@oneuptime/common 14.0.12 → 14.0.14

package/Tests/Server/Services/IncidentFormPostgres.test.ts

@@ -1,19 +1,32 @@
 import Entities from "../../../Models/DatabaseModels/Index";
-import IncidentForm from "../../../Models/DatabaseModels/IncidentForm";
-import IncidentFormSubmission from "../../../Models/DatabaseModels/IncidentFormSubmission";
+import File from "../../../Models/DatabaseModels/File";
+import Form from "../../../Models/DatabaseModels/Form";
+import FormSubmission from "../../../Models/DatabaseModels/FormSubmission";
 import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import FileService, { FileFacts } from "../../../Server/Services/FileService";
+import FormService from "../../../Server/Services/FormService";
+import FormSubmissionService from "../../../Server/Services/FormSubmissionService";
 import IncidentCustomFieldService from "../../../Server/Services/IncidentCustomFieldService";
-import IncidentFormService from "../../../Server/Services/IncidentFormService";
-import IncidentFormSubmissionService from "../../../Server/Services/IncidentFormSubmissionService";
-import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import Email from "../../../Types/Email";
-import { IncidentFormFieldSetting } from "../../../Types/Incident/IncidentFormPublic";
+import MimeType from "../../../Types/File/MimeType";
+import {
+  FORM_FAVICON_NOT_FOUND_MESSAGE,
+  FORM_LOGO_MAX_BYTES,
+  FORM_LOGO_NOT_FOUND_MESSAGE,
+  FORM_LOGO_TOO_LARGE_MESSAGE,
+  FORM_LOGO_TYPE_MESSAGE,
+  PublicFormImage,
+} from "../../../Types/Form/FormBranding";
+import { PublicForm } from "../../../Types/Form/FormPublic";
+import {
+  FormField,
+  FormFieldSource,
+  getDefaultFormFields,
+} from "../../../Types/Form/FormField";
+import FormTargetType from "../../../Types/Form/FormTargetType";
+import { JSONArray } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
-import Permission, {
-  UserTenantAccessPermission,
-} from "../../../Types/Permission";
-import UserType from "../../../Types/UserType";
 import {
   afterAll,
   beforeAll,
@@ -26,6 +39,8 @@ import {
 import { DataSource } from "typeorm";
 
 /*
+ * Forms (which replaced incident forms) against a migrated Postgres.
+ *
  * Opt in with RUN_POSTGRES_INCIDENT_FORM_TESTS=true against a database the
  * registered migrations have been applied to, e.g.
  *
@@ -36,26 +51,31 @@ import { DataSource } from "typeorm";
  *
  * CI runs it in .github/workflows/postgres-schema-drift.yaml ("Test incident
  * forms on migrated Postgres"), right after that job has applied every
- * registered migration to an empty database. The Common test job's Postgres
+ * registered migration to an empty database - which is why the file and the
+ * variables keep their incident-form names. The Common test job's Postgres
  * is not migrated, so the suite is skipped there.
  *
  * Two halves:
  *
  * - the migrated public tables are inspected as they are: every foreign
- *   key's ON DELETE rule, the link key's unique constraint, and the columns
- *   a fake QueryRunner cannot prove are what Postgres ended up with;
+ *   key's ON DELETE rule, the link key's unique constraint, the columns'
+ *   defaults, and that the incident form tables are gone;
  * - behaviour runs in a uniquely named schema holding structure-only clones
  *   of the tables involved. The clones carry the migrated indexes and
- *   constraints (LIKE ... INCLUDING ALL), and the two new tables' foreign
+ *   constraints (LIKE ... INCLUDING ALL), and the two form tables' foreign
  *   keys are copied from the migrated definitions, so a cascade observed
  *   here is the cascade the migration declared. No row is ever written
  *   outside that schema, and the schema is dropped afterwards.
  *
- * The production IncidentFormService and IncidentFormSubmissionService run
- * against the clones; only realtime and workflow triggers are stubbed.
- * Privacy clauses reference the owner and team tables, which are not
- * cloned: they resolve to the migrated public tables through the search
- * path, where a member with a freshly generated id owns nothing.
+ * The production FormService and FormSubmissionService run against the
+ * clones; only realtime and workflow triggers are stubbed (and, for the
+ * public read, the plan check, which reads billing this suite has none of).
+ *
+ * A form's branding - its logo and favicon, Files - runs here too: the
+ * project an upload is stamped with, the check of the File a write names
+ * (its type, size and project, measured in Postgres), the public read that
+ * joins the form's own files in the one lookup and checks their project
+ * again, and that deleting a file only takes it off the form.
  */
 // describe.skip's type is the one both branches share.
 const describePostgres: typeof describe.skip =
@@ -66,15 +86,15 @@ const describePostgres: typeof describe.skip =
 const TABLES: Array<string> = [
   "Project",
   "User",
-  "IncidentSeverity",
-  "IncidentTemplate",
+  "File",
   "Incident",
+  "ScheduledMaintenance",
   "IncidentCustomField",
-  "IncidentForm",
-  "IncidentFormSubmission",
+  "Form",
+  "FormSubmission",
 ];
 
-const NEW_TABLES: Array<string> = ["IncidentForm", "IncidentFormSubmission"];
+const NEW_TABLES: Array<string> = ["Form", "FormSubmission"];
 
 interface ForeignKeyRow {
   table: string;
@@ -85,8 +105,8 @@ interface ForeignKeyRow {
   definition: string;
 }
 
-describePostgres("Incident forms against a migrated Postgres", () => {
-  const schema: string = `incident_form_${ObjectID.generate()
+describePostgres("Forms against a migrated Postgres", () => {
+  const schema: string = `form_${ObjectID.generate()
     .toString()
     .replace(/-/g, "")}`;
 
@@ -161,8 +181,8 @@ describePostgres("Incident forms against a migrated Postgres", () => {
     jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue(database);
 
     for (const service of [
-      IncidentFormService,
-      IncidentFormSubmissionService,
+      FormService,
+      FormSubmissionService,
       IncidentCustomFieldService,
     ] as Array<{
       onTriggerRealtime: unknown;
@@ -200,73 +220,103 @@ describePostgres("Incident forms against a migrated Postgres", () => {
   async function seedProject(id: ObjectID): Promise<void> {
     await database.query(
       `INSERT INTO "${schema}"."Project" ("_id", "name", "slug", "version")
-       VALUES ($1, 'Incident form test', $2, 1)`,
-      [id.toString(), `incident-form-${id.toString()}`],
+       VALUES ($1, 'Form test', $2, 1)`,
+      [id.toString(), `form-${id.toString()}`],
     );
   }
 
-  async function seedSeverity(
-    project: ObjectID = projectId,
-  ): Promise<ObjectID> {
+  async function seedIncident(): Promise<ObjectID> {
     const id: ObjectID = ObjectID.generate();
     await database.query(
-      `INSERT INTO "${schema}"."IncidentSeverity" ("_id", "projectId", "name", "slug", "color", "order", "version")
-       VALUES ($1, $2, 'High', $3, '#ff0000', 1, 1)`,
-      [id.toString(), project.toString(), `severity-${id.toString()}`],
+      `INSERT INTO "${schema}"."Incident"
+       ("_id", "projectId", "title", "slug", "currentIncidentStateId", "incidentSeverityId", "version")
+       VALUES ($1, $2, 'Checkout is failing', $3, $4, $5, 1)`,
+      [
+        id.toString(),
+        projectId.toString(),
+        `incident-${id.toString()}`,
+        ObjectID.generate().toString(),
+        ObjectID.generate().toString(),
+      ],
     );
     return id;
   }
 
-  async function seedTemplate(
-    project: ObjectID = projectId,
-  ): Promise<ObjectID> {
+  async function seedEvent(): Promise<ObjectID> {
     const id: ObjectID = ObjectID.generate();
     await database.query(
-      `INSERT INTO "${schema}"."IncidentTemplate" ("_id", "projectId", "title", "templateName", "templateDescription", "slug", "version")
-       VALUES ($1, $2, 'Possible data breach', 'Data breach', 'For security reports', $3, 1)`,
-      [id.toString(), project.toString(), `template-${id.toString()}`],
+      `INSERT INTO "${schema}"."ScheduledMaintenance"
+       ("_id", "projectId", "title", "slug", "currentScheduledMaintenanceStateId", "startsAt", "endsAt", "version")
+       VALUES ($1, $2, 'Database upgrade', $3, $4, now(), now() + interval '1 hour', 1)`,
+      [
+        id.toString(),
+        projectId.toString(),
+        `event-${id.toString()}`,
+        ObjectID.generate().toString(),
+      ],
     );
     return id;
   }
 
-  async function seedIncident(
-    options: { isPrivate?: boolean } = {},
+  async function seedCustomField(
+    project: ObjectID = projectId,
   ): Promise<ObjectID> {
     const id: ObjectID = ObjectID.generate();
     await database.query(
-      `INSERT INTO "${schema}"."Incident"
-       ("_id", "projectId", "title", "slug", "currentIncidentStateId", "incidentSeverityId", "isPrivate", "version")
-       VALUES ($1, $2, 'Checkout is failing', $3, $4, $5, $6, 1)`,
+      `INSERT INTO "${schema}"."IncidentCustomField"
+       ("_id", "projectId", "name", "customFieldType", "variableKey", "sortOrder", "version")
+       VALUES ($1, $2, $3, 'Text', $4, 1, 1)`,
       [
         id.toString(),
-        projectId.toString(),
-        `incident-${id.toString()}`,
-        ObjectID.generate().toString(),
-        ObjectID.generate().toString(),
-        Boolean(options.isPrivate),
+        project.toString(),
+        `Impact ${id.toString().slice(0, 8)}`,
+        `impact_${id.toString().replace(/-/g, "").slice(0, 8)}`,
       ],
     );
     return id;
   }
 
-  async function createForm(
-    data: Partial<IncidentForm> = {},
-  ): Promise<IncidentForm> {
-    const form: IncidentForm = new IncidentForm();
+  async function createForm(data: Partial<Form> = {}): Promise<Form> {
+    const form: Form = new Form();
     form.projectId = projectId;
     form.name = `Report ${ObjectID.generate().toString()}`;
-    form.incidentSeverityId = await seedSeverity();
     Object.assign(form, data);
 
-    return IncidentFormService.create({
+    return FormService.create({
       data: form,
       props: { isRoot: true },
     });
   }
 
+  /*
+   * A File row, as an upload leaves it: private, with its bytes and the
+   * project it was uploaded in (null for none, as every file from before
+   * files recorded one).
+   */
+  async function seedFile(
+    fileType: string,
+    bytes: Buffer,
+    project: ObjectID | null = projectId,
+  ): Promise<ObjectID> {
+    const id: ObjectID = ObjectID.generate();
+    await database.query(
+      `INSERT INTO "${schema}"."File"
+       ("_id", "name", "file", "fileType", "slug", "isPublic", "projectId", "version")
+       VALUES ($1, 'logo', $2, $3, $4, false, $5, 1)`,
+      [
+        id.toString(),
+        bytes,
+        fileType,
+        `logo-${id.toString()}`,
+        project ? project.toString() : null,
+      ],
+    );
+    return id;
+  }
+
   async function storedForm(id: ObjectID): Promise<Record<string, unknown>> {
     const rows: Array<Record<string, unknown>> = await database.query(
-      `SELECT * FROM "${schema}"."IncidentForm" WHERE "_id" = $1`,
+      `SELECT * FROM "${schema}"."Form" WHERE "_id" = $1`,
       [id.toString()],
     );
 
@@ -277,24 +327,29 @@ describePostgres("Incident forms against a migrated Postgres", () => {
 
   async function createSubmission(
     formId: ObjectID,
-    data: Partial<IncidentFormSubmission> = {},
-  ): Promise<IncidentFormSubmission> {
-    const submission: IncidentFormSubmission = new IncidentFormSubmission();
+    data: Partial<FormSubmission> = {},
+  ): Promise<FormSubmission> {
+    const submission: FormSubmission = new FormSubmission();
     submission.projectId = projectId;
-    submission.incidentFormId = formId;
+    submission.formId = formId;
     Object.assign(submission, data);
 
-    return IncidentFormSubmissionService.create({
+    return FormSubmissionService.create({
       data: submission,
       props: { isRoot: true },
     });
   }
 
   async function submissionRows(): Promise<
-    Array<{ _id: string; incidentId: string | null }>
+    Array<{
+      _id: string;
+      formId: string;
+      incidentId: string | null;
+      scheduledMaintenanceId: string | null;
+    }>
   > {
     return database.query(
-      `SELECT "_id", "incidentId" FROM "${schema}"."IncidentFormSubmission" ORDER BY "createdAt"`,
+      `SELECT "_id", "formId", "incidentId", "scheduledMaintenanceId" FROM "${schema}"."FormSubmission" ORDER BY "createdAt"`,
     );
   }
 
@@ -310,42 +365,12 @@ describePostgres("Incident forms against a migrated Postgres", () => {
     return "no error";
   }
 
-  // A member of the test project with one role, who owns nothing.
-  function memberProps(permission: Permission): DatabaseCommonInteractionProps {
-    const tenantPermission: UserTenantAccessPermission = {
-      projectId: projectId,
-      _type: "UserTenantAccessPermission",
-      permissions: [
-        {
-          _type: "UserPermission",
-          permission: permission,
-          labelIds: [],
-          isBlockPermission: false,
-        },
-      ],
-    };
-
-    return {
-      tenantId: projectId,
-      userId: ObjectID.generate(),
-      userType: UserType.User,
-      userTenantAccessPermission: {
-        [projectId.toString()]: tenantPermission,
-      },
-    };
-  }
-
-  // An incident viewer of the test project, who owns nothing.
-  function viewerProps(): DatabaseCommonInteractionProps {
-    return memberProps(Permission.IncidentViewer);
-  }
-
   describe("the migrated tables", () => {
-    test("a form goes with its project and outlives its severity, template and users", () => {
+    test("a form goes with its project and outlives its users", () => {
       expect(
         migratedForeignKeys
           .filter((foreignKey: ForeignKeyRow): boolean => {
-            return foreignKey.table === "IncidentForm";
+            return foreignKey.table === "Form";
           })
           .map((foreignKey: ForeignKeyRow): Array<string> => {
             return [
@@ -358,17 +383,18 @@ describePostgres("Incident forms against a migrated Postgres", () => {
         // confdeltype: c = CASCADE, n = SET NULL
         ["createdByUserId", "User", "n"],
         ["deletedByUserId", "User", "n"],
-        ["incidentSeverityId", "IncidentSeverity", "n"],
-        ["incidentTemplateId", "IncidentTemplate", "n"],
+        // A deleted logo or favicon only leaves the form without it.
+        ["faviconFileId", "File", "n"],
+        ["logoFileId", "File", "n"],
         ["projectId", "Project", "c"],
       ]);
     });
 
-    test("a submission goes with its project and its form, and outlives its incident", () => {
+    test("a submission goes with its project and its form, and outlives what it created", () => {
       expect(
         migratedForeignKeys
           .filter((foreignKey: ForeignKeyRow): boolean => {
-            return foreignKey.table === "IncidentFormSubmission";
+            return foreignKey.table === "FormSubmission";
           })
           .map((foreignKey: ForeignKeyRow): Array<string> => {
             return [
@@ -378,9 +404,10 @@ describePostgres("Incident forms against a migrated Postgres", () => {
             ];
           }),
       ).toEqual([
-        ["incidentFormId", "IncidentForm", "c"],
+        ["formId", "Form", "c"],
         ["incidentId", "Incident", "n"],
         ["projectId", "Project", "c"],
+        ["scheduledMaintenanceId", "ScheduledMaintenance", "n"],
       ]);
     });
 
@@ -390,7 +417,7 @@ describePostgres("Incident forms against a migrated Postgres", () => {
            FROM pg_constraint c
            JOIN pg_class t ON t.oid = c.conrelid
            JOIN pg_namespace n ON n.oid = t.relnamespace
-          WHERE n.nspname = 'public' AND t.relname = 'IncidentForm' AND c.contype = 'u'`,
+          WHERE n.nspname = 'public' AND t.relname = 'Form' AND c.contype = 'u'`,
       );
 
       expect(constraints).toEqual([{ definition: 'UNIQUE ("shareKey")' }]);
@@ -398,113 +425,91 @@ describePostgres("Incident forms against a migrated Postgres", () => {
       const columns: Array<{ is_nullable: string; data_type: string }> =
         await database.query(
           `SELECT is_nullable, data_type FROM information_schema.columns
-            WHERE table_schema = 'public' AND table_name = 'IncidentForm' AND column_name = 'shareKey'`,
+            WHERE table_schema = 'public' AND table_name = 'Form' AND column_name = 'shareKey'`,
         );
 
       expect(columns).toEqual([{ is_nullable: "NO", data_type: "uuid" }]);
     });
 
-    test("the columns start where the models say they do", async () => {
+    test("the columns start where the model says they do", async () => {
       const rows: Array<{
         column_name: string;
         is_nullable: string;
         column_default: string | null;
+        data_type: string;
       }> = await database.query(
-        `SELECT column_name, is_nullable, column_default FROM information_schema.columns
-          WHERE table_schema = 'public' AND table_name = 'IncidentForm'
-            AND column_name IN ('isEnabled', 'allowReporterToChooseSeverity', 'isReporterDetailsRequired', 'descriptionSetting', 'incidentSeverityId', 'incidentTemplateId', 'customFieldSettings')
+        `SELECT column_name, is_nullable, column_default, data_type FROM information_schema.columns
+          WHERE table_schema = 'public' AND table_name = 'Form'
+            AND column_name IN ('isEnabled', 'targetType', 'fields', 'targetSettings')
           ORDER BY column_name`,
       );
 
       expect(rows).toEqual([
         {
-          column_name: "allowReporterToChooseSeverity",
-          is_nullable: "NO",
-          column_default: "false",
-        },
-        {
-          column_name: "customFieldSettings",
+          column_name: "fields",
           is_nullable: "YES",
           column_default: null,
+          data_type: "jsonb",
         },
         {
-          column_name: "descriptionSetting",
+          column_name: "isEnabled",
           is_nullable: "NO",
-          column_default: "'Optional'::character varying",
-        },
-        {
-          column_name: "incidentSeverityId",
-          is_nullable: "YES",
-          column_default: null,
+          column_default: "true",
+          data_type: "boolean",
         },
         {
-          column_name: "incidentTemplateId",
+          column_name: "targetSettings",
           is_nullable: "YES",
           column_default: null,
+          data_type: "jsonb",
         },
         {
-          column_name: "isEnabled",
+          column_name: "targetType",
           is_nullable: "NO",
-          column_default: "true",
-        },
-        {
-          column_name: "isReporterDetailsRequired",
-          is_nullable: "NO",
-          column_default: "true",
+          column_default: "'Incident'::character varying",
+          data_type: "character varying",
         },
       ]);
     });
 
-    test("every existing template gets a nullable settings column with no default", async () => {
-      const rows: Array<{
-        data_type: string;
-        is_nullable: string;
-        column_default: string | null;
-      }> = await database.query(
-        `SELECT data_type, is_nullable, column_default FROM information_schema.columns
+    test("the incident form tables are gone; the templates keep their custom field settings", async () => {
+      const tables: Array<{ table_name: string }> = await database.query(
+        `SELECT table_name FROM information_schema.tables
+          WHERE table_schema = 'public' AND table_name IN ('IncidentForm', 'IncidentFormSubmission')`,
+      );
+
+      expect(tables).toEqual([]);
+
+      const settings: Array<{ data_type: string }> = await database.query(
+        `SELECT data_type FROM information_schema.columns
           WHERE table_schema = 'public' AND table_name = 'IncidentTemplate' AND column_name = 'customFieldSettings'`,
       );
 
-      expect(rows).toEqual([
-        { data_type: "jsonb", is_nullable: "YES", column_default: null },
-      ]);
+      expect(settings).toEqual([{ data_type: "jsonb" }]);
     });
   });
 
   describe("forms", () => {
-    test("a form is given its own link key, keeps its questions exactly as sent and starts with the column defaults", async () => {
+    test("a new form gets its own link key, creates incidents and asks its target's questions", async () => {
       const clientKey: ObjectID = ObjectID.generate();
-      const templateId: ObjectID = await seedTemplate();
-
-      const created: IncidentForm = await createForm({
-        shareKey: clientKey,
-        incidentTemplateId: templateId,
-        customFieldSettings: {
-          impact: "Required",
-          affected_location: "Optional",
-          customer: "Default",
-        },
-      });
 
+      const created: Form = await createForm({ shareKey: clientKey });
       const row: Record<string, unknown> = await storedForm(created.id!);
 
       expect(ObjectID.isValidUUID(String(row["shareKey"]))).toBe(true);
       expect(row["shareKey"]).not.toBe(clientKey.toString());
-      expect(row["customFieldSettings"]).toEqual({
-        impact: "Required",
-        affected_location: "Optional",
-        customer: "Default",
-      });
-      expect(row["incidentTemplateId"]).toBe(templateId.toString());
       expect(row["isEnabled"]).toBe(true);
-      expect(row["allowReporterToChooseSeverity"]).toBe(false);
-      expect(row["isReporterDetailsRequired"]).toBe(true);
-      expect(row["descriptionSetting"]).toBe(IncidentFormFieldSetting.Optional);
+      expect(row["targetType"]).toBe(FormTargetType.Incident);
+      expect(
+        (row["fields"] as Array<FormField>).map((field: FormField) => {
+          return field.targetField || field.submitterField;
+        }),
+      ).toEqual(["title", "description", "Name", "Email"]);
 
       // Read back through the model, the key is an ObjectID again.
-      const read: IncidentForm | null = await IncidentFormService.findOneById({
+      const read: Form | null = await FormService.findOneById({
         id: created.id!,
-        select: { shareKey: true, customFieldSettings: true },
+        select: { shareKey: true, fields: true },
         props: { isRoot: true },
       });
 
@@ -512,9 +517,27 @@ describePostgres("Incident forms against a migrated Postgres", () => {
       expect(read?.shareKey?.toString()).toBe(row["shareKey"]);
     });
 
+    test("keeps the questions and settings exactly as sent", async () => {
+      const fields: Array<FormField> = getDefaultFormFields(
+        FormTargetType.ScheduledMaintenance,
+      );
+
+      const created: Form = await createForm({
+        targetType: FormTargetType.ScheduledMaintenance,
+        fields: fields as unknown as JSONArray,
+        targetSettings: { showOnStatusPages: true },
+      });
+
+      const row: Record<string, unknown> = await storedForm(created.id!);
+
+      expect(row["fields"]).toEqual(JSON.parse(JSON.stringify(fields)));
+      expect(row["targetSettings"]).toEqual({ showOnStatusPages: true });
+      expect(row["targetType"]).toBe(FormTargetType.ScheduledMaintenance);
+    });
+
     test("no two forms share a key, and a key another form holds cannot be taken", async () => {
-      const first: IncidentForm = await createForm();
-      const second: IncidentForm = await createForm();
+      const first: Form = await createForm();
+      const second: Form = await createForm();
 
       const firstKey: string = String(
         (await storedForm(first.id!))["shareKey"],
@@ -526,7 +549,7 @@ describePostgres("Incident forms against a migrated Postgres", () => {
       expect(firstKey).not.toBe(secondKey);
 
       await expect(
-        IncidentFormService.updateOneById({
+        FormService.updateOneById({
           id: second.id!,
           data: { shareKey: new ObjectID(firstKey) },
           props: { isRoot: true },
@@ -539,7 +562,7 @@ describePostgres("Incident forms against a migrated Postgres", () => {
       expect(
         await sqlState(() => {
           return database.query(
-            `UPDATE "${schema}"."IncidentForm" SET "shareKey" = $1 WHERE "_id" = $2`,
+            `UPDATE "${schema}"."Form" SET "shareKey" = $1 WHERE "_id" = $2`,
             [firstKey, second.id!.toString()],
           );
         }),
@@ -547,11 +570,11 @@ describePostgres("Incident forms against a migrated Postgres", () => {
     });
 
     test("resetting the link stores the new key, and the old one no longer finds the form", async () => {
-      const form: IncidentForm = await createForm();
+      const form: Form = await createForm();
       const oldKey: string = String((await storedForm(form.id!))["shareKey"]);
       const newKey: ObjectID = ObjectID.generate();
 
-      await IncidentFormService.updateOneById({
+      await FormService.updateOneById({
         id: form.id!,
         data: { shareKey: newKey },
         props: { isRoot: true },
@@ -559,400 +582,429 @@ describePostgres("Incident forms against a migrated Postgres", () => {
 
       expect((await storedForm(form.id!))["shareKey"]).toBe(newKey.toString());
       expect(
-        await IncidentFormService.findOneBy({
+        await FormService.findOneBy({
           query: { shareKey: new ObjectID(oldKey) },
           select: { _id: true },
           props: { isRoot: true },
         }),
       ).toBeNull();
-      expect(
-        (
-          await IncidentFormService.findOneBy({
-            query: { shareKey: newKey },
-            select: { _id: true },
-            props: { isRoot: true },
-          })
-        )?.id?.toString(),
-      ).toBe(form.id!.toString());
     });
 
     test("a null key is refused by the database too", async () => {
-      const form: IncidentForm = await createForm();
+      const form: Form = await createForm();
 
       expect(
         await sqlState(() => {
           return database.query(
-            `UPDATE "${schema}"."IncidentForm" SET "shareKey" = NULL WHERE "_id" = $1`,
+            `UPDATE "${schema}"."Form" SET "shareKey" = NULL WHERE "_id" = $1`,
             [form.id!.toString()],
           );
         }),
       ).toBe("23502");
     });
 
-    test("a severity or template from another project is refused", async () => {
-      const foreignSeverityId: ObjectID = await seedSeverity(otherProjectId);
-      const foreignTemplateId: ObjectID = await seedTemplate(otherProjectId);
+    test("two forms of one project cannot share a name; another project's can", async () => {
+      await createForm({ name: "Report a Problem" });
 
       await expect(
-        createForm({ incidentSeverityId: foreignSeverityId }),
+        createForm({ name: "Report a Problem" }),
       ).rejects.toBeInstanceOf(BadDataException);
       await expect(
-        createForm({ incidentTemplateId: foreignTemplateId }),
+        createForm({ name: "Report a Problem", projectId: otherProjectId }),
+      ).resolves.toBeDefined();
+    });
+
+    test("a question linked to another project's custom field is refused, and nothing is stored", async () => {
+      const foreignFieldId: ObjectID = await seedCustomField(otherProjectId);
+
+      await expect(
+        createForm({
+          fields: [
+            {
+              id: "impact",
+              source: FormFieldSource.TargetCustomField,
+              customFieldId: foreignFieldId.toString(),
+              label: "Impact",
+              isRequired: false,
+            },
+          ] as unknown as JSONArray,
+        }),
       ).rejects.toBeInstanceOf(BadDataException);
 
       const rows: Array<{ count: string }> = await database.query(
-        `SELECT count(*)::text AS "count" FROM "${schema}"."IncidentForm"`,
+        `SELECT count(*)::text AS "count" FROM "${schema}"."Form"`,
       );
       expect(rows[0]!.count).toBe("0");
     });
 
-    test("deleting its severity clears it, and the form stays", async () => {
-      const form: IncidentForm = await createForm();
-      const severityId: string = String(
-        (await storedForm(form.id!))["incidentSeverityId"],
-      );
-
-      await database.query(
-        `DELETE FROM "${schema}"."IncidentSeverity" WHERE "_id" = $1`,
-        [severityId],
-      );
+    /*
+     * Forms name a custom field by its id. Deleting the field leaves the
+     * question where it is - the builder shows it as one to delete, and the
+     * public page leaves it out - so the forms are not touched at all.
+     */
+    test("deleting a custom field leaves the forms that ask it untouched", async () => {
+      const fieldId: ObjectID = await seedCustomField();
+
+      const form: Form = await createForm({
+        fields: [
+          {
+            id: "impact",
+            source: FormFieldSource.TargetCustomField,
+            customFieldId: fieldId.toString(),
+            label: "Impact",
+            isRequired: true,
+          },
+        ] as unknown as JSONArray,
+      });
 
-      expect((await storedForm(form.id!))["incidentSeverityId"]).toBeNull();
-    });
+      const before: Record<string, unknown> = await storedForm(form.id!);
 
-    test("deleting its template clears it, and the form stays", async () => {
-      const templateId: ObjectID = await seedTemplate();
-      const form: IncidentForm = await createForm({
-        incidentTemplateId: templateId,
+      await IncidentCustomFieldService.deleteOneById({
+        id: fieldId,
+        props: { isRoot: true },
       });
 
-      await database.query(
-        `DELETE FROM "${schema}"."IncidentTemplate" WHERE "_id" = $1`,
-        [templateId.toString()],
-      );
+      const after: Record<string, unknown> = await storedForm(form.id!);
 
-      expect((await storedForm(form.id!))["incidentTemplateId"]).toBeNull();
+      expect(after["fields"]).toEqual(before["fields"]);
+      expect(after["version"]).toBe(before["version"]);
     });
   });
 
-  /*
-   * A form asks custom fields by template key, and a field created again
-   * gets its old key back. Deleting a field must take it off the forms, or
-   * the new field would appear on every public form that asked the old one.
-   */
-  describe("deleting a custom field", () => {
-    async function seedField(data: {
-      name: string;
-      variableKey: string;
-      customFieldType?: string;
-      dropdownOptions?: string;
-    }): Promise<ObjectID> {
-      const id: ObjectID = ObjectID.generate();
-      await database.query(
-        `INSERT INTO "${schema}"."IncidentCustomField"
-         ("_id", "projectId", "name", "customFieldType", "dropdownOptions", "variableKey", "sortOrder", "version")
-         VALUES ($1, $2, $3, $4, $5, $6, 1, 1)`,
-        [
-          id.toString(),
-          projectId.toString(),
-          data.name,
-          data.customFieldType || "Text",
-          data.dropdownOptions || null,
-          data.variableKey,
-        ],
-      );
-      return id;
-    }
+  describe("branding", () => {
+    const LOGO: Buffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a]);
+    const FAVICON: Buffer = Buffer.from(
+      '<svg xmlns="http://www.w3.org/2000/svg"/>',
+    );
 
-    async function storedSettings(
-      table: string,
-      id: ObjectID,
-    ): Promise<{
-      customFieldSettings: unknown;
-      version: number;
-      updatedAt: Date;
-    }> {
-      const rows: Array<{
-        customFieldSettings: unknown;
-        version: number;
-        updatedAt: Date;
-      }> = await database.query(
-        `SELECT "customFieldSettings", "version", "updatedAt" FROM "${schema}"."${table}" WHERE "_id" = $1`,
-        [id.toString()],
-      );
+    test("a form keeps its logo and favicon, and its public page gets them inside the form", async () => {
+      jest.spyOn(FormService, "isProjectOnPlan").mockResolvedValue(true);
 
-      return rows[0]!;
-    }
+      const logoId: ObjectID = await seedFile("image/png", LOGO);
+      const faviconId: ObjectID = await seedFile("image/svg+xml", FAVICON);
 
-    test("takes the field off every form of its project - not another project's, and no template - without touching the forms' version", async () => {
-      const customerId: ObjectID = await seedField({
-        name: "Customer",
-        variableKey: "customer",
+      const form: Form = await createForm({
+        logoFileId: logoId,
+        logoAltText: "Acme Inc.",
+        faviconFileId: faviconId,
       });
-      await seedField({ name: "Impact", variableKey: "impact" });
+      const row: Record<string, unknown> = await storedForm(form.id!);
 
-      const form: IncidentForm = await createForm({
-        customFieldSettings: { customer: "Optional", impact: "Required" },
-      });
-      const otherProjectsForm: IncidentForm = await createForm({
-        projectId: otherProjectId,
-        incidentSeverityId: await seedSeverity(otherProjectId),
-        customFieldSettings: { customer: "Required" },
+      expect(row["logoFileId"]).toBe(logoId.toString());
+      expect(row["faviconFileId"]).toBe(faviconId.toString());
+      expect(row["logoAltText"]).toBe("Acme Inc.");
+
+      // The real lookup: the form's own files, joined in the one query.
+      const told: PublicForm = await FormService.getPublicForm({
+        shareKey: String(row["shareKey"]),
+        clientIp: "203.0.113.7",
       });
-      const templateId: ObjectID = await seedTemplate();
-      await database.query(
-        `UPDATE "${schema}"."IncidentTemplate" SET "customFieldSettings" = $1::jsonb WHERE "_id" = $2`,
-        [JSON.stringify({ customer: "Required" }), templateId.toString()],
-      );
 
-      const before: { version: number; updatedAt: Date } = await storedSettings(
-        "IncidentForm",
-        form.id!,
+      expect(told.logo).toEqual({
+        type: "image/png",
+        data: LOGO.toString("base64"),
+      } as PublicFormImage);
+      expect(told.logoAltText).toBe("Acme Inc.");
+      expect(told.favicon).toEqual({
+        type: "image/svg+xml",
+        data: FAVICON.toString("base64"),
+      } as PublicFormImage);
+
+      // The files themselves were never made public.
+      const files: Array<{ isPublic: boolean }> = await database.query(
+        `SELECT "isPublic" FROM "${schema}"."File" ORDER BY "createdAt"`,
       );
+      expect(files).toEqual([{ isPublic: false }, { isPublic: false }]);
+    });
 
-      const formWorkflow: ReturnType<typeof jest.fn> = jest.spyOn(
-        IncidentFormService,
-        "onTriggerWorkflow",
-      ) as unknown as ReturnType<typeof jest.fn>;
-      formWorkflow.mockClear();
+    test("a form without branding tells its page nothing more than before", async () => {
+      jest.spyOn(FormService, "isProjectOnPlan").mockResolvedValue(true);
 
-      await IncidentCustomFieldService.deleteOneById({
-        id: customerId,
-        props: { isRoot: true },
+      const form: Form = await createForm();
+      const told: PublicForm = await FormService.getPublicForm({
+        shareKey: String((await storedForm(form.id!))["shareKey"]),
+        clientIp: "203.0.113.7",
       });
 
-      const after: {
-        customFieldSettings: unknown;
-        version: number;
-        updatedAt: Date;
-      } = await storedSettings("IncidentForm", form.id!);
+      expect(Object.keys(told).sort()).toEqual(
+        ["fields", "isCaptchaRequired", "name"].sort(),
+      );
+    });
 
-      expect(after.customFieldSettings).toEqual({ impact: "Required" });
-      expect(after.version).toBe(before.version);
-      expect(new Date(after.updatedAt).getTime()).toBe(
-        new Date(before.updatedAt).getTime(),
+    test("a file that is not an image is refused as a logo, and nothing is stored", async () => {
+      const pdfId: ObjectID = await seedFile(
+        "application/pdf",
+        Buffer.from("%PDF-1.7"),
       );
-      expect(formWorkflow).not.toHaveBeenCalled();
 
-      expect(
-        (await storedSettings("IncidentForm", otherProjectsForm.id!))
-          .customFieldSettings,
-      ).toEqual({ customer: "Required" });
-      expect(
-        (await storedSettings("IncidentTemplate", templateId))
-          .customFieldSettings,
-      ).toEqual({ customer: "Required" });
-
-      /*
-       * Created again, as a dropdown with options nobody meant to publish:
-       * it gets the old key back, and the form still does not ask it.
-       */
-      await seedField({
-        name: "Customer",
-        variableKey: "customer",
-        customFieldType: "Dropdown",
-        dropdownOptions: "Acme Corp (key account)\nGlobex (churn risk)",
-      });
+      await expect(createForm({ logoFileId: pdfId })).rejects.toThrow(
+        FORM_LOGO_TYPE_MESSAGE,
+      );
 
-      expect(
-        (await storedSettings("IncidentForm", form.id!)).customFieldSettings,
-      ).toEqual({ impact: "Required" });
+      const rows: Array<{ count: string }> = await database.query(
+        `SELECT count(*)::text AS "count" FROM "${schema}"."Form"`,
+      );
+      expect(rows[0]!.count).toBe("0");
     });
-  });
 
-  describe("submissions", () => {
-    test("the reporter's email is stored lowercased and read back as an Email", async () => {
-      const form: IncidentForm = await createForm();
+    test("an upload is stamped with the request's project, never the one its body names", async () => {
+      const upload: (props: {
+        tenantId?: ObjectID;
+      }) => Promise<Record<string, unknown>> = async (props: {
+        tenantId?: ObjectID;
+      }): Promise<Record<string, unknown>> => {
+        const file: File = new File();
+        file.name = "logo.png";
+        file.file = LOGO;
+        file.fileType = MimeType.png;
+        file.isPublic = false;
+        (file as unknown as Record<string, unknown>)["projectId"] =
+          otherProjectId;
+
+        const created: File = await FileService.create({
+          data: file,
+          props: { isRoot: true, ...props },
+        });
 
-      const created: IncidentFormSubmission = await createSubmission(form.id!, {
-        reporterName: "Jane Doe",
-        reporterEmail: new Email("Jane.Doe@Example.COM"),
-      });
+        const rows: Array<Record<string, unknown>> = await database.query(
+          `SELECT "projectId" FROM "${schema}"."File" WHERE "_id" = $1`,
+          [created.id!.toString()],
+        );
 
-      const read: IncidentFormSubmission | null =
-        await IncidentFormSubmissionService.findOneById({
-          id: created.id!,
-          select: { reporterName: true, reporterEmail: true },
-          props: { isRoot: true },
-        });
+        return rows[0]!;
+      };
 
-      expect(read?.reporterName).toBe("Jane Doe");
-      expect(read?.reporterEmail).toBeInstanceOf(Email);
-      expect(read?.reporterEmail?.toString()).toBe("jane.doe@example.com");
+      expect((await upload({ tenantId: projectId }))["projectId"]).toBe(
+        projectId.toString(),
+      );
+      expect((await upload({}))["projectId"]).toBeNull();
     });
 
-    test("deleting the incident keeps the submission, with no incident", async () => {
-      const form: IncidentForm = await createForm();
-      const incidentId: ObjectID = await seedIncident();
-      const submission: IncidentFormSubmission = await createSubmission(
-        form.id!,
-        { incidentId: incidentId },
-      );
+    test("a file's facts are its type, its size and its project, measured in Postgres", async () => {
+      const logoId: ObjectID = await seedFile("image/png", LOGO);
+      const unownedId: ObjectID = await seedFile("image/png", LOGO, null);
+
+      const facts: FileFacts | null = await FileService.getFileFacts(logoId);
+
+      expect(facts).toEqual({
+        fileType: "image/png",
+        size: LOGO.byteLength,
+        projectId: projectId,
+      });
+      expect((await FileService.getFileFacts(unownedId))?.projectId).toBeNull();
+      expect(await FileService.getFileFacts(ObjectID.generate())).toBeNull();
 
+      // A deleted file is no file.
       await database.query(
-        `DELETE FROM "${schema}"."Incident" WHERE "_id" = $1`,
-        [incidentId.toString()],
+        `UPDATE "${schema}"."File" SET "deletedAt" = now() WHERE "_id" = $1`,
+        [logoId.toString()],
+      );
+      expect(await FileService.getFileFacts(logoId)).toBeNull();
+    });
+
+    test("a file of another project, or of none, is refused as one that does not exist", async () => {
+      const foreignId: ObjectID = await seedFile(
+        "image/png",
+        LOGO,
+        otherProjectId,
       );
+      const unownedId: ObjectID = await seedFile("image/png", LOGO, null);
 
-      expect(await submissionRows()).toEqual([
-        { _id: submission.id!.toString(), incidentId: null },
-      ]);
+      await expect(createForm({ logoFileId: foreignId })).rejects.toThrow(
+        FORM_LOGO_NOT_FOUND_MESSAGE,
+      );
+      await expect(createForm({ faviconFileId: unownedId })).rejects.toThrow(
+        FORM_FAVICON_NOT_FOUND_MESSAGE,
+      );
+      await expect(
+        createForm({ logoFileId: ObjectID.generate() }),
+      ).rejects.toThrow(FORM_LOGO_NOT_FOUND_MESSAGE);
+
+      // The same file is a fine logo for a form of its own project.
+      await expect(
+        createForm({ projectId: otherProjectId, logoFileId: foreignId }),
+      ).resolves.toBeDefined();
     });
 
-    test("deleting the form deletes its submissions, and only its own", async () => {
-      const form: IncidentForm = await createForm();
-      const otherForm: IncidentForm = await createForm();
-      await createSubmission(form.id!);
-      await createSubmission(form.id!);
-      const kept: IncidentFormSubmission = await createSubmission(
-        otherForm.id!,
+    test("a logo's size is measured in Postgres: 512 KB passes, one byte more is refused", async () => {
+      const largest: ObjectID = await seedFile(
+        "image/png",
+        Buffer.alloc(FORM_LOGO_MAX_BYTES, 1),
+      );
+      const tooLarge: ObjectID = await seedFile(
+        "image/png",
+        Buffer.alloc(FORM_LOGO_MAX_BYTES + 1, 1),
+      );
+
+      await expect(createForm({ logoFileId: largest })).resolves.toBeDefined();
+      await expect(createForm({ logoFileId: tooLarge })).rejects.toThrow(
+        FORM_LOGO_TOO_LARGE_MESSAGE,
+      );
+    });
+
+    test("saving a form that already shows its logo passes; pointing it at another project's file does not", async () => {
+      const logoId: ObjectID = await seedFile("image/png", LOGO);
+      const foreignId: ObjectID = await seedFile(
+        "image/png",
+        LOGO,
+        otherProjectId,
       );
+      const form: Form = await createForm({ logoFileId: logoId });
 
-      await IncidentFormService.deleteOneById({
+      await FormService.updateOneById({
         id: form.id!,
+        data: { logoFileId: logoId, logoAltText: "Acme Inc." },
         props: { isRoot: true },
       });
 
-      expect(
-        (await submissionRows()).map((row: { _id: string }): string => {
-          return row._id;
+      await expect(
+        FormService.updateOneById({
+          id: form.id!,
+          data: { logoFileId: foreignId },
+          props: { isRoot: true },
         }),
-      ).toEqual([kept.id!.toString()]);
+      ).rejects.toThrow(FORM_LOGO_NOT_FOUND_MESSAGE);
+
+      const row: Record<string, unknown> = await storedForm(form.id!);
+
+      expect(row["logoFileId"]).toBe(logoId.toString());
+      expect(row["logoAltText"]).toBe("Acme Inc.");
     });
 
-    test("a viewer sees the submissions of incidents they can see - never of a private incident, nor of one that is gone", async () => {
-      const form: IncidentForm = await createForm();
-      const publicIncidentId: ObjectID = await seedIncident();
-      const privateIncidentId: ObjectID = await seedIncident({
-        isPrivate: true,
-      });
+    test("the public read hands over no file of another project, even when a row names one", async () => {
+      jest.spyOn(FormService, "isProjectOnPlan").mockResolvedValue(true);
 
-      const ofPublic: IncidentFormSubmission = await createSubmission(
-        form.id!,
-        { incidentId: publicIncidentId },
+      const foreignId: ObjectID = await seedFile(
+        "image/png",
+        LOGO,
+        otherProjectId,
       );
-      await createSubmission(form.id!, { incidentId: privateIncidentId });
-      await createSubmission(form.id!);
+      const unownedId: ObjectID = await seedFile(
+        "image/svg+xml",
+        FAVICON,
+        null,
+      );
+      const form: Form = await createForm({ logoAltText: "Someone Else" });
 
-      const viewer: DatabaseCommonInteractionProps = viewerProps();
+      // Past every write check, as only SQL can.
+      await database.query(
+        `UPDATE "${schema}"."Form" SET "logoFileId" = $1, "faviconFileId" = $2 WHERE "_id" = $3`,
+        [foreignId.toString(), unownedId.toString(), form.id!.toString()],
+      );
 
-      const visible: Array<IncidentFormSubmission> =
-        await IncidentFormSubmissionService.findBy({
-          query: { incidentFormId: form.id! },
-          select: { _id: true },
-          limit: 10,
-          skip: 0,
-          props: viewer,
-        });
+      const told: PublicForm = await FormService.getPublicForm({
+        shareKey: String((await storedForm(form.id!))["shareKey"]),
+        clientIp: "203.0.113.7",
+      });
 
-      expect(
-        visible.map((row: IncidentFormSubmission): string => {
-          return row._id!.toString();
-        }),
-      ).toEqual([ofPublic.id!.toString()]);
+      expect(told.logo).toBeUndefined();
+      expect(told.logoAltText).toBeUndefined();
+      expect(told.favicon).toBeUndefined();
+      expect(JSON.stringify(told)).not.toContain(LOGO.toString("base64"));
+    });
 
-      expect(
-        (
-          await IncidentFormSubmissionService.countBy({
-            query: { incidentFormId: form.id! },
-            props: viewer,
-          })
-        ).toNumber(),
-      ).toBe(1);
+    test("deleting the logo's file only takes it off the form", async () => {
+      const logoId: ObjectID = await seedFile("image/png", LOGO);
+      const form: Form = await createForm({ logoFileId: logoId });
 
-      // Root, which bypasses privacy, sees all three.
-      expect(
-        await IncidentFormSubmissionService.findBy({
-          query: { incidentFormId: form.id! },
-          select: { _id: true },
-          limit: 10,
-          skip: 0,
-          props: { isRoot: true },
-        }),
-      ).toHaveLength(3);
+      await database.query(`DELETE FROM "${schema}"."File" WHERE "_id" = $1`, [
+        logoId.toString(),
+      ]);
+
+      const row: Record<string, unknown> = await storedForm(form.id!);
+
+      expect(row["logoFileId"]).toBeNull();
+      expect(row["name"]).toBe(form.name);
     });
+  });
 
-    /*
-     * Deleting an incident clears the submission's link (ON DELETE SET
-     * NULL), and nothing then records that the incident was private. The
-     * reporter of a private report must not become visible to the whole
-     * project at that moment: a submission with no incident is listed only
-     * for those who see every incident.
-     */
-    test("a deleted private incident's submission stays hidden from readers who could not see it", async () => {
-      const form: IncidentForm = await createForm();
-      const privateIncidentId: ObjectID = await seedIncident({
-        isPrivate: true,
+  describe("submissions", () => {
+    test("the submitter's email is stored lowercased and read back as an Email", async () => {
+      const form: Form = await createForm();
+      const submission: FormSubmission = await createSubmission(form.id!, {
+        submitterName: "Jane",
+        submitterEmail: new Email("Jane@Example.com"),
+        answers: [
+          {
+            fieldId: "title",
+            label: "Title",
+            value: "Down",
+            displayValue: "Down",
+          },
+        ],
       });
 
-      const submission: IncidentFormSubmission = await createSubmission(
-        form.id!,
+      const read: FormSubmission | null =
+        await FormSubmissionService.findOneById({
+          id: submission.id!,
+          select: { submitterEmail: true, answers: true },
+          props: { isRoot: true },
+        });
+
+      expect(read?.submitterEmail).toBeInstanceOf(Email);
+      expect(read?.submitterEmail?.toString()).toBe("jane@example.com");
+      expect(read?.answers).toEqual([
         {
-          incidentId: privateIncidentId,
-          reporterName: "Alice",
-          reporterEmail: new Email("alice@corp.example"),
+          fieldId: "title",
+          label: "Title",
+          value: "Down",
+          displayValue: "Down",
         },
-      );
-
-      const readers: Array<DatabaseCommonInteractionProps> = [
-        memberProps(Permission.Viewer),
-        memberProps(Permission.ProjectMember),
-        memberProps(Permission.IncidentViewer),
-        memberProps(Permission.IncidentMember),
-        memberProps(Permission.IncidentAdmin),
-        memberProps(Permission.ReadIncidentFormSubmission),
-      ];
-
-      const listedFor: (
-        props: DatabaseCommonInteractionProps,
-      ) => Promise<Array<string>> = async (
-        props: DatabaseCommonInteractionProps,
-      ): Promise<Array<string>> => {
-        return (
-          await IncidentFormSubmissionService.findBy({
-            query: { incidentFormId: form.id! },
-            select: { _id: true, reporterName: true, reporterEmail: true },
-            limit: 10,
-            skip: 0,
-            props: props,
-          })
-        ).map((row: IncidentFormSubmission): string => {
-          return row._id!.toString();
-        });
-      };
+      ]);
+    });
 
-      for (const reader of readers) {
-        expect(await listedFor(reader)).toEqual([]);
-      }
+    test("deleting the incident keeps the submission, with no incident", async () => {
+      const form: Form = await createForm();
+      const incidentId: ObjectID = await seedIncident();
+      await createSubmission(form.id!, {
+        incidentId,
+        targetType: FormTargetType.Incident,
+      });
 
       await database.query(
         `DELETE FROM "${schema}"."Incident" WHERE "_id" = $1`,
-        [privateIncidentId.toString()],
+        [incidentId.toString()],
       );
 
       expect(await submissionRows()).toEqual([
-        { _id: submission.id!.toString(), incidentId: null },
+        expect.objectContaining({ incidentId: null }),
       ]);
+    });
+
+    test("deleting the scheduled maintenance event keeps the submission, with no event", async () => {
+      const form: Form = await createForm();
+      const eventId: ObjectID = await seedEvent();
+      await createSubmission(form.id!, {
+        scheduledMaintenanceId: eventId,
+        targetType: FormTargetType.ScheduledMaintenance,
+      });
+
+      await database.query(
+        `DELETE FROM "${schema}"."ScheduledMaintenance" WHERE "_id" = $1`,
+        [eventId.toString()],
+      );
 
-      for (const reader of readers) {
-        expect(await listedFor(reader)).toEqual([]);
-        expect(
-          (
-            await IncidentFormSubmissionService.countBy({
-              query: { incidentFormId: form.id! },
-              props: reader,
-            })
-          ).toNumber(),
-        ).toBe(0);
-      }
-
-      // Those who see every incident still see it.
-      expect(await listedFor(memberProps(Permission.ProjectAdmin))).toEqual([
-        submission.id!.toString(),
+      expect(await submissionRows()).toEqual([
+        expect.objectContaining({ scheduledMaintenanceId: null }),
       ]);
-      expect(await listedFor({ isRoot: true })).toEqual([
-        submission.id!.toString(),
+    });
+
+    test("deleting the form deletes its submissions, and only its own", async () => {
+      const form: Form = await createForm();
+      const other: Form = await createForm();
+      await createSubmission(form.id!);
+      await createSubmission(form.id!);
+      await createSubmission(other.id!);
+
+      await database.query(`DELETE FROM "${schema}"."Form" WHERE "_id" = $1`, [
+        form.id!.toString(),
       ]);
+
+      expect(
+        (await submissionRows()).map((row: { formId: string }) => {
+          return row.formId;
+        }),
+      ).toEqual([other.id!.toString()]);
     });
   });
 });