "ansi-styles": {
diff --git a/package.json b/package.json
index c7281697f9..98fb79d3a4 100644
--- a/package.json
+++ b/package.json
@@ -153,7 +153,7 @@
     "web-streams-polyfill": "^3.0.3",
     "whatwg-fetch": "^3.6.2",
     "winston": "^3.3.3",
-    "winston-cloudwatch": "^2.5.1"
+    "winston-cloudwatch": "^2.5.2"
   },
   "devDependencies": {
     "@babel/core": "^7.13.15",

From 5ca787ddcfdd29e0c4c258a696643a096ee99641 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Tue, 13 Apr 2021 11:34:36 +0800
Subject: [PATCH 63/75] fix: call correct user update emergency contact
 endpoint (#1631)

---
 .../edit-contact-number-modal.client.controller.js            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js b/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
index 60b0b48ee9..3ad98f2a8e 100644
--- a/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
+++ b/src/public/modules/core/controllers/edit-contact-number-modal.client.controller.js
@@ -97,7 +97,7 @@ function EditContactNumberModalController(
     $scope.otpForm.otp.$setPristine()
     $scope.otpForm.otp.$setUntouched()
     $http
-      .post('/api/v3/user/otp/generate', {
+      .post('/api/v3/user/contact/otp/generate', {
         contact: vm.contact.number,
         userId: vm.user._id,
       })
@@ -126,7 +126,7 @@ function EditContactNumberModalController(
     vm.otp.isFetching = true
     // Check with backend if the otp is correct
     $http
-      .post('/api/v3/user/otp/verify', {
+      .post('/api/v3/user/contact/otp/verify', {
         contact: vm.contact.number,
         otp: vm.otp.value,
         userId: vm.user._id,

From c4724a9f64c6dd5cb134dd46ceae8ab6a736dbec Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Tue, 13 Apr 2021 11:56:42 +0800
Subject: [PATCH 64/75] chore: bump version to v5.6.0

---
 CHANGELOG.md      | 71 +++++++++++++++++++++++++++++++++++++++++++++++
 package-lock.json |  2 +-
 package.json      |  2 +-
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a61a8541e..21073bd9d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,80 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v5.6.0](https://github.com/opengovsg/FormSG/compare/v5.5.1...v5.6.0)
+
+- fix: call correct user update emergency contact endpoint [`#1631`](https://github.com/opengovsg/FormSG/pull/1631)
+- fix(deps): bump winston-cloudwatch from 2.5.1 to 2.5.2 [`#1626`](https://github.com/opengovsg/FormSG/pull/1626)
+- chore(deps-dev): bump @typescript-eslint/parser from 4.21.0 to 4.22.0 [`#1627`](https://github.com/opengovsg/FormSG/pull/1627)
+- chore(deps-dev): bump date-fns from 2.20.1 to 2.20.2 [`#1628`](https://github.com/opengovsg/FormSG/pull/1628)
+- chore(deps-dev): bump @typescript-eslint/eslint-plugin [`#1625`](https://github.com/opengovsg/FormSG/pull/1625)
+- chore(deps-dev): bump typescript from 4.1.5 to 4.2.4 [`#1624`](https://github.com/opengovsg/FormSG/pull/1624)
+- chore: disable no-await-without-trycatch in backend [`#1623`](https://github.com/opengovsg/FormSG/pull/1623)
+- refactor(admin-form/controller): changed if-else in admin-form controller into chains [`#1622`](https://github.com/opengovsg/FormSG/pull/1622)
+- test: fix flaky form feedback test [`#1620`](https://github.com/opengovsg/FormSG/pull/1620)
+- Test: publicform integration tests [`#1572`](https://github.com/opengovsg/FormSG/pull/1572)
+- refactor: Minor cleanup to avoid using res.locals [`#1621`](https://github.com/opengovsg/FormSG/pull/1621)
+- refactor(misc-api): duplicate misc endpoints to new /api/v3 router [`#1573`](https://github.com/opengovsg/FormSG/pull/1573)
+- chore: rearrange directory structure [`#1606`](https://github.com/opengovsg/FormSG/pull/1606)
+- chore: uninstall sinon and ts-mock-imports (forreal) [`#1611`](https://github.com/opengovsg/FormSG/pull/1611)
+- chore: merge release v5.5.1 back to develop [`#1612`](https://github.com/opengovsg/FormSG/pull/1612)
+- chore(deps-dev): bump @types/bcrypt from 3.0.0 to 3.0.1 [`#1619`](https://github.com/opengovsg/FormSG/pull/1619)
+- chore(deps-dev): bump eslint from 7.23.0 to 7.24.0 [`#1613`](https://github.com/opengovsg/FormSG/pull/1613)
+- fix(deps): bump web-streams-polyfill from 3.0.2 to 3.0.3 [`#1618`](https://github.com/opengovsg/FormSG/pull/1618)
+- fix(deps): bump aws-sdk from 2.883.0 to 2.884.0 [`#1615`](https://github.com/opengovsg/FormSG/pull/1615)
+- chore(deps-dev): bump date-fns from 2.20.0 to 2.20.1 [`#1617`](https://github.com/opengovsg/FormSG/pull/1617)
+- chore(deps-dev): bump eslint-plugin-jest from 24.3.4 to 24.3.5 [`#1616`](https://github.com/opengovsg/FormSG/pull/1616)
+- fix(deps): bump winston-cloudwatch from 2.5.0 to 2.5.1 [`#1614`](https://github.com/opengovsg/FormSG/pull/1614)
+- chore(deps-dev): bump date-fns from 2.19.0 to 2.20.0 [`#1607`](https://github.com/opengovsg/FormSG/pull/1607)
+- chore(deps-dev): bump core-js from 3.9.1 to 3.10.1 [`#1608`](https://github.com/opengovsg/FormSG/pull/1608)
+- chore(deps-dev): bump @babel/preset-env from 7.13.12 to 7.13.15 [`#1599`](https://github.com/opengovsg/FormSG/pull/1599)
+- fix(deps): bump aws-sdk from 2.882.0 to 2.883.0 [`#1609`](https://github.com/opengovsg/FormSG/pull/1609)
+- chore(deps-dev): bump @babel/plugin-transform-runtime [`#1602`](https://github.com/opengovsg/FormSG/pull/1602)
+- fix(deps): bump twilio from 3.59.0 to 3.60.0 [`#1601`](https://github.com/opengovsg/FormSG/pull/1601)
+- chore(deps-dev): bump @babel/core from 7.13.14 to 7.13.15 [`#1600`](https://github.com/opengovsg/FormSG/pull/1600)
+- test: fix flakiness (again) by hardcoding created dates [`#1604`](https://github.com/opengovsg/FormSG/pull/1604)
+- refactor: remove typecasts and non-null assertions [`#1596`](https://github.com/opengovsg/FormSG/pull/1596)
+- refactor: migrate public routes to TypeScript [`#1595`](https://github.com/opengovsg/FormSG/pull/1595)
+- refactor: convert Bounce module to use neverthrow [`#1591`](https://github.com/opengovsg/FormSG/pull/1591)
+- fix: clear current worker pool on download [`#1590`](https://github.com/opengovsg/FormSG/pull/1590)
+- feat: migrate EncryptSubmissionRouter to own router, remove unused forms.server.controller, remove jasmine [`#1592`](https://github.com/opengovsg/FormSG/pull/1592)
+- refactor: migrate frontend routes and google analytics factory to ts [`#1405`](https://github.com/opengovsg/FormSG/pull/1405)
+- refactor: update getPublicForm endpoint to typescript [`#1398`](https://github.com/opengovsg/FormSG/pull/1398)
+- refactor: collapse email preview submission middleware [`#1561`](https://github.com/opengovsg/FormSG/pull/1561)
+- refactor: collapse encrypt preview submission middleware [`#1554`](https://github.com/opengovsg/FormSG/pull/1554)
+- test: migrate logic.spec from javascript to typescript [`#1587`](https://github.com/opengovsg/FormSG/pull/1587)
+- test: migrate file-validation util tests to TypeScript [`#1578`](https://github.com/opengovsg/FormSG/pull/1578)
+- fix(deps): bump aws-sdk from 2.880.0 to 2.882.0 [`#1585`](https://github.com/opengovsg/FormSG/pull/1585)
+- chore(deps-dev): bump testcafe from 1.13.0 to 1.14.0 [`#1580`](https://github.com/opengovsg/FormSG/pull/1580)
+- fix: /adminform integration tests being flakey by loosening some checks [`#1584`](https://github.com/opengovsg/FormSG/pull/1584)
+- ref: migrate (most) /adminform endpoints to TypeScript, add integration tests [`#1567`](https://github.com/opengovsg/FormSG/pull/1567)
+- fix: convert bigint to string, not number to avoid losing fidelity [`#1577`](https://github.com/opengovsg/FormSG/pull/1577)
+- fix(test): use app import instead of dist import [`#1576`](https://github.com/opengovsg/FormSG/pull/1576)
+- refactor: migrate admin-console client service to ts [`#1531`](https://github.com/opengovsg/FormSG/pull/1531)
+- refactor: Refactor attachment upload into a service [`#1547`](https://github.com/opengovsg/FormSG/pull/1547)
+- refactor(user-api): duplicate user endpoints to new /api/v3 router [`#1553`](https://github.com/opengovsg/FormSG/pull/1553)
+- fix(deps): bump aws-sdk from 2.879.0 to 2.880.0 [`#1570`](https://github.com/opengovsg/FormSG/pull/1570)
+- fix(deps): bump libphonenumber-js from 1.9.14 to 1.9.16 [`#1569`](https://github.com/opengovsg/FormSG/pull/1569)
+- chore(deps-dev): bump concurrently from 6.0.0 to 6.0.1 [`#1568`](https://github.com/opengovsg/FormSG/pull/1568)
+- refactor(webhook-services): migrate webhook services to neverthrow [`#1529`](https://github.com/opengovsg/FormSG/pull/1529)
+- build: merge Release 5.5.0 into develop [`#1566`](https://github.com/opengovsg/FormSG/pull/1566)
+- [Snyk] Security upgrade mongoose from 5.11.10 to 5.12.3 [`#1538`](https://github.com/opengovsg/FormSG/pull/1538)
+- ref(auth-api): duplicate auth endpoints to new /api/v3 router [`#1551`](https://github.com/opengovsg/FormSG/pull/1551)
+- chore: add createReqMeta to verification module logging [`#1562`](https://github.com/opengovsg/FormSG/pull/1562)
+- chore(deps-dev): bump @typescript-eslint/parser from 4.20.0 to 4.21.0 [`#1558`](https://github.com/opengovsg/FormSG/pull/1558)
+- chore(deps-dev): bump ngrok from 4.0.0 to 4.0.1 [`#1560`](https://github.com/opengovsg/FormSG/pull/1560)
+- chore(deps-dev): bump eslint-plugin-jest from 24.3.3 to 24.3.4 [`#1559`](https://github.com/opengovsg/FormSG/pull/1559)
+- chore(deps-dev): bump @types/mongodb from 3.6.10 to 3.6.12 [`#1557`](https://github.com/opengovsg/FormSG/pull/1557)
+- chore(deps-dev): bump @typescript-eslint/eslint-plugin [`#1556`](https://github.com/opengovsg/FormSG/pull/1556)
+- fix(deps): bump @opengovsg/spcp-auth-client from 1.4.4 to 1.4.5 [`#1555`](https://github.com/opengovsg/FormSG/pull/1555)
+- refactor(corppass-ui): make ui changes for corppass [`#1533`](https://github.com/opengovsg/FormSG/pull/1533)
+
 #### [v5.5.1](https://github.com/opengovsg/FormSG/compare/v5.5.0...v5.5.1)
 
+> 9 April 2021
+
 - refactor(corppass-ui): make ui changes for corppass [`#1533`](https://github.com/opengovsg/FormSG/pull/1533)
+- chore: bump version to v5.5.1 [`aca5c20`](https://github.com/opengovsg/FormSG/commit/aca5c20e2b3245163cdc9aa4fcc2d3e0df9a77f3)
 
 #### [v5.5.0](https://github.com/opengovsg/FormSG/compare/v5.4.0...v5.5.0)
 
diff --git a/package-lock.json b/package-lock.json
index 7abaf6e42a..3523c3a3e6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "FormSG",
-  "version": "5.5.1",
+  "version": "5.6.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index 98fb79d3a4..cbad5c6f5c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "FormSG",
   "description": "Form Manager for Government",
-  "version": "5.5.1",
+  "version": "5.6.0",
   "homepage": "https://form.gov.sg",
   "authors": [
     "FormSG <formsg@data.gov.sg>"

From fffd972ecb228c9394eafe8d33d83044f4545170 Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Tue, 13 Apr 2021 13:22:25 +0800
Subject: [PATCH 65/75] refactor(frontend-api): duplicate frontend client
 endpoints to new /api/v3 router (#1574)

* refactor(frontend-api): duplicate frontend client endpoints to new /api/v3 router

- duplicate frontend client endpoints functionality and update them to use
the new api v3 routes
- update v3 router to use new endpoints
- update frontend api calls to use new endpoints

* refactor(frontend-api): use updated frontend handlers

* refactor(frontend-api): clean up routes and update comments

* fix(frontend-api): fix /features route and clean up routes
---
 src/app/routes/api/v3/client/client.routes.ts | 52 +++++++++++++++++++
 src/app/routes/api/v3/client/index.ts         |  1 +
 src/app/routes/api/v3/v3.routes.ts            |  2 +
 src/app/views/index.server.view.html          |  6 +--
 .../core/services/features.client.factory.js  |  2 +-
 tests/end-to-end/helpers/util.js              |  2 +-
 6 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 src/app/routes/api/v3/client/client.routes.ts
 create mode 100644 src/app/routes/api/v3/client/index.ts

diff --git a/src/app/routes/api/v3/client/client.routes.ts b/src/app/routes/api/v3/client/client.routes.ts
new file mode 100644
index 0000000000..2d3d0a7c4b
--- /dev/null
+++ b/src/app/routes/api/v3/client/client.routes.ts
@@ -0,0 +1,52 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import * as FrontendServerController from '../../../../modules/frontend/frontend.controller'
+import { GoogleAnalyticsFactory } from '../../../../modules/frontend/google-analytics.factory'
+
+export const ClientRouter = Router()
+
+/**
+ * Generate the templated Javascript code for the frontend to initialise Google Tag Manager
+ * Code depends on whether googleAnalyticsFeature.isEnabled
+ * @route GET /api/v3/client/analytics/google
+ * @return 200 when code generation is successful
+ * @return 400 when code generation fails
+ */
+ClientRouter.get(
+  '/analytics/google',
+  GoogleAnalyticsFactory.addGoogleAnalyticsData,
+)
+
+/**
+ * Generate the templated Javascript code with environment variables for the frontend
+ * @route GET /api/v3/client/environment
+ * @return 200 when code generation is successful
+ * @return 400 when code generation fails
+ */
+ClientRouter.get('/environment', FrontendServerController.addEnvVarData)
+
+/**
+ * Generate a json of current activated features
+ * @route GET /api/v3/client/features
+ * @return json with featureManager.states
+ */
+ClientRouter.get('/features', FrontendServerController.showFeaturesStates)
+
+/**
+ * Generate the javascript code to redirect to the correct url
+ * @route GET /api/v3/client/redirect
+ * @return 200 when redirect code is  successful
+ * @return 400 when redirect code fails
+ */
+ClientRouter.get(
+  '/redirect',
+  celebrate({
+    [Segments.QUERY]: {
+      redirectPath: Joi.string()
+        .regex(/^[a-fA-F0-9]{24}(\/(preview|template|use-template))?/)
+        .required(),
+    },
+  }),
+  FrontendServerController.generateRedirectUrl,
+)
diff --git a/src/app/routes/api/v3/client/index.ts b/src/app/routes/api/v3/client/index.ts
new file mode 100644
index 0000000000..98779c66d5
--- /dev/null
+++ b/src/app/routes/api/v3/client/index.ts
@@ -0,0 +1 @@
+export { ClientRouter } from './client.routes'
diff --git a/src/app/routes/api/v3/v3.routes.ts b/src/app/routes/api/v3/v3.routes.ts
index 3c27d4270e..765759dc42 100644
--- a/src/app/routes/api/v3/v3.routes.ts
+++ b/src/app/routes/api/v3/v3.routes.ts
@@ -4,6 +4,7 @@ import { AdminRouter } from './admin'
 import { AnalyticsRouter } from './analytics'
 import { AuthRouter } from './auth'
 import { BillingsRouter } from './billings'
+import { ClientRouter } from './client'
 import { NotificationsRouter } from './notifications'
 import { UserRouter } from './user'
 
@@ -12,6 +13,7 @@ export const V3Router = Router()
 V3Router.use('/admin', AdminRouter)
 V3Router.use('/user', UserRouter)
 V3Router.use('/auth', AuthRouter)
+V3Router.use('/client', ClientRouter)
 V3Router.use('/notifications', NotificationsRouter)
 V3Router.use('/billings', BillingsRouter)
 V3Router.use('/analytics', AnalyticsRouter)
diff --git a/src/app/views/index.server.view.html b/src/app/views/index.server.view.html
index 9f593de497..431aff888e 100644
--- a/src/app/views/index.server.view.html
+++ b/src/app/views/index.server.view.html
@@ -7,13 +7,13 @@
       async
       src="https://www.googletagmanager.com/gtag/js?id=<%= GATrackingID%>"
     ></script>
-    <script src="/frontend/datalayer"></script>
+    <script src="/api/v3/client/analytics/google"></script>
     <% } %>
     <!--Embedding custom variables in window-->
-    <script src="/frontend/environment"></script>
+    <script src="/api/v3/client/environment"></script>
 
     <%if (redirectPath) { %>
-    <script src="/frontend/redirect?redirectPath=<%= redirectPath%>"></script>
+    <script src="/api/v3/client/redirect?redirectPath=<%= redirectPath%>"></script>
     <% } %>
 
     <title><%= title %></title>
diff --git a/src/public/modules/core/services/features.client.factory.js b/src/public/modules/core/services/features.client.factory.js
index c6820dbae5..867590021a 100644
--- a/src/public/modules/core/services/features.client.factory.js
+++ b/src/public/modules/core/services/features.client.factory.js
@@ -9,7 +9,7 @@ function featureFactory($resource) {
       if (this.states) {
         return this.states
       } else {
-        this.states = await $resource('/frontend/features').get().$promise
+        this.states = await $resource('/api/v3/client/features').get().$promise
         return this.states
       }
     },
diff --git a/tests/end-to-end/helpers/util.js b/tests/end-to-end/helpers/util.js
index 130769596e..b4b405ae48 100644
--- a/tests/end-to-end/helpers/util.js
+++ b/tests/end-to-end/helpers/util.js
@@ -77,7 +77,7 @@ async function enterEmail(t, email) {
  * @returns boolean
  */
 async function getFeatureState(feature) {
-  const featureStates = await axios.get(`${appUrl}/frontend/features`)
+  const featureStates = await axios.get(`${appUrl}/api/v3/client/features`)
   return featureStates.data[feature]
 }
 

From f876c4363828252c6d86029e15b04449b96e38cb Mon Sep 17 00:00:00 2001
From: orbitalsqwib <21305518+orbitalsqwib@users.noreply.github.com>
Date: Tue, 13 Apr 2021 13:29:49 +0800
Subject: [PATCH 66/75]  refactor(feedback-api): duplicate adminform feedback
 endpoints for /api/v3 (#1589)

* refactor(settings-api): shard admin routes into separate files

* refactor(feedback-api): duplicate adminform feedback endpoints to new /api/v3 router

- duplicate adminform feedback endpoint functionalities and update them to use the
new api v3 routes
- update v3 router to use new endpoints
- update frontend api calls to use new endpoints

* fix(feedback-api): add auth middleware back to main admin router

* test(feedback-api): update test router to use real root route

* refactor(forms-routes): fix tests and clean up endpoints

- remove duplicated auth middleware from feedback endpoints
- import index level router for form-route tests to account for
shifted auth middleware
- shard index into admin-forms.routes and index to follow convention

* ref(feedback-api): rename handle-get-form-feedbacks to feedback
---
 .../__tests__/admin-form.controller.spec.ts   |  18 +-
 .../form/admin-form/admin-form.controller.ts  |   4 +-
 .../form/admin-form/admin-form.routes.ts      |   2 +-
 .../admin-forms.feedback.routes.spec.ts       | 532 ++++++++++++++++++
 ...ts => admin-forms.settings.routes.spec.ts} |   2 +-
 .../forms/admin-forms.feedback.routes.ts      |  59 ++
 .../api/v3/admin/forms/admin-forms.routes.ts  |  54 +-
 .../forms/admin-forms.settings.routes.ts      |  54 ++
 .../services/form-feedback.client.factory.js  |   2 +-
 9 files changed, 664 insertions(+), 63 deletions(-)
 create mode 100644 src/app/routes/api/v3/admin/forms/__tests__/admin-forms.feedback.routes.spec.ts
 rename src/app/routes/api/v3/admin/forms/__tests__/{admin-forms.routes.spec.ts => admin-forms.settings.routes.spec.ts} (99%)
 create mode 100644 src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
 create mode 100644 src/app/routes/api/v3/admin/forms/admin-forms.settings.routes.ts

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
index d3dd7dbfbd..40849ab657 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
@@ -2366,7 +2366,7 @@ describe('admin-form.controller', () => {
     })
   })
 
-  describe('handleGetFormFeedbacks', () => {
+  describe('handleGetFormFeedback', () => {
     const MOCK_USER_ID = new ObjectId().toHexString()
     const MOCK_FORM_ID = new ObjectId().toHexString()
     const MOCK_USER = {
@@ -2419,7 +2419,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2454,7 +2454,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2488,7 +2488,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2522,7 +2522,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2553,7 +2553,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2580,7 +2580,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2610,7 +2610,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -2648,7 +2648,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleGetFormFeedbacks(
+      await AdminFormController.handleGetFormFeedback(
         MOCK_REQ,
         mockRes,
         jest.fn(),
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 03d4ccefab..ba03b67cd2 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -534,7 +534,7 @@ export const handleStreamFormFeedback: RequestHandler<{
  * @returns 422 when user in session cannot be retrieved from the database
  * @returns 500 when database error occurs
  */
-export const handleGetFormFeedbacks: RequestHandler<{
+export const handleGetFormFeedback: RequestHandler<{
   formId: string
 }> = (req, res) => {
   const { formId } = req.params
@@ -554,7 +554,7 @@ export const handleGetFormFeedbacks: RequestHandler<{
       logger.error({
         message: 'Error retrieving form feedbacks',
         meta: {
-          action: 'handleGetFormFeedbacks',
+          action: 'handleGetFormFeedback',
           ...createReqMeta(req),
           userId: sessionUserId,
           formId,
diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
index 6ae229987a..cc67c28302 100644
--- a/src/app/modules/form/admin-form/admin-form.routes.ts
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -293,7 +293,7 @@ AdminFormsRouter.get(
 AdminFormsRouter.get(
   '/:formId([a-fA-F0-9]{24})/adminform/feedback',
   withUserAuthentication,
-  AdminFormController.handleGetFormFeedbacks,
+  AdminFormController.handleGetFormFeedback,
 )
 
 /**
diff --git a/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.feedback.routes.spec.ts b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.feedback.routes.spec.ts
new file mode 100644
index 0000000000..36d3522c8f
--- /dev/null
+++ b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.feedback.routes.spec.ts
@@ -0,0 +1,532 @@
+/* eslint-disable @typescript-eslint/ban-ts-comment */
+import { ObjectId } from 'bson-ext'
+import mongoose from 'mongoose'
+import supertest, { Session } from 'supertest-session'
+
+import { getEncryptedFormModel } from 'src/app/models/form.server.model'
+import getFormFeedbackModel from 'src/app/models/form_feedback.server.model'
+import getUserModel from 'src/app/models/user.server.model'
+import { IFormDocument, IUserSchema, ResponseMode, Status } from 'src/types'
+
+import {
+  createAuthedSession,
+  logoutSession,
+} from 'tests/integration/helpers/express-auth'
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
+
+import { insertFormFeedback } from '../../../../../../modules/form/public-form/public-form.service'
+import { AdminFormsRouter } from '../admin-forms.routes'
+
+// Prevent rate limiting.
+jest.mock('src/app/utils/limit-rate')
+
+const UserModel = getUserModel(mongoose)
+const EncryptFormModel = getEncryptedFormModel(mongoose)
+const FormFeedbackModel = getFormFeedbackModel(mongoose)
+
+const app = setupApp('/admin/forms', AdminFormsRouter, {
+  setupWithAuth: true,
+})
+
+describe('admin-form.feedback.routes', () => {
+  let request: Session
+  let defaultUser: IUserSchema
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+    const { user } = await dbHandler.insertFormCollectionReqs()
+    // Default all requests to come from authenticated user.
+    request = await createAuthedSession(user.email, request)
+    defaultUser = user
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+
+  describe('GET /admin/forms/:formId/feedback', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with empty feedback meta when no feedback exists', async () => {
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual({
+        count: 0,
+        feedback: [],
+      })
+    })
+
+    it('should return 200 with form feedback meta when feedback exists', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      const expected = {
+        average: (
+          formFeedbacks.reduce((a, b) => a + b.rating, 0) / formFeedbacks.length
+        ).toFixed(2),
+        count: formFeedbacks.length,
+        feedback: [
+          expect.objectContaining({
+            comment: formFeedbacks[0].comment,
+            rating: formFeedbacks[0].rating,
+            date: expect.any(String),
+            dateShort: expect.any(String),
+            timestamp: expect.any(Number),
+            index: 1,
+          }),
+          expect.objectContaining({
+            comment: formFeedbacks[1].comment,
+            rating: formFeedbacks[1].rating,
+            date: expect.any(String),
+            dateShort: expect.any(String),
+            timestamp: expect.any(Number),
+            index: 2,
+          }),
+        ],
+      }
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expected)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${inaccessibleForm._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${archivedForm._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form feedback', async () => {
+      // Arrange
+      // Mock database error
+      // @ts-ignore
+      jest.spyOn(FormFeedbackModel, 'find').mockImplementationOnce(() => ({
+        sort: jest.fn().mockReturnThis(),
+        exec: jest
+          .fn()
+          .mockRejectedValueOnce(new Error('something went wrong')),
+      }))
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Error: [something went wrong]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+  })
+
+  describe('GET /admin/forms/:formId/feedback/count', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with 0 count when no feedback exists', async () => {
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with feedback count when feedback exists', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(formFeedbacks.length)
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${inaccessibleForm._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${archivedForm._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst retrieving form feedback', async () => {
+      // Arrange
+      // Mock database error
+      // @ts-ignore
+      jest.spyOn(FormFeedbackModel, 'countDocuments').mockReturnValueOnce({
+        exec: jest
+          .fn()
+          .mockRejectedValueOnce(new Error('something went wrong')),
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message:
+          'Error: [something went wrong]. Please refresh and try again. If you still need help, email us at form@open.gov.sg.',
+      })
+    })
+  })
+
+  describe('GET /admin/forms/:formId/feedback/download', () => {
+    let formForFeedback: IFormDocument
+    beforeEach(async () => {
+      formForFeedback = (await EncryptFormModel.create({
+        title: 'form to view feedback',
+        admin: defaultUser._id,
+        publicKey: 'does not matter',
+      })) as IFormDocument
+    })
+
+    it('should return 200 with feedback stream when feedbacks exist', async () => {
+      // Arrange
+      const formFeedbacks = [
+        { formId: formForFeedback._id, rating: 5, comment: 'nice' },
+        { formId: formForFeedback._id, rating: 2, comment: 'not nice' },
+      ]
+      await insertFormFeedback(formFeedbacks[0])
+      await insertFormFeedback(formFeedbacks[1])
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${formForFeedback._id}/feedback/download`)
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => {
+            cb(null, JSON.parse(buffer))
+          })
+        })
+
+      // Assert
+      const expected = await FormFeedbackModel.find({
+        formId: formForFeedback._id,
+      }).exec()
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(jsonParseStringify(expected))
+    })
+
+    it('should return 200 with empty stream when feedbacks do not exist', async () => {
+      // Act
+      const response = await request
+        .get(`/admin/forms/${formForFeedback._id}/feedback/download`)
+        .buffer()
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual([])
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions for form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${inaccessibleForm._id}/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form cannot be found', async () => {
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form is already archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${archivedForm._id}/feedback/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Delete user after login.
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${formForFeedback._id}/feedback`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+})
diff --git a/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.routes.spec.ts b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.settings.routes.spec.ts
similarity index 99%
rename from src/app/routes/api/v3/admin/forms/__tests__/admin-forms.routes.spec.ts
rename to src/app/routes/api/v3/admin/forms/__tests__/admin-forms.settings.routes.spec.ts
index 54450827ee..c6efd1968c 100644
--- a/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.routes.spec.ts
+++ b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.settings.routes.spec.ts
@@ -19,7 +19,7 @@ const app = setupApp('/admin/forms', AdminFormsRouter, {
   setupWithAuth: true,
 })
 
-describe('admin-form.routes', () => {
+describe('admin-form.settings.routes', () => {
   let request: Session
 
   const USER_ID = new ObjectId()
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
new file mode 100644
index 0000000000..f7db87c640
--- /dev/null
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
@@ -0,0 +1,59 @@
+import { Router } from 'express'
+
+import * as AdminFormController from '../../../../../modules/form/admin-form/admin-form.controller'
+
+export const AdminFormsFeedbackRouter = Router()
+
+/**
+ * Retrieve feedback for a public form
+ * @route GET /api/v3/admim/forms/:formId/feedback
+ * @security session
+ *
+ * @returns 200 with feedback response
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsFeedbackRouter.get(
+  '/:formId([a-fA-F0-9]{24})/feedback',
+  AdminFormController.handleGetFormFeedback,
+)
+
+/**
+ * Count the number of feedback for a form
+ * @route GET /api/v3/admim/forms/{formId}/feedback/count
+ * @security session
+ *
+ * @returns 200 with feedback counts of given form
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsFeedbackRouter.get(
+  '/:formId([a-fA-F0-9]{24})/feedback/count',
+  AdminFormController.handleCountFormFeedback,
+)
+
+/**
+ * Stream download all feedback for a form
+ * @route GET /api/v3/admim/forms/{formId}/feedback/download
+ * @security session
+ *
+ * @returns 200 with feedback stream
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database or stream error occurs
+ */
+AdminFormsFeedbackRouter.get(
+  '/:formId([a-fA-F0-9]{24})/feedback/download',
+  AdminFormController.handleStreamFormFeedback,
+)
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
index f4683a8d77..bb466328f1 100644
--- a/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
@@ -1,58 +1,14 @@
-import { celebrate, Joi, Segments } from 'celebrate'
 import { Router } from 'express'
 
-import { AuthType, Status } from '../../../../../../types'
-import { SettingsUpdateDto } from '../../../../../../types/api'
 import { withUserAuthentication } from '../../../../../modules/auth/auth.middlewares'
-import { handleUpdateSettings } from '../../../../../modules/form/admin-form/admin-form.controller'
+
+import { AdminFormsFeedbackRouter } from './admin-forms.feedback.routes'
+import { AdminFormsSettingsRouter } from './admin-forms.settings.routes'
 
 export const AdminFormsRouter = Router()
 
 // All routes in this handler should be protected by authentication.
 AdminFormsRouter.use(withUserAuthentication)
 
-/**
- * Joi validator for PATCH /forms/:formId/settings route.
- */
-const updateSettingsValidator = celebrate({
-  [Segments.BODY]: Joi.object<SettingsUpdateDto>({
-    authType: Joi.string().valid(...Object.values(AuthType)),
-    emails: Joi.alternatives().try(
-      Joi.array().items(Joi.string().email()),
-      Joi.string().email({ multiple: true }),
-    ),
-    esrvcId: Joi.string().allow(''),
-    hasCaptcha: Joi.boolean(),
-    inactiveMessage: Joi.string(),
-    status: Joi.string().valid(...Object.values(Status)),
-    submissionLimit: Joi.number().allow(null),
-    title: Joi.string(),
-    webhook: Joi.object({
-      url: Joi.string().uri().required().allow(''),
-    }),
-  }).min(1),
-})
-
-/**
- * Update form settings according to given subset of settings.
- * @route PATCH /admin/forms/:formId/settings
- * @group admin
- * @param body the subset of settings to patch
- * @produces application/json
- * @consumes application/json
- * @returns 200 with latest form settings on successful update
- * @returns 400 when given body fails Joi validation
- * @returns 401 when current user is not logged in
- * @returns 403 when current user does not have permissions to update form settings
- * @returns 404 when form to update settings for cannot be found
- * @returns 409 when saving form settings incurs a conflict in the database
- * @returns 410 when updating settings for archived form
- * @returns 413 when updating settings causes form to be too large to be saved in the database
- * @returns 422 when an invalid settings update is attempted on the form
- * @returns 422 when user in session cannot be retrieved from the database
- * @returns 500 when database error occurs
- */
-AdminFormsRouter.route('/:formId([a-fA-F0-9]{24})/settings').patch(
-  updateSettingsValidator,
-  handleUpdateSettings,
-)
+AdminFormsRouter.use(AdminFormsSettingsRouter)
+AdminFormsRouter.use(AdminFormsFeedbackRouter)
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.settings.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.settings.routes.ts
new file mode 100644
index 0000000000..54e2677cf9
--- /dev/null
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.settings.routes.ts
@@ -0,0 +1,54 @@
+import { celebrate, Joi, Segments } from 'celebrate'
+import { Router } from 'express'
+
+import { AuthType, Status } from '../../../../../../types'
+import { SettingsUpdateDto } from '../../../../../../types/api'
+import { handleUpdateSettings } from '../../../../../modules/form/admin-form/admin-form.controller'
+
+export const AdminFormsSettingsRouter = Router()
+
+/**
+ * Joi validator for PATCH /forms/:formId/settings route.
+ */
+const updateSettingsValidator = celebrate({
+  [Segments.BODY]: Joi.object<SettingsUpdateDto>({
+    authType: Joi.string().valid(...Object.values(AuthType)),
+    emails: Joi.alternatives().try(
+      Joi.array().items(Joi.string().email()),
+      Joi.string().email({ multiple: true }),
+    ),
+    esrvcId: Joi.string().allow(''),
+    hasCaptcha: Joi.boolean(),
+    inactiveMessage: Joi.string(),
+    status: Joi.string().valid(...Object.values(Status)),
+    submissionLimit: Joi.number().allow(null),
+    title: Joi.string(),
+    webhook: Joi.object({
+      url: Joi.string().uri().required().allow(''),
+    }),
+  }).min(1),
+})
+
+/**
+ * Update form settings according to given subset of settings.
+ * @route PATCH /admin/forms/:formId/settings
+ * @group admin
+ * @param body the subset of settings to patch
+ * @produces application/json
+ * @consumes application/json
+ * @returns 200 with latest form settings on successful update
+ * @returns 400 when given body fails Joi validation
+ * @returns 401 when current user is not logged in
+ * @returns 403 when current user does not have permissions to update form settings
+ * @returns 404 when form to update settings for cannot be found
+ * @returns 409 when saving form settings incurs a conflict in the database
+ * @returns 410 when updating settings for archived form
+ * @returns 413 when updating settings causes form to be too large to be saved in the database
+ * @returns 422 when an invalid settings update is attempted on the form
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsSettingsRouter.route('/:formId([a-fA-F0-9]{24})/settings').patch(
+  updateSettingsValidator,
+  handleUpdateSettings,
+)
diff --git a/src/public/modules/forms/services/form-feedback.client.factory.js b/src/public/modules/forms/services/form-feedback.client.factory.js
index c2118f1243..2ba6b61760 100644
--- a/src/public/modules/forms/services/form-feedback.client.factory.js
+++ b/src/public/modules/forms/services/form-feedback.client.factory.js
@@ -30,7 +30,7 @@ angular.module('forms').factory('FormFeedback', ['$q', '$http', FormFeedback])
 
 function FormFeedback($q, $http) {
   let resourceUrl = '/:formId/feedback'
-  const feedbackAdminUrl = '/:formId/adminform/feedback'
+  const feedbackAdminUrl = '/api/v3/admin/forms/:formId/feedback'
   let feedbackService = {
     postFeedback: function (params, body) {
       let deferred = $q.defer()

From 864561c129bebd24cfd7dca2851106066141a780 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Tue, 13 Apr 2021 16:54:27 +0800
Subject: [PATCH 67/75] fix: use Joi.date.min() instead of Joi.date.greater()
 for date range

bug prevented users from counting same day responses
---
 src/app/modules/form/admin-form/admin-form.routes.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
index 6ae229987a..836e19b1f8 100644
--- a/src/app/modules/form/admin-form/admin-form.routes.ts
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -386,7 +386,7 @@ AdminFormsRouter.get(
         startDate: Joi.date().format('YYYY-MM-DD').raw(),
         endDate: Joi.date()
           .format('YYYY-MM-DD')
-          .greater(Joi.ref('startDate'))
+          .min(Joi.ref('startDate'))
           .raw(),
       })
       .and('startDate', 'endDate'),
@@ -447,7 +447,7 @@ AdminFormsRouter.get(
         startDate: Joi.date().format('YYYY-MM-DD').raw(),
         endDate: Joi.date()
           .format('YYYY-MM-DD')
-          .greater(Joi.ref('startDate'))
+          .min(Joi.ref('startDate'))
           .raw(),
         downloadAttachments: Joi.boolean().default(false),
       })

From 2d81ff4a4573a70a698596f5ac2ec1a4c5139b27 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Tue, 13 Apr 2021 17:00:26 +0800
Subject: [PATCH 68/75] test(AdminFormRoutes): test for equal start and end
 dates validation

---
 .../__tests__/admin-form.routes.spec.ts       | 41 ++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index e5760e47a4..6f899d413f 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -4050,6 +4050,44 @@ describe('admin-form.routes', () => {
       expect(response.body).toEqual(1)
     })
 
+    it('should return 200 with counts of submissions made with same start and end dates.', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      const results = await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+      // Update first submission to be 5 days ago.
+      const expectedDate = subDays(new Date(), 5)
+      const firstSubmission = results[0]._unsafeUnwrap()
+      firstSubmission.created = expectedDate
+      await firstSubmission.save()
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: format(expectedDate, 'yyyy-MM-dd'),
+          endDate: format(expectedDate, 'yyyy-MM-dd'),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(1)
+    })
+
     it('should return 400 when query.startDate is missing when query.endDate is provided', async () => {
       // Arrange
       const newForm = await EncryptFormModel.create({
@@ -4190,7 +4228,8 @@ describe('admin-form.routes', () => {
         buildCelebrateError({
           query: {
             key: 'endDate',
-            message: '"endDate" must be greater than "ref:startDate"',
+            message:
+              '"endDate" must be greater than or equal to "ref:startDate"',
           },
         }),
       )

From c640dd1e8c219f5293f36fff18f57881ae1ded73 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Tue, 13 Apr 2021 17:02:11 +0800
Subject: [PATCH 69/75] chore: bump version to v5.6.1

---
 CHANGELOG.md      | 8 ++++++++
 package-lock.json | 2 +-
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21073bd9d1..23939c2350 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,8 +4,15 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v5.6.1](https://github.com/opengovsg/FormSG/compare/v5.6.0...v5.6.1)
+
+- test(AdminFormRoutes): test for equal start and end dates validation [`2d81ff4`](https://github.com/opengovsg/FormSG/commit/2d81ff4a4573a70a698596f5ac2ec1a4c5139b27)
+- fix: use Joi.date.min() instead of Joi.date.greater() for date range [`864561c`](https://github.com/opengovsg/FormSG/commit/864561c129bebd24cfd7dca2851106066141a780)
+
 #### [v5.6.0](https://github.com/opengovsg/FormSG/compare/v5.5.1...v5.6.0)
 
+> 13 April 2021
+
 - fix: call correct user update emergency contact endpoint [`#1631`](https://github.com/opengovsg/FormSG/pull/1631)
 - fix(deps): bump winston-cloudwatch from 2.5.1 to 2.5.2 [`#1626`](https://github.com/opengovsg/FormSG/pull/1626)
 - chore(deps-dev): bump @typescript-eslint/parser from 4.21.0 to 4.22.0 [`#1627`](https://github.com/opengovsg/FormSG/pull/1627)
@@ -71,6 +78,7 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 - chore(deps-dev): bump @typescript-eslint/eslint-plugin [`#1556`](https://github.com/opengovsg/FormSG/pull/1556)
 - fix(deps): bump @opengovsg/spcp-auth-client from 1.4.4 to 1.4.5 [`#1555`](https://github.com/opengovsg/FormSG/pull/1555)
 - refactor(corppass-ui): make ui changes for corppass [`#1533`](https://github.com/opengovsg/FormSG/pull/1533)
+- chore: bump version to v5.6.0 [`c4724a9`](https://github.com/opengovsg/FormSG/commit/c4724a9f64c6dd5cb134dd46ceae8ab6a736dbec)
 
 #### [v5.5.1](https://github.com/opengovsg/FormSG/compare/v5.5.0...v5.5.1)
 
diff --git a/package-lock.json b/package-lock.json
index 3523c3a3e6..81cd03e37c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "FormSG",
-  "version": "5.6.0",
+  "version": "5.6.1",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index cbad5c6f5c..5059ac62ea 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "FormSG",
   "description": "Form Manager for Government",
-  "version": "5.6.0",
+  "version": "5.6.1",
   "homepage": "https://form.gov.sg",
   "authors": [
     "FormSG <formsg@data.gov.sg>"

From 35c5fcc46c027de31da2cc928679600434d72577 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 13 Apr 2021 17:27:05 +0000
Subject: [PATCH 70/75] fix(deps): bump aws-sdk from 2.884.0 to 2.885.0 (#1636)

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.884.0 to 2.885.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.884.0...v2.885.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3523c3a3e6..e9433cc91c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6434,9 +6434,9 @@
       "integrity": "sha512-24q5Rh3bno7ldoyCq99d6hpnLI+PAMocdeVaaGt/5BTQMprvDwQToHfNnruqN11odCHZZIQbRBw+nZo1lTCH9g=="
     },
     "aws-sdk": {
-      "version": "2.884.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.884.0.tgz",
-      "integrity": "sha512-+rhzq7zmntsj4VJRUf0v6ri9vw3dYroy9BbRtbxLHILdnSFPkoqMcodr/pwcUSO5kYEYbCG7mxr5/R2a+cfbxQ==",
+      "version": "2.885.0",
+      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.885.0.tgz",
+      "integrity": "sha512-V7fS53HkLYap+mt00frWB516HZV34C5pHNhBs/Het3Vgl7A0GbCpJs07G4FOIT9ioJ38+k9McscOzXG++1rWMQ==",
       "requires": {
         "buffer": "4.9.2",
         "events": "1.1.1",
diff --git a/package.json b/package.json
index cbad5c6f5c..b1b6aff29a 100644
--- a/package.json
+++ b/package.json
@@ -83,7 +83,7 @@
     "angular-ui-bootstrap": "~2.5.6",
     "angular-ui-router": "~1.0.29",
     "aws-info": "^1.2.0",
-    "aws-sdk": "^2.884.0",
+    "aws-sdk": "^2.885.0",
     "axios": "^0.21.1",
     "bcrypt": "^5.0.1",
     "bluebird": "^3.5.2",

From bdcc15659a19503884812ccd2580c203d01dac6c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 13 Apr 2021 17:34:46 +0000
Subject: [PATCH 71/75] chore(deps-dev): bump date-fns from 2.20.2 to 2.20.3
 (#1637)

Bumps [date-fns](https://github.com/date-fns/date-fns) from 2.20.2 to 2.20.3.
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md)
- [Commits](https://github.com/date-fns/date-fns/compare/v2.20.2...v2.20.3)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e9433cc91c..7acca74db9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9369,9 +9369,9 @@
       }
     },
     "date-fns": {
-      "version": "2.20.2",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.2.tgz",
-      "integrity": "sha512-QS0Z8SD/ALhKFvhtU4Fhz+1crsI7fPzBquXmdWay33KJPEU7btro2hnmmErpQRmt2D624B1lbjXQKDUMLnQTmQ==",
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.20.3.tgz",
+      "integrity": "sha512-BbiJSlfmr1Fnfi1OHY8arklKdwtZ9n3NkjCeK8G9gtEe0ZSUwJuwHc6gYBl0uoC0Oa5RdpJV1gBBdXcZi8Efdw==",
       "dev": true
     },
     "dateformat": {
diff --git a/package.json b/package.json
index b1b6aff29a..6677ef8692 100644
--- a/package.json
+++ b/package.json
@@ -202,7 +202,7 @@
     "coveralls": "^3.1.0",
     "css-loader": "^2.1.1",
     "csv-parse": "^4.15.3",
-    "date-fns": "^2.20.2",
+    "date-fns": "^2.20.3",
     "env-cmd": "^10.1.0",
     "eslint": "^7.24.0",
     "eslint-config-prettier": "^8.1.0",

From ac4dde3046560095381318713d8e99193f79f341 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 13 Apr 2021 18:09:36 +0000
Subject: [PATCH 72/75] chore(deps-dev): bump eslint-config-prettier from 8.1.0
 to 8.2.0 (#1639)

Bumps [eslint-config-prettier](https://github.com/prettier/eslint-config-prettier) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/prettier/eslint-config-prettier/releases)
- [Changelog](https://github.com/prettier/eslint-config-prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/eslint-config-prettier/compare/v8.1.0...v8.2.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7acca74db9..8bfaaf9545 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10869,9 +10869,9 @@
       }
     },
     "eslint-config-prettier": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.1.0.tgz",
-      "integrity": "sha512-oKMhGv3ihGbCIimCAjqkdzx2Q+jthoqnXSP+d86M9tptwugycmTFdVR4IpLgq2c4SHifbwO90z2fQ8/Aio73yw==",
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.2.0.tgz",
+      "integrity": "sha512-dWV9EVeSo2qodOPi1iBYU/x6F6diHv8uujxbxr77xExs3zTAlNXvVZKiyLsQGNz7yPV2K49JY5WjPzNIuDc2Bw==",
       "dev": true
     },
     "eslint-import-resolver-node": {
diff --git a/package.json b/package.json
index 6677ef8692..1db7011895 100644
--- a/package.json
+++ b/package.json
@@ -205,7 +205,7 @@
     "date-fns": "^2.20.3",
     "env-cmd": "^10.1.0",
     "eslint": "^7.24.0",
-    "eslint-config-prettier": "^8.1.0",
+    "eslint-config-prettier": "^8.2.0",
     "eslint-plugin-angular": "^4.0.1",
     "eslint-plugin-import": "^2.22.1",
     "eslint-plugin-jest": "^24.3.5",

From 735941351c97c1ab92f88e07e810e36061e87dbe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 14 Apr 2021 01:52:09 +0000
Subject: [PATCH 73/75] chore(deps-dev): bump concurrently from 6.0.1 to 6.0.2
 (#1638)

Bumps [concurrently](https://github.com/kimmobrunfeldt/concurrently) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/kimmobrunfeldt/concurrently/releases)
- [Commits](https://github.com/kimmobrunfeldt/concurrently/compare/v6.0.1...v6.0.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 14 +++++++-------
 package.json      |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8bfaaf9545..3fcc783f9c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8329,14 +8329,14 @@
       }
     },
     "concurrently": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-6.0.1.tgz",
-      "integrity": "sha512-YCF/Wf31a910hXu7eGN9/SyHKD/usw3Shw4IPYuqIsxxC39v92engYlIlOs/zXnBJtX/6aVuhgzfhZeGJkhU4w==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-6.0.2.tgz",
+      "integrity": "sha512-u+1Q0dJG5BidgUTpz9CU16yoHTt/oApFDQ3mbvHwSDgMjU7aGqy0q8ZQyaZyaNxdwRKTD872Ux3Twc6//sWA+Q==",
       "dev": true,
       "requires": {
         "chalk": "^4.1.0",
         "date-fns": "^2.16.1",
-        "lodash": "^4.17.20",
+        "lodash": "^4.17.21",
         "read-pkg": "^5.2.0",
         "rxjs": "^6.6.3",
         "spawn-command": "^0.0.2-1",
@@ -8460,9 +8460,9 @@
           }
         },
         "y18n": {
-          "version": "5.0.6",
-          "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.6.tgz",
-          "integrity": "sha512-PlVX4Y0lDTN6E2V4ES2tEdyvXkeKzxa8c/vo0pxPr/TqbztddTP0yn7zZylIyiAuxerqj0Q5GhpJ1YJCP8LaZQ==",
+          "version": "5.0.8",
+          "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+          "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
           "dev": true
         },
         "yargs": {
diff --git a/package.json b/package.json
index 1db7011895..bf0ba0cce3 100644
--- a/package.json
+++ b/package.json
@@ -196,7 +196,7 @@
     "auto-changelog": "^2.2.1",
     "axios-mock-adapter": "^1.19.0",
     "babel-loader": "^8.2.2",
-    "concurrently": "^6.0.1",
+    "concurrently": "^6.0.2",
     "copy-webpack-plugin": "^6.0.2",
     "core-js": "^3.10.1",
     "coveralls": "^3.1.0",

From 132d5fe144eb697bfb372857b9eca0a09eec64ec Mon Sep 17 00:00:00 2001
From: seaerchin <44049504+seaerchin@users.noreply.github.com>
Date: Wed, 14 Apr 2021 17:31:54 +0800
Subject: [PATCH 74/75] refactor: duplicate adminform submissions to /api/v3
 endpoint (#1641)

* style(admin-forms/feedback): fixed misspelling of admin

* refactor(admin-form/controller): combined validator into handleCountFormSubmission

* refactor(admin-forms/submissions): duplicates over submissions over to new routes

* refactor(submissions/client/factory): removed FE callsite

* fix(admin-forms/submission): adds joi/date to base joi

* test(admin-forms/submissions): adds test from old route

* fix(submissions/client/factory): fixed endpoints for adminform

* refactor(encrypt-submission): combines validation together with handler

* test(encrypt-submission): fixes controller tests due to atomic export for validator + handler

* test(admin-forms/submissoins): ports over tests for submissions/download

* refactor(submissions/client/factory): changed frontend to call new backend api

* chore(admin-forms/submissions): renamed file from submission to submissions

* style(submissions/client/factory): combined api and admin form prefix into one

* fix(admin-form/encrypt-submission): fixed date validation to be min instead of greater

* test(admin-forms): added tests for date validation to submissions/count and submissions/download

as start date can be equal to end date, the hotfix in #1634 was ported over. additionally, an extra
unit test for /submissions/download was added to ensure that the same issue does not plague it

* style(admin-forms/submissions): changed submission to be submissionS

* docs(admin-forms/submissions): fixed comment
---
 .../__tests__/admin-form.controller.spec.ts   |  20 +-
 .../__tests__/admin-form.routes.spec.ts       |  41 +-
 .../form/admin-form/admin-form.controller.ts  |  25 +-
 .../form/admin-form/admin-form.routes.ts      |  23 -
 .../encrypt-submission.controller.spec.ts     |  18 +-
 .../encrypt-submission.controller.ts          |  27 +-
 .../admin-forms.submissions.routes.spec.ts    | 935 ++++++++++++++++++
 .../forms/admin-forms.feedback.routes.ts      |   6 +-
 .../api/v3/admin/forms/admin-forms.routes.ts  |   2 +
 .../forms/admin-forms.submissions.routes.ts   |  43 +
 .../services/submissions.client.factory.js    |  13 +-
 11 files changed, 1101 insertions(+), 52 deletions(-)
 create mode 100644 src/app/routes/api/v3/admin/forms/__tests__/admin-forms.submissions.routes.spec.ts
 create mode 100644 src/app/routes/api/v3/admin/forms/admin-forms.submissions.routes.ts

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
index 40849ab657..49c06f6eaa 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.controller.spec.ts
@@ -1362,7 +1362,7 @@ describe('admin-form.controller', () => {
     })
   })
 
-  describe('handleCountFormSubmissions', () => {
+  describe('countFormSubmissions', () => {
     const MOCK_USER_ID = new ObjectId().toHexString()
     const MOCK_FORM_ID = new ObjectId().toHexString()
     const MOCK_USER = {
@@ -1403,7 +1403,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1454,7 +1454,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         mockReqWithQuery,
         mockRes,
         jest.fn(),
@@ -1493,7 +1493,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1534,7 +1534,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1575,7 +1575,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1612,7 +1612,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1645,7 +1645,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1682,7 +1682,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
@@ -1725,7 +1725,7 @@ describe('admin-form.controller', () => {
       )
 
       // Act
-      await AdminFormController.handleCountFormSubmissions(
+      await AdminFormController.countFormSubmissions(
         MOCK_REQ,
         mockRes,
         jest.fn(),
diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index e5760e47a4..11dc67c074 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -4167,6 +4167,44 @@ describe('admin-form.routes', () => {
       )
     })
 
+    it('should return 200 with counts of submissions made with same start and end dates.', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      const results = await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+      // Update first submission to be 5 days ago.
+      const expectedDate = subDays(new Date(), 5)
+      const firstSubmission = results[0]._unsafeUnwrap()
+      firstSubmission.created = expectedDate
+      await firstSubmission.save()
+
+      // Act
+      const response = await request
+        .get(`/${newForm._id}/adminform/submissions/count`)
+        .query({
+          startDate: format(expectedDate, 'yyyy-MM-dd'),
+          endDate: format(expectedDate, 'yyyy-MM-dd'),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(1)
+    })
+
     it('should return 400 when query.endDate is before query.startDate', async () => {
       // Arrange
       const newForm = await EncryptFormModel.create({
@@ -4190,7 +4228,8 @@ describe('admin-form.routes', () => {
         buildCelebrateError({
           query: {
             key: 'endDate',
-            message: '"endDate" must be greater than "ref:startDate"',
+            message:
+              '"endDate" must be greater than or equal to "ref:startDate"',
           },
         }),
       )
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index ba03b67cd2..2026c27fbe 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -1,3 +1,5 @@
+import JoiDate from '@joi/date'
+import { celebrate, Joi as BaseJoi, Segments } from 'celebrate'
 import { Request, RequestHandler } from 'express'
 import { ParamsDictionary } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
@@ -59,6 +61,9 @@ import {
 } from './admin-form.types'
 import { mapRouteError } from './admin-form.utils'
 
+// NOTE: Refer to this for documentation: https://github.com/sideway/joi-date/blob/master/API.md
+const Joi = BaseJoi.extend(JoiDate)
+
 const logger = createLoggerWithLabel(module)
 
 /**
@@ -307,8 +312,18 @@ export const handleCreatePresignedPostUrlForLogos: RequestHandler<
   )
 }
 
+// Validates that the ending date >= starting date
+const validateDateRange = celebrate({
+  [Segments.QUERY]: Joi.object()
+    .keys({
+      startDate: Joi.date().format('YYYY-MM-DD').raw(),
+      endDate: Joi.date().format('YYYY-MM-DD').min(Joi.ref('startDate')).raw(),
+    })
+    .and('startDate', 'endDate'),
+})
+
 /**
- * Handler for GET /{formId}/adminform/submissions/count.
+ * NOTE: This is exported solely for testing
  * @security session
  *
  * @returns 200 with submission counts of given form
@@ -319,7 +334,7 @@ export const handleCreatePresignedPostUrlForLogos: RequestHandler<
  * @returns 422 when user in session cannot be retrieved from the database
  * @returns 500 when database error occurs
  */
-export const handleCountFormSubmissions: RequestHandler<
+export const countFormSubmissions: RequestHandler<
   { formId: string },
   unknown,
   unknown,
@@ -380,6 +395,12 @@ export const handleCountFormSubmissions: RequestHandler<
     })
 }
 
+// Handler for GET /admin/forms/:formId/submissions/count
+export const handleCountFormSubmissions = [
+  validateDateRange,
+  countFormSubmissions,
+] as RequestHandler[]
+
 /**
  * Handler for GET /{formId}/adminform/feedback/count.
  * @security session
diff --git a/src/app/modules/form/admin-form/admin-form.routes.ts b/src/app/modules/form/admin-form/admin-form.routes.ts
index cc67c28302..aa5c63733f 100644
--- a/src/app/modules/form/admin-form/admin-form.routes.ts
+++ b/src/app/modules/form/admin-form/admin-form.routes.ts
@@ -380,17 +380,6 @@ AdminFormsRouter.get(
 AdminFormsRouter.get(
   '/:formId([a-fA-F0-9]{24})/adminform/submissions/count',
   withUserAuthentication,
-  celebrate({
-    [Segments.QUERY]: Joi.object()
-      .keys({
-        startDate: Joi.date().format('YYYY-MM-DD').raw(),
-        endDate: Joi.date()
-          .format('YYYY-MM-DD')
-          .greater(Joi.ref('startDate'))
-          .raw(),
-      })
-      .and('startDate', 'endDate'),
-  }),
   AdminFormController.handleCountFormSubmissions,
 )
 
@@ -441,18 +430,6 @@ AdminFormsRouter.get(
 AdminFormsRouter.get(
   '/:formId([a-fA-F0-9]{24})/adminform/submissions/download',
   withUserAuthentication,
-  celebrate({
-    [Segments.QUERY]: Joi.object()
-      .keys({
-        startDate: Joi.date().format('YYYY-MM-DD').raw(),
-        endDate: Joi.date()
-          .format('YYYY-MM-DD')
-          .greater(Joi.ref('startDate'))
-          .raw(),
-        downloadAttachments: Joi.boolean().default(false),
-      })
-      .and('startDate', 'endDate'),
-  }),
   EncryptSubmissionController.handleStreamEncryptedResponses,
 )
 
diff --git a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.controller.spec.ts b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.controller.spec.ts
index e336149e4f..ea055358e0 100644
--- a/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.controller.spec.ts
+++ b/src/app/modules/submission/encrypt-submission/__tests__/encrypt-submission.controller.spec.ts
@@ -31,7 +31,7 @@ import {
 import {
   handleGetEncryptedResponse,
   handleGetMetadata,
-  handleStreamEncryptedResponses,
+  streamEncryptedResponses,
 } from '../encrypt-submission.controller'
 import * as EncryptSubmissionService from '../encrypt-submission.service'
 
@@ -739,7 +739,7 @@ describe('encrypt-submission.controller', () => {
     })
   })
 
-  describe('handleStreamEncryptedResponses', () => {
+  describe('streamEncryptedResponses', () => {
     const MOCK_USER_ID = new ObjectId().toHexString()
     const MOCK_FORM_ID = new ObjectId().toHexString()
     const MOCK_USER = {
@@ -786,7 +786,7 @@ describe('encrypt-submission.controller', () => {
       const mockRes = expressHandler.mockResponse()
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(400)
@@ -809,7 +809,7 @@ describe('encrypt-submission.controller', () => {
       const mockRes = expressHandler.mockResponse()
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(403)
@@ -835,7 +835,7 @@ describe('encrypt-submission.controller', () => {
       const mockRes = expressHandler.mockResponse()
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(404)
@@ -861,7 +861,7 @@ describe('encrypt-submission.controller', () => {
       const mockRes = expressHandler.mockResponse()
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(410)
@@ -884,7 +884,7 @@ describe('encrypt-submission.controller', () => {
       )
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(422)
@@ -910,7 +910,7 @@ describe('encrypt-submission.controller', () => {
       )
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(500)
@@ -939,7 +939,7 @@ describe('encrypt-submission.controller', () => {
       const mockRes = expressHandler.mockResponse()
 
       // Act
-      await handleStreamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
+      await streamEncryptedResponses(MOCK_REQ, mockRes, jest.fn())
 
       // Assert
       expect(mockRes.status).toHaveBeenCalledWith(500)
diff --git a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
index 9daeafb4c0..bc5a299e46 100644
--- a/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
+++ b/src/app/modules/submission/encrypt-submission/encrypt-submission.controller.ts
@@ -1,3 +1,5 @@
+import JoiDate from '@joi/date'
+import { celebrate, Joi as BaseJoi, Segments } from 'celebrate'
 import { RequestHandler } from 'express'
 import { Query } from 'express-serve-static-core'
 import { StatusCodes } from 'http-status-codes'
@@ -51,6 +53,9 @@ import {
 const logger = createLoggerWithLabel(module)
 const EncryptSubmission = getEncryptSubmissionModel(mongoose)
 
+// NOTE: Refer to this for documentation: https://github.com/sideway/joi-date/blob/master/API.md
+const Joi = BaseJoi.extend(JoiDate)
+
 export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
   const { formId } = req.params
   const logMeta = {
@@ -368,8 +373,20 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
   })
 }
 
+// Validates that the ending date >= starting date
+const validateDateRange = celebrate({
+  [Segments.QUERY]: Joi.object()
+    .keys({
+      startDate: Joi.date().format('YYYY-MM-DD').raw(),
+      endDate: Joi.date().format('YYYY-MM-DD').min(Joi.ref('startDate')).raw(),
+      downloadAttachments: Joi.boolean().default(false),
+    })
+    .and('startDate', 'endDate'),
+})
+
 /**
- * Handler for GET /:formId([a-fA-F0-9]{24})/adminform/submissions/download
+ * NOTE: This is exported solely for testing
+ * Streams and downloads for GET /:formId([a-fA-F0-9]{24})/adminform/submissions/download
  * @security session
  *
  * @returns 200 with stream of encrypted responses
@@ -381,7 +398,7 @@ export const handleEncryptedSubmission: RequestHandler = async (req, res) => {
  * @returns 422 when user in session cannot be retrieved from the database
  * @returns 500 if any errors occurs in stream pipeline or error retrieving form
  */
-export const handleStreamEncryptedResponses: RequestHandler<
+export const streamEncryptedResponses: RequestHandler<
   { formId: string },
   unknown,
   unknown,
@@ -493,6 +510,12 @@ export const handleStreamEncryptedResponses: RequestHandler<
     })
 }
 
+// Handler for GET /:formId([a-fA-F0-9]{24})/submissions/download
+export const handleStreamEncryptedResponses = [
+  validateDateRange,
+  streamEncryptedResponses,
+] as RequestHandler[]
+
 /**
  * Handler for GET /:formId/adminform/submissions
  * @security session
diff --git a/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.submissions.routes.spec.ts b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.submissions.routes.spec.ts
new file mode 100644
index 0000000000..bf57c2441d
--- /dev/null
+++ b/src/app/routes/api/v3/admin/forms/__tests__/admin-forms.submissions.routes.spec.ts
@@ -0,0 +1,935 @@
+/* eslint-disable @typescript-eslint/ban-ts-comment */
+import { ObjectId } from 'bson-ext'
+import { format, subDays } from 'date-fns'
+import { times } from 'lodash'
+import mongoose from 'mongoose'
+import supertest, { Session } from 'supertest-session'
+
+import {
+  getEmailFormModel,
+  getEncryptedFormModel,
+} from 'src/app/models/form.server.model'
+import getSubmissionModel from 'src/app/models/submission.server.model'
+import getUserModel from 'src/app/models/user.server.model'
+import { saveSubmissionMetadata } from 'src/app/modules/submission/email-submission/email-submission.service'
+import { SubmissionHash } from 'src/app/modules/submission/email-submission/email-submission.types'
+import {
+  IFormDocument,
+  IPopulatedEmailForm,
+  IUserSchema,
+  ResponseMode,
+  Status,
+  SubmissionCursorData,
+  SubmissionType,
+} from 'src/types'
+
+import {
+  createAuthedSession,
+  logoutSession,
+} from 'tests/integration/helpers/express-auth'
+import { setupApp } from 'tests/integration/helpers/express-setup'
+import { buildCelebrateError } from 'tests/unit/backend/helpers/celebrate'
+import dbHandler from 'tests/unit/backend/helpers/jest-db'
+import { jsonParseStringify } from 'tests/unit/backend/helpers/serialize-data'
+
+import { AdminFormsRouter } from '../admin-forms.routes'
+
+// Prevent rate limiting.
+jest.mock('src/app/utils/limit-rate')
+jest.mock('nodemailer', () => ({
+  createTransport: jest.fn().mockReturnValue({
+    sendMail: jest.fn().mockResolvedValue(true),
+  }),
+}))
+
+const UserModel = getUserModel(mongoose)
+const EmailFormModel = getEmailFormModel(mongoose)
+const EncryptFormModel = getEncryptedFormModel(mongoose)
+const SubmissionModel = getSubmissionModel(mongoose)
+
+const app = setupApp('/admin/forms', AdminFormsRouter, {
+  setupWithAuth: true,
+})
+
+describe('admin-form.submissions.routes', () => {
+  let defaultUser: IUserSchema
+  let request: Session
+
+  beforeAll(async () => await dbHandler.connect())
+  beforeEach(async () => {
+    request = supertest(app)
+    const { user } = await dbHandler.insertFormCollectionReqs()
+    // Default all requests to come from authenticated user.
+    request = await createAuthedSession(user.email, request)
+    defaultUser = user
+  })
+  afterEach(async () => {
+    await dbHandler.clearDatabase()
+    jest.restoreAllMocks()
+  })
+  afterAll(async () => await dbHandler.closeDatabase())
+  describe('GET /:formId/submissions/count', () => {
+    it('should return 200 with 0 count when email mode form has no submissions', async () => {
+      // Arrange
+      const newForm = await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${newForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with 0 count when storage mode form has no submissions', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${newForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(0)
+    })
+
+    it('should return 200 with form submission counts for email mode forms', async () => {
+      // Arrange
+      const expectedSubmissionCount = 5
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${newForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expectedSubmissionCount)
+    })
+
+    it('should return 200 with form submission counts for storage mode forms', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+      await Promise.all(
+        times(expectedSubmissionCount, (count) => {
+          return SubmissionModel.create({
+            submissionType: SubmissionType.Encrypt,
+            form: newForm._id,
+            authType: newForm.authType,
+            myInfoFields: newForm.getUniqueMyInfoAttrs(),
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map(),
+            version: 1,
+          })
+        }),
+      )
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${newForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(expectedSubmissionCount)
+    })
+
+    it('should return 200 with counts of submissions made between given start and end dates.', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      const results = await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+      // Update first submission to be 5 days ago.
+      const now = new Date()
+      const firstSubmission = results[0]._unsafeUnwrap()
+      firstSubmission.created = subDays(now, 5)
+      await firstSubmission.save()
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: format(subDays(now, 6), 'yyyy-MM-dd'),
+          endDate: format(subDays(now, 3), 'yyyy-MM-dd'),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(1)
+    })
+
+    it('should return 200 with counts of submissions made with same start and end dates.', async () => {
+      // Arrange
+      const expectedSubmissionCount = 3
+      const newForm = (await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })) as IPopulatedEmailForm
+      // Insert submissions
+      const mockSubmissionHash: SubmissionHash = {
+        hash: 'some hash',
+        salt: 'some salt',
+      }
+      const results = await Promise.all(
+        times(expectedSubmissionCount, () =>
+          saveSubmissionMetadata(newForm, mockSubmissionHash),
+        ),
+      )
+      // Update first submission to be 5 days ago.
+      const expectedDate = subDays(new Date(), 5)
+      const firstSubmission = results[0]._unsafeUnwrap()
+      firstSubmission.created = expectedDate
+      await firstSubmission.save()
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: format(expectedDate, 'yyyy-MM-dd'),
+          endDate: format(expectedDate, 'yyyy-MM-dd'),
+        })
+
+      // Assert
+      expect(response.status).toEqual(200)
+      expect(response.body).toEqual(1)
+    })
+
+    it('should return 400 when query.startDate is missing when query.endDate is provided', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          endDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message:
+              '"endDate" date references "ref:startDate" which must have a valid date format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is missing when query.startDate is provided', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: '',
+            message:
+              '"value" contains [startDate] without its required peers [endDate]',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.startDate is malformed', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: 'not a date',
+          endDate: '2021-04-06',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'startDate',
+            message: '"startDate" must be in YYYY-MM-DD format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is malformed', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+          // Wrong format
+          endDate: '04-06-1993',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message: '"endDate" must be in YYYY-MM-DD format',
+          },
+        }),
+      )
+    })
+
+    it('should return 400 when query.endDate is before query.startDate', async () => {
+      // Arrange
+      const newForm = await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'some public key',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${newForm._id}/submissions/count`)
+        .query({
+          startDate: '2021-04-06',
+          endDate: '2020-01-01',
+        })
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual(
+        buildCelebrateError({
+          query: {
+            key: 'endDate',
+            message:
+              '"endDate" must be greater than or equal to "ref:startDate"',
+          },
+        }),
+      )
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${inaccessibleForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to retrieve submission counts for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${invalidFormId}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to retrieve submission counts for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${archivedForm._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+
+    it('should return 500 when database error occurs whilst counting submissions', async () => {
+      // Arrange
+      const form = await EmailFormModel.create({
+        title: 'normal form',
+        status: Status.Private,
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+      // @ts-ignore
+      jest.spyOn(SubmissionModel, 'countDocuments').mockReturnValueOnce({
+        exec: jest.fn().mockRejectedValueOnce(new Error('some error')),
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${form._id}/submissions/count`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(500)
+      expect(response.body).toEqual({
+        message: 'Something went wrong. Please try again.',
+      })
+    })
+  })
+
+  describe('GET /:formId/submissions/download', () => {
+    let defaultForm: IFormDocument
+
+    beforeEach(async () => {
+      defaultForm = (await EncryptFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'any public key',
+        admin: defaultUser._id,
+      })) as IFormDocument
+    })
+
+    it('should return 200 with stream of encrypted responses without attachment URLs when query.downloadAttachments is false', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(11, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${defaultForm._id}/submissions/download`)
+        .query({ downloadAttachments: false })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to not have attachment metadata.
+            attachmentMetadata: {},
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 200 with stream of encrypted responses with attachment URLs when query.downloadAttachments is true', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(5, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${defaultForm._id}/submissions/download`)
+        .query({ downloadAttachments: true })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to also have attachment metadata.
+            attachmentMetadata: s.attachmentMetadata,
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+        .map((s) => ({
+          ...s,
+          // Require second map due to stringify stage prior to this.
+          attachmentMetadata: {
+            fieldId1: expect.stringContaining(s.attachmentMetadata['fieldId1']),
+            fieldId2: expect.stringContaining(s.attachmentMetadata['fieldId2']),
+          },
+        }))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 200 with stream of encrypted responses when query.startDate is the same as query.endDate', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(5, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      const expectedDate = '2020-02-03'
+      // Set 2 submissions to be submitted with specific date
+      submissions[2].created = new Date(expectedDate)
+      submissions[4].created = new Date(expectedDate)
+      await submissions[2].save()
+      await submissions[4].save()
+      const expectedSubmissionIds = [
+        String(submissions[2]._id),
+        String(submissions[4]._id),
+      ]
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${defaultForm._id}/submissions/download`)
+        .query({
+          startDate: expectedDate,
+          endDate: expectedDate,
+        })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to not have attachment metadata since query is false.
+            attachmentMetadata: {},
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .filter((s) => expectedSubmissionIds.includes(s._id))
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 200 with stream of encrypted responses between given query.startDate and query.endDate', async () => {
+      // Arrange
+      const submissions = await Promise.all(
+        times(5, (count) =>
+          createSubmission({
+            form: defaultForm,
+            encryptedContent: `any encrypted content ${count}`,
+            verifiedContent: `any verified content ${count}`,
+            attachmentMetadata: new Map([
+              ['fieldId1', `some.attachment.url.${count}`],
+              ['fieldId2', `some.other.attachment.url.${count}`],
+            ]),
+          }),
+        ),
+      )
+
+      const startDateStr = '2020-02-03'
+      const endDateStr = '2020-02-04'
+      // Set 2 submissions to be submitted with specific date
+      submissions[2].created = new Date(startDateStr)
+      submissions[4].created = new Date(endDateStr)
+      await submissions[2].save()
+      await submissions[4].save()
+      const expectedSubmissionIds = [
+        String(submissions[2]._id),
+        String(submissions[4]._id),
+      ]
+
+      // Act
+      const response = await request
+        .get(`/admin/forms/${defaultForm._id}/submissions/download`)
+        .query({
+          startDate: startDateStr,
+          endDate: endDateStr,
+        })
+        .buffer()
+        .parse((res, cb) => {
+          let buffer = ''
+          res.on('data', (chunk) => {
+            buffer += chunk
+          })
+          res.on('end', () => cb(null, buffer))
+        })
+
+      // Assert
+      const expectedSorted = submissions
+        .map((s) =>
+          jsonParseStringify({
+            _id: s._id,
+            submissionType: s.submissionType,
+            // Expect returned submissions to not have attachment metadata since query is false.
+            attachmentMetadata: {},
+            encryptedContent: s.encryptedContent,
+            verifiedContent: s.verifiedContent,
+            created: s.created,
+          }),
+        )
+        .filter((s) => expectedSubmissionIds.includes(s._id))
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      const actualSorted = (response.body as string)
+        .split('\n')
+        .map(
+          (submissionStr: string) =>
+            JSON.parse(submissionStr) as SubmissionCursorData,
+        )
+        .sort((a, b) => String(a._id).localeCompare(String(b._id)))
+
+      expect(response.status).toEqual(200)
+      expect(actualSorted).toEqual(expectedSorted)
+    })
+
+    it('should return 400 when form of given formId is not an encrypt mode form', async () => {
+      // Arrange
+      const emailForm = await EmailFormModel.create({
+        title: 'new form',
+        responseMode: ResponseMode.Email,
+        emails: [defaultUser.email],
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${emailForm._id}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(400)
+      expect(response.body).toEqual({
+        message: 'Attempted to submit encrypt form to email endpoint',
+      })
+    })
+
+    it('should return 401 when user is not logged in', async () => {
+      // Arrange
+      await logoutSession(request)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${defaultForm._id}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(401)
+      expect(response.body).toEqual({ message: 'User is unauthorized.' })
+    })
+
+    it('should return 403 when user does not have read permissions to form', async () => {
+      // Arrange
+      const anotherUser = (
+        await dbHandler.insertFormCollectionReqs({
+          userId: new ObjectId(),
+          mailName: 'some-user',
+          shortName: 'someUser',
+        })
+      ).user
+      // Form that defaultUser has no access to.
+      const inaccessibleForm = await EncryptFormModel.create({
+        title: 'Collab form',
+        publicKey: 'some public key',
+        admin: anotherUser._id,
+        permissionList: [],
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${inaccessibleForm._id}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(403)
+      expect(response.body).toEqual({
+        message: expect.stringContaining(
+          'not authorized to perform read operation',
+        ),
+      })
+    })
+
+    it('should return 404 when form to download submissions for cannot be found', async () => {
+      // Arrange
+      const invalidFormId = new ObjectId().toHexString()
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${invalidFormId}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(404)
+      expect(response.body).toEqual({ message: 'Form not found' })
+    })
+
+    it('should return 410 when form to download submissions for is archived', async () => {
+      // Arrange
+      const archivedForm = await EncryptFormModel.create({
+        title: 'archived form',
+        status: Status.Archived,
+        responseMode: ResponseMode.Encrypt,
+        publicKey: 'does not matter',
+        admin: defaultUser._id,
+      })
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${archivedForm._id}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(410)
+      expect(response.body).toEqual({ message: 'Form has been archived' })
+    })
+
+    it('should return 422 when user in session cannot be retrieved from the database', async () => {
+      // Arrange
+      // Clear user collection
+      await dbHandler.clearCollection(UserModel.collection.name)
+
+      // Act
+      const response = await request.get(
+        `/admin/forms/${new ObjectId()}/submissions/download`,
+      )
+
+      // Assert
+      expect(response.status).toEqual(422)
+      expect(response.body).toEqual({ message: 'User not found' })
+    })
+  })
+})
+
+// Helper utils
+const createSubmission = ({
+  form,
+  encryptedContent,
+  verifiedContent,
+  attachmentMetadata,
+  created,
+}: {
+  form: IFormDocument
+  encryptedContent: string
+  attachmentMetadata?: Map<string, string>
+  verifiedContent?: string
+  created?: Date
+}) => {
+  return SubmissionModel.create({
+    submissionType: SubmissionType.Encrypt,
+    form: form._id,
+    authType: form.authType,
+    myInfoFields: form.getUniqueMyInfoAttrs(),
+    attachmentMetadata,
+    encryptedContent,
+    verifiedContent,
+    created,
+    version: 1,
+  })
+}
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
index f7db87c640..2b4060d407 100644
--- a/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.feedback.routes.ts
@@ -6,7 +6,7 @@ export const AdminFormsFeedbackRouter = Router()
 
 /**
  * Retrieve feedback for a public form
- * @route GET /api/v3/admim/forms/:formId/feedback
+ * @route GET /api/v3/admin/forms/:formId/feedback
  * @security session
  *
  * @returns 200 with feedback response
@@ -24,7 +24,7 @@ AdminFormsFeedbackRouter.get(
 
 /**
  * Count the number of feedback for a form
- * @route GET /api/v3/admim/forms/{formId}/feedback/count
+ * @route GET /api/v3/admin/forms/{formId}/feedback/count
  * @security session
  *
  * @returns 200 with feedback counts of given form
@@ -42,7 +42,7 @@ AdminFormsFeedbackRouter.get(
 
 /**
  * Stream download all feedback for a form
- * @route GET /api/v3/admim/forms/{formId}/feedback/download
+ * @route GET /api/v3/admin/forms/{formId}/feedback/download
  * @security session
  *
  * @returns 200 with feedback stream
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
index bb466328f1..20265addb0 100644
--- a/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.routes.ts
@@ -4,6 +4,7 @@ import { withUserAuthentication } from '../../../../../modules/auth/auth.middlew
 
 import { AdminFormsFeedbackRouter } from './admin-forms.feedback.routes'
 import { AdminFormsSettingsRouter } from './admin-forms.settings.routes'
+import { AdminFormsSubmissionsRouter } from './admin-forms.submissions.routes'
 
 export const AdminFormsRouter = Router()
 
@@ -12,3 +13,4 @@ AdminFormsRouter.use(withUserAuthentication)
 
 AdminFormsRouter.use(AdminFormsSettingsRouter)
 AdminFormsRouter.use(AdminFormsFeedbackRouter)
+AdminFormsRouter.use(AdminFormsSubmissionsRouter)
diff --git a/src/app/routes/api/v3/admin/forms/admin-forms.submissions.routes.ts b/src/app/routes/api/v3/admin/forms/admin-forms.submissions.routes.ts
new file mode 100644
index 0000000000..7cdab1489a
--- /dev/null
+++ b/src/app/routes/api/v3/admin/forms/admin-forms.submissions.routes.ts
@@ -0,0 +1,43 @@
+import { Router } from 'express'
+
+import * as AdminFormController from '../../../../../modules/form/admin-form/admin-form.controller'
+import * as EncryptSubmissionController from '../../../../../modules/submission/encrypt-submission/encrypt-submission.controller'
+
+export const AdminFormsSubmissionsRouter = Router()
+
+/**
+ * Count the number of submissions for a form
+ * @route GET /:formId/submissions/count
+ * @security session
+ *
+ * @returns 200 with submission counts of given form
+ * @returns 400 when query.startDate or query.endDate is malformed
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have permissions to access form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 when database error occurs
+ */
+AdminFormsSubmissionsRouter.route(
+  '/:formId([a-fA-F0-9]{24})/submissions/count',
+).get(AdminFormController.handleCountFormSubmissions)
+
+/**
+ * Stream download all encrypted responses for a form
+ * @route GET /:formId/submissions/download
+ * @security session
+ *
+ * @returns 200 with stream of encrypted responses
+ * @returns 400 if form is not an encrypt mode form
+ * @returns 400 when Joi validation fails
+ * @returns 401 when user does not exist in session
+ * @returns 403 when user does not have read permissions for form
+ * @returns 404 when form cannot be found
+ * @returns 410 when form is archived
+ * @returns 422 when user in session cannot be retrieved from the database
+ * @returns 500 if any errors occurs in stream pipeline or error retrieving form
+ */
+AdminFormsSubmissionsRouter.route(
+  '/:formId([a-fA-F0-9]{24})/submissions/download',
+).get(EncryptSubmissionController.handleStreamEncryptedResponses)
diff --git a/src/public/modules/forms/services/submissions.client.factory.js b/src/public/modules/forms/services/submissions.client.factory.js
index 744005024f..17c9208f6a 100644
--- a/src/public/modules/forms/services/submissions.client.factory.js
+++ b/src/public/modules/forms/services/submissions.client.factory.js
@@ -46,8 +46,14 @@ function SubmissionsFactory(
   const publicSubmitUrl = '/v2/submissions/:responseMode/:formId'
   const previewSubmitUrl = '/v2/submissions/:responseMode/preview/:formId'
 
+  const ADMIN_FORMS_PREFIX = '/api/v3/admin/forms'
+
   const generateDownloadUrl = (params, downloadAttachments) => {
-    let resUrl = `${fixParamsToUrl(params, submitAdminUrl)}/download?`
+    // NOTE: The ? is appended behind to ensure that the query parameters in url are constructed correctly
+    let resUrl = `${fixParamsToUrl(
+      params,
+      `${ADMIN_FORMS_PREFIX}/:formId/submissions/download?`,
+    )}`
     if (params.startDate && params.endDate) {
       resUrl += `startDate=${params.startDate}&endDate=${params.endDate}&`
     }
@@ -159,7 +165,10 @@ function SubmissionsFactory(
     },
     count: function (params) {
       const deferred = $q.defer()
-      let resUrl = fixParamsToUrl(params, submitAdminUrl) + '/count'
+      let resUrl = fixParamsToUrl(
+        params,
+        `${ADMIN_FORMS_PREFIX}/:formId/submissions/count`,
+      )
       if (params.startDate && params.endDate) {
         resUrl += `?startDate=${params.startDate}&endDate=${params.endDate}`
       }

From 9f0930e6665a5e635fe6187e031c3c5ea50dfc41 Mon Sep 17 00:00:00 2001
From: Kar Rui Lau <karrui.lau@gmail.com>
Date: Thu, 15 Apr 2021 09:40:48 +0800
Subject: [PATCH 75/75] fix: merge conflict from merging with develop

---
 .../__tests__/admin-form.routes.spec.ts       | 38 -------------------
 1 file changed, 38 deletions(-)

diff --git a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
index 7c96aee8ad..6f899d413f 100644
--- a/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
+++ b/src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts
@@ -4205,44 +4205,6 @@ describe('admin-form.routes', () => {
       )
     })
 
-    it('should return 200 with counts of submissions made with same start and end dates.', async () => {
-      // Arrange
-      const expectedSubmissionCount = 3
-      const newForm = (await EmailFormModel.create({
-        title: 'new form',
-        responseMode: ResponseMode.Email,
-        emails: [defaultUser.email],
-        admin: defaultUser._id,
-      })) as IPopulatedEmailForm
-      // Insert submissions
-      const mockSubmissionHash: SubmissionHash = {
-        hash: 'some hash',
-        salt: 'some salt',
-      }
-      const results = await Promise.all(
-        times(expectedSubmissionCount, () =>
-          saveSubmissionMetadata(newForm, mockSubmissionHash),
-        ),
-      )
-      // Update first submission to be 5 days ago.
-      const expectedDate = subDays(new Date(), 5)
-      const firstSubmission = results[0]._unsafeUnwrap()
-      firstSubmission.created = expectedDate
-      await firstSubmission.save()
-
-      // Act
-      const response = await request
-        .get(`/${newForm._id}/adminform/submissions/count`)
-        .query({
-          startDate: format(expectedDate, 'yyyy-MM-dd'),
-          endDate: format(expectedDate, 'yyyy-MM-dd'),
-        })
-
-      // Assert
-      expect(response.status).toEqual(200)
-      expect(response.body).toEqual(1)
-    })
-
     it('should return 400 when query.endDate is before query.startDate', async () => {
       // Arrange
       const newForm = await EncryptFormModel.create({