build: release v6.260.0 (#8823)

* feat: email redact (#8821)

* feat: mask optionsToRecipientsMap and static workflow step emails

* fix: retain admin id if not populated

* feat: update docs to jsdocs

* fix: not pojo after stripping

* feat: add tc coverage for redaction and splitting of getPublicView

* feat: simplify strip options to recipients map

* feat: remove unneeded destructuring

* feat: apply lint changes

* chore: bump version to v6.260.0

Author: kevin9foong

CHANGELOG.md

@@ -4,11 +4,20 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v6.260.0](https://github.com/opengovsg/FormSG/compare/v6.259.0...v6.260.0)
+
+- feat: email redact [`#8821`](https://github.com/opengovsg/FormSG/pull/8821)
+- build: merge release v6.259.0 to develop [`#8820`](https://github.com/opengovsg/FormSG/pull/8820)
+- build: release v6.259.0 [`#8819`](https://github.com/opengovsg/FormSG/pull/8819)
+
 #### [v6.259.0](https://github.com/opengovsg/FormSG/compare/v6.258.0...v6.259.0)
 
+> 16 October 2025
+
 - fix: myinfo child not reflecting correct vaccination status  [`#8818`](https://github.com/opengovsg/FormSG/pull/8818)
 - build: merge release v6.258.0 to develop [`#8817`](https://github.com/opengovsg/FormSG/pull/8817)
 - build: release v6.258.0 [`#8816`](https://github.com/opengovsg/FormSG/pull/8816)
+- chore: bump version to v6.259.0 [`1ee5a2f`](https://github.com/opengovsg/FormSG/commit/1ee5a2f5ebd3542b2ce34855547cc868f08b4154)
 
 #### [v6.258.0](https://github.com/opengovsg/FormSG/compare/v6.257.0...v6.258.0)
 

frontend/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "form-frontend",
-  "version": "6.259.0",
+  "version": "6.260.0",
   "homepage": ".",
   "type": "module",
   "private": true,

frontend/package.json

@@ -1,9 +1,9 @@
-import { FormFieldDto, FormWorkflowStep } from '~shared/types'
+import { FormFieldDto, StrippedFormWorkflowStepDto } from '~shared/types'
 
 import { NON_RESPONSE_FIELD_SET } from '../constants'
 
 export const isFieldEnabledByMrfWorkflow = (
-  workflowStep: FormWorkflowStep | undefined,
+  workflowStep: StrippedFormWorkflowStepDto | undefined,
   field: FormFieldDto,
 ) => {
   // If no workflow, default to enabled
@@ -24,7 +24,7 @@ export const isFieldEnabledByMrfWorkflow = (
  * @returns The field with the disabled property set based on the workflow step and its previous disabled state
  */
 export const augmentFieldWithMrfWorkflowDisabling = (
-  workflowStep: FormWorkflowStep | undefined,
+  workflowStep: StrippedFormWorkflowStepDto | undefined,
   field: FormFieldDto,
 ) => ({
   ...field,

frontend/src/features/form/utils/augmentFieldWithMrfWorkflowDisabling.ts

@@ -30,10 +30,10 @@ import { ErrorCode } from '~shared/types/errorCodes'
 import {
   FormAuthType,
   FormResponseMode,
-  FormWorkflowStepDto,
   Language,
   ProductItem,
   PublicFormDto,
+  StrippedFormWorkflowStepDto,
 } from '~shared/types/form'
 import { centsToDollars, dollarsToCents } from '~shared/utils/payments'
 
@@ -210,7 +210,7 @@ const transformFormInputTrimTextInputs =
 
 export const augmentFormFields = (
   formFields: FormFieldDto[],
-  currentStepNumberWorkflowStep?: FormWorkflowStepDto,
+  currentStepNumberWorkflowStep?: StrippedFormWorkflowStepDto,
 ) => {
   return formFields
     .map(augmentWithMyInfo)
@@ -256,7 +256,7 @@ export const getInitialFormValues = ({
   formResponseMode: FormResponseMode
   previousSubmission?: ReturnType<typeof decryptSubmission>
   previousAttachments?: Record<string, ArrayBuffer>
-  currentStepNumberWorkflowStep?: FormWorkflowStepDto
+  currentStepNumberWorkflowStep?: StrippedFormWorkflowStepDto
   augmentedFormFields: FormFieldDto[]
   fieldPrefillMap: PrefillMap
   draftResponsesToRestore: FormFieldValues

frontend/src/features/public-form/PublicFormProvider.tsx

@@ -1,7 +1,7 @@
 {
   "name": "FormSG",
   "description": "Form Manager for Government",
-  "version": "6.259.0",
+  "version": "6.260.0",
   "homepage": "https://form.gov.sg",
   "authors": [
     "FormSG <[email protected]>"

package-lock.json

@@ -1,13 +1,14 @@
 import { PublicUserDto, UserDto } from '../user'
 import {
+  BasicField,
   FormField,
   FormFieldDto,
   MyInfoChildData,
   TranslationMapping,
 } from '../field'
 
 import { FormLogo } from './form_logo'
-import type { Merge, Tagged, PartialDeep } from 'type-fest'
+import type { Except, Merge, Tagged, PartialDeep } from 'type-fest'
 import {
   ADMIN_FORM_META_FIELDS,
   EMAIL_FORM_SETTINGS_FIELDS,
@@ -21,7 +22,12 @@ import { DateString } from '../generic'
 import { FormLogic, LogicDto } from './form_logic'
 import { PaymentChannel, PaymentMethodType, PaymentType } from '../payment'
 import { Product } from './product'
-import { FormWorkflow, FormWorkflowDto, FormWorkflowStepDto } from './workflow'
+import {
+  FormWorkflow,
+  FormWorkflowDto,
+  FormWorkflowStepDto,
+  StrippedFormWorkflowDto,
+} from './workflow'
 import { ErrorCode } from '../errorCodes'
 
 export type FormId = Tagged<string, 'FormId'>
@@ -310,10 +316,28 @@ export type PublicMultirespondentFormDto = Merge<
   PublicFormBase
 >
 
-export type PublicFormDto =
+export type StrippedPublicMultirespondentFormDto =
+  PublicMultirespondentFormDto & {
+    workflow: StrippedFormWorkflowDto
+  }
+
+/**
+ * Used for public form view to redact sensitive information.
+ * Specifically, it omits optionsToRecipientsMap for Dropdown field types.
+ */
+export type StrippedFormFieldDto<T extends FormFieldDto = FormFieldDto> =
+  T extends {
+    fieldType: BasicField.Dropdown
+  }
+    ? Except<T, 'optionsToRecipientsMap'>
+    : T
+
+export type PublicFormDto = Merge<
   | PublicStorageFormDto
   | PublicEmailFormDto
-  | PublicMultirespondentFormDto
+  | StrippedPublicMultirespondentFormDto,
+  { form_fields: StrippedFormFieldDto[] }
+>
 
 export type EmailFormSettings = Pick<
   EmailFormDto,

package.json

@@ -0,0 +1,13 @@
+import { omit } from 'lodash'
+import { BasicField, FormFieldDto } from '../types'
+
+export function stripDropdownFieldOptionsToRecipientsMap(
+  formFields: FormFieldDto[],
+): FormFieldDto[] {
+  return formFields.map((formField) => {
+    if (formField.fieldType === BasicField.Dropdown) {
+      return omit(formField, 'optionsToRecipientsMap')
+    }
+    return formField
+  })
+}