@flusys/nestjs-form-builder 6.0.2 → 6.1.0

package/cjs/services/form.service.spec.js

@@ -0,0 +1,746 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _testing = require("@nestjs/testing");
+const _nestjscore = require("@flusys/nestjs-core");
+const _modules = require("@flusys/nestjs-shared/modules");
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _entities = require("../entities");
+const _formaccesstypeenum = require("../enums/form-access-type.enum");
+const _permissionutils = /*#__PURE__*/ _interop_require_wildcard(require("../utils/permission.utils"));
+const _formservice = require("./form.service");
+const _formbuilderconfigservice = require("./form-builder-config.service");
+const _formbuilderdatasourceprovider = require("./form-builder-datasource.provider");
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+jest.mock('../utils/permission.utils', ()=>({
+        validateUserPermissions: jest.fn()
+    }));
+function buildForm(overrides = {}) {
+    return {
+        id: 'form-uuid-1',
+        name: 'Customer Survey',
+        description: null,
+        slug: 'customer-survey',
+        schema: {
+            sections: [],
+            settings: {}
+        },
+        schemaVersion: 1,
+        accessType: _formaccesstypeenum.FormAccessType.AUTHENTICATED,
+        actionGroups: null,
+        tags: null,
+        isActive: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+describe('FormService', ()=>{
+    let service;
+    let mockRepo;
+    let mockFormBuilderConfig;
+    async function buildService(companyFeatureEnabled = false) {
+        mockRepo = (0, _repositorymock.createMockRepository)();
+        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
+        mockFormBuilderConfig = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(companyFeatureEnabled)
+        };
+        const module = await _testing.Test.createTestingModule({
+            providers: [
+                _formservice.FormService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: _modules.UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: _formbuilderconfigservice.FormBuilderConfigService,
+                    useValue: mockFormBuilderConfig
+                },
+                {
+                    provide: _formbuilderdatasourceprovider.FormBuilderDataSourceProvider,
+                    useValue: mockDataSourceProvider
+                }
+            ]
+        }).compile();
+        service = await module.resolve(_formservice.FormService);
+        // Pre-warm the lazily-initialized repository so protected/public helper methods
+        // that read `this.repository` directly (outside the insert/update pipeline) work in tests.
+        await service.ensureDataSourceRepository();
+    }
+    afterEach(()=>{
+        jest.clearAllMocks();
+    });
+    describe('resolveEntity', ()=>{
+        it('resolves to Form when company feature disabled', async ()=>{
+            await buildService(false);
+            expect(service.resolveEntity()).toBe(_entities.Form);
+        });
+        it('resolves to FormWithCompany when company feature enabled', async ()=>{
+            await buildService(true);
+            expect(service.resolveEntity()).toBe(_entities.FormWithCompany);
+        });
+    });
+    // ==========================================================================
+    // convertSingleDtoToEntity — schema versioning + company scoping
+    // ==========================================================================
+    describe('convertSingleDtoToEntity', ()=>{
+        describe('create (no id)', ()=>{
+            it('merges the DTO fields into a fresh entity without touching the repository', async ()=>{
+                await buildService(false);
+                const result = await service.convertSingleDtoToEntity({
+                    name: 'New Form',
+                    schema: {
+                        sections: []
+                    }
+                }, (0, _loggedusermock.buildMockUser)());
+                expect(result.name).toBe('New Form');
+                expect(mockRepo.findOne).not.toHaveBeenCalled();
+            });
+            it('sets companyId from the DTO when company feature enabled and DTO provides it', async ()=>{
+                await buildService(true);
+                const result = await service.convertSingleDtoToEntity({
+                    name: 'New Form',
+                    schema: {},
+                    companyId: 'company-explicit'
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBe('company-explicit');
+            });
+            it('falls back to the user companyId when company feature enabled and DTO omits it', async ()=>{
+                await buildService(true);
+                const result = await service.convertSingleDtoToEntity({
+                    name: 'New Form',
+                    schema: {}
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBe('company-from-user');
+            });
+            it('sets companyId to null when company feature enabled, no DTO value, and no user', async ()=>{
+                await buildService(true);
+                const result = await service.convertSingleDtoToEntity({
+                    name: 'New Form',
+                    schema: {}
+                }, null);
+                expect(result.companyId).toBeNull();
+            });
+            it('does not set companyId when company feature is disabled', async ()=>{
+                await buildService(false);
+                const result = await service.convertSingleDtoToEntity({
+                    name: 'New Form',
+                    schema: {}
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBeUndefined();
+            });
+        });
+        describe('update (with id)', ()=>{
+            it('throws NotFoundException when the form does not exist', async ()=>{
+                await buildService(false);
+                mockRepo.findOne.mockResolvedValue(null);
+                await expect(service.convertSingleDtoToEntity({
+                    id: 'missing-id',
+                    schema: {}
+                }, (0, _loggedusermock.buildMockUser)())).rejects.toMatchObject({
+                    response: expect.objectContaining({
+                        messageKey: 'form.not.found'
+                    })
+                });
+            });
+            it('bumps schemaVersion when the schema payload differs from the stored schema', async ()=>{
+                await buildService(false);
+                const existing = buildForm({
+                    id: 'form-1',
+                    schemaVersion: 3,
+                    schema: {
+                        a: 1
+                    }
+                });
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    schema: {
+                        a: 2
+                    }
+                }, (0, _loggedusermock.buildMockUser)());
+                expect(result.schemaVersion).toBe(4);
+            });
+            it('does not bump schemaVersion when the schema payload is unchanged', async ()=>{
+                await buildService(false);
+                const existing = buildForm({
+                    id: 'form-1',
+                    schemaVersion: 3,
+                    schema: {
+                        a: 1
+                    }
+                });
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    schema: {
+                        a: 1
+                    }
+                }, (0, _loggedusermock.buildMockUser)());
+                expect(result.schemaVersion).toBe(3);
+            });
+            it('does not bump schemaVersion when the DTO omits schema entirely', async ()=>{
+                await buildService(false);
+                const existing = buildForm({
+                    id: 'form-1',
+                    schemaVersion: 3,
+                    schema: {
+                        a: 1
+                    }
+                });
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    name: 'Renamed'
+                }, (0, _loggedusermock.buildMockUser)());
+                expect(result.schemaVersion).toBe(3);
+                expect(result.name).toBe('Renamed');
+            });
+            it('uses the DTO companyId when explicitly provided on update (company feature enabled)', async ()=>{
+                await buildService(true);
+                const existing = buildForm({
+                    id: 'form-1'
+                });
+                existing.companyId = 'company-original';
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    companyId: 'company-new'
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBe('company-new');
+            });
+            it('preserves the existing companyId when the update DTO omits it', async ()=>{
+                await buildService(true);
+                const existing = buildForm({
+                    id: 'form-1'
+                });
+                existing.companyId = 'company-original';
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    name: 'Renamed'
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBe('company-original');
+            });
+            it('falls back to the user companyId when the existing form has no companyId set', async ()=>{
+                await buildService(true);
+                // Simulate a stored Form (not FormWithCompany) — companyId is undefined on the entity.
+                const existing = buildForm({
+                    id: 'form-1'
+                });
+                mockRepo.findOne.mockResolvedValue(existing);
+                const result = await service.convertSingleDtoToEntity({
+                    id: 'form-1',
+                    name: 'Renamed'
+                }, (0, _loggedusermock.buildMockUser)({
+                    companyId: 'company-from-user'
+                }));
+                expect(result.companyId).toBe('company-from-user');
+            });
+        });
+    });
+    // ==========================================================================
+    // getSelectQuery
+    // ==========================================================================
+    describe('getSelectQuery', ()=>{
+        it('applies the default field list, prefixed with the entity name', async ()=>{
+            await buildService(false);
+            const query = {
+                select: jest.fn().mockReturnThis()
+            };
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), undefined);
+            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'form.id',
+                'form.name',
+                'form.schema',
+                'form.schemaVersion'
+            ]));
+        });
+        it('appends form.companyId to the default fields when company feature is enabled', async ()=>{
+            await buildService(true);
+            const query = {
+                select: jest.fn().mockReturnThis()
+            };
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), undefined);
+            const selectedFields = query.select.mock.calls[0][0];
+            expect(selectedFields).toContain('form.companyId');
+        });
+        it('appends form.companyId even when a custom select list is provided', async ()=>{
+            await buildService(true);
+            const query = {
+                select: jest.fn().mockReturnThis()
+            };
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), [
+                'name'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'form.name',
+                'form.companyId'
+            ]);
+        });
+        it('does not append companyId when company feature is disabled with a custom select', async ()=>{
+            await buildService(false);
+            const query = {
+                select: jest.fn().mockReturnThis()
+            };
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), [
+                'name'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'form.name'
+            ]);
+        });
+    });
+    // ==========================================================================
+    // getFilterQuery — tag filtering across DB drivers
+    // ==========================================================================
+    describe('getFilterQuery', ()=>{
+        function buildQueryStub() {
+            return {
+                andWhere: jest.fn().mockReturnThis()
+            };
+        }
+        it('delegates directly to the base filter query when no tags filter is present', async ()=>{
+            await buildService(false);
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                isActive: true
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('form.isActive = :value', {
+                value: true
+            });
+        });
+        it('ignores an empty tags array (no tag filter applied)', async ()=>{
+            await buildService(false);
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: []
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+        it('coerces a single non-array tag value into a one-item list', async ()=>{
+            await buildService(false);
+            jest.spyOn(_nestjscore.envConfig, 'getTypeOrmConfig').mockReturnValue({
+                type: 'mysql'
+            });
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: 'survey'
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('JSON_CONTAINS(form.tags, :tagValues)', {
+                tagValues: JSON.stringify([
+                    'survey'
+                ])
+            });
+        });
+        it('uses jsonb containment for postgres', async ()=>{
+            await buildService(false);
+            jest.spyOn(_nestjscore.envConfig, 'getTypeOrmConfig').mockReturnValue({
+                type: 'postgres'
+            });
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: [
+                    'survey',
+                    'review'
+                ]
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('form.tags @> :tagValues::jsonb', {
+                tagValues: JSON.stringify([
+                    'survey',
+                    'review'
+                ])
+            });
+        });
+        it('uses JSON_CONTAINS for mysql', async ()=>{
+            await buildService(false);
+            jest.spyOn(_nestjscore.envConfig, 'getTypeOrmConfig').mockReturnValue({
+                type: 'mysql'
+            });
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: [
+                    'survey',
+                    'review'
+                ]
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('JSON_CONTAINS(form.tags, :tagValues)', {
+                tagValues: JSON.stringify([
+                    'survey',
+                    'review'
+                ])
+            });
+        });
+        it('falls back to per-tag LIKE matching for other drivers (e.g. sqlite)', async ()=>{
+            await buildService(false);
+            jest.spyOn(_nestjscore.envConfig, 'getTypeOrmConfig').mockReturnValue({
+                type: 'sqlite'
+            });
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: [
+                    'survey',
+                    'review'
+                ]
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('form.tags LIKE :tagValue0', {
+                tagValue0: '%"survey"%'
+            });
+            expect(query.andWhere).toHaveBeenCalledWith('form.tags LIKE :tagValue1', {
+                tagValue1: '%"review"%'
+            });
+        });
+        it('still applies remaining (non-tag) filters alongside the tag filter', async ()=>{
+            await buildService(false);
+            jest.spyOn(_nestjscore.envConfig, 'getTypeOrmConfig').mockReturnValue({
+                type: 'mysql'
+            });
+            const query = buildQueryStub();
+            await service.getFilterQuery(query, {
+                tags: [
+                    'survey'
+                ],
+                isActive: true
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(query.andWhere).toHaveBeenCalledWith('form.isActive = :value', {
+                value: true
+            });
+            expect(query.andWhere).toHaveBeenCalledWith('JSON_CONTAINS(form.tags, :tagValues)', {
+                tagValues: JSON.stringify([
+                    'survey'
+                ])
+            });
+        });
+    });
+    // ==========================================================================
+    // getExtraManipulateQuery — company scoping
+    // ==========================================================================
+    describe('getExtraManipulateQuery', ()=>{
+        it('applies a company filter when company feature is enabled and user has a companyId', async ()=>{
+            await buildService(true);
+            const query = {
+                andWhere: jest.fn().mockReturnThis()
+            };
+            await service.getExtraManipulateQuery(query, {}, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).toHaveBeenCalledWith('form.companyId = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('does not filter by company when company feature is disabled', async ()=>{
+            await buildService(false);
+            const query = {
+                andWhere: jest.fn().mockReturnThis()
+            };
+            await service.getExtraManipulateQuery(query, {}, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+        it('does not filter by company when the user has no companyId', async ()=>{
+            await buildService(true);
+            const query = {
+                andWhere: jest.fn().mockReturnThis()
+            };
+            await service.getExtraManipulateQuery(query, {}, (0, _loggedusermock.buildMockUser)({
+                companyId: undefined
+            }));
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+    });
+    // ==========================================================================
+    // convertEntityToResponseDto
+    // ==========================================================================
+    describe('convertEntityToResponseDto', ()=>{
+        it('maps entity fields to the response shape and defaults companyId to null', async ()=>{
+            await buildService(false);
+            const entity = buildForm();
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto).toMatchObject({
+                id: entity.id,
+                name: entity.name,
+                companyId: null
+            });
+        });
+        it('carries through companyId when present on the entity', async ()=>{
+            await buildService(true);
+            const entity = buildForm();
+            entity.companyId = 'company-1';
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto.companyId).toBe('company-1');
+        });
+    });
+    // ==========================================================================
+    // Public form access
+    // ==========================================================================
+    describe('getPublicForm', ()=>{
+        it('returns the public projection of an active public form', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.PUBLIC
+            }));
+            const result = await service.getPublicForm('form-uuid-1');
+            expect(result).toEqual({
+                id: 'form-uuid-1',
+                name: 'Customer Survey',
+                description: null,
+                schema: {
+                    sections: [],
+                    settings: {}
+                },
+                schemaVersion: 1
+            });
+        });
+        it('throws NotFoundException when the form is missing, inactive, or not public', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.getPublicForm('missing')).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.not.public'
+                })
+            });
+        });
+    });
+    describe('getFormForSubmission', ()=>{
+        it('throws NotFoundException when the form does not exist or is inactive', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.getFormForSubmission('missing', null)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.not.found'
+                })
+            });
+        });
+        it('allows anonymous access to PUBLIC forms', async ()=>{
+            await buildService(false);
+            const form = buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.PUBLIC
+            });
+            mockRepo.findOne.mockResolvedValue(form);
+            const result = await service.getFormForSubmission('form-uuid-1', null);
+            expect(result).toBe(form);
+        });
+        it('requires authentication for non-public forms', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.AUTHENTICATED
+            }));
+            await expect(service.getFormForSubmission('form-uuid-1', null)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.auth.required'
+                })
+            });
+        });
+        it('allows an authenticated user to access an AUTHENTICATED form', async ()=>{
+            await buildService(false);
+            const form = buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.AUTHENTICATED
+            });
+            mockRepo.findOne.mockResolvedValue(form);
+            const result = await service.getFormForSubmission('form-uuid-1', (0, _loggedusermock.buildMockUser)());
+            expect(result).toBe(form);
+        });
+        it('allows an authenticated user to access an ACTION_GROUP form (permission check deferred)', async ()=>{
+            await buildService(false);
+            const form = buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: [
+                    'hr.submit'
+                ]
+            });
+            mockRepo.findOne.mockResolvedValue(form);
+            const result = await service.getFormForSubmission('form-uuid-1', (0, _loggedusermock.buildMockUser)());
+            expect(result).toBe(form);
+        });
+        it('throws BadRequestException for an unrecognized access type', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: 'weird'
+            }));
+            await expect(service.getFormForSubmission('form-uuid-1', (0, _loggedusermock.buildMockUser)())).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.invalid.access.type'
+                })
+            });
+        });
+    });
+    describe('getBySlug', ()=>{
+        it('returns the form response DTO when found', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                slug: 'customer-survey'
+            }));
+            const result = await service.getBySlug('customer-survey');
+            expect(result?.slug).toBe('customer-survey');
+        });
+        it('returns null when the slug does not match any form', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(null);
+            const result = await service.getBySlug('missing-slug');
+            expect(result).toBeNull();
+        });
+    });
+    describe('getPublicFormBySlug', ()=>{
+        it('returns the public projection when found', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.PUBLIC,
+                slug: 'public-slug'
+            }));
+            const result = await service.getPublicFormBySlug('public-slug');
+            expect(result).toEqual(expect.objectContaining({
+                id: 'form-uuid-1',
+                name: 'Customer Survey'
+            }));
+        });
+        it('returns null when no public active form matches the slug', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(null);
+            const result = await service.getPublicFormBySlug('missing-slug');
+            expect(result).toBeNull();
+        });
+    });
+    describe('getFormAccessInfo', ()=>{
+        it('returns access metadata for an existing form', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: [
+                    'hr.submit'
+                ]
+            }));
+            const result = await service.getFormAccessInfo('form-uuid-1');
+            expect(result).toEqual({
+                id: 'form-uuid-1',
+                name: 'Customer Survey',
+                description: null,
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: [
+                    'hr.submit'
+                ],
+                isActive: true
+            });
+        });
+        it('throws NotFoundException when the form does not exist', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.getFormAccessInfo('missing')).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.not.found'
+                })
+            });
+        });
+    });
+    describe('getAuthenticatedForm', ()=>{
+        it('returns the public projection for an AUTHENTICATED form without checking permissions', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.AUTHENTICATED
+            }));
+            const result = await service.getAuthenticatedForm('form-uuid-1', (0, _loggedusermock.buildMockUser)());
+            expect(result.id).toBe('form-uuid-1');
+            expect(_permissionutils.validateUserPermissions).not.toHaveBeenCalled();
+        });
+        it('returns the form when the user has one of the required action-group permissions', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: [
+                    'hr.submit'
+                ]
+            }));
+            _permissionutils.validateUserPermissions.mockResolvedValue(true);
+            const result = await service.getAuthenticatedForm('form-uuid-1', (0, _loggedusermock.buildMockUser)());
+            expect(result.id).toBe('form-uuid-1');
+            expect(_permissionutils.validateUserPermissions).toHaveBeenCalledWith(expect.any(Object), [
+                'hr.submit'
+            ], expect.anything(), false);
+        });
+        it('throws ForbiddenException when the user lacks all action-group permissions', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: [
+                    'hr.submit'
+                ]
+            }));
+            _permissionutils.validateUserPermissions.mockResolvedValue(false);
+            await expect(service.getAuthenticatedForm('form-uuid-1', (0, _loggedusermock.buildMockUser)())).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: 'form.access.denied'
+                })
+            });
+        });
+        it('skips the permission check when an ACTION_GROUP form has no configured action groups', async ()=>{
+            await buildService(false);
+            mockRepo.findOne.mockResolvedValue(buildForm({
+                accessType: _formaccesstypeenum.FormAccessType.ACTION_GROUP,
+                actionGroups: []
+            }));
+            const result = await service.getAuthenticatedForm('form-uuid-1', (0, _loggedusermock.buildMockUser)());
+            expect(result.id).toBe('form-uuid-1');
+            expect(_permissionutils.validateUserPermissions).not.toHaveBeenCalled();
+        });
+    });
+});