fix: rollback merge

Co-authored-by: Alex <alexander.seliakov@gmail.com>

.cursor/rules/database.mdc

@@ -7,6 +7,7 @@ description: >
 globs: []
 alwaysApply: agent-requested
 ---
+
 # Formbricks Database Schema Reference
 
 This rule provides a reference to the Formbricks database structure. For the most up-to-date and complete schema definitions, please refer to the schema.prisma file directly.
@@ -16,6 +17,7 @@ This rule provides a reference to the Formbricks database structure. For the mos
 Formbricks uses PostgreSQL with Prisma ORM. The schema is designed for multi-tenancy with strong data isolation between organizations.
 
 ### Core Hierarchy
+
 ```
 Organization
 └── Project
@@ -29,6 +31,7 @@ Organization
 ## Schema Reference
 
 For the complete and up-to-date database schema, please refer to:
+
 - Main schema: `packages/database/schema.prisma`
 - JSON type definitions: `packages/database/json-types.ts`
 
@@ -37,17 +40,22 @@ The schema.prisma file contains all model definitions, relationships, enums, and
 ## Data Access Patterns
 
 ### Multi-tenancy
+
 - All data is scoped by Organization
 - Environment-level isolation for surveys and contacts
 - Project-level grouping for related surveys
 
 ### Soft Deletion
+
 Some models use soft deletion patterns:
+
 - Check `isActive` fields where present
 - Use proper filtering in queries
 
 ### Cascading Deletes
+
 Configured cascade relationships:
+
 - Organization deletion cascades to all child entities
 - Survey deletion removes responses, displays, triggers
 - Contact deletion removes attributes and responses
@@ -55,6 +63,7 @@ Configured cascade relationships:
 ## Common Query Patterns
 
 ### Survey with Responses
+
 ```typescript
 // Include response count and latest responses
 const survey = await prisma.survey.findUnique({
@@ -62,40 +71,40 @@ const survey = await prisma.survey.findUnique({
   include: {
     responses: {
       take: 10,
-      orderBy: { createdAt: 'desc' }
+      orderBy: { createdAt: "desc" },
     },
     _count: {
-      select: { responses: true }
-    }
-  }
+      select: { responses: true },
+    },
+  },
 });
 ```
 
 ### Environment Scoping
+
 ```typescript
 // Always scope by environment
 const surveys = await prisma.survey.findMany({
   where: {
     environmentId: environmentId,
     // Additional filters...
-  }
+  },
 });
 ```
 
 ### Contact with Attributes
+
 ```typescript
 const contact = await prisma.contact.findUnique({
   where: { id: contactId },
   include: {
     attributes: {
       include: {
-        attributeKey: true
-      }
-    }
-  }
+        attributeKey: true,
+      },
+    },
+  },
 });
 ```
 
 This schema supports Formbricks' core functionality: multi-tenant survey management, user targeting, response collection, and analysis, all while maintaining strict data isolation and security.
-
-

.github/actions/build-and-push-docker/action.yml

@@ -1,312 +0,0 @@
-name: Build and Push Docker Image
-description: |
-  Unified Docker build and push action for both ECR and GHCR registries.
-
-  Supports:
-  - ECR builds for Formbricks Cloud deployment
-  - GHCR builds for community self-hosting
-  - Automatic version resolution and tagging
-  - Conditional signing and deployment tags
-
-inputs:
-  registry_type:
-    description: "Registry type: 'ecr' or 'ghcr'"
-    required: true
-
-  # Version input
-  version:
-    description: "Explicit version (SemVer only, e.g., 1.2.3). If provided, this version is used directly. If empty, version is auto-generated from branch name."
-    required: false
-  experimental_mode:
-    description: "Enable experimental timestamped versions"
-    required: false
-    default: "false"
-
-  # ECR specific inputs
-  ecr_registry:
-    description: "ECR registry URL (required for ECR builds)"
-    required: false
-  ecr_repository:
-    description: "ECR repository name (required for ECR builds)"
-    required: false
-  ecr_region:
-    description: "ECR AWS region (required for ECR builds)"
-    required: false
-  aws_role_arn:
-    description: "AWS role ARN for ECR authentication (required for ECR builds)"
-    required: false
-
-  # GHCR specific inputs
-  ghcr_image_name:
-    description: "GHCR image name (required for GHCR builds)"
-    required: false
-
-  # Deployment options
-  deploy_production:
-    description: "Tag image for production deployment"
-    required: false
-    default: "false"
-  deploy_staging:
-    description: "Tag image for staging deployment"
-    required: false
-    default: "false"
-  is_prerelease:
-    description: "Whether this is a prerelease (auto-tags for staging/production)"
-    required: false
-    default: "false"
-
-  # Build options
-  dockerfile:
-    description: "Path to Dockerfile"
-    required: false
-    default: "apps/web/Dockerfile"
-  context:
-    description: "Build context"
-    required: false
-    default: "."
-
-outputs:
-  image_tag:
-    description: "Resolved image tag used for the build"
-    value: ${{ steps.version.outputs.version }}
-  registry_tags:
-    description: "Complete registry tags that were pushed"
-    value: ${{ steps.build.outputs.tags }}
-  image_digest:
-    description: "Image digest from the build"
-    value: ${{ steps.build.outputs.digest }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Validate inputs
-      shell: bash
-      env:
-        REGISTRY_TYPE: ${{ inputs.registry_type }}
-        ECR_REGISTRY: ${{ inputs.ecr_registry }}
-        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
-        ECR_REGION: ${{ inputs.ecr_region }}
-        AWS_ROLE_ARN: ${{ inputs.aws_role_arn }}
-        GHCR_IMAGE_NAME: ${{ inputs.ghcr_image_name }}
-      run: |
-        set -euo pipefail
-
-        if [[ "$REGISTRY_TYPE" != "ecr" && "$REGISTRY_TYPE" != "ghcr" ]]; then
-          echo "ERROR: registry_type must be 'ecr' or 'ghcr', got: $REGISTRY_TYPE"
-          exit 1
-        fi
-
-        if [[ "$REGISTRY_TYPE" == "ecr" ]]; then
-          if [[ -z "$ECR_REGISTRY" || -z "$ECR_REPOSITORY" || -z "$ECR_REGION" || -z "$AWS_ROLE_ARN" ]]; then
-            echo "ERROR: ECR builds require ecr_registry, ecr_repository, ecr_region, and aws_role_arn"
-            exit 1
-          fi
-        fi
-
-        if [[ "$REGISTRY_TYPE" == "ghcr" ]]; then
-          if [[ -z "$GHCR_IMAGE_NAME" ]]; then
-            echo "ERROR: GHCR builds require ghcr_image_name"
-            exit 1
-          fi
-        fi
-
-        echo "SUCCESS: Input validation passed for $REGISTRY_TYPE build"
-
-    - name: Resolve Docker version
-      id: version
-      uses: ./.github/actions/resolve-docker-version
-      with:
-        version: ${{ inputs.version }}
-        current_branch: ${{ github.ref_name }}
-        experimental_mode: ${{ inputs.experimental_mode }}
-
-    - name: Update package.json version
-      uses: ./.github/actions/update-package-version
-      with:
-        version: ${{ steps.version.outputs.version }}
-
-    - name: Configure AWS credentials (ECR only)
-      if: ${{ inputs.registry_type == 'ecr' }}
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.2.0
-      with:
-        role-to-assume: ${{ inputs.aws_role_arn }}
-        aws-region: ${{ inputs.ecr_region }}
-
-    - name: Log in to Amazon ECR (ECR only)
-      if: ${{ inputs.registry_type == 'ecr' }}
-      uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
-
-    - name: Set up Docker build tools
-      uses: ./.github/actions/docker-build-setup
-      with:
-        registry: ${{ inputs.registry_type == 'ghcr' && 'ghcr.io' || '' }}
-        setup_cosign: ${{ inputs.registry_type == 'ghcr' && 'true' || 'false' }}
-        skip_login_on_pr: ${{ inputs.registry_type == 'ghcr' && 'true' || 'false' }}
-
-    - name: Build ECR tag list
-      if: ${{ inputs.registry_type == 'ecr' }}
-      id: ecr-tags
-      shell: bash
-      env:
-        IMAGE_TAG: ${{ steps.version.outputs.version }}
-        ECR_REGISTRY: ${{ inputs.ecr_registry }}
-        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
-        DEPLOY_PRODUCTION: ${{ inputs.deploy_production }}
-        DEPLOY_STAGING: ${{ inputs.deploy_staging }}
-        IS_PRERELEASE: ${{ inputs.is_prerelease }}
-      run: |
-        set -euo pipefail
-
-        # Start with the base image tag
-        TAGS="${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
-
-        # Handle automatic tagging based on release type
-        if [[ "${IS_PRERELEASE}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:staging"
-          echo "Adding staging tag for prerelease"
-        elif [[ "${IS_PRERELEASE}" == "false" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:production"
-          echo "Adding production tag for stable release"
-        fi
-
-        # Handle manual deployment overrides
-        if [[ "${DEPLOY_PRODUCTION}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:production"
-          echo "Adding production tag (manual override)"
-        fi
-        if [[ "${DEPLOY_STAGING}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:staging"
-          echo "Adding staging tag (manual override)"
-        fi
-
-        echo "ECR tags generated:"
-        echo -e "${TAGS}"
-
-        {
-          echo "tags<<EOF"
-          echo -e "${TAGS}"
-          echo "EOF"
-        } >> "${GITHUB_OUTPUT}"
-
-    - name: Generate additional GHCR tags for releases
-      if: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'false' && (github.event_name == 'workflow_call' || github.event_name == 'release' || github.event_name == 'workflow_dispatch') }}
-      id: ghcr-extra-tags
-      shell: bash
-      env:
-        VERSION: ${{ steps.version.outputs.version }}
-        IMAGE_NAME: ${{ inputs.ghcr_image_name }}
-        IS_PRERELEASE: ${{ inputs.is_prerelease }}
-      run: |
-        set -euo pipefail
-
-        # Start with base version tag
-        TAGS="ghcr.io/${IMAGE_NAME}:${VERSION}"
-
-        # For proper SemVer releases, add major.minor and major tags
-        if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          # Extract major and minor versions
-          MAJOR=$(echo "${VERSION}" | cut -d. -f1)
-          MINOR=$(echo "${VERSION}" | cut -d. -f2)
-          
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:${MAJOR}.${MINOR}"
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:${MAJOR}"
-          
-          echo "Added SemVer tags: ${MAJOR}.${MINOR}, ${MAJOR}"
-        fi
-
-        # Add latest tag for stable releases
-        if [[ "${IS_PRERELEASE}" == "false" ]]; then
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:latest"
-          echo "Added latest tag for stable release"
-        fi
-
-        echo "Generated GHCR tags:"
-        echo -e "${TAGS}"
-
-        # Debug: Show what will be passed to Docker build
-        echo "DEBUG: Tags for Docker build step:"
-        echo -e "${TAGS}"
-
-        {
-          echo "tags<<EOF"
-          echo -e "${TAGS}"
-          echo "EOF"
-        } >> "${GITHUB_OUTPUT}"
-
-    - name: Build GHCR metadata (experimental)
-      if: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' }}
-      id: ghcr-meta-experimental
-      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
-      with:
-        images: ghcr.io/${{ inputs.ghcr_image_name }}
-        tags: |
-          type=ref,event=branch
-          type=raw,value=${{ steps.version.outputs.version }}
-
-    - name: Debug Docker build tags
-      shell: bash
-      run: |
-        echo "=== DEBUG: Docker Build Configuration ==="
-        echo "Registry Type: ${{ inputs.registry_type }}"
-        echo "Experimental Mode: ${{ inputs.experimental_mode }}"
-        echo "Event Name: ${{ github.event_name }}"
-        echo "Is Prerelease: ${{ inputs.is_prerelease }}"
-        echo "Version: ${{ steps.version.outputs.version }}"
-
-        if [[ "${{ inputs.registry_type }}" == "ecr" ]]; then
-          echo "ECR Tags: ${{ steps.ecr-tags.outputs.tags }}"
-        elif [[ "${{ inputs.experimental_mode }}" == "true" ]]; then
-          echo "GHCR Experimental Tags: ${{ steps.ghcr-meta-experimental.outputs.tags }}"
-        else
-          echo "GHCR Extra Tags: ${{ steps.ghcr-extra-tags.outputs.tags }}"
-        fi
-
-    - name: Build and push Docker image
-      id: build
-      uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
-      with:
-        project: tw0fqmsx3c
-        token: ${{ env.DEPOT_PROJECT_TOKEN }}
-        context: ${{ inputs.context }}
-        file: ${{ inputs.dockerfile }}
-        platforms: linux/amd64,linux/arm64
-        push: ${{ github.event_name != 'pull_request' }}
-        tags: ${{ inputs.registry_type == 'ecr' && steps.ecr-tags.outputs.tags || (inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.tags) || (inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'false' && steps.ghcr-extra-tags.outputs.tags) || (inputs.registry_type == 'ghcr' && format('ghcr.io/{0}:{1}', inputs.ghcr_image_name, steps.version.outputs.version)) || (inputs.registry_type == 'ecr' && format('{0}/{1}:{2}', inputs.ecr_registry, inputs.ecr_repository, steps.version.outputs.version)) }}
-        labels: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.labels || '' }}
-        secrets: |
-          database_url=${{ env.DUMMY_DATABASE_URL }}
-          encryption_key=${{ env.DUMMY_ENCRYPTION_KEY }}
-          redis_url=${{ env.DUMMY_REDIS_URL }}
-          sentry_auth_token=${{ env.SENTRY_AUTH_TOKEN }}
-      env:
-        DEPOT_PROJECT_TOKEN: ${{ env.DEPOT_PROJECT_TOKEN }}
-        DUMMY_DATABASE_URL: ${{ env.DUMMY_DATABASE_URL }}
-        DUMMY_ENCRYPTION_KEY: ${{ env.DUMMY_ENCRYPTION_KEY }}
-        DUMMY_REDIS_URL: ${{ env.DUMMY_REDIS_URL }}
-        SENTRY_AUTH_TOKEN: ${{ env.SENTRY_AUTH_TOKEN }}
-
-    - name: Sign GHCR image (GHCR only)
-      if: ${{ inputs.registry_type == 'ghcr' && (github.event_name == 'workflow_call' || github.event_name == 'release' || github.event_name == 'workflow_dispatch') }}
-      shell: bash
-      env:
-        TAGS: ${{ inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.tags || steps.ghcr-extra-tags.outputs.tags }}
-        DIGEST: ${{ steps.build.outputs.digest }}
-      run: |
-        set -euo pipefail
-        echo "${TAGS}" | xargs -I {} cosign sign --yes "{}@${DIGEST}"
-
-    - name: Output build summary
-      shell: bash
-      env:
-        REGISTRY_TYPE: ${{ inputs.registry_type }}
-        IMAGE_TAG: ${{ steps.version.outputs.version }}
-        VERSION_SOURCE: ${{ steps.version.outputs.source }}
-      run: |
-        echo "SUCCESS: Built and pushed Docker image to $REGISTRY_TYPE"
-        echo "Image Tag: $IMAGE_TAG (source: $VERSION_SOURCE)"
-        if [[ "$REGISTRY_TYPE" == "ecr" ]]; then
-          echo "ECR Registry: ${{ inputs.ecr_registry }}"
-          echo "ECR Repository: ${{ inputs.ecr_repository }}"
-        else
-          echo "GHCR Image: ghcr.io/${{ inputs.ghcr_image_name }}"
-        fi

.github/actions/docker-build-setup/action.yml

@@ -1,106 +0,0 @@
-name: Docker Build Setup
-description: |
-  Sets up common Docker build tools and authentication with security validation.
-
-  Security Features:
-  - Registry URL validation
-  - Input sanitization
-  - Conditional setup based on event type
-  - Post-setup verification
-
-  Supports Depot CLI, Cosign signing, and Docker registry authentication.
-
-inputs:
-  registry:
-    description: "Docker registry hostname to login to (e.g., ghcr.io, registry.example.com:5000). No paths allowed."
-    required: false
-    default: "ghcr.io"
-  setup_cosign:
-    description: "Whether to install cosign for image signing"
-    required: false
-    default: "true"
-  skip_login_on_pr:
-    description: "Whether to skip registry login on pull requests"
-    required: false
-    default: "true"
-
-runs:
-  using: "composite"
-  steps:
-    - name: Validate inputs
-      shell: bash
-      env:
-        REGISTRY: ${{ inputs.registry }}
-        SETUP_COSIGN: ${{ inputs.setup_cosign }}
-        SKIP_LOGIN_ON_PR: ${{ inputs.skip_login_on_pr }}
-      run: |
-        set -euo pipefail
-
-        # Security: Validate registry input - must be hostname[:port] only, no paths
-        # Allow empty registry for cases where login is handled externally (e.g., ECR)
-        if [[ -n "$REGISTRY" ]]; then
-          if [[ "$REGISTRY" =~ / ]]; then
-            echo "ERROR: Invalid registry format: $REGISTRY"
-            echo "Registry must be host[:port] with no path (e.g., 'ghcr.io' or 'registry.example.com:5000')"
-            echo "Path components like 'ghcr.io/org' are not allowed as they break docker login"
-            exit 1
-          fi
-
-          # Validate hostname with optional port format
-          if [[ ! "$REGISTRY" =~ ^[a-zA-Z0-9.-]+(\:[0-9]+)?$ ]]; then
-            echo "ERROR: Invalid registry hostname format: $REGISTRY"
-            echo "Registry must be a valid hostname optionally with port (e.g., 'ghcr.io' or 'registry.example.com:5000')"
-            exit 1
-          fi
-        fi
-
-        # Validate boolean inputs
-        if [[ "$SETUP_COSIGN" != "true" && "$SETUP_COSIGN" != "false" ]]; then
-          echo "ERROR: setup_cosign must be 'true' or 'false', got: $SETUP_COSIGN"
-          exit 1
-        fi
-
-        if [[ "$SKIP_LOGIN_ON_PR" != "true" && "$SKIP_LOGIN_ON_PR" != "false" ]]; then
-          echo "ERROR: skip_login_on_pr must be 'true' or 'false', got: $SKIP_LOGIN_ON_PR"
-          exit 1
-        fi
-
-        echo "SUCCESS: Input validation passed"
-
-    - name: Set up Depot CLI
-      uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
-
-    - name: Install cosign
-      # Install cosign when requested AND when we might actually sign images
-      # (i.e., non-PR contexts or when we login on PRs)
-      if: ${{ inputs.setup_cosign == 'true' && (inputs.skip_login_on_pr == 'false' || github.event_name != 'pull_request') }}
-      uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
-
-    - name: Log into registry
-      if: ${{ inputs.registry != '' && (inputs.skip_login_on_pr == 'false' || github.event_name != 'pull_request') }}
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-      with:
-        registry: ${{ inputs.registry }}
-        username: ${{ github.actor }}
-        password: ${{ github.token }}
-
-    - name: Verify setup completion
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        # Verify Depot CLI is available
-        if ! command -v depot >/dev/null 2>&1; then
-          echo "ERROR: Depot CLI not found in PATH"
-          exit 1
-        fi
-
-        # Verify cosign if it should be installed (same conditions as install step)
-        if [[ "${{ inputs.setup_cosign }}" == "true" ]] && [[ "${{ inputs.skip_login_on_pr }}" == "false" || "${{ github.event_name }}" != "pull_request" ]]; then
-          if ! command -v cosign >/dev/null 2>&1; then
-            echo "ERROR: Cosign not found in PATH despite being requested"
-            exit 1
-          fi
-        fi
-
-        echo "SUCCESS: Docker build setup completed successfully"

.github/actions/resolve-docker-version/action.yml

@@ -1,192 +0,0 @@
-name: Resolve Docker Version
-description: |
-  Resolves and validates Docker-compatible SemVer versions for container builds with comprehensive security.
-
-  Security Features:
-  - Command injection protection
-  - Input sanitization and validation
-  - Docker tag character restrictions
-  - Length limits and boundary checks
-  - Safe branch name handling
-
-  Supports multiple modes: release, manual override, branch auto-detection, and experimental timestamped versions.
-
-inputs:
-  version:
-    description: "Explicit version (SemVer only, e.g., 1.2.3-beta). If provided, this version is used directly. If empty, version is auto-generated from branch name."
-    required: false
-  current_branch:
-    description: "Current branch name for auto-detection"
-    required: true
-  experimental_mode:
-    description: "Enable experimental mode with timestamp-based versions"
-    required: false
-    default: "false"
-
-outputs:
-  version:
-    description: "Resolved Docker-compatible SemVer version"
-    value: ${{ steps.resolve.outputs.version }}
-  source:
-    description: "Source of version (release|override|branch)"
-    value: ${{ steps.resolve.outputs.source }}
-  normalized:
-    description: "Whether the version was normalized (true/false)"
-    value: ${{ steps.resolve.outputs.normalized }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Resolve and validate Docker version
-      id: resolve
-      shell: bash
-      env:
-        EXPLICIT_VERSION: ${{ inputs.version }}
-        CURRENT_BRANCH: ${{ inputs.current_branch }}
-        EXPERIMENTAL_MODE: ${{ inputs.experimental_mode }}
-      run: |
-        set -euo pipefail
-
-        # Function to validate SemVer format (Docker-compatible, no '+' build metadata)
-        validate_semver() {
-          local version="$1"
-          local context="$2"
-          
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "ERROR: Invalid $context format. Must be semver without build metadata (e.g., 1.2.3, 1.2.3-alpha)"
-            echo "Provided: $version"
-            echo "Note: Docker tags cannot contain '+' characters. Use prerelease identifiers instead."
-            exit 1
-          fi
-        }
-
-        # Function to generate branch-based version
-        generate_branch_version() {
-          local branch="$1"
-          local use_timestamp="${2:-true}"
-          local timestamp
-          
-          if [[ "$use_timestamp" == "true" ]]; then
-            timestamp=$(date +%s)
-          else
-            timestamp=""
-          fi
-          
-          # Sanitize branch name for Docker compatibility
-          local sanitized_branch=$(echo "$branch" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
-          
-          # Additional safety: truncate if too long (reserve space for prefix and timestamp)
-          if (( ${#sanitized_branch} > 80 )); then
-            sanitized_branch="${sanitized_branch:0:80}"
-            echo "INFO: Branch name truncated for Docker compatibility" >&2
-          fi
-          local version
-          
-          # Generate version based on branch name (unified approach)
-          # All branches get alpha versions with sanitized branch name
-          if [[ -n "$timestamp" ]]; then
-            version="0.0.0-alpha-$sanitized_branch-$timestamp"
-            echo "INFO: Branch '$branch' detected - alpha version: $version" >&2
-          else
-            version="0.0.0-alpha-$sanitized_branch"
-            echo "INFO: Branch '$branch' detected - alpha version: $version" >&2
-          fi
-          
-          echo "$version"
-        }
-
-
-        # Input validation and sanitization
-        if [[ -z "$CURRENT_BRANCH" ]]; then
-          echo "ERROR: current_branch input is required"
-          exit 1
-        fi
-
-        # Security: Validate inputs to prevent command injection
-        # Use grep to check for dangerous characters (more reliable than bash regex)
-        validate_input() {
-          local input="$1"
-          local name="$2"
-          
-          # Check for dangerous characters using grep
-          if echo "$input" | grep -q '[;|&`$(){}\\[:space:]]'; then
-            echo "ERROR: $name contains potentially dangerous characters: $input"
-            echo "Input should only contain letters, numbers, hyphens, underscores, dots, and forward slashes"
-            return 1
-          fi
-          
-          return 0
-        }
-
-        # Validate current branch
-        if ! validate_input "$CURRENT_BRANCH" "Branch name"; then
-          exit 1
-        fi
-
-        # Validate explicit version if provided
-        if [[ -n "$EXPLICIT_VERSION" ]] && ! validate_input "$EXPLICIT_VERSION" "Explicit version"; then
-          exit 1
-        fi
-
-        # Main resolution logic (ultra-simplified)
-        NORMALIZED="false"
-
-        if [[ -n "$EXPLICIT_VERSION" ]]; then
-          # Use provided explicit version (from either workflow_call or manual input)
-          validate_semver "$EXPLICIT_VERSION" "explicit version"
-          
-          # Normalize to lowercase for Docker/ECR compatibility
-          RESOLVED_VERSION="${EXPLICIT_VERSION,,}"
-          if [[ "$EXPLICIT_VERSION" != "$RESOLVED_VERSION" ]]; then
-            NORMALIZED="true"
-            echo "INFO: Original version contained uppercase characters, normalized: $EXPLICIT_VERSION -> $RESOLVED_VERSION"
-          fi
-          
-          SOURCE="explicit"
-          echo "INFO: Using explicit version: $RESOLVED_VERSION"
-          
-        else
-          # Auto-generate version from branch name
-          if [[ "$EXPERIMENTAL_MODE" == "true" ]]; then
-            # Use timestamped version generation
-            echo "INFO: Experimental mode: generating timestamped version from branch: $CURRENT_BRANCH"
-            RESOLVED_VERSION=$(generate_branch_version "$CURRENT_BRANCH" "true")
-            SOURCE="experimental"
-          else
-            # Standard branch version (no timestamp)
-            echo "INFO: Auto-detecting version from branch: $CURRENT_BRANCH"
-            RESOLVED_VERSION=$(generate_branch_version "$CURRENT_BRANCH" "false")
-            SOURCE="branch"
-          fi
-          echo "Generated version: $RESOLVED_VERSION"
-        fi
-
-        # Final validation - ensure result is valid Docker tag
-        if [[ -z "$RESOLVED_VERSION" ]]; then
-          echo "ERROR: Failed to resolve version"
-          exit 1
-        fi
-
-        if (( ${#RESOLVED_VERSION} > 128 )); then
-          echo "ERROR: Version must be at most 128 characters (Docker limitation)"
-          echo "Generated version: $RESOLVED_VERSION (${#RESOLVED_VERSION} chars)"
-          exit 1
-        fi
-
-        if [[ ! "$RESOLVED_VERSION" =~ ^[a-z0-9._-]+$ ]]; then
-          echo "ERROR: Version contains invalid characters for Docker tags"
-          echo "Version: $RESOLVED_VERSION"
-          exit 1
-        fi
-
-        if [[ "$RESOLVED_VERSION" =~ ^[.-] || "$RESOLVED_VERSION" =~ [.-]$ ]]; then
-          echo "ERROR: Version must not start or end with '.' or '-'"
-          echo "Version: $RESOLVED_VERSION"
-          exit 1
-        fi
-
-        # Output results
-        echo "SUCCESS: Resolved Docker version: $RESOLVED_VERSION (source: $SOURCE)"
-        echo "version=$RESOLVED_VERSION" >> $GITHUB_OUTPUT
-        echo "source=$SOURCE" >> $GITHUB_OUTPUT
-        echo "normalized=$NORMALIZED" >> $GITHUB_OUTPUT

.github/actions/update-package-version/action.yml

@@ -1,160 +0,0 @@
-name: Update Package Version
-description: |
-  Safely updates package.json version with comprehensive validation and atomic operations.
-
-  Security Features:
-  - Path traversal protection
-  - SemVer validation with length limits
-  - Atomic file operations with backup/recovery
-  - JSON validation before applying changes
-
-  This action is designed to be secure by default and prevent common attack vectors.
-
-inputs:
-  version:
-    description: "Version to set in package.json (must be valid SemVer)"
-    required: true
-  package_path:
-    description: "Path to package.json file"
-    required: false
-    default: "./apps/web/package.json"
-
-outputs:
-  updated_version:
-    description: "The version that was actually set in package.json"
-    value: ${{ steps.update.outputs.updated_version }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Update and verify package.json version
-      id: update
-      shell: bash
-      env:
-        VERSION: ${{ inputs.version }}
-        PACKAGE_PATH: ${{ inputs.package_path }}
-      run: |
-        set -euo pipefail
-
-        # Validate inputs
-        if [[ -z "$VERSION" ]]; then
-          echo "ERROR: version input is required"
-          exit 1
-        fi
-
-        # Security: Validate package_path to prevent path traversal attacks
-        # Only allow paths within the workspace and must end with package.json
-        if [[ "$PACKAGE_PATH" =~ \.\./|^/|^~ ]]; then
-          echo "ERROR: Invalid package path - path traversal detected: $PACKAGE_PATH"
-          echo "Package path must be relative to workspace root and cannot contain '../', start with '/', or '~'"
-          exit 1
-        fi
-
-        if [[ ! "$PACKAGE_PATH" =~ package\.json$ ]]; then
-          echo "ERROR: Package path must end with 'package.json': $PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Resolve to absolute path within workspace for additional security
-        WORKSPACE_ROOT="${GITHUB_WORKSPACE:-$(pwd)}"
-
-        # Use realpath to resolve both paths and handle symlinks properly
-        WORKSPACE_ROOT=$(realpath "$WORKSPACE_ROOT")
-        RESOLVED_PATH=$(realpath "${WORKSPACE_ROOT}/${PACKAGE_PATH}")
-
-        # Ensure WORKSPACE_ROOT has a trailing slash for proper prefix matching
-        WORKSPACE_ROOT="${WORKSPACE_ROOT}/"
-
-        # Use shell string matching to ensure RESOLVED_PATH is within workspace
-        # This is more secure than regex and handles edge cases properly
-        if [[ "$RESOLVED_PATH" != "$WORKSPACE_ROOT"* ]]; then
-          echo "ERROR: Resolved path is outside workspace: $RESOLVED_PATH"
-          echo "Workspace root: $WORKSPACE_ROOT"
-          exit 1
-        fi
-
-        if [[ ! -f "$RESOLVED_PATH" ]]; then
-          echo "ERROR: package.json not found at: $RESOLVED_PATH"
-          exit 1
-        fi
-
-        # Use resolved path for operations
-        PACKAGE_PATH="$RESOLVED_PATH"
-
-        # Validate SemVer format with additional security checks
-        if [[ ${#VERSION} -gt 128 ]]; then
-          echo "ERROR: Version string too long (${#VERSION} chars, max 128): $VERSION"
-          exit 1
-        fi
-
-        if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-          echo "ERROR: Invalid SemVer format: $VERSION"
-          echo "Expected format: MAJOR.MINOR.PATCH[-PRERELEASE]"
-          echo "Only alphanumeric characters, dots, and hyphens allowed in prerelease"
-          exit 1
-        fi
-
-        # Additional validation: Check for reasonable version component sizes
-        # Extract base version (MAJOR.MINOR.PATCH) without prerelease/build metadata
-        if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+) ]]; then
-          BASE_VERSION="${BASH_REMATCH[1]}"
-        else
-          echo "ERROR: Could not extract base version from: $VERSION"
-          exit 1
-        fi
-
-        # Split version components safely
-        IFS='.' read -ra VERSION_PARTS <<< "$BASE_VERSION"
-
-        # Validate component sizes (should have exactly 3 parts due to regex above)
-        if (( ${VERSION_PARTS[0]} > 999 || ${VERSION_PARTS[1]} > 999 || ${VERSION_PARTS[2]} > 999 )); then
-          echo "ERROR: Version components too large (max 999 each): $VERSION"
-          echo "Components: ${VERSION_PARTS[0]}.${VERSION_PARTS[1]}.${VERSION_PARTS[2]}"
-          exit 1
-        fi
-
-        echo "Updating package.json version to: $VERSION"
-
-        # Create backup for atomic operations
-        BACKUP_PATH="${PACKAGE_PATH}.backup.$$"
-        cp "$PACKAGE_PATH" "$BACKUP_PATH"
-
-        # Use jq to safely update the version field with error handling
-        if ! jq --arg version "$VERSION" '.version = $version' "$PACKAGE_PATH" > "${PACKAGE_PATH}.tmp"; then
-          echo "ERROR: jq failed to process package.json"
-          rm -f "${PACKAGE_PATH}.tmp" "$BACKUP_PATH"
-          exit 1
-        fi
-
-        # Validate the generated JSON before applying changes
-        if ! jq empty "${PACKAGE_PATH}.tmp" 2>/dev/null; then
-          echo "ERROR: Generated invalid JSON"
-          rm -f "${PACKAGE_PATH}.tmp" "$BACKUP_PATH"
-          exit 1
-        fi
-
-        # Atomic move operation
-        if ! mv "${PACKAGE_PATH}.tmp" "$PACKAGE_PATH"; then
-          echo "ERROR: Failed to update package.json"
-          # Restore backup
-          mv "$BACKUP_PATH" "$PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Verify the update was successful
-        UPDATED_VERSION=$(jq -r '.version' "$PACKAGE_PATH" 2>/dev/null)
-
-        if [[ "$UPDATED_VERSION" != "$VERSION" ]]; then
-          echo "ERROR: Version update failed!"
-          echo "Expected: $VERSION"
-          echo "Actual: $UPDATED_VERSION"
-          # Restore backup
-          mv "$BACKUP_PATH" "$PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Clean up backup on success
-        rm -f "$BACKUP_PATH"
-
-        echo "SUCCESS: Updated package.json version to: $UPDATED_VERSION"
-        echo "updated_version=$UPDATED_VERSION" >> $GITHUB_OUTPUT

.github/actions/upload-sentry-sourcemaps/action.yml

@@ -0,0 +1,104 @@
+name: "Upload Sentry Sourcemaps"
+description: "Extract sourcemaps from Docker image and upload to Sentry"
+
+inputs:
+  docker_image:
+    description: "Docker image to extract sourcemaps from"
+    required: true
+  release_version:
+    description: "Sentry release version (e.g., v1.2.3)"
+    required: true
+  sentry_auth_token:
+    description: "Sentry authentication token"
+    required: true
+  environment:
+    description: "Sentry environment (e.g., production, staging)"
+    required: false
+    default: "staging"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Extract sourcemaps from Docker image
+      shell: bash
+      env:
+        DOCKER_IMAGE: ${{ inputs.docker_image }}
+      run: |
+        set -euo pipefail
+
+        # Validate docker image format (basic validation)
+        if [[ ! "$DOCKER_IMAGE" =~ ^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$ ]] && [[ ! "$DOCKER_IMAGE" =~ ^[a-zA-Z0-9._/-]+@sha256:[A-Fa-f0-9]{64}$ ]]; then
+          echo "❌ Error: Invalid docker image format. Must be in format 'image:tag' or 'image@sha256:hash'"
+          echo "Provided: ${DOCKER_IMAGE}"
+          exit 1
+        fi
+
+        echo "📦 Extracting sourcemaps from Docker image: ${DOCKER_IMAGE}"
+
+        # Create temporary container from the image and capture its ID
+        echo "Creating temporary container..."
+        CONTAINER_ID=$(docker create "$DOCKER_IMAGE")
+        echo "Container created with ID: ${CONTAINER_ID}"
+
+        # Set up cleanup function to ensure container is removed on script exit
+        cleanup_container() {
+          # Capture the current exit code to preserve it
+          local original_exit_code=$?
+          
+          echo "🧹 Cleaning up Docker container..."
+          
+          # Remove the container if it exists (ignore errors if already removed)
+          if [ -n "$CONTAINER_ID" ]; then
+            docker rm -f "$CONTAINER_ID" 2>/dev/null || true
+            echo "Container ${CONTAINER_ID} removed"
+          fi
+          
+          # Exit with the original exit code to preserve script success/failure status
+          exit $original_exit_code
+        }
+
+        # Register cleanup function to run on script exit (success or failure)
+        trap cleanup_container EXIT
+
+        # Extract .next directory containing sourcemaps
+        docker cp "$CONTAINER_ID:/home/nextjs/apps/web/.next" ./extracted-next
+
+        # Verify sourcemaps exist
+        if [ ! -d "./extracted-next/static/chunks" ]; then
+          echo "❌ Error: .next/static/chunks directory not found in Docker image"
+          echo "Expected structure: /home/nextjs/apps/web/.next/static/chunks/"
+          exit 1
+        fi
+
+        sourcemap_count=$(find ./extracted-next/static/chunks -name "*.map" | wc -l)
+        echo "✅ Found ${sourcemap_count} sourcemap files"
+
+        if [ "$sourcemap_count" -eq 0 ]; then
+          echo "❌ Error: No sourcemap files found. Check that productionBrowserSourceMaps is enabled."
+          exit 1
+        fi
+
+    - name: Create Sentry release and upload sourcemaps
+      uses: getsentry/action-release@v3
+      env:
+        SENTRY_AUTH_TOKEN: ${{ inputs.sentry_auth_token }}
+        SENTRY_ORG: formbricks
+        SENTRY_PROJECT: formbricks-cloud
+      with:
+        environment: ${{ inputs.environment }}
+        version: ${{ inputs.release_version }}
+        sourcemaps: "./extracted-next/"
+
+    - name: Clean up extracted files
+      shell: bash
+      if: always()
+      run: |
+        set -euo pipefail
+        # Clean up extracted files
+        rm -rf ./extracted-next
+        echo "🧹 Cleaned up extracted files"

.github/workflows/build-and-push-ecr.yml

@@ -1,44 +1,12 @@
-name: Build Cloud Deployment Images
-
-# This workflow builds Formbricks Docker images for ECR deployment:
-# - workflow_call: Used by releases with explicit SemVer versions
-# - workflow_dispatch: Auto-detects version from current branch or uses override
+name: Build & Push Docker to ECR
 
 on:
   workflow_dispatch:
-    inputs:
-      version_override:
-        description: "Override version (SemVer only, e.g., 1.2.3). Leave empty to auto-detect from branch."
-        required: false
-        type: string
-      deploy_production:
-        description: "Tag image for production deployment"
-        required: false
-        default: false
-        type: boolean
-      deploy_staging:
-        description: "Tag image for staging deployment"
-        required: false
-        default: false
-        type: boolean
-  workflow_call:
     inputs:
       image_tag:
-        description: "Image tag to push (required for workflow_call)"
+        description: "Image tag to push (e.g., v3.16.1)"
         required: true
-        type: string
-      IS_PRERELEASE:
-        description: "Whether this is a prerelease (auto-tags for staging/production)"
-        required: false
-        type: boolean
-        default: false
-    outputs:
-      IMAGE_TAG:
-        description: "Normalized image tag used for the build"
-        value: ${{ jobs.build-and-push.outputs.IMAGE_TAG }}
-      TAGS:
-        description: "Newline-separated list of ECR tags pushed"
-        value: ${{ jobs.build-and-push.outputs.TAGS }}
+        default: "v3.16.1"
 
 permissions:
   contents: read
@@ -49,15 +17,14 @@ env:
   # ECR settings are sourced from repository/environment variables for portability across envs/forks
   ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
   ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
+  DOCKERFILE: apps/web/Dockerfile
+  CONTEXT: .
 
 jobs:
   build-and-push:
     name: Build and Push
     runs-on: ubuntu-latest
     timeout-minutes: 45
-    outputs:
-      IMAGE_TAG: ${{ steps.build.outputs.image_tag }}
-      TAGS: ${{ steps.build.outputs.registry_tags }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
@@ -67,22 +34,66 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Build and push cloud deployment image
-        id: build
-        uses: ./.github/actions/build-and-push-docker
-        with:
-          registry_type: "ecr"
-          ecr_registry: ${{ env.ECR_REGISTRY }}
-          ecr_repository: ${{ env.ECR_REPOSITORY }}
-          ecr_region: ${{ env.ECR_REGION }}
-          aws_role_arn: ${{ secrets.AWS_ECR_PUSH_ROLE_ARN }}
-          version: ${{ inputs.version_override || inputs.image_tag }}
-          deploy_production: ${{ inputs.deploy_production }}
-          deploy_staging: ${{ inputs.deploy_staging }}
-          is_prerelease: ${{ inputs.IS_PRERELEASE }}
+      - name: Validate image tag input
+        shell: bash
         env:
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${IMAGE_TAG}" ]]; then
+            echo "❌ Image tag is required (non-empty)."
+            exit 1
+          fi
+          if (( ${#IMAGE_TAG} > 128 )); then
+            echo "❌ Image tag must be at most 128 characters."
+            exit 1
+          fi
+          if [[ ! "${IMAGE_TAG}" =~ ^[a-z0-9._-]+$ ]]; then
+            echo "❌ Image tag may only contain lowercase letters, digits, '.', '_' and '-'."
+            exit 1
+          fi
+          if [[ "${IMAGE_TAG}" =~ ^[.-] || "${IMAGE_TAG}" =~ [.-]$ ]]; then
+            echo "❌ Image tag must not start or end with '.' or '-'."
+            exit 1
+          fi
+
+      - name: Validate required variables
+        shell: bash
+        env:
+          ECR_REGISTRY: ${{ env.ECR_REGISTRY }}
+          ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }}
+          ECR_REGION: ${{ env.ECR_REGION }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${ECR_REGISTRY}" || -z "${ECR_REPOSITORY}" || -z "${ECR_REGION}" ]]; then
+            echo "ECR_REGION, ECR_REGISTRY and ECR_REPOSITORY must be set via repository or environment variables (Settings → Variables)."
+            exit 1
+          fi
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a
+        with:
+          role-to-assume: ${{ secrets.AWS_ECR_PUSH_ROLE_ARN }}
+          aws-region: ${{ env.ECR_REGION }}
+
+      - name: Log in to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      - name: Build and push image (Depot remote builder)
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: ${{ env.CONTEXT }}
+          file: ${{ env.DOCKERFILE }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ inputs.image_tag }}
+            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}

.github/workflows/deploy-formbricks-cloud.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       VERSION:
-        description: "The version of the Docker image to release (clean SemVer, e.g., 1.2.3)"
+        description: "The version of the Docker image to release, full image tag if image tag is v0.0.0 enter v0.0.0."
         required: true
         type: string
       REPOSITORY:

.github/workflows/docker-build-validation.yml

@@ -21,10 +21,10 @@ jobs:
     name: Validate Docker Build
     runs-on: ubuntu-latest
 
-    # Add PostgreSQL and Redis service containers
+    # Add PostgreSQL service container
     services:
       postgres:
-        image: pgvector/pgvector@sha256:9ae02a756ba16a2d69dd78058e25915e36e189bb36ddf01ceae86390d7ed786a
+        image: pgvector/pgvector:pg17
         env:
           POSTGRES_USER: test
           POSTGRES_PASSWORD: test
@@ -38,11 +38,6 @@ jobs:
           --health-timeout 5s
           --health-retries 5
 
-      redis:
-        image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
-        ports:
-          - 6379:6379
-
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
@@ -72,7 +67,6 @@ jobs:
           secrets: |
             database_url=${{ secrets.DUMMY_DATABASE_URL }}
             encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
-            redis_url=redis://localhost:6379
 
       - name: Verify and Initialize PostgreSQL
         run: |
@@ -102,29 +96,6 @@ jobs:
           echo "Network configuration:"
           netstat -tulpn | grep 5432 || echo "No process listening on port 5432"
 
-      - name: Verify Redis/Valkey Connection
-        run: |
-          echo "Verifying Redis/Valkey connection..."
-          # Install Redis client to test connection
-          sudo apt-get update && sudo apt-get install -y redis-tools
-
-          # Test connection using redis-cli with timeout and proper error handling
-          echo "Testing Redis connection with 30 second timeout..."
-          if timeout 30 bash -c 'until redis-cli -h localhost -p 6379 ping >/dev/null 2>&1; do
-            echo "Waiting for Redis to be ready..."
-            sleep 2
-          done'; then
-            echo "✅ Redis connection successful"
-            redis-cli -h localhost -p 6379 info server | head -5
-          else
-            echo "❌ Redis connection failed after 30 seconds"
-            exit 1
-          fi
-
-          # Show network configuration for Redis
-          echo "Redis network configuration:"
-          netstat -tulpn | grep 6379 || echo "No process listening on port 6379"
-
       - name: Test Docker Image with Health Check
         shell: bash
         env:
@@ -142,7 +113,6 @@ jobs:
             -p 3000:3000 \
             -e DATABASE_URL="postgresql://test:test@host.docker.internal:5432/formbricks" \
             -e ENCRYPTION_KEY="$DUMMY_ENCRYPTION_KEY" \
-            -e REDIS_URL="redis://host.docker.internal:6379" \
             -d "formbricks-test:$GITHUB_SHA"
 
           # Start health check polling immediately (every 5 seconds for up to 5 minutes)

.github/workflows/e2e.yml

@@ -182,4 +182,4 @@ jobs:
 
       - name: Output App Logs
         if: failure()
-        run: cat app.log
+        run: cat app.log

.github/workflows/formbricks-release.yml

@@ -8,8 +8,8 @@ permissions:
   contents: read
 
 jobs:
-  docker-build-community:
-    name: Build & release community docker image
+  docker-build:
+    name: Build & release docker image
     permissions:
       contents: read
       packages: write
@@ -19,19 +19,6 @@ jobs:
     with:
       IS_PRERELEASE: ${{ github.event.release.prerelease }}
 
-  docker-build-cloud:
-    name: Build & push Formbricks Cloud to ECR
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/build-and-push-ecr.yml
-    secrets: inherit
-    with:
-      image_tag: ${{ needs.docker-build-community.outputs.VERSION }}
-      IS_PRERELEASE: ${{ github.event.release.prerelease }}
-    needs:
-      - docker-build-community
-
   helm-chart-release:
     name: Release Helm Chart
     permissions:
@@ -40,42 +27,48 @@ jobs:
     uses: ./.github/workflows/release-helm-chart.yml
     secrets: inherit
     needs:
-      - docker-build-community
+      - docker-build
     with:
-      VERSION: ${{ needs.docker-build-community.outputs.VERSION }}
+      VERSION: ${{ needs.docker-build.outputs.VERSION }}
 
-  verify-cloud-build:
-    name: Verify Cloud Build Outputs
-    runs-on: ubuntu-latest
-    timeout-minutes: 5 # Simple verification should be quick
+  deploy-formbricks-cloud:
+    name: Deploy Helm Chart to Formbricks Cloud
+    permissions:
+      contents: read
+      id-token: write
+    secrets: inherit
+    uses: ./.github/workflows/deploy-formbricks-cloud.yml
     needs:
-      - docker-build-cloud
+      - docker-build
+      - helm-chart-release
+    with:
+      VERSION: v${{ needs.docker-build.outputs.VERSION }}
+      ENVIRONMENT: ${{ github.event.release.prerelease && 'staging' || 'production' }}
+
+  upload-sentry-sourcemaps:
+    name: Upload Sentry Sourcemaps
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs:
+      - docker-build
+      - deploy-formbricks-cloud
     steps:
-      - name: Harden the runner
+      - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - name: Display ECR build outputs
-        env:
-          IMAGE_TAG: ${{ needs.docker-build-cloud.outputs.IMAGE_TAG }}
-          TAGS: ${{ needs.docker-build-cloud.outputs.TAGS }}
-        run: |
-          set -euo pipefail
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
 
-          echo "✅ ECR Build Completed Successfully"
-          echo "Image Tag: ${IMAGE_TAG}"
-          echo "ECR Tags:"
-          printf '%s\n' "${TAGS}"
-
-  move-stable-tag:
-    name: Move stable tag to release
-    permissions:
-      contents: write # Required for tag push operations in called workflow
-    uses: ./.github/workflows/move-stable-tag.yml
-    needs:
-      - docker-build-community # Ensure release is successful first
-    with:
-      release_tag: ${{ github.event.release.tag_name }}
-      commit_sha: ${{ github.sha }}
-      is_prerelease: ${{ github.event.release.prerelease }}
+      - name: Upload Sentry Sourcemaps
+        uses: ./.github/actions/upload-sentry-sourcemaps
+        continue-on-error: true
+        with:
+          docker_image: ghcr.io/formbricks/formbricks:v${{ needs.docker-build.outputs.VERSION }}
+          release_version: v${{ needs.docker-build.outputs.VERSION }}
+          sentry_auth_token: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          environment: ${{ github.event.release.prerelease && 'staging' || 'production' }}

.github/workflows/move-stable-tag.yml

@@ -1,96 +0,0 @@
-name: Move Stable Tag
-
-on:
-  workflow_call:
-    inputs:
-      release_tag:
-        description: "The release tag name (e.g., 1.2.3)"
-        required: true
-        type: string
-      commit_sha:
-        description: "The commit SHA to point the stable tag to"
-        required: true
-        type: string
-      is_prerelease:
-        description: "Whether this is a prerelease (stable tag won't be moved for prereleases)"
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-
-# Prevent concurrent stable tag operations to avoid race conditions
-concurrency:
-  group: move-stable-tag-${{ github.repository }}
-  cancel-in-progress: true
-
-jobs:
-  move-stable-tag:
-    name: Move stable tag to release
-    runs-on: ubuntu-latest
-    timeout-minutes: 10 # Prevent hung git operations
-    permissions:
-      contents: write # Required to push tags
-    # Only move stable tag for non-prerelease versions
-    if: ${{ !inputs.is_prerelease }}
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0 # Full history needed for tag operations
-
-      - name: Validate inputs
-        env:
-          RELEASE_TAG: ${{ inputs.release_tag }}
-          COMMIT_SHA: ${{ inputs.commit_sha }}
-        run: |
-          set -euo pipefail
-
-          # Validate release tag format
-          if [[ ! "$RELEASE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "❌ Error: Invalid release tag format. Expected format: 1.2.3, 1.2.3-alpha"
-            echo "Provided: $RELEASE_TAG"
-            exit 1
-          fi
-
-          # Validate commit SHA format (40 character hex)
-          if [[ ! "$COMMIT_SHA" =~ ^[a-f0-9]{40}$ ]]; then
-            echo "❌ Error: Invalid commit SHA format. Expected 40 character hex string"
-            echo "Provided: $COMMIT_SHA"
-            exit 1
-          fi
-
-          echo "✅ Input validation passed"
-          echo "Release tag: $RELEASE_TAG"
-          echo "Commit SHA: $COMMIT_SHA"
-
-      - name: Move stable tag
-        env:
-          RELEASE_TAG: ${{ inputs.release_tag }}
-          COMMIT_SHA: ${{ inputs.commit_sha }}
-        run: |
-          set -euo pipefail
-
-          # Configure git
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Verify the commit exists
-          if ! git cat-file -e "$COMMIT_SHA"; then
-            echo "❌ Error: Commit $COMMIT_SHA does not exist in this repository"
-            exit 1
-          fi
-
-          # Move stable tag to the release commit
-          echo "📌 Moving stable tag to commit: $COMMIT_SHA (release: $RELEASE_TAG)"
-          git tag -f stable "$COMMIT_SHA"
-          git push origin stable --force
-
-          echo "✅ Successfully moved stable tag to release $RELEASE_TAG"
-          echo "🔗 Stable tag now points to: https://github.com/${{ github.repository }}/commit/$COMMIT_SHA"

.github/workflows/release-docker-github-experimental.yml

@@ -1,31 +1,41 @@
-name: Build Community Testing Images
+name: Docker Release to Github Experimental
 
-# This workflow builds experimental/testing versions of Formbricks for self-hosting customers
-# to test fixes and features before official releases. Images are pushed to GHCR with
-# timestamped experimental versions for easy identification and testing.
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
 
 on:
   workflow_dispatch:
-    inputs:
-      version_override:
-        description: "Override version (SemVer only, e.g., 1.2.3-beta). Leave empty for auto-generated experimental version."
-        required: false
-        type: string
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}-experimental
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 permissions:
   contents: read
-  packages: write
-  id-token: write
 
 jobs:
-  build-community-testing:
-    name: Build Community Testing Image
+  build:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    outputs:
+      DOCKER_IMAGE: ${{ steps.extract_image_info.outputs.DOCKER_IMAGE }}
+      RELEASE_VERSION: ${{ steps.extract_image_info.outputs.RELEASE_VERSION }}
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -34,17 +44,151 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build and push community testing image
-        uses: ./.github/actions/build-and-push-docker
-        with:
-          registry_type: "ghcr"
-          ghcr_image_name: "${{ github.repository }}-experimental"
-          experimental_mode: "true"
-          version: ${{ inputs.version_override }}
+      - name: Generate SemVer version from branch or tag
+        id: generate_version
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+        run: |
+          # Get reference name and type from environment variables
+          echo "Reference type: $REF_TYPE"
+          echo "Reference name: $REF_NAME"
+
+          if [[ "$REF_TYPE" == "tag" ]]; then
+            # If running from a tag, use the tag name
+            if [[ "$REF_NAME" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
+              # Tag looks like a SemVer, use it directly (remove 'v' prefix if present)
+              VERSION=$(echo "$REF_NAME" | sed 's/^v//')
+              echo "Using SemVer tag: $VERSION"
+            else
+              # Tag is not SemVer, treat as prerelease
+              SANITIZED_TAG=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
+              VERSION="0.0.0-$SANITIZED_TAG"
+              echo "Using tag as prerelease: $VERSION"
+            fi
+          else
+            # Running from branch, use branch name as prerelease
+            SANITIZED_BRANCH=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
+            VERSION="0.0.0-$SANITIZED_BRANCH"
+            echo "Using branch as prerelease: $VERSION"
+          fi
+
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+          echo "Generated SemVer version: $VERSION"
+
+      - name: Update package.json version
+        run: |
+          sed -i "s/\"version\": \"0.0.0\"/\"version\": \"${{ env.VERSION }}\"/" ./apps/web/package.json
+          cat ./apps/web/package.json | grep version
+
+      - name: Set Sentry environment in .env
+        run: |
+          if ! grep -q "^SENTRY_ENVIRONMENT=staging$" .env 2>/dev/null; then
+            echo "SENTRY_ENVIRONMENT=staging" >> .env
+            echo "Added SENTRY_ENVIRONMENT=staging to .env file"
+          else
+            echo "SENTRY_ENVIRONMENT=staging already exists in .env file"
+          fi
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: .
+          file: ./apps/web/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+
+      - name: Extract image info for sourcemap upload
+        id: extract_image_info
+        run: |
+          # Use the first readable tag from metadata action output
+          DOCKER_IMAGE=$(echo "${{ steps.meta.outputs.tags }}" | head -n1 | xargs)
+          echo "DOCKER_IMAGE=$DOCKER_IMAGE" >> $GITHUB_OUTPUT
+
+          # Use the generated version for Sentry release
+          RELEASE_VERSION="$VERSION"
+          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_OUTPUT
+
+          echo "Docker image: $DOCKER_IMAGE"
+          echo "Release version: $RELEASE_VERSION"
+          echo "Available tags: ${{ steps.meta.outputs.tags }}"
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+
+  upload-sentry-sourcemaps:
+    name: Upload Sentry Sourcemaps
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs:
+      - build
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Upload Sentry Sourcemaps
+        uses: ./.github/actions/upload-sentry-sourcemaps
+        continue-on-error: true
+        with:
+          docker_image: ${{ needs.build.outputs.DOCKER_IMAGE }}
+          release_version: ${{ needs.build.outputs.RELEASE_VERSION }}
+          sentry_auth_token: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          environment: staging

.github/workflows/release-docker-github.yml

@@ -1,4 +1,4 @@
-name: Release Community Docker Images
+name: Docker Release to Github
 
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
@@ -23,6 +23,8 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 permissions:
   contents: read
@@ -30,7 +32,6 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
     permissions:
       contents: read
       packages: write
@@ -43,60 +44,102 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Extract release version from tag
+      - name: Get Release Tag
         id: extract_release_tag
         run: |
-          set -euo pipefail
+          # Extract version from tag (e.g., refs/tags/v1.2.3 -> 1.2.3)
+          TAG="$GITHUB_REF"
+          TAG=${TAG#refs/tags/v}
 
-          # Extract tag name with fallback logic for different trigger contexts
-          if [[ -n "${RELEASE_TAG:-}" ]]; then
-            TAG="$RELEASE_TAG"
-            echo "Using RELEASE_TAG override: $TAG"
-          elif [[ "$GITHUB_REF_NAME" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]] || [[ "$GITHUB_REF_NAME" =~ ^v[0-9] ]]; then
-            TAG="$GITHUB_REF_NAME"
-            echo "Using GITHUB_REF_NAME (looks like tag): $TAG"
-          else
-            # Fallback: extract from GITHUB_REF for direct tag triggers
-            TAG="${GITHUB_REF#refs/tags/}"
-            if [[ -z "$TAG" || "$TAG" == "$GITHUB_REF" ]]; then
-              TAG="$GITHUB_REF_NAME"
-              echo "Using GITHUB_REF_NAME as final fallback: $TAG"
-            else
-              echo "Extracted from GITHUB_REF: $TAG"
-            fi
-          fi
-
-          # Strip v-prefix if present (normalize to clean SemVer)
-          TAG=${TAG#[vV]}
-
-          # Validate SemVer format (supports prereleases like 4.0.0-rc.1)
-          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "ERROR: Invalid tag format '$TAG'. Expected SemVer (e.g., 1.2.3, 4.0.0-rc.1)"
+          # Validate the extracted tag format
+          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "❌ Error: Invalid release tag format after extraction. Must be semver (e.g., 1.2.3, 1.2.3-alpha)"
+            echo "Original ref: $GITHUB_REF"
+            echo "Extracted tag: $TAG"
             exit 1
           fi
 
-          echo "VERSION=$TAG" >> $GITHUB_OUTPUT
-          echo "Using version: $TAG"
+          # Safely add to environment variables
+          echo "RELEASE_TAG=$TAG" >> $GITHUB_ENV
 
-      - name: Build and push community release image
-        id: build
-        uses: ./.github/actions/build-and-push-docker
+          echo "VERSION=$TAG" >> $GITHUB_OUTPUT
+          echo "Using tag-based version: $TAG"
+
+      - name: Update package.json version
+        run: |
+          sed -i "s/\"version\": \"0.0.0\"/\"version\": \"${{ env.RELEASE_TAG }}\"/" ./apps/web/package.json
+          cat ./apps/web/package.json | grep version
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
-          registry_type: "ghcr"
-          ghcr_image_name: ${{ env.IMAGE_NAME }}
-          version: ${{ steps.extract_release_tag.outputs.VERSION }}
-          is_prerelease: ${{ inputs.IS_PRERELEASE }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            # Default semver tags (version, major.minor, major)
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            # Only tag as 'latest' for stable releases (not prereleases)
+            type=raw,value=latest,enable=${{ !inputs.IS_PRERELEASE  }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: .
+          file: ./apps/web/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/release-helm-chart.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -59,35 +59,14 @@ jobs:
         uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
       - name: Update Chart.yaml with new version
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Updating Chart.yaml with version: ${VERSION}"
-          yq -i ".version = \"${VERSION}\"" helm-chart/Chart.yaml
-          yq -i ".appVersion = \"${VERSION}\"" helm-chart/Chart.yaml
-
-          echo "✅ Successfully updated Chart.yaml"
+          yq -i ".version = \"$VERSION\"" helm-chart/Chart.yaml
+          yq -i ".appVersion = \"v$VERSION\"" helm-chart/Chart.yaml
 
       - name: Package Helm chart
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Packaging Helm chart version: ${VERSION}"
           helm package ./helm-chart
 
-          echo "✅ Successfully packaged formbricks-${VERSION}.tgz"
-
       - name: Push Helm chart to GitHub Container Registry
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Pushing Helm chart to registry: formbricks-${VERSION}.tgz"
-          helm push "formbricks-${VERSION}.tgz" oci://ghcr.io/formbricks/helm-charts
-
-          echo "✅ Successfully pushed Helm chart to registry"
+          helm push "formbricks-$VERSION.tgz" oci://ghcr.io/formbricks/helm-charts

.github/workflows/upload-sentry-sourcemaps.yml

@@ -0,0 +1,48 @@
+name: Upload Sentry Sourcemaps (Manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      docker_image:
+        description: "Docker image to extract sourcemaps from"
+        required: true
+        type: string
+      release_version:
+        description: "Release version (e.g., v1.2.3)"
+        required: true
+        type: string
+      tag_version:
+        description: "Docker image tag (leave empty to use release_version)"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  upload-sourcemaps:
+    name: Upload Sourcemaps to Sentry
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set Docker Image
+        run: echo "DOCKER_IMAGE=${DOCKER_IMAGE}" >> $GITHUB_ENV
+        env:
+          DOCKER_IMAGE: ${{ inputs.docker_image }}:${{ inputs.tag_version != '' && inputs.tag_version || inputs.release_version }}
+
+      - name: Upload Sourcemaps to Sentry
+        uses: ./.github/actions/upload-sentry-sourcemaps
+        with:
+          docker_image: ${{ env.DOCKER_IMAGE }}
+          release_version: ${{ inputs.release_version }}
+          sentry_auth_token: ${{ secrets.SENTRY_AUTH_TOKEN }}

apps/web/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine3.21 AS base
+FROM node:22-alpine3.22 AS base
 
 #
 ## step 1: Prune monorepo

apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/components/landing-sidebar.test.tsx

@@ -45,7 +45,7 @@ afterEach(() => {
 });
 
 describe("LandingSidebar component", () => {
-  const user = { id: "u1", name: "Alice", email: "alice@example.com", imageUrl: "" } as any;
+  const user = { id: "u1", name: "Alice", email: "alice@example.com" } as any;
   const organization = { id: "o1", name: "orgOne" } as any;
   const organizations = [
     { id: "o2", name: "betaOrg" },

apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/components/landing-sidebar.tsx

@@ -82,7 +82,7 @@ export const LandingSidebar = ({
             id="userDropdownTrigger"
             className="w-full rounded-br-xl border-t p-4 transition-colors duration-200 hover:bg-slate-50 focus:outline-none">
             <div tabIndex={0} className={cn("flex cursor-pointer flex-row items-center gap-3")}>
-              <ProfileAvatar userId={user.id} imageUrl={user.imageUrl} />
+              <ProfileAvatar userId={user.id} />
               <>
                 <div className="grow overflow-hidden">
                   <p

apps/web/app/(app)/environments/[environmentId]/components/EnvironmentLayout.test.tsx

@@ -113,7 +113,6 @@ const mockUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/components/MainNavigation.test.tsx

@@ -111,7 +111,6 @@ const mockUser = {
   id: "user1",
   name: "Test User",
   email: "test@example.com",
-  imageUrl: "http://example.com/avatar.png",
   emailVerified: new Date(),
   twoFactorEnabled: false,
   identityProvider: "email",

apps/web/app/(app)/environments/[environmentId]/components/MainNavigation.tsx

@@ -342,7 +342,7 @@ export const MainNavigation = ({
                       "flex cursor-pointer flex-row items-center gap-3",
                       isCollapsed ? "justify-center px-2" : "px-4"
                     )}>
-                    <ProfileAvatar userId={user.id} imageUrl={user.imageUrl} />
+                    <ProfileAvatar userId={user.id} />
                     {!isCollapsed && !isTextVisible && (
                       <>
                         <div

apps/web/app/(app)/environments/[environmentId]/page.test.tsx

@@ -37,7 +37,6 @@ describe("EnvironmentPage", () => {
       id: mockUserId,
       name: "Test User",
       email: "test@example.com",
-      imageUrl: "",
       twoFactorEnabled: false,
       identityProvider: "email",
       createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/actions.ts

@@ -5,8 +5,6 @@ import {
   verifyUserPassword,
 } from "@/app/(app)/environments/[environmentId]/settings/(account)/profile/lib/user";
 import { EMAIL_VERIFICATION_DISABLED } from "@/lib/constants";
-import { deleteFile } from "@/lib/storage/service";
-import { getFileNameWithIdFromUrl } from "@/lib/storage/utils";
 import { getUser, updateUser } from "@/lib/user/service";
 import { authenticatedActionClient } from "@/lib/utils/action-client";
 import { AuthenticatedActionClientCtx } from "@/lib/utils/action-client/types/context";
@@ -15,8 +13,6 @@ import { applyRateLimit } from "@/modules/core/rate-limit/helpers";
 import { rateLimitConfigs } from "@/modules/core/rate-limit/rate-limit-configs";
 import { withAuditLogging } from "@/modules/ee/audit-logs/lib/handler";
 import { sendForgotPasswordEmail, sendVerificationNewEmail } from "@/modules/email";
-import { z } from "zod";
-import { ZId } from "@formbricks/types/common";
 import { AuthenticationError, AuthorizationError, OperationNotAllowedError } from "@formbricks/types/errors";
 import {
   TUserPersonalInfoUpdateInput,
@@ -97,58 +93,6 @@ export const updateUserAction = authenticatedActionClient.schema(ZUserPersonalIn
   )
 );
 
-const ZUpdateAvatarAction = z.object({
-  avatarUrl: z.string(),
-});
-
-export const updateAvatarAction = authenticatedActionClient.schema(ZUpdateAvatarAction).action(
-  withAuditLogging(
-    "updated",
-    "user",
-    async ({ ctx, parsedInput }: { ctx: AuthenticatedActionClientCtx; parsedInput: Record<string, any> }) => {
-      const oldObject = await getUser(ctx.user.id);
-      const result = await updateUser(ctx.user.id, { imageUrl: parsedInput.avatarUrl });
-      ctx.auditLoggingCtx.userId = ctx.user.id;
-      ctx.auditLoggingCtx.oldObject = oldObject;
-      ctx.auditLoggingCtx.newObject = result;
-      return result;
-    }
-  )
-);
-
-const ZRemoveAvatarAction = z.object({
-  environmentId: ZId,
-});
-
-export const removeAvatarAction = authenticatedActionClient.schema(ZRemoveAvatarAction).action(
-  withAuditLogging(
-    "updated",
-    "user",
-    async ({ ctx, parsedInput }: { ctx: AuthenticatedActionClientCtx; parsedInput: Record<string, any> }) => {
-      const oldObject = await getUser(ctx.user.id);
-      const imageUrl = ctx.user.imageUrl;
-      if (!imageUrl) {
-        throw new Error("Image not found");
-      }
-
-      const fileName = getFileNameWithIdFromUrl(imageUrl);
-      if (!fileName) {
-        throw new Error("Invalid filename");
-      }
-
-      const deletionResult = await deleteFile(parsedInput.environmentId, "public", fileName);
-      if (!deletionResult.success) {
-        throw new Error("Deletion failed");
-      }
-      const result = await updateUser(ctx.user.id, { imageUrl: null });
-      ctx.auditLoggingCtx.userId = ctx.user.id;
-      ctx.auditLoggingCtx.oldObject = oldObject;
-      ctx.auditLoggingCtx.newObject = result;
-      return result;
-    }
-  )
-);
-
 export const resetPasswordAction = authenticatedActionClient.action(
   withAuditLogging(
     "passwordReset",

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/components/EditProfileAvatarForm.test.tsx

@@ -1,104 +0,0 @@
-import * as profileActions from "@/app/(app)/environments/[environmentId]/settings/(account)/profile/actions";
-import * as fileUploadHooks from "@/app/lib/fileUpload";
-import { cleanup, render, screen, waitFor } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { Session } from "next-auth";
-import toast from "react-hot-toast";
-import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
-import { EditProfileAvatarForm } from "./EditProfileAvatarForm";
-
-vi.mock("@/modules/ui/components/avatars", () => ({
-  ProfileAvatar: ({ imageUrl }) => <div data-testid="profile-avatar">{imageUrl || "No Avatar"}</div>,
-}));
-
-vi.mock("next/navigation", () => ({
-  useRouter: () => ({
-    refresh: vi.fn(),
-  }),
-}));
-
-vi.mock("@/app/(app)/environments/[environmentId]/settings/(account)/profile/actions", () => ({
-  updateAvatarAction: vi.fn(),
-  removeAvatarAction: vi.fn(),
-}));
-
-vi.mock("@/app/lib/fileUpload", () => ({
-  handleFileUpload: vi.fn(),
-}));
-
-const mockSession: Session = {
-  user: { id: "user-id" },
-  expires: "session-expires-at",
-};
-const environmentId = "test-env-id";
-
-describe("EditProfileAvatarForm", () => {
-  afterEach(() => {
-    cleanup();
-    vi.clearAllMocks();
-  });
-
-  beforeEach(() => {
-    vi.mocked(profileActions.updateAvatarAction).mockResolvedValue({});
-    vi.mocked(profileActions.removeAvatarAction).mockResolvedValue({});
-    vi.mocked(fileUploadHooks.handleFileUpload).mockResolvedValue({
-      url: "new-avatar.jpg",
-      error: undefined,
-    });
-  });
-
-  test("renders correctly without an existing image", () => {
-    render(<EditProfileAvatarForm session={mockSession} environmentId={environmentId} imageUrl={null} />);
-    expect(screen.getByTestId("profile-avatar")).toHaveTextContent("No Avatar");
-    expect(screen.getByText("environments.settings.profile.upload_image")).toBeInTheDocument();
-    expect(screen.queryByText("environments.settings.profile.remove_image")).not.toBeInTheDocument();
-  });
-
-  test("renders correctly with an existing image", () => {
-    render(
-      <EditProfileAvatarForm
-        session={mockSession}
-        environmentId={environmentId}
-        imageUrl="existing-avatar.jpg"
-      />
-    );
-    expect(screen.getByTestId("profile-avatar")).toHaveTextContent("existing-avatar.jpg");
-    expect(screen.getByText("environments.settings.profile.change_image")).toBeInTheDocument();
-    expect(screen.getByText("environments.settings.profile.remove_image")).toBeInTheDocument();
-  });
-
-  test("handles image removal successfully", async () => {
-    render(
-      <EditProfileAvatarForm
-        session={mockSession}
-        environmentId={environmentId}
-        imageUrl="existing-avatar.jpg"
-      />
-    );
-    const removeButton = screen.getByText("environments.settings.profile.remove_image");
-    await userEvent.click(removeButton);
-
-    await waitFor(() => {
-      expect(profileActions.removeAvatarAction).toHaveBeenCalledWith({ environmentId });
-    });
-  });
-
-  test("shows error if removeAvatarAction fails", async () => {
-    vi.mocked(profileActions.removeAvatarAction).mockRejectedValue(new Error("API error"));
-    render(
-      <EditProfileAvatarForm
-        session={mockSession}
-        environmentId={environmentId}
-        imageUrl="existing-avatar.jpg"
-      />
-    );
-    const removeButton = screen.getByText("environments.settings.profile.remove_image");
-    await userEvent.click(removeButton);
-
-    await waitFor(() => {
-      expect(vi.mocked(toast.error)).toHaveBeenCalledWith(
-        "environments.settings.profile.avatar_update_failed"
-      );
-    });
-  });
-});

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/components/EditProfileAvatarForm.tsx

@@ -1,178 +0,0 @@
-"use client";
-
-import {
-  removeAvatarAction,
-  updateAvatarAction,
-} from "@/app/(app)/environments/[environmentId]/settings/(account)/profile/actions";
-import { handleFileUpload } from "@/app/lib/fileUpload";
-import { ProfileAvatar } from "@/modules/ui/components/avatars";
-import { Button } from "@/modules/ui/components/button";
-import { FormError, FormField, FormItem, FormProvider } from "@/modules/ui/components/form";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { useTranslate } from "@tolgee/react";
-import { Session } from "next-auth";
-import { useRouter } from "next/navigation";
-import { useRef, useState } from "react";
-import { useForm } from "react-hook-form";
-import toast from "react-hot-toast";
-import { z } from "zod";
-
-interface EditProfileAvatarFormProps {
-  session: Session;
-  environmentId: string;
-  imageUrl: string | null;
-}
-
-export const EditProfileAvatarForm = ({ session, environmentId, imageUrl }: EditProfileAvatarFormProps) => {
-  const inputRef = useRef<HTMLInputElement>(null);
-  const [isLoading, setIsLoading] = useState(false);
-  const router = useRouter();
-  const { t } = useTranslate();
-  const fileSchema =
-    typeof window !== "undefined"
-      ? z
-          .instanceof(FileList)
-          .refine((files) => files.length === 1, t("environments.settings.profile.you_must_select_a_file"))
-          .refine((files) => {
-            const file = files[0];
-            const allowedTypes = ["image/jpeg", "image/png", "image/webp"];
-            return allowedTypes.includes(file.type);
-          }, t("environments.settings.profile.invalid_file_type"))
-          .refine((files) => {
-            const file = files[0];
-            const maxSize = 10 * 1024 * 1024;
-            return file.size <= maxSize;
-          }, t("environments.settings.profile.file_size_must_be_less_than_10mb"))
-      : z.any();
-
-  const formSchema = z.object({
-    file: fileSchema,
-  });
-
-  type FormValues = z.infer<typeof formSchema>;
-
-  const form = useForm<FormValues>({
-    mode: "onChange",
-    resolver: zodResolver(formSchema),
-  });
-
-  const handleUpload = async (file: File, environmentId: string) => {
-    setIsLoading(true);
-    try {
-      if (imageUrl) {
-        // If avatar image already exists, then remove it before update action
-        await removeAvatarAction({ environmentId });
-      }
-      const { url, error } = await handleFileUpload(file, environmentId);
-
-      if (error) {
-        toast.error(error);
-        setIsLoading(false);
-        return;
-      }
-
-      await updateAvatarAction({ avatarUrl: url });
-      router.refresh();
-    } catch (err) {
-      toast.error(t("environments.settings.profile.avatar_update_failed"));
-      setIsLoading(false);
-    }
-
-    setIsLoading(false);
-  };
-
-  const handleRemove = async () => {
-    setIsLoading(true);
-
-    try {
-      await removeAvatarAction({ environmentId });
-    } catch (err) {
-      toast.error(t("environments.settings.profile.avatar_update_failed"));
-    } finally {
-      setIsLoading(false);
-      form.reset();
-    }
-  };
-
-  const onSubmit = async (data: FormValues) => {
-    const file = data.file[0];
-    if (file) {
-      await handleUpload(file, environmentId);
-    }
-  };
-
-  return (
-    <div>
-      <div className="relative h-10 w-10 overflow-hidden rounded-full">
-        {isLoading && (
-          <div className="absolute inset-0 flex items-center justify-center bg-black bg-opacity-30">
-            <svg className="h-7 w-7 animate-spin text-slate-200" viewBox="0 0 24 24">
-              <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
-              <path
-                className="opacity-75"
-                fill="currentColor"
-                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-              />
-            </svg>
-          </div>
-        )}
-
-        <ProfileAvatar userId={session.user.id} imageUrl={imageUrl} />
-      </div>
-
-      <FormProvider {...form}>
-        <form onSubmit={form.handleSubmit(onSubmit)} className="mt-4">
-          <FormField
-            name="file"
-            control={form.control}
-            render={({ field, fieldState }) => (
-              <FormItem>
-                <div className="flex">
-                  <Button
-                    type="button"
-                    size="sm"
-                    className="mr-2"
-                    variant={!!fieldState.error?.message ? "destructive" : "secondary"}
-                    onClick={() => {
-                      inputRef.current?.click();
-                    }}>
-                    {imageUrl
-                      ? t("environments.settings.profile.change_image")
-                      : t("environments.settings.profile.upload_image")}
-                    <input
-                      type="file"
-                      id="hiddenFileInput"
-                      ref={(e) => {
-                        field.ref(e);
-                        inputRef.current = e;
-                      }}
-                      className="hidden"
-                      accept="image/jpeg, image/png, image/webp"
-                      onChange={(e) => {
-                        field.onChange(e.target.files);
-                        form.handleSubmit(onSubmit)();
-                      }}
-                    />
-                  </Button>
-
-                  {imageUrl && (
-                    <Button
-                      type="button"
-                      className="mr-2"
-                      variant="destructive"
-                      size="sm"
-                      onClick={handleRemove}>
-                      {t("environments.settings.profile.remove_image")}
-                    </Button>
-                  )}
-                </div>
-
-                <FormError />
-              </FormItem>
-            )}
-          />
-        </form>
-      </FormProvider>
-    </div>
-  );
-};

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/loading.test.tsx

@@ -49,15 +49,12 @@ describe("Loading", () => {
     );
 
     const loadingCards = screen.getAllByTestId("loading-card");
-    expect(loadingCards).toHaveLength(3);
+    expect(loadingCards).toHaveLength(2);
 
     expect(loadingCards[0]).toHaveTextContent("environments.settings.profile.personal_information");
     expect(loadingCards[0]).toHaveTextContent("environments.settings.profile.update_personal_info");
 
-    expect(loadingCards[1]).toHaveTextContent("common.avatar");
-    expect(loadingCards[1]).toHaveTextContent("environments.settings.profile.organization_identification");
-
-    expect(loadingCards[2]).toHaveTextContent("environments.settings.profile.delete_account");
-    expect(loadingCards[2]).toHaveTextContent("environments.settings.profile.confirm_delete_account");
+    expect(loadingCards[1]).toHaveTextContent("environments.settings.profile.delete_account");
+    expect(loadingCards[1]).toHaveTextContent("environments.settings.profile.confirm_delete_account");
   });
 });

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/loading.tsx

@@ -19,11 +19,6 @@ const Loading = () => {
         { classes: "h-6 w-64" },
       ],
     },
-    {
-      title: t("common.avatar"),
-      description: t("environments.settings.profile.organization_identification"),
-      skeletonLines: [{ classes: "h-10 w-10" }, { classes: "h-8 w-24" }],
-    },
     {
       title: t("environments.settings.profile.delete_account"),
       description: t("environments.settings.profile.confirm_delete_account"),

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/page.test.tsx

@@ -55,11 +55,6 @@ vi.mock(
 vi.mock("./components/DeleteAccount", () => ({
   DeleteAccount: ({ user }) => <div data-testid="delete-account">DeleteAccount: {user.id}</div>,
 }));
-vi.mock("./components/EditProfileAvatarForm", () => ({
-  EditProfileAvatarForm: ({ _, environmentId }) => (
-    <div data-testid="edit-profile-avatar-form">EditProfileAvatarForm: {environmentId}</div>
-  ),
-}));
 vi.mock("./components/EditProfileDetailsForm", () => ({
   EditProfileDetailsForm: ({ user }) => (
     <div data-testid="edit-profile-details-form">EditProfileDetailsForm: {user.id}</div>
@@ -73,7 +68,6 @@ const mockUser = {
   id: "user-123",
   name: "Test User",
   email: "test@example.com",
-  imageUrl: "http://example.com/avatar.png",
   twoFactorEnabled: false,
   identityProvider: "email",
   notificationSettings: { alert: {}, unsubscribedOrganizationIds: [] },
@@ -117,7 +111,6 @@ describe("ProfilePage", () => {
         "AccountSettingsNavbar: env-123 profile"
       );
       expect(screen.getByTestId("edit-profile-details-form")).toBeInTheDocument();
-      expect(screen.getByTestId("edit-profile-avatar-form")).toBeInTheDocument();
       expect(screen.getByTestId("account-security")).toBeInTheDocument(); // Shown because 2FA license is enabled
       expect(screen.queryByTestId("upgrade-prompt")).not.toBeInTheDocument();
       expect(screen.getByTestId("delete-account")).toBeInTheDocument();

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/page.tsx

@@ -12,7 +12,6 @@ import { UpgradePrompt } from "@/modules/ui/components/upgrade-prompt";
 import { getTranslate } from "@/tolgee/server";
 import { SettingsCard } from "../../components/SettingsCard";
 import { DeleteAccount } from "./components/DeleteAccount";
-import { EditProfileAvatarForm } from "./components/EditProfileAvatarForm";
 import { EditProfileDetailsForm } from "./components/EditProfileDetailsForm";
 
 const Page = async (props: { params: Promise<{ environmentId: string }> }) => {
@@ -50,17 +49,6 @@ const Page = async (props: { params: Promise<{ environmentId: string }> }) => {
               isPasswordResetEnabled={isPasswordResetEnabled}
             />
           </SettingsCard>
-          <SettingsCard
-            title={t("common.avatar")}
-            description={t("environments.settings.profile.organization_identification")}>
-            {user && (
-              <EditProfileAvatarForm
-                session={session}
-                environmentId={environmentId}
-                imageUrl={user.imageUrl}
-              />
-            )}
-          </SettingsCard>
           {user.identityProvider === "email" && (
             <SettingsCard
               title={t("common.security")}

apps/web/app/(app)/environments/[environmentId]/settings/(organization)/enterprise/page.test.tsx

@@ -126,7 +126,6 @@ const mockUser = {
   createdAt: new Date(),
   updatedAt: new Date(),
   emailVerified: new Date(),
-  imageUrl: "",
   twoFactorEnabled: false,
   identityProvider: "email",
   notificationSettings: { alert: {} },

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseCardModal.test.tsx

@@ -128,7 +128,6 @@ const mockUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseDataView.test.tsx

@@ -145,7 +145,6 @@ const mockUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseTableColumns.test.tsx

@@ -147,8 +147,14 @@ const mockSurvey = {
       id: "q2matrix",
       type: TSurveyQuestionTypeEnum.Matrix,
       headline: { default: "Matrix Question" },
-      rows: [{ default: "Row1" }, { default: "Row2" }],
-      columns: [{ default: "Col1" }, { default: "Col2" }],
+      rows: [
+        { id: "row-1", label: { default: "Row1" } },
+        { id: "row-2", label: { default: "Row2" } },
+      ],
+      columns: [
+        { id: "col-1", label: { default: "Col1" } },
+        { id: "col-2", label: { default: "Col2" } },
+      ],
       required: false,
     } as unknown as TSurveyQuestion,
     {

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseTableColumns.tsx

@@ -74,7 +74,7 @@ const getQuestionColumnsData = (
     case "matrix":
       return question.rows.map((matrixRow) => {
         return {
-          accessorKey: matrixRow.default,
+          accessorKey: matrixRow.label.default,
           header: () => {
             return (
               <div className="flex items-center justify-between">
@@ -83,14 +83,14 @@ const getQuestionColumnsData = (
                   <span className="truncate">
                     {getLocalizedValue(question.headline, "default") +
                       " - " +
-                      getLocalizedValue(matrixRow, "default")}
+                      getLocalizedValue(matrixRow.label, "default")}
                   </span>
                 </div>
               </div>
             );
           },
           cell: ({ row }) => {
-            const responseValue = row.original.responseData[matrixRow.default];
+            const responseValue = row.original.responseData[matrixRow.label.default];
             if (typeof responseValue === "string") {
               return <p className="text-slate-900">{responseValue}</p>;
             }

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/SurveyAnalysisCTA.test.tsx

@@ -291,7 +291,6 @@ const mockUser: TUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "https://example.com/avatar.jpg",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/share-survey-modal.test.tsx

@@ -250,7 +250,6 @@ const mockUser: TUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "https://example.com/avatar.jpg",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/share-survey-modal.tsx

@@ -198,6 +198,7 @@ export const ShareSurveyModal = ({
     if (survey.type !== "link") {
       return ShareViaType.APP;
     }
+
     return ShareViaType.ANON_LINKS;
   }, [survey.type]);
 

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/lib/surveySummary.test.ts

@@ -1327,8 +1327,17 @@ describe("Matrix question type tests", () => {
       type: TSurveyQuestionTypeEnum.Matrix,
       headline: { default: "Rate these aspects" },
       required: true,
-      rows: [{ default: "Speed" }, { default: "Quality" }, { default: "Price" }],
-      columns: [{ default: "Poor" }, { default: "Average" }, { default: "Good" }, { default: "Excellent" }],
+      rows: [
+        { id: "row-1", label: { default: "Speed" } },
+        { id: "row-2", label: { default: "Quality" } },
+        { id: "row-3", label: { default: "Price" } },
+      ],
+      columns: [
+        { id: "col-1", label: { default: "Poor" } },
+        { id: "col-2", label: { default: "Average" } },
+        { id: "col-3", label: { default: "Good" } },
+        { id: "col-4", label: { default: "Excellent" } },
+      ],
     };
 
     const survey = {
@@ -1410,15 +1419,15 @@ describe("Matrix question type tests", () => {
       headline: { default: "Rate these aspects", es: "Califica estos aspectos" },
       required: true,
       rows: [
-        { default: "Speed", es: "Velocidad" },
-        { default: "Quality", es: "Calidad" },
-        { default: "Price", es: "Precio" },
+        { id: "row-1", label: { default: "Speed", es: "Velocidad" } },
+        { id: "row-2", label: { default: "Quality", es: "Calidad" } },
+        { id: "row-3", label: { default: "Price", es: "Precio" } },
       ],
       columns: [
-        { default: "Poor", es: "Malo" },
-        { default: "Average", es: "Promedio" },
-        { default: "Good", es: "Bueno" },
-        { default: "Excellent", es: "Excelente" },
+        { id: "col-1", label: { default: "Poor", es: "Malo" } },
+        { id: "col-2", label: { default: "Average", es: "Promedio" } },
+        { id: "col-3", label: { default: "Good", es: "Bueno" } },
+        { id: "col-4", label: { default: "Excellent", es: "Excelente" } },
       ],
     };
 
@@ -1587,8 +1596,16 @@ describe("Matrix question type tests", () => {
       type: TSurveyQuestionTypeEnum.Matrix,
       headline: { default: "Rate these aspects" },
       required: true,
-      rows: [{ default: "Speed" }, { default: "Quality" }, { default: "Price" }],
-      columns: [{ default: "Poor" }, { default: "Average" }, { default: "Good" }],
+      rows: [
+        { id: "row-1", label: { default: "Speed" } },
+        { id: "row-2", label: { default: "Quality" } },
+        { id: "row-3", label: { default: "Price" } },
+      ],
+      columns: [
+        { id: "col-1", label: { default: "Poor" } },
+        { id: "col-2", label: { default: "Average" } },
+        { id: "col-3", label: { default: "Good" } },
+      ],
     };
 
     const survey = {
@@ -1721,8 +1738,16 @@ describe("Matrix question type tests", () => {
       type: TSurveyQuestionTypeEnum.Matrix,
       headline: { default: "Rate these aspects" },
       required: true,
-      rows: [{ default: "Speed" }, { default: "Quality" }, { default: "Price" }],
-      columns: [{ default: "Poor" }, { default: "Average" }, { default: "Good" }],
+      rows: [
+        { id: "row-1", label: { default: "Speed" } },
+        { id: "row-2", label: { default: "Quality" } },
+        { id: "row-3", label: { default: "Price" } },
+      ],
+      columns: [
+        { id: "col-1", label: { default: "Poor" } },
+        { id: "col-2", label: { default: "Average" } },
+        { id: "col-3", label: { default: "Good" } },
+      ],
     };
 
     const survey = {
@@ -1785,8 +1810,14 @@ describe("Matrix question type tests", () => {
       type: TSurveyQuestionTypeEnum.Matrix,
       headline: { default: "Rate these aspects" },
       required: true,
-      rows: [{ default: "Speed" }, { default: "Quality" }],
-      columns: [{ default: "Poor" }, { default: "Good" }],
+      rows: [
+        { id: "row-1", label: { default: "Speed" } },
+        { id: "row-2", label: { default: "Quality" } },
+      ],
+      columns: [
+        { id: "col-1", label: { default: "Poor" } },
+        { id: "col-2", label: { default: "Good" } },
+      ],
     };
 
     const survey = {
@@ -1849,12 +1880,12 @@ describe("Matrix question type tests", () => {
       headline: { default: "Rate these aspects", fr: "Évaluez ces aspects" },
       required: true,
       rows: [
-        { default: "Speed", fr: "Vitesse" },
-        { default: "Quality", fr: "Qualité" },
+        { id: "row-1", label: { default: "Speed", fr: "Vitesse" } },
+        { id: "row-2", label: { default: "Quality", fr: "Qualité" } },
       ],
       columns: [
-        { default: "Poor", fr: "Médiocre" },
-        { default: "Good", fr: "Bon" },
+        { id: "col-1", label: { default: "Poor", fr: "Médiocre" } },
+        { id: "col-2", label: { default: "Good", fr: "Bon" } },
       ],
     };
 

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/lib/surveySummary.ts

@@ -736,8 +736,8 @@ export const getQuestionSummary = async (
         break;
       }
       case TSurveyQuestionTypeEnum.Matrix: {
-        const rows = question.rows.map((row) => getLocalizedValue(row, "default"));
-        const columns = question.columns.map((column) => getLocalizedValue(column, "default"));
+        const rows = question.rows.map((row) => getLocalizedValue(row.label, "default"));
+        const columns = question.columns.map((column) => getLocalizedValue(column.label, "default"));
         let totalResponseCount = 0;
 
         // Initialize count object
@@ -755,13 +755,15 @@ export const getQuestionSummary = async (
           if (selectedResponses) {
             totalResponseCount++;
             question.rows.forEach((row) => {
-              const localizedRow = getLocalizedValue(row, responseLanguageCode);
+              const localizedRow = getLocalizedValue(row.label, responseLanguageCode);
               const colValue = question.columns.find((column) => {
-                return getLocalizedValue(column, responseLanguageCode) === selectedResponses[localizedRow];
+                return (
+                  getLocalizedValue(column.label, responseLanguageCode) === selectedResponses[localizedRow]
+                );
               });
-              const colValueInDefaultLanguage = getLocalizedValue(colValue, "default");
+              const colValueInDefaultLanguage = getLocalizedValue(colValue?.label, "default");
               if (colValueInDefaultLanguage && columns.includes(colValueInDefaultLanguage)) {
-                countMap[getLocalizedValue(row, "default")][colValueInDefaultLanguage] += 1;
+                countMap[getLocalizedValue(row.label, "default")][colValueInDefaultLanguage] += 1;
               }
             });
           }

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/page.test.tsx

@@ -158,7 +158,6 @@ const mockUser = {
   name: "Test User",
   email: "test@example.com",
   emailVerified: new Date(),
-  imageUrl: "",
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),
@@ -174,7 +173,6 @@ const mockSession = {
     id: mockUserId,
     name: mockUser.name,
     email: mockUser.email,
-    image: mockUser.imageUrl,
     role: mockUser.role,
     plan: "free",
     status: "active",

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/components/QuestionFilterComboBox.test.tsx

@@ -89,4 +89,94 @@ describe("QuestionFilterComboBox", () => {
     await userEvent.click(comboBoxOpenerButton);
     expect(screen.queryByText("X")).not.toBeInTheDocument();
   });
+
+  test("shows text input for URL meta field", () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "url",
+      filterValue: "Contains",
+      filterComboBoxValue: "example.com",
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    const textInput = screen.getByDisplayValue("example.com");
+    expect(textInput).toBeInTheDocument();
+    expect(textInput).toHaveAttribute("type", "text");
+  });
+
+  test("text input is disabled when no filter value is selected for URL field", () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "url",
+      filterValue: undefined,
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    const textInput = screen.getByRole("textbox");
+    expect(textInput).toBeDisabled();
+  });
+
+  test("text input calls onChangeFilterComboBoxValue when typing for URL field", async () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "url",
+      filterValue: "Contains",
+      filterComboBoxValue: "",
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    const textInput = screen.getByRole("textbox");
+    await userEvent.type(textInput, "t");
+    expect(props.onChangeFilterComboBoxValue).toHaveBeenCalledWith("t");
+  });
+
+  test("shows regular combobox for non-URL meta fields", () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "source",
+      filterValue: "Equals",
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    expect(screen.queryByRole("textbox")).not.toBeInTheDocument();
+    expect(screen.getAllByRole("button").length).toBeGreaterThanOrEqual(2);
+  });
+
+  test("shows regular combobox for URL field with non-text operations", () => {
+    const props = {
+      ...defaultProps,
+      type: "Other",
+      fieldId: "url",
+      filterValue: "Equals",
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    expect(screen.queryByRole("textbox")).not.toBeInTheDocument();
+    expect(screen.getAllByRole("button").length).toBeGreaterThanOrEqual(2);
+  });
+
+  test("text input handles string filter combo box values correctly", () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "url",
+      filterValue: "Contains",
+      filterComboBoxValue: "test-url",
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    const textInput = screen.getByDisplayValue("test-url");
+    expect(textInput).toBeInTheDocument();
+  });
+
+  test("text input handles non-string filter combo box values gracefully", () => {
+    const props = {
+      ...defaultProps,
+      type: "Meta",
+      fieldId: "url",
+      filterValue: "Contains",
+      filterComboBoxValue: ["array-value"],
+    } as any;
+    render(<QuestionFilterComboBox {...props} />);
+    const textInput = screen.getByRole("textbox");
+    expect(textInput).toHaveValue("");
+  });
 });

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/components/QuestionFilterComboBox.tsx

@@ -33,6 +33,7 @@ type QuestionFilterComboBoxProps = {
   type?: TSurveyQuestionTypeEnum | Omit<OptionsType, OptionsType.QUESTIONS>;
   handleRemoveMultiSelect: (value: string[]) => void;
   disabled?: boolean;
+  fieldId?: string;
 };
 
 export const QuestionFilterComboBox = ({
@@ -45,6 +46,7 @@ export const QuestionFilterComboBox = ({
   type,
   handleRemoveMultiSelect,
   disabled = false,
+  fieldId,
 }: QuestionFilterComboBoxProps) => {
   const [open, setOpen] = React.useState(false);
   const [openFilterValue, setOpenFilterValue] = React.useState<boolean>(false);
@@ -75,6 +77,9 @@ export const QuestionFilterComboBox = ({
     (type === TSurveyQuestionTypeEnum.NPS || type === TSurveyQuestionTypeEnum.Rating) &&
     (filterValue === "Submitted" || filterValue === "Skipped");
 
+  // Check if this is a URL field with string comparison operations that require text input
+  const isTextInputField = type === OptionsType.META && fieldId === "url";
+
   const filteredOptions = options?.filter((o) =>
     (typeof o === "object" ? getLocalizedValue(o, defaultLanguageCode) : o)
       .toLowerCase()
@@ -161,70 +166,80 @@ export const QuestionFilterComboBox = ({
           </DropdownMenuContent>
         </DropdownMenu>
       )}
-      <Command ref={commandRef} className="h-10 overflow-visible bg-transparent">
-        <div
-          className={clsx(
-            "group flex items-center justify-between rounded-md rounded-l-none bg-white px-3 py-2 text-sm"
-          )}>
-          {filterComboBoxValue && filterComboBoxValue.length > 0 ? (
-            filterComboBoxItem
-          ) : (
+      {isTextInputField ? (
+        <Input
+          type="text"
+          value={typeof filterComboBoxValue === "string" ? filterComboBoxValue : ""}
+          onChange={(e) => onChangeFilterComboBoxValue(e.target.value)}
+          disabled={disabled || !filterValue}
+          className="h-9 rounded-l-none border-none bg-white text-sm focus:ring-offset-0"
+        />
+      ) : (
+        <Command ref={commandRef} className="h-10 overflow-visible bg-transparent">
+          <div
+            className={clsx(
+              "group flex items-center justify-between rounded-md rounded-l-none bg-white px-3 py-2 text-sm"
+            )}>
+            {filterComboBoxValue && filterComboBoxValue.length > 0 ? (
+              filterComboBoxItem
+            ) : (
+              <button
+                type="button"
+                onClick={() => !disabled && !isDisabledComboBox && filterValue && setOpen(true)}
+                disabled={disabled || isDisabledComboBox || !filterValue}
+                className={clsx(
+                  "flex-1 text-left text-slate-400",
+                  disabled || isDisabledComboBox || !filterValue ? "opacity-50" : "cursor-pointer"
+                )}>
+                {t("common.select")}...
+              </button>
+            )}
             <button
               type="button"
               onClick={() => !disabled && !isDisabledComboBox && filterValue && setOpen(true)}
               disabled={disabled || isDisabledComboBox || !filterValue}
               className={clsx(
-                "flex-1 text-left text-slate-400",
+                "ml-2 flex items-center justify-center",
                 disabled || isDisabledComboBox || !filterValue ? "opacity-50" : "cursor-pointer"
               )}>
-              {t("common.select")}...
+              {open ? (
+                <ChevronUp className="h-4 w-4 opacity-50" />
+              ) : (
+                <ChevronDown className="h-4 w-4 opacity-50" />
+              )}
             </button>
-          )}
-          <button
-            type="button"
-            onClick={() => !disabled && !isDisabledComboBox && filterValue && setOpen(true)}
-            disabled={disabled || isDisabledComboBox || !filterValue}
-            className={clsx(
-              "ml-2 flex items-center justify-center",
-              disabled || isDisabledComboBox || !filterValue ? "opacity-50" : "cursor-pointer"
-            )}>
-            {open ? (
-              <ChevronUp className="h-4 w-4 opacity-50" />
-            ) : (
-              <ChevronDown className="h-4 w-4 opacity-50" />
+          </div>
+          <div className="relative mt-2 h-full">
+            {open && (
+              <div className="animate-in absolute top-0 z-10 max-h-52 w-full overflow-auto rounded-md bg-white outline-none">
+                <CommandList>
+                  <div className="p-2">
+                    <Input
+                      type="text"
+                      autoFocus
+                      placeholder={t("common.search") + "..."}
+                      value={searchQuery}
+                      onChange={(e) => setSearchQuery(e.target.value)}
+                      className="w-full rounded-md border border-slate-300 p-2 text-sm focus:border-slate-300"
+                    />
+                  </div>
+                  <CommandEmpty>{t("common.no_result_found")}</CommandEmpty>
+                  <CommandGroup>
+                    {filteredOptions?.map((o, index) => (
+                      <CommandItem
+                        key={`option-${typeof o === "object" ? getLocalizedValue(o, defaultLanguageCode) : o}-${index}`}
+                        onSelect={() => commandItemOnSelect(o)}
+                        className="cursor-pointer">
+                        {typeof o === "object" ? getLocalizedValue(o, defaultLanguageCode) : o}
+                      </CommandItem>
+                    ))}
+                  </CommandGroup>
+                </CommandList>
+              </div>
             )}
-          </button>
-        </div>
-        <div className="relative mt-2 h-full">
-          {open && (
-            <div className="animate-in absolute top-0 z-10 max-h-52 w-full overflow-auto rounded-md bg-white outline-none">
-              <CommandList>
-                <div className="p-2">
-                  <Input
-                    type="text"
-                    autoFocus
-                    placeholder={t("common.search") + "..."}
-                    value={searchQuery}
-                    onChange={(e) => setSearchQuery(e.target.value)}
-                    className="w-full rounded-md border border-slate-300 p-2 text-sm focus:border-slate-300"
-                  />
-                </div>
-                <CommandEmpty>{t("common.no_result_found")}</CommandEmpty>
-                <CommandGroup>
-                  {filteredOptions?.map((o, index) => (
-                    <CommandItem
-                      key={`option-${typeof o === "object" ? getLocalizedValue(o, defaultLanguageCode) : o}-${index}`}
-                      onSelect={() => commandItemOnSelect(o)}
-                      className="cursor-pointer">
-                      {typeof o === "object" ? getLocalizedValue(o, defaultLanguageCode) : o}
-                    </CommandItem>
-                  ))}
-                </CommandGroup>
-              </CommandList>
-            </div>
-          )}
-        </div>
-      </Command>
+          </div>
+        </Command>
+      )}
     </div>
   );
 };

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/components/QuestionsComboBox.tsx

@@ -28,6 +28,7 @@ import {
   HomeIcon,
   ImageIcon,
   LanguagesIcon,
+  LinkIcon,
   ListIcon,
   ListOrderedIcon,
   MessageSquareTextIcon,
@@ -94,6 +95,7 @@ const questionIcons = {
   source: ArrowUpFromDotIcon,
   action: MousePointerClickIcon,
   country: FlagIcon,
+  url: LinkIcon,
 
   // others
   Language: LanguagesIcon,
@@ -138,7 +140,7 @@ export const SelectedCommandItem = ({ label, questionType, type }: Partial<Quest
 
   const getLabelStyle = (): string | undefined => {
     if (type !== OptionsType.META) return undefined;
-    return label === "os" ? "uppercase" : "capitalize";
+    return label === "os" || label === "url" ? "uppercase" : "capitalize";
   };
 
   return (

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/components/ResponseFilter.tsx

@@ -246,9 +246,9 @@ export const ResponseFilter = ({ survey }: ResponseFilterProps) => {
               <div className="flex w-full flex-wrap gap-3 md:flex-nowrap">
                 <div
                   className="grid w-full grid-cols-1 items-center gap-3 md:grid-cols-2"
-                  key={`${s.questionType.id}-${i}`}>
+                  key={`${s.questionType.id}-${i}-${s.questionType.label}`}>
                   <QuestionsComboBox
-                    key={`${s.questionType.label}-${i}`}
+                    key={`${s.questionType.label}-${i}-${s.questionType.id}`}
                     options={questionComboBoxOptions}
                     selected={s.questionType}
                     onChangeValue={(value) => handleOnChangeQuestionComboBoxValue(value, i)}
@@ -276,6 +276,7 @@ export const ResponseFilter = ({ survey }: ResponseFilterProps) => {
                         ? s?.questionType?.questionType
                         : s?.questionType?.type
                     }
+                    fieldId={s?.questionType?.id}
                     handleRemoveMultiSelect={(value) => handleRemoveMultiSelect(value, i)}
                     onChangeFilterComboBoxValue={(value) => handleOnChangeFilterComboBoxValue(value, i)}
                     onChangeFilterValue={(value) => handleOnChangeFilterValue(value, i)}

apps/web/app/lib/surveys/surveys.test.ts

@@ -231,6 +231,43 @@ describe("surveys", () => {
       expect(result.questionFilterOptions.some((o) => o.id === "q7")).toBeTruthy();
       expect(result.questionFilterOptions.some((o) => o.id === "q8")).toBeTruthy();
     });
+
+    test("should provide extended filter options for URL meta field", () => {
+      const survey = {
+        id: "survey1",
+        name: "Test Survey",
+        questions: [],
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        environmentId: "env1",
+        status: "draft",
+      } as unknown as TSurvey;
+
+      const meta = {
+        url: ["https://example.com", "https://test.com"],
+        source: ["web", "mobile"],
+      };
+
+      const result = generateQuestionAndFilterOptions(survey, undefined, {}, meta, {});
+
+      const urlFilterOption = result.questionFilterOptions.find((o) => o.id === "url");
+      const sourceFilterOption = result.questionFilterOptions.find((o) => o.id === "source");
+
+      expect(urlFilterOption).toBeDefined();
+      expect(urlFilterOption?.filterOptions).toEqual([
+        "Equals",
+        "Not equals",
+        "Contains",
+        "Does not contain",
+        "Starts with",
+        "Does not start with",
+        "Ends with",
+        "Does not end with",
+      ]);
+
+      expect(sourceFilterOption).toBeDefined();
+      expect(sourceFilterOption?.filterOptions).toEqual(["Equals", "Not equals"]);
+    });
   });
 
   describe("getFormattedFilters", () => {
@@ -717,6 +754,119 @@ describe("surveys", () => {
       expect(result.data?.npsQ).toEqual({ op: "greaterThan", value: 7 });
       expect(result.tags?.applied).toContain("Tag 1");
     });
+
+    test("should format URL meta filters with string operations", () => {
+      const selectedFilter = {
+        responseStatus: "all",
+        filter: [
+          {
+            questionType: { type: "Meta", label: "url", id: "url" },
+            filterType: { filterValue: "Contains", filterComboBoxValue: "example.com" },
+          },
+        ],
+      } as any;
+
+      const result = getFormattedFilters(survey, selectedFilter, dateRange);
+
+      expect(result.meta?.url).toEqual({ op: "contains", value: "example.com" });
+    });
+
+    test("should format URL meta filters with all supported string operations", () => {
+      const testCases = [
+        { filterValue: "Equals", expected: { op: "equals", value: "https://example.com" } },
+        { filterValue: "Not equals", expected: { op: "notEquals", value: "https://example.com" } },
+        { filterValue: "Contains", expected: { op: "contains", value: "example.com" } },
+        { filterValue: "Does not contain", expected: { op: "doesNotContain", value: "test.com" } },
+        { filterValue: "Starts with", expected: { op: "startsWith", value: "https://" } },
+        { filterValue: "Does not start with", expected: { op: "doesNotStartWith", value: "http://" } },
+        { filterValue: "Ends with", expected: { op: "endsWith", value: ".com" } },
+        { filterValue: "Does not end with", expected: { op: "doesNotEndWith", value: ".org" } },
+      ];
+
+      testCases.forEach(({ filterValue, expected }) => {
+        const selectedFilter = {
+          responseStatus: "all",
+          filter: [
+            {
+              questionType: { type: "Meta", label: "url", id: "url" },
+              filterType: { filterValue, filterComboBoxValue: expected.value },
+            },
+          ],
+        } as any;
+
+        const result = getFormattedFilters(survey, selectedFilter, dateRange);
+        expect(result.meta?.url).toEqual(expected);
+      });
+    });
+
+    test("should handle URL meta filters with empty string values", () => {
+      const selectedFilter = {
+        responseStatus: "all",
+        filter: [
+          {
+            questionType: { type: "Meta", label: "url", id: "url" },
+            filterType: { filterValue: "Contains", filterComboBoxValue: "" },
+          },
+        ],
+      } as any;
+
+      const result = getFormattedFilters(survey, selectedFilter, dateRange);
+
+      expect(result.meta?.url).toBeUndefined();
+    });
+
+    test("should handle URL meta filters with whitespace-only values", () => {
+      const selectedFilter = {
+        responseStatus: "all",
+        filter: [
+          {
+            questionType: { type: "Meta", label: "url", id: "url" },
+            filterType: { filterValue: "Contains", filterComboBoxValue: "   " },
+          },
+        ],
+      } as any;
+
+      const result = getFormattedFilters(survey, selectedFilter, dateRange);
+
+      expect(result.meta?.url).toEqual({ op: "contains", value: "" });
+    });
+
+    test("should still handle existing meta filters with array values", () => {
+      const selectedFilter = {
+        responseStatus: "all",
+        filter: [
+          {
+            questionType: { type: "Meta", label: "source", id: "source" },
+            filterType: { filterValue: "Equals", filterComboBoxValue: ["google"] },
+          },
+        ],
+      } as any;
+
+      const result = getFormattedFilters(survey, selectedFilter, dateRange);
+
+      expect(result.meta?.source).toEqual({ op: "equals", value: "google" });
+    });
+
+    test("should handle mixed URL and traditional meta filters", () => {
+      const selectedFilter = {
+        responseStatus: "all",
+        filter: [
+          {
+            questionType: { type: "Meta", label: "url", id: "url" },
+            filterType: { filterValue: "Contains", filterComboBoxValue: "formbricks.com" },
+          },
+          {
+            questionType: { type: "Meta", label: "source", id: "source" },
+            filterType: { filterValue: "Equals", filterComboBoxValue: ["newsletter"] },
+          },
+        ],
+      } as any;
+
+      const result = getFormattedFilters(survey, selectedFilter, dateRange);
+
+      expect(result.meta?.url).toEqual({ op: "contains", value: "formbricks.com" });
+      expect(result.meta?.source).toEqual({ op: "equals", value: "newsletter" });
+    });
   });
 
   describe("getTodayDate", () => {

apps/web/app/lib/surveys/surveys.ts

@@ -47,6 +47,18 @@ const filterOptions = {
   ranking: ["Filled out", "Skipped"],
 };
 
+// URL/meta text operators mapping
+const META_OP_MAP = {
+  Equals: "equals",
+  "Not equals": "notEquals",
+  Contains: "contains",
+  "Does not contain": "doesNotContain",
+  "Starts with": "startsWith",
+  "Does not start with": "doesNotStartWith",
+  "Ends with": "endsWith",
+  "Does not end with": "doesNotEndWith",
+} as const;
+
 // creating the options for the filtering to be selected there are 4 types questions, attributes, tags and metadata
 export const generateQuestionAndFilterOptions = (
   survey: TSurvey,
@@ -165,7 +177,7 @@ export const generateQuestionAndFilterOptions = (
     Object.keys(meta).forEach((m) => {
       questionFilterOptions.push({
         type: "Meta",
-        filterOptions: ["Equals", "Not equals"],
+        filterOptions: m === "url" ? Object.keys(META_OP_MAP) : ["Equals", "Not equals"],
         filterComboBoxOptions: meta[m],
         id: m,
       });
@@ -481,17 +493,23 @@ export const getFormattedFilters = (
   if (meta.length) {
     meta.forEach(({ filterType, questionType }) => {
       if (!filters.meta) filters.meta = {};
-      if (!filterType.filterComboBoxValue) return;
-      if (filterType.filterValue === "Equals") {
-        filters.meta[questionType.label ?? ""] = {
-          op: "equals",
-          value: filterType.filterComboBoxValue as string,
-        };
-      } else if (filterType.filterValue === "Not equals") {
-        filters.meta[questionType.label ?? ""] = {
-          op: "notEquals",
-          value: filterType.filterComboBoxValue as string,
-        };
+
+      // For text input cases (URL filtering)
+      if (typeof filterType.filterComboBoxValue === "string" && filterType.filterComboBoxValue.length > 0) {
+        const value = filterType.filterComboBoxValue.trim();
+        const op = META_OP_MAP[filterType.filterValue as keyof typeof META_OP_MAP];
+        if (op) {
+          filters.meta[questionType.label ?? ""] = { op, value };
+        }
+      }
+      // For dropdown/select cases (existing metadata fields)
+      else if (Array.isArray(filterType.filterComboBoxValue) && filterType.filterComboBoxValue.length > 0) {
+        const value = filterType.filterComboBoxValue[0]; // Take first selected value
+        if (filterType.filterValue === "Equals") {
+          filters.meta[questionType.label ?? ""] = { op: "equals", value };
+        } else if (filterType.filterValue === "Not equals") {
+          filters.meta[questionType.label ?? ""] = { op: "notEquals", value };
+        }
       }
     });
   }

apps/web/app/page.test.tsx

@@ -118,7 +118,6 @@ describe("Page", () => {
       name: "Test User",
       email: "test@example.com",
       emailVerified: null,
-      imageUrl: null,
       twoFactorEnabled: false,
       identityProvider: "email",
       createdAt: new Date(),
@@ -161,7 +160,6 @@ describe("Page", () => {
       name: "Test User",
       email: "test@example.com",
       emailVerified: null,
-      imageUrl: null,
       twoFactorEnabled: false,
       identityProvider: "email",
       createdAt: new Date(),
@@ -250,7 +248,6 @@ describe("Page", () => {
       name: "Test User",
       email: "test@example.com",
       emailVerified: null,
-      imageUrl: null,
       twoFactorEnabled: false,
       identityProvider: "email",
       createdAt: new Date(),
@@ -339,7 +336,6 @@ describe("Page", () => {
       name: "Test User",
       email: "test@example.com",
       emailVerified: null,
-      imageUrl: null,
       twoFactorEnabled: false,
       identityProvider: "email",
       createdAt: new Date(),

apps/web/lib/jwt.test.ts

@@ -1,5 +1,4 @@
-import * as crypto from "@/lib/crypto";
-import jwt from "jsonwebtoken";
+import { env } from "@/lib/env";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import {
@@ -15,69 +14,12 @@ import {
   verifyTokenForLinkSurvey,
 } from "./jwt";
 
-const TEST_ENCRYPTION_KEY = "0".repeat(32); // 32-byte key for AES-256-GCM
-const TEST_NEXTAUTH_SECRET = "test-nextauth-secret";
-const DIFFERENT_SECRET = "different-secret";
-
-// Error message constants
-const NEXTAUTH_SECRET_ERROR = "NEXTAUTH_SECRET is not set";
-const ENCRYPTION_KEY_ERROR = "ENCRYPTION_KEY is not set";
-
-// Helper function to test error cases for missing secrets/keys
-const testMissingSecretsError = async (
-  testFn: (...args: any[]) => any,
-  args: any[],
-  options: {
-    testNextAuthSecret?: boolean;
-    testEncryptionKey?: boolean;
-    isAsync?: boolean;
-  } = {}
-) => {
-  const { testNextAuthSecret = true, testEncryptionKey = true, isAsync = false } = options;
-
-  if (testNextAuthSecret) {
-    const constants = await import("@/lib/constants");
-    const originalSecret = (constants as any).NEXTAUTH_SECRET;
-    (constants as any).NEXTAUTH_SECRET = undefined;
-
-    if (isAsync) {
-      await expect(testFn(...args)).rejects.toThrow(NEXTAUTH_SECRET_ERROR);
-    } else {
-      expect(() => testFn(...args)).toThrow(NEXTAUTH_SECRET_ERROR);
-    }
-
-    // Restore
-    (constants as any).NEXTAUTH_SECRET = originalSecret;
-  }
-
-  if (testEncryptionKey) {
-    const constants = await import("@/lib/constants");
-    const originalKey = (constants as any).ENCRYPTION_KEY;
-    (constants as any).ENCRYPTION_KEY = undefined;
-
-    if (isAsync) {
-      await expect(testFn(...args)).rejects.toThrow(ENCRYPTION_KEY_ERROR);
-    } else {
-      expect(() => testFn(...args)).toThrow(ENCRYPTION_KEY_ERROR);
-    }
-
-    // Restore
-    (constants as any).ENCRYPTION_KEY = originalKey;
-  }
-};
-
 // Mock environment variables
 vi.mock("@/lib/env", () => ({
   env: {
-    ENCRYPTION_KEY: "0".repeat(32),
+    ENCRYPTION_KEY: "0".repeat(32), // 32-byte key for AES-256-GCM
     NEXTAUTH_SECRET: "test-nextauth-secret",
-  },
-}));
-
-// Mock constants
-vi.mock("@/lib/constants", () => ({
-  NEXTAUTH_SECRET: "test-nextauth-secret",
-  ENCRYPTION_KEY: "0".repeat(32),
+  } as typeof env,
 }));
 
 // Mock prisma
@@ -89,65 +31,22 @@ vi.mock("@formbricks/database", () => ({
   },
 }));
 
-// Mock logger
-vi.mock("@formbricks/logger", () => ({
-  logger: {
-    error: vi.fn(),
-    warn: vi.fn(),
-    info: vi.fn(),
-  },
-}));
-
-describe("JWT Functions - Comprehensive Security Tests", () => {
+describe("JWT Functions", () => {
   const mockUser = {
     id: "test-user-id",
     email: "test@example.com",
   };
 
-  let mockSymmetricEncrypt: any;
-  let mockSymmetricDecrypt: any;
-
   beforeEach(() => {
     vi.clearAllMocks();
-
-    // Setup default crypto mocks
-    mockSymmetricEncrypt = vi
-      .spyOn(crypto, "symmetricEncrypt")
-      .mockImplementation((text: string) => `encrypted_${text}`);
-
-    mockSymmetricDecrypt = vi
-      .spyOn(crypto, "symmetricDecrypt")
-      .mockImplementation((encryptedText: string) => encryptedText.replace("encrypted_", ""));
-
     (prisma.user.findUnique as any).mockResolvedValue(mockUser);
   });
 
   describe("createToken", () => {
-    test("should create a valid token with encrypted user ID", () => {
-      const token = createToken(mockUser.id);
+    test("should create a valid token", () => {
+      const token = createToken(mockUser.id, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.id, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should accept custom options", () => {
-      const customOptions = { expiresIn: "1h" };
-      const token = createToken(mockUser.id, customOptions);
-      expect(token).toBeDefined();
-
-      // Verify the token contains the expected expiration
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 1 hour (3600 seconds)
-      expect(decoded.exp - decoded.iat).toBe(3600);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET is not set", async () => {
-      await testMissingSecretsError(createToken, [mockUser.id], {
-        testNextAuthSecret: true,
-        testEncryptionKey: false,
-      });
     });
   });
 
@@ -157,18 +56,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createTokenForLinkSurvey(surveyId, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should include surveyId in payload", () => {
-      const surveyId = "test-survey-id";
-      const token = createTokenForLinkSurvey(surveyId, mockUser.email);
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.surveyId).toBe(surveyId);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createTokenForLinkSurvey, ["survey-id", mockUser.email]);
     });
   });
 
@@ -177,30 +64,24 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createEmailToken(mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
     });
 
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createEmailToken, [mockUser.email]);
+    test("should throw error if NEXTAUTH_SECRET is not set", () => {
+      const originalSecret = env.NEXTAUTH_SECRET;
+      try {
+        (env as any).NEXTAUTH_SECRET = undefined;
+        expect(() => createEmailToken(mockUser.email)).toThrow("NEXTAUTH_SECRET is not set");
+      } finally {
+        (env as any).NEXTAUTH_SECRET = originalSecret;
+      }
     });
   });
 
-  describe("createEmailChangeToken", () => {
-    test("should create a valid email change token with 1 day expiration", () => {
-      const token = createEmailChangeToken(mockUser.id, mockUser.email);
-      expect(token).toBeDefined();
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.id, TEST_ENCRYPTION_KEY);
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 1 day (86400 seconds)
-      expect(decoded.exp - decoded.iat).toBe(86400);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createEmailChangeToken, [mockUser.id, mockUser.email]);
+  describe("getEmailFromEmailToken", () => {
+    test("should extract email from valid token", () => {
+      const token = createEmailToken(mockUser.email);
+      const extractedEmail = getEmailFromEmailToken(token);
+      expect(extractedEmail).toBe(mockUser.email);
     });
   });
 
@@ -210,50 +91,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createInviteToken(inviteId, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(inviteId, TEST_ENCRYPTION_KEY);
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should accept custom options", () => {
-      const inviteId = "test-invite-id";
-      const customOptions = { expiresIn: "24h" };
-      const token = createInviteToken(inviteId, mockUser.email, customOptions);
-      expect(token).toBeDefined();
-
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 24 hours (86400 seconds)
-      expect(decoded.exp - decoded.iat).toBe(86400);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createInviteToken, ["invite-id", mockUser.email]);
-    });
-  });
-
-  describe("getEmailFromEmailToken", () => {
-    test("should extract email from valid token", () => {
-      const token = createEmailToken(mockUser.email);
-      const extractedEmail = getEmailFromEmailToken(token);
-      expect(extractedEmail).toBe(mockUser.email);
-      expect(mockSymmetricDecrypt).toHaveBeenCalledWith(`encrypted_${mockUser.email}`, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should fall back to original email if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementationOnce(() => {
-        throw new Error("Decryption failed");
-      });
-
-      // Create token manually with unencrypted email for legacy compatibility
-      const legacyToken = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      const extractedEmail = getEmailFromEmailToken(legacyToken);
-      expect(extractedEmail).toBe(mockUser.email);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      const token = jwt.sign({ email: "test@example.com" }, TEST_NEXTAUTH_SECRET);
-      await testMissingSecretsError(getEmailFromEmailToken, [token]);
     });
   });
 
@@ -269,194 +106,23 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const result = verifyTokenForLinkSurvey("invalid-token", "test-survey-id");
       expect(result).toBeNull();
     });
-
-    test("should return null if NEXTAUTH_SECRET is not set", async () => {
-      const constants = await import("@/lib/constants");
-      const originalSecret = (constants as any).NEXTAUTH_SECRET;
-      (constants as any).NEXTAUTH_SECRET = undefined;
-
-      const result = verifyTokenForLinkSurvey("any-token", "test-survey-id");
-      expect(result).toBeNull();
-
-      // Restore
-      (constants as any).NEXTAUTH_SECRET = originalSecret;
-    });
-
-    test("should return null if surveyId doesn't match", () => {
-      const surveyId = "test-survey-id";
-      const differentSurveyId = "different-survey-id";
-      const token = createTokenForLinkSurvey(surveyId, mockUser.email);
-      const result = verifyTokenForLinkSurvey(token, differentSurveyId);
-      expect(result).toBeNull();
-    });
-
-    test("should return null if email is missing from payload", () => {
-      const tokenWithoutEmail = jwt.sign({ surveyId: "test-survey-id" }, TEST_NEXTAUTH_SECRET);
-      const result = verifyTokenForLinkSurvey(tokenWithoutEmail, "test-survey-id");
-      expect(result).toBeNull();
-    });
-
-    test("should fall back to original email if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementationOnce(() => {
-        throw new Error("Decryption failed");
-      });
-
-      // Create legacy token with unencrypted email
-      const legacyToken = jwt.sign(
-        {
-          email: mockUser.email,
-          surveyId: "test-survey-id",
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const result = verifyTokenForLinkSurvey(legacyToken, "test-survey-id");
-      expect(result).toBe(mockUser.email);
-    });
-
-    test("should fall back to original email if ENCRYPTION_KEY is not set", async () => {
-      const constants = await import("@/lib/constants");
-      const originalKey = (constants as any).ENCRYPTION_KEY;
-      (constants as any).ENCRYPTION_KEY = undefined;
-
-      // Create a token with unencrypted email (as it would be if ENCRYPTION_KEY was not set during creation)
-      const token = jwt.sign(
-        {
-          email: mockUser.email,
-          surveyId: "survey-id",
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const result = verifyTokenForLinkSurvey(token, "survey-id");
-      expect(result).toBe(mockUser.email);
-
-      // Restore
-      (constants as any).ENCRYPTION_KEY = originalKey;
-    });
-
-    test("should verify legacy survey tokens with surveyId-based secret", async () => {
-      const surveyId = "test-survey-id";
-
-      // Create legacy token with old format (NEXTAUTH_SECRET + surveyId)
-      const legacyToken = jwt.sign({ email: `encrypted_${mockUser.email}` }, TEST_NEXTAUTH_SECRET + surveyId);
-
-      const result = verifyTokenForLinkSurvey(legacyToken, surveyId);
-      expect(result).toBe(mockUser.email);
-    });
-
-    test("should reject survey tokens that fail both new and legacy verification", async () => {
-      const surveyId = "test-survey-id";
-      const invalidToken = jwt.sign({ email: "encrypted_test@example.com" }, "wrong-secret");
-
-      const result = verifyTokenForLinkSurvey(invalidToken, surveyId);
-      expect(result).toBeNull();
-
-      // Verify error logging
-      const { logger } = await import("@formbricks/logger");
-      expect(logger.error).toHaveBeenCalledWith(expect.any(Error), "Survey link token verification failed");
-    });
-
-    test("should reject legacy survey tokens for wrong survey", () => {
-      const correctSurveyId = "correct-survey-id";
-      const wrongSurveyId = "wrong-survey-id";
-
-      // Create legacy token for one survey
-      const legacyToken = jwt.sign(
-        { email: `encrypted_${mockUser.email}` },
-        TEST_NEXTAUTH_SECRET + correctSurveyId
-      );
-
-      // Try to verify with different survey ID
-      const result = verifyTokenForLinkSurvey(legacyToken, wrongSurveyId);
-      expect(result).toBeNull();
-    });
   });
 
   describe("verifyToken", () => {
     test("should verify valid token", async () => {
-      const token = createToken(mockUser.id);
+      const token = createToken(mockUser.id, mockUser.email);
       const verified = await verifyToken(token);
       expect(verified).toEqual({
-        id: mockUser.id, // Returns the decrypted user ID
+        id: mockUser.id,
         email: mockUser.email,
       });
     });
 
     test("should throw error if user not found", async () => {
       (prisma.user.findUnique as any).mockResolvedValue(null);
-      const token = createToken(mockUser.id);
+      const token = createToken(mockUser.id, mockUser.email);
       await expect(verifyToken(token)).rejects.toThrow("User not found");
     });
-
-    test("should throw error if NEXTAUTH_SECRET is not set", async () => {
-      await testMissingSecretsError(verifyToken, ["any-token"], {
-        testNextAuthSecret: true,
-        testEncryptionKey: false,
-        isAsync: true,
-      });
-    });
-
-    test("should throw error for invalid token signature", async () => {
-      const invalidToken = jwt.sign({ id: "test-id" }, DIFFERENT_SECRET);
-      await expect(verifyToken(invalidToken)).rejects.toThrow("Invalid token");
-    });
-
-    test("should throw error if token payload is missing id", async () => {
-      const tokenWithoutId = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyToken(tokenWithoutId)).rejects.toThrow("Invalid token");
-    });
-
-    test("should return raw id from payload", async () => {
-      // Create token with unencrypted id
-      const token = jwt.sign({ id: mockUser.id }, TEST_NEXTAUTH_SECRET);
-      const verified = await verifyToken(token);
-      expect(verified).toEqual({
-        id: mockUser.id, // Returns the raw ID from payload
-        email: mockUser.email,
-      });
-    });
-
-    test("should verify legacy tokens with email-based secret", async () => {
-      // Create legacy token with old format (NEXTAUTH_SECRET + userEmail)
-      const legacyToken = jwt.sign({ id: `encrypted_${mockUser.id}` }, TEST_NEXTAUTH_SECRET + mockUser.email);
-
-      const verified = await verifyToken(legacyToken);
-      expect(verified).toEqual({
-        id: mockUser.id, // Returns the decrypted user ID
-        email: mockUser.email,
-      });
-    });
-
-    test("should prioritize new tokens over legacy tokens", async () => {
-      // Create both new and legacy tokens for the same user
-      const newToken = createToken(mockUser.id);
-      const legacyToken = jwt.sign({ id: `encrypted_${mockUser.id}` }, TEST_NEXTAUTH_SECRET + mockUser.email);
-
-      // New token should verify without triggering legacy path
-      const verifiedNew = await verifyToken(newToken);
-      expect(verifiedNew.id).toBe(mockUser.id); // Returns decrypted user ID
-
-      // Legacy token should trigger legacy path
-      const verifiedLegacy = await verifyToken(legacyToken);
-      expect(verifiedLegacy.id).toBe(mockUser.id); // Returns decrypted user ID
-    });
-
-    test("should reject tokens that fail both new and legacy verification", async () => {
-      const invalidToken = jwt.sign({ id: "encrypted_test-id" }, "wrong-secret");
-      await expect(verifyToken(invalidToken)).rejects.toThrow("Invalid token");
-
-      // Verify both methods were attempted
-      const { logger } = await import("@formbricks/logger");
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.any(Error),
-        "Token verification failed with new method"
-      );
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.any(Error),
-        "Token verification failed with legacy method"
-      );
-    });
   });
 
   describe("verifyInviteToken", () => {
@@ -473,53 +139,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
     test("should throw error for invalid token", () => {
       expect(() => verifyInviteToken("invalid-token")).toThrow("Invalid or expired invite token");
     });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(verifyInviteToken, ["any-token"]);
-    });
-
-    test("should throw error if inviteId is missing", () => {
-      const tokenWithoutInviteId = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      expect(() => verifyInviteToken(tokenWithoutInviteId)).toThrow("Invalid or expired invite token");
-    });
-
-    test("should throw error if email is missing", () => {
-      const tokenWithoutEmail = jwt.sign({ inviteId: "test-invite-id" }, TEST_NEXTAUTH_SECRET);
-      expect(() => verifyInviteToken(tokenWithoutEmail)).toThrow("Invalid or expired invite token");
-    });
-
-    test("should fall back to original values if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementation(() => {
-        throw new Error("Decryption failed");
-      });
-
-      const inviteId = "test-invite-id";
-      const legacyToken = jwt.sign(
-        {
-          inviteId,
-          email: mockUser.email,
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const verified = verifyInviteToken(legacyToken);
-      expect(verified).toEqual({
-        inviteId,
-        email: mockUser.email,
-      });
-    });
-
-    test("should throw error for token with wrong signature", () => {
-      const invalidToken = jwt.sign(
-        {
-          inviteId: "test-invite-id",
-          email: mockUser.email,
-        },
-        DIFFERENT_SECRET
-      );
-
-      expect(() => verifyInviteToken(invalidToken)).toThrow("Invalid or expired invite token");
-    });
   });
 
   describe("verifyEmailChangeToken", () => {
@@ -531,478 +150,22 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       expect(result).toEqual({ id: userId, email });
     });
 
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(verifyEmailChangeToken, ["any-token"], { isAsync: true });
-    });
-
     test("should throw error if token is invalid or missing fields", async () => {
-      const token = jwt.sign({ foo: "bar" }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyEmailChangeToken(token)).rejects.toThrow(
-        "Token is invalid or missing required fields"
-      );
-    });
-
-    test("should throw error if id is missing", async () => {
-      const token = jwt.sign({ email: "test@example.com" }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyEmailChangeToken(token)).rejects.toThrow(
-        "Token is invalid or missing required fields"
-      );
-    });
-
-    test("should throw error if email is missing", async () => {
-      const token = jwt.sign({ id: "test-id" }, TEST_NEXTAUTH_SECRET);
+      // Create a token with missing fields
+      const jwt = await import("jsonwebtoken");
+      const token = jwt.sign({ foo: "bar" }, env.NEXTAUTH_SECRET as string);
       await expect(verifyEmailChangeToken(token)).rejects.toThrow(
         "Token is invalid or missing required fields"
       );
     });
 
     test("should return original id/email if decryption fails", async () => {
-      mockSymmetricDecrypt.mockImplementation(() => {
-        throw new Error("Decryption failed");
-      });
-
+      // Create a token with non-encrypted id/email
+      const jwt = await import("jsonwebtoken");
       const payload = { id: "plain-id", email: "plain@example.com" };
-      const token = jwt.sign(payload, TEST_NEXTAUTH_SECRET);
+      const token = jwt.sign(payload, env.NEXTAUTH_SECRET as string);
       const result = await verifyEmailChangeToken(token);
       expect(result).toEqual(payload);
     });
-
-    test("should throw error for token with wrong signature", async () => {
-      const invalidToken = jwt.sign(
-        {
-          id: "test-id",
-          email: "test@example.com",
-        },
-        DIFFERENT_SECRET
-      );
-
-      await expect(verifyEmailChangeToken(invalidToken)).rejects.toThrow();
-    });
-  });
-
-  // SECURITY SCENARIO TESTS
-  describe("Security Scenarios", () => {
-    describe("Algorithm Confusion Attack Prevention", () => {
-      test("should reject 'none' algorithm tokens in verifyToken", async () => {
-        // Create malicious token with "none" algorithm
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              id: "encrypted_malicious-id",
-            })
-          ).toString("base64url") +
-          ".";
-
-        await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject 'none' algorithm tokens in verifyTokenForLinkSurvey", () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              email: "encrypted_attacker@evil.com",
-              surveyId: "test-survey-id",
-            })
-          ).toString("base64url") +
-          ".";
-
-        const result = verifyTokenForLinkSurvey(maliciousToken, "test-survey-id");
-        expect(result).toBeNull();
-      });
-
-      test("should reject 'none' algorithm tokens in verifyInviteToken", () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              inviteId: "encrypted_malicious-invite",
-              email: "encrypted_attacker@evil.com",
-            })
-          ).toString("base64url") +
-          ".";
-
-        expect(() => verifyInviteToken(maliciousToken)).toThrow("Invalid or expired invite token");
-      });
-
-      test("should reject 'none' algorithm tokens in verifyEmailChangeToken", async () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              id: "encrypted_malicious-id",
-              email: "encrypted_attacker@evil.com",
-            })
-          ).toString("base64url") +
-          ".";
-
-        await expect(verifyEmailChangeToken(maliciousToken)).rejects.toThrow();
-      });
-
-      test("should reject RS256 algorithm tokens (HS256/RS256 confusion)", async () => {
-        // Create malicious token with RS256 algorithm header but HS256 signature
-        const maliciousHeader = Buffer.from(
-          JSON.stringify({
-            alg: "RS256",
-            typ: "JWT",
-          })
-        ).toString("base64url");
-
-        const maliciousPayload = Buffer.from(
-          JSON.stringify({
-            id: "encrypted_malicious-id",
-          })
-        ).toString("base64url");
-
-        // Create signature using HMAC (as if it were HS256)
-        const crypto = require("crypto");
-        const signature = crypto
-          .createHmac("sha256", TEST_NEXTAUTH_SECRET)
-          .update(`${maliciousHeader}.${maliciousPayload}`)
-          .digest("base64url");
-
-        const maliciousToken = `${maliciousHeader}.${maliciousPayload}.${signature}`;
-
-        await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should only accept HS256 algorithm", async () => {
-        // Test that other valid algorithms are rejected
-        const otherAlgorithms = ["HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512"];
-
-        for (const alg of otherAlgorithms) {
-          const maliciousHeader = Buffer.from(
-            JSON.stringify({
-              alg,
-              typ: "JWT",
-            })
-          ).toString("base64url");
-
-          const maliciousPayload = Buffer.from(
-            JSON.stringify({
-              id: "encrypted_test-id",
-            })
-          ).toString("base64url");
-
-          const maliciousToken = `${maliciousHeader}.${maliciousPayload}.fake-signature`;
-
-          await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-        }
-      });
-    });
-
-    describe("Token Tampering", () => {
-      test("should reject tokens with modified payload", async () => {
-        const token = createToken(mockUser.id);
-        const [header, payload, signature] = token.split(".");
-
-        // Modify the payload
-        const decodedPayload = JSON.parse(Buffer.from(payload, "base64url").toString());
-        decodedPayload.id = "malicious-id";
-        const tamperedPayload = Buffer.from(JSON.stringify(decodedPayload)).toString("base64url");
-        const tamperedToken = `${header}.${tamperedPayload}.${signature}`;
-
-        await expect(verifyToken(tamperedToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject tokens with modified signature", async () => {
-        const token = createToken(mockUser.id);
-        const [header, payload] = token.split(".");
-        const tamperedToken = `${header}.${payload}.tamperedsignature`;
-
-        await expect(verifyToken(tamperedToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject malformed tokens", async () => {
-        const malformedTokens = [
-          "not.a.jwt",
-          "only.two.parts",
-          "too.many.parts.here.invalid",
-          "",
-          "invalid-base64",
-        ];
-
-        for (const malformedToken of malformedTokens) {
-          await expect(verifyToken(malformedToken)).rejects.toThrow();
-        }
-      });
-    });
-
-    describe("Cross-Survey Token Reuse", () => {
-      test("should reject survey tokens used for different surveys", () => {
-        const surveyId1 = "survey-1";
-        const surveyId2 = "survey-2";
-
-        const token = createTokenForLinkSurvey(surveyId1, mockUser.email);
-        const result = verifyTokenForLinkSurvey(token, surveyId2);
-
-        expect(result).toBeNull();
-      });
-    });
-
-    describe("Expired Tokens", () => {
-      test("should reject expired tokens", async () => {
-        const expiredToken = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            exp: Math.floor(Date.now() / 1000) - 3600, // Expired 1 hour ago
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        await expect(verifyToken(expiredToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject expired email change tokens", async () => {
-        const expiredToken = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            email: "encrypted_test@example.com",
-            exp: Math.floor(Date.now() / 1000) - 3600, // Expired 1 hour ago
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        await expect(verifyEmailChangeToken(expiredToken)).rejects.toThrow();
-      });
-    });
-
-    describe("Encryption Key Attacks", () => {
-      test("should fail gracefully with wrong encryption key", async () => {
-        mockSymmetricDecrypt.mockImplementation(() => {
-          throw new Error("Authentication tag verification failed");
-        });
-
-        // Mock findUnique to only return user for correct decrypted ID, not ciphertext
-        (prisma.user.findUnique as any).mockImplementation(({ where }: { where: { id: string } }) => {
-          if (where.id === mockUser.id) {
-            return Promise.resolve(mockUser);
-          }
-          return Promise.resolve(null); // Return null for ciphertext IDs
-        });
-
-        const token = createToken(mockUser.id);
-        // Should fail because ciphertext passed as userId won't match any user in DB
-        await expect(verifyToken(token)).rejects.toThrow(/User not found/i);
-      });
-
-      test("should handle encryption key not set gracefully", async () => {
-        const constants = await import("@/lib/constants");
-        const originalKey = (constants as any).ENCRYPTION_KEY;
-        (constants as any).ENCRYPTION_KEY = undefined;
-
-        const token = jwt.sign(
-          {
-            email: "test@example.com",
-            surveyId: "test-survey-id",
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        const result = verifyTokenForLinkSurvey(token, "test-survey-id");
-        expect(result).toBe("test@example.com");
-
-        // Restore
-        (constants as any).ENCRYPTION_KEY = originalKey;
-      });
-    });
-
-    describe("SQL Injection Attempts", () => {
-      test("should safely handle malicious user IDs", async () => {
-        const maliciousIds = [
-          "'; DROP TABLE users; --",
-          "1' OR '1'='1",
-          "admin'/*",
-          "<script>alert('xss')</script>",
-          "../../etc/passwd",
-        ];
-
-        for (const maliciousId of maliciousIds) {
-          mockSymmetricDecrypt.mockReturnValueOnce(maliciousId);
-
-          const token = jwt.sign({ id: "encrypted_malicious" }, TEST_NEXTAUTH_SECRET);
-
-          // The function should look up the user safely
-          await verifyToken(token);
-          expect(prisma.user.findUnique).toHaveBeenCalledWith({
-            where: { id: maliciousId },
-          });
-        }
-      });
-    });
-
-    describe("Token Reuse and Replay Attacks", () => {
-      test("should allow legitimate token reuse within validity period", async () => {
-        const token = createToken(mockUser.id);
-
-        // First use
-        const result1 = await verifyToken(token);
-        expect(result1.id).toBe(mockUser.id); // Returns decrypted user ID
-
-        // Second use (should still work)
-        const result2 = await verifyToken(token);
-        expect(result2.id).toBe(mockUser.id); // Returns decrypted user ID
-      });
-    });
-
-    describe("Legacy Token Compatibility", () => {
-      test("should handle legacy unencrypted tokens gracefully", async () => {
-        // Legacy token with plain text data
-        const legacyToken = jwt.sign({ id: mockUser.id }, TEST_NEXTAUTH_SECRET);
-        const result = await verifyToken(legacyToken);
-
-        expect(result.id).toBe(mockUser.id); // Returns raw ID from payload
-        expect(result.email).toBe(mockUser.email);
-      });
-
-      test("should handle mixed encrypted/unencrypted fields", async () => {
-        mockSymmetricDecrypt
-          .mockImplementationOnce(() => mockUser.id) // id decrypts successfully
-          .mockImplementationOnce(() => {
-            throw new Error("Email not encrypted");
-          }); // email fails
-
-        const token = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            email: "plain-email@example.com",
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        const result = await verifyEmailChangeToken(token);
-        expect(result.id).toBe(mockUser.id);
-        expect(result.email).toBe("plain-email@example.com");
-      });
-
-      test("should verify old format user tokens with email-based secrets", async () => {
-        // Simulate old token format with per-user secret
-        const oldFormatToken = jwt.sign(
-          { id: `encrypted_${mockUser.id}` },
-          TEST_NEXTAUTH_SECRET + mockUser.email
-        );
-
-        const result = await verifyToken(oldFormatToken);
-        expect(result.id).toBe(mockUser.id); // Returns decrypted user ID
-        expect(result.email).toBe(mockUser.email);
-      });
-
-      test("should verify old format survey tokens with survey-based secrets", () => {
-        const surveyId = "legacy-survey-id";
-
-        // Simulate old survey token format
-        const oldFormatSurveyToken = jwt.sign(
-          { email: `encrypted_${mockUser.email}` },
-          TEST_NEXTAUTH_SECRET + surveyId
-        );
-
-        const result = verifyTokenForLinkSurvey(oldFormatSurveyToken, surveyId);
-        expect(result).toBe(mockUser.email);
-      });
-
-      test("should gracefully handle database errors during legacy verification", async () => {
-        // Create token that will fail new method
-        const legacyToken = jwt.sign(
-          { id: `encrypted_${mockUser.id}` },
-          TEST_NEXTAUTH_SECRET + mockUser.email
-        );
-
-        // Make database lookup fail
-        (prisma.user.findUnique as any).mockRejectedValueOnce(new Error("DB connection lost"));
-
-        await expect(verifyToken(legacyToken)).rejects.toThrow("DB connection lost");
-      });
-    });
-
-    describe("Edge Cases and Error Handling", () => {
-      test("should handle database connection errors gracefully", async () => {
-        (prisma.user.findUnique as any).mockRejectedValue(new Error("Database connection failed"));
-
-        const token = createToken(mockUser.id);
-        await expect(verifyToken(token)).rejects.toThrow("Database connection failed");
-      });
-
-      test("should handle crypto module errors", () => {
-        mockSymmetricEncrypt.mockImplementation(() => {
-          throw new Error("Crypto module error");
-        });
-
-        expect(() => createToken(mockUser.id)).toThrow("Crypto module error");
-      });
-
-      test("should validate email format in tokens", () => {
-        const invalidEmails = ["", "not-an-email", "missing@", "@missing-local.com", "spaces in@email.com"];
-
-        invalidEmails.forEach((invalidEmail) => {
-          expect(() => createEmailToken(invalidEmail)).not.toThrow();
-          // Note: JWT functions don't validate email format, they just encrypt/decrypt
-          // Email validation should happen at a higher level
-        });
-      });
-
-      test("should handle extremely long inputs", () => {
-        const longString = "a".repeat(10000);
-
-        expect(() => createToken(longString)).not.toThrow();
-        expect(() => createEmailToken(longString)).not.toThrow();
-      });
-
-      test("should handle special characters in user data", () => {
-        const specialChars = "!@#$%^&*()_+-=[]{}|;:'\",.<>?/~`";
-
-        expect(() => createToken(specialChars)).not.toThrow();
-        expect(() => createEmailToken(specialChars)).not.toThrow();
-      });
-    });
-
-    describe("Performance and Resource Exhaustion", () => {
-      test("should handle rapid token creation without memory leaks", () => {
-        const tokens: string[] = [];
-        for (let i = 0; i < 1000; i++) {
-          tokens.push(createToken(`user-${i}`));
-        }
-
-        expect(tokens.length).toBe(1000);
-        expect(tokens.every((token) => typeof token === "string")).toBe(true);
-      });
-
-      test("should handle rapid token verification", async () => {
-        const token = createToken(mockUser.id);
-
-        const verifications: Promise<any>[] = [];
-        for (let i = 0; i < 100; i++) {
-          verifications.push(verifyToken(token));
-        }
-
-        const results = await Promise.all(verifications);
-        expect(results.length).toBe(100);
-        expect(results.every((result: any) => result.id === mockUser.id)).toBe(true); // Returns decrypted user ID
-      });
-    });
   });
 });

apps/web/lib/jwt.ts

@@ -1,64 +1,43 @@
-import { ENCRYPTION_KEY, NEXTAUTH_SECRET } from "@/lib/constants";
 import { symmetricDecrypt, symmetricEncrypt } from "@/lib/crypto";
+import { env } from "@/lib/env";
 import jwt, { JwtPayload } from "jsonwebtoken";
 import { prisma } from "@formbricks/database";
 import { logger } from "@formbricks/logger";
 
-// Helper function to decrypt with fallback to plain text
-const decryptWithFallback = (encryptedText: string, key: string): string => {
-  try {
-    return symmetricDecrypt(encryptedText, key);
-  } catch {
-    return encryptedText; // Return as-is if decryption fails (legacy format)
-  }
-};
-
-export const createToken = (userId: string, options = {}): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedUserId = symmetricEncrypt(userId, ENCRYPTION_KEY);
-  return jwt.sign({ id: encryptedUserId }, NEXTAUTH_SECRET, options);
+export const createToken = (userId: string, userEmail: string, options = {}): string => {
+  const encryptedUserId = symmetricEncrypt(userId, env.ENCRYPTION_KEY);
+  return jwt.sign({ id: encryptedUserId }, env.NEXTAUTH_SECRET + userEmail, options);
 };
 export const createTokenForLinkSurvey = (surveyId: string, userEmail: string): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedEmail = symmetricEncrypt(userEmail, ENCRYPTION_KEY);
-  return jwt.sign({ email: encryptedEmail, surveyId }, NEXTAUTH_SECRET);
+  const encryptedEmail = symmetricEncrypt(userEmail, env.ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, env.NEXTAUTH_SECRET + surveyId);
 };
 
 export const verifyEmailChangeToken = async (token: string): Promise<{ id: string; email: string }> => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as {
-    id: string;
-    email: string;
-  };
+  const payload = jwt.verify(token, env.NEXTAUTH_SECRET) as { id: string; email: string };
 
   if (!payload?.id || !payload?.email) {
     throw new Error("Token is invalid or missing required fields");
   }
 
-  // Decrypt both fields with fallback
-  const decryptedId = decryptWithFallback(payload.id, ENCRYPTION_KEY);
-  const decryptedEmail = decryptWithFallback(payload.email, ENCRYPTION_KEY);
+  let decryptedId: string;
+  let decryptedEmail: string;
+
+  try {
+    decryptedId = symmetricDecrypt(payload.id, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedId = payload.id;
+  }
+
+  try {
+    decryptedEmail = symmetricDecrypt(payload.email, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedEmail = payload.email;
+  }
 
   return {
     id: decryptedId,
@@ -67,230 +46,127 @@ export const verifyEmailChangeToken = async (token: string): Promise<{ id: strin
 };
 
 export const createEmailChangeToken = (userId: string, email: string): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedUserId = symmetricEncrypt(userId, ENCRYPTION_KEY);
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
+  const encryptedUserId = symmetricEncrypt(userId, env.ENCRYPTION_KEY);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
 
   const payload = {
     id: encryptedUserId,
     email: encryptedEmail,
   };
 
-  return jwt.sign(payload, NEXTAUTH_SECRET, {
+  return jwt.sign(payload, env.NEXTAUTH_SECRET as string, {
     expiresIn: "1d",
   });
 };
-
 export const createEmailToken = (email: string): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
-  return jwt.sign({ email: encryptedEmail }, NEXTAUTH_SECRET);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, env.NEXTAUTH_SECRET);
 };
 
 export const getEmailFromEmailToken = (token: string): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
+  const payload = jwt.verify(token, env.NEXTAUTH_SECRET) as JwtPayload;
+  try {
+    // Try to decrypt first (for newer tokens)
+    const decryptedEmail = symmetricDecrypt(payload.email, env.ENCRYPTION_KEY);
+    return decryptedEmail;
+  } catch {
+    // If decryption fails, return the original email (for older tokens)
+    return payload.email;
   }
-
-  const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-    email: string;
-  };
-  return decryptWithFallback(payload.email, ENCRYPTION_KEY);
 };
 
 export const createInviteToken = (inviteId: string, email: string, options = {}): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedInviteId = symmetricEncrypt(inviteId, ENCRYPTION_KEY);
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
-  return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, NEXTAUTH_SECRET, options);
+  const encryptedInviteId = symmetricEncrypt(inviteId, env.ENCRYPTION_KEY);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
+  return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, env.NEXTAUTH_SECRET, options);
 };
 
 export const verifyTokenForLinkSurvey = (token: string, surveyId: string): string | null => {
-  if (!NEXTAUTH_SECRET) {
-    return null;
-  }
-
   try {
-    let payload: JwtPayload & { email: string; surveyId?: string };
-
-    // Try primary method first (consistent secret)
+    const { email } = jwt.verify(token, env.NEXTAUTH_SECRET + surveyId) as JwtPayload;
     try {
-      payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-        email: string;
-        surveyId: string;
-      };
-    } catch (primaryError) {
-      logger.error(primaryError, "Token verification failed with primary method");
-
-      // Fallback to legacy method (surveyId-based secret)
-      try {
-        payload = jwt.verify(token, NEXTAUTH_SECRET + surveyId, { algorithms: ["HS256"] }) as JwtPayload & {
-          email: string;
-        };
-      } catch (legacyError) {
-        logger.error(legacyError, "Token verification failed with legacy method");
-        throw new Error("Invalid token");
+      // Try to decrypt first (for newer tokens)
+      if (!env.ENCRYPTION_KEY) {
+        throw new Error("ENCRYPTION_KEY is not set");
       }
+      const decryptedEmail = symmetricDecrypt(email, env.ENCRYPTION_KEY);
+      return decryptedEmail;
+    } catch {
+      // If decryption fails, return the original email (for older tokens)
+      return email;
     }
-
-    // Verify the surveyId matches if present in payload (new format)
-    if (payload.surveyId && payload.surveyId !== surveyId) {
-      return null;
-    }
-
-    const { email } = payload;
-    if (!email) {
-      return null;
-    }
-
-    // Decrypt email with fallback to plain text
-    if (!ENCRYPTION_KEY) {
-      return email; // Return as-is if encryption key not set
-    }
-
-    return decryptWithFallback(email, ENCRYPTION_KEY);
-  } catch (error) {
-    logger.error(error, "Survey link token verification failed");
+  } catch (err) {
     return null;
   }
 };
 
-// Helper function to get user email for legacy verification
-const getUserEmailForLegacyVerification = async (
-  token: string,
-  userId?: string
-): Promise<{ userId: string; userEmail: string }> => {
-  if (!userId) {
-    const decoded = jwt.decode(token);
+export const verifyToken = async (token: string): Promise<JwtPayload> => {
+  // First decode to get the ID
+  const decoded = jwt.decode(token);
+  const payload: JwtPayload = decoded as JwtPayload;
 
-    // Validate decoded token structure before using it
-    if (
-      !decoded ||
-      typeof decoded !== "object" ||
-      !decoded.id ||
-      typeof decoded.id !== "string" ||
-      decoded.id.trim() === ""
-    ) {
-      logger.error("Invalid token: missing or invalid user ID");
-      throw new Error("Invalid token");
-    }
-
-    userId = decoded.id;
+  if (!payload) {
+    throw new Error("Token is invalid");
   }
 
-  const decryptedId = decryptWithFallback(userId, ENCRYPTION_KEY);
-
-  // Validate decrypted ID before database query
-  if (!decryptedId || typeof decryptedId !== "string" || decryptedId.trim() === "") {
-    logger.error("Invalid token: missing or invalid user ID");
-    throw new Error("Invalid token");
+  const { id } = payload;
+  if (!id) {
+    throw new Error("Token missing required field: id");
   }
 
+  // Try to decrypt the ID (for newer tokens), if it fails use the ID as-is (for older tokens)
+  let decryptedId: string;
+  try {
+    decryptedId = symmetricDecrypt(id, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedId = id;
+  }
+
+  // If no email provided, look up the user
   const foundUser = await prisma.user.findUnique({
     where: { id: decryptedId },
   });
 
   if (!foundUser) {
-    const errorMessage = "User not found";
-    logger.error(errorMessage);
-    throw new Error(errorMessage);
+    throw new Error("User not found");
   }
 
-  return { userId: decryptedId, userEmail: foundUser.email };
-};
+  const userEmail = foundUser.email;
 
-export const verifyToken = async (token: string): Promise<JwtPayload> => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  let payload: JwtPayload & { id: string };
-  let userData: { userId: string; userEmail: string } | null = null;
-
-  // Try new method first, with smart fallback to legacy
-  try {
-    payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-      id: string;
-    };
-  } catch (newMethodError) {
-    logger.error(newMethodError, "Token verification failed with new method");
-
-    // Get user email for legacy verification
-    userData = await getUserEmailForLegacyVerification(token);
-
-    // Try legacy verification with email-based secret
-    try {
-      payload = jwt.verify(token, NEXTAUTH_SECRET + userData.userEmail, {
-        algorithms: ["HS256"],
-      }) as JwtPayload & {
-        id: string;
-      };
-    } catch (legacyMethodError) {
-      logger.error(legacyMethodError, "Token verification failed with legacy method");
-      throw new Error("Invalid token");
-    }
-  }
-
-  if (!payload?.id) {
-    throw new Error("Invalid token");
-  }
-
-  // Get user email if we don't have it yet
-  userData ??= await getUserEmailForLegacyVerification(token, payload.id);
-
-  return { id: userData.userId, email: userData.userEmail };
+  return { id: decryptedId, email: userEmail };
 };
 
 export const verifyInviteToken = (token: string): { inviteId: string; email: string } => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
   try {
-    const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-      inviteId: string;
-      email: string;
-    };
+    const decoded = jwt.decode(token);
+    const payload: JwtPayload = decoded as JwtPayload;
 
-    const { inviteId: encryptedInviteId, email: encryptedEmail } = payload;
+    const { inviteId, email } = payload;
 
-    if (!encryptedInviteId || !encryptedEmail) {
-      throw new Error("Invalid token");
+    let decryptedInviteId: string;
+    let decryptedEmail: string;
+
+    try {
+      // Try to decrypt first (for newer tokens)
+      decryptedInviteId = symmetricDecrypt(inviteId, env.ENCRYPTION_KEY);
+      decryptedEmail = symmetricDecrypt(email, env.ENCRYPTION_KEY);
+    } catch {
+      // If decryption fails, use original values (for older tokens)
+      decryptedInviteId = inviteId;
+      decryptedEmail = email;
     }
 
-    // Decrypt both fields with fallback to original values
-    const decryptedInviteId = decryptWithFallback(encryptedInviteId, ENCRYPTION_KEY);
-    const decryptedEmail = decryptWithFallback(encryptedEmail, ENCRYPTION_KEY);
-
     return {
       inviteId: decryptedInviteId,
       email: decryptedEmail,

apps/web/lib/response/utils.test.ts

@@ -157,6 +157,46 @@ describe("Response Utils", () => {
         },
       ]);
     });
+
+    test("meta: URL string comparison operations", () => {
+      const testCases = [
+        {
+          name: "contains",
+          criteria: { meta: { url: { op: "contains" as const, value: "example.com" } } },
+          expected: { meta: { path: ["url"], string_contains: "example.com" } },
+        },
+        {
+          name: "doesNotContain",
+          criteria: { meta: { url: { op: "doesNotContain" as const, value: "test.com" } } },
+          expected: { NOT: { meta: { path: ["url"], string_contains: "test.com" } } },
+        },
+        {
+          name: "startsWith",
+          criteria: { meta: { url: { op: "startsWith" as const, value: "https://" } } },
+          expected: { meta: { path: ["url"], string_starts_with: "https://" } },
+        },
+        {
+          name: "doesNotStartWith",
+          criteria: { meta: { url: { op: "doesNotStartWith" as const, value: "http://" } } },
+          expected: { NOT: { meta: { path: ["url"], string_starts_with: "http://" } } },
+        },
+        {
+          name: "endsWith",
+          criteria: { meta: { url: { op: "endsWith" as const, value: ".com" } } },
+          expected: { meta: { path: ["url"], string_ends_with: ".com" } },
+        },
+        {
+          name: "doesNotEndWith",
+          criteria: { meta: { url: { op: "doesNotEndWith" as const, value: ".org" } } },
+          expected: { NOT: { meta: { path: ["url"], string_ends_with: ".org" } } },
+        },
+      ];
+
+      testCases.forEach(({ criteria, expected }) => {
+        const result = buildWhereClause(baseSurvey as TSurvey, criteria);
+        expect(result.AND).toEqual([{ AND: [expected] }]);
+      });
+    });
   });
 
   describe("buildWhereClause – data‐field filter operations", () => {
@@ -495,10 +535,98 @@ describe("Response Utils", () => {
       expect(result.os).toContain("MacOS");
     });
 
+    test("should extract URL data correctly", () => {
+      const responses = [
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            url: "https://example.com/page1",
+            source: "direct",
+          },
+        },
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            url: "https://test.com/page2?param=value",
+            source: "google",
+          },
+        },
+      ];
+      const result = getResponseMeta(responses as Pick<TResponse, "contactAttributes" | "data" | "meta">[]);
+      expect(result.url).toEqual([]);
+      expect(result.source).toContain("direct");
+      expect(result.source).toContain("google");
+    });
+
+    test("should handle mixed meta data with URLs", () => {
+      const responses = [
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            userAgent: { browser: "Chrome", device: "desktop" },
+            url: "https://formbricks.com/dashboard",
+            country: "US",
+          },
+        },
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            userAgent: { browser: "Safari", device: "mobile" },
+            url: "https://formbricks.com/surveys/123",
+            country: "UK",
+          },
+        },
+      ];
+      const result = getResponseMeta(responses as Pick<TResponse, "contactAttributes" | "data" | "meta">[]);
+      expect(result.browser).toContain("Chrome");
+      expect(result.browser).toContain("Safari");
+      expect(result.device).toContain("desktop");
+      expect(result.device).toContain("mobile");
+      expect(result.url).toEqual([]);
+      expect(result.country).toContain("US");
+      expect(result.country).toContain("UK");
+    });
+
     test("should handle empty responses", () => {
       const result = getResponseMeta([]);
       expect(result).toEqual({});
     });
+
+    test("should ignore empty or null URL values", () => {
+      const responses = [
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            url: "",
+            source: "direct",
+          },
+        },
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            url: null as any,
+            source: "newsletter",
+          },
+        },
+        {
+          contactAttributes: {},
+          data: {},
+          meta: {
+            url: "https://valid.com",
+            source: "google",
+          },
+        },
+      ];
+      const result = getResponseMeta(responses as Pick<TResponse, "contactAttributes" | "data" | "meta">[]);
+      expect(result.url).toEqual([]);
+      expect(result.source).toEqual(expect.arrayContaining(["direct", "newsletter", "google"]));
+    });
   });
 
   describe("getResponseHiddenFields", () => {

apps/web/lib/response/utils.ts

@@ -234,6 +234,60 @@ export const buildWhereClause = (survey: TSurvey, filterCriteria?: TResponseFilt
             },
           });
           break;
+        case "contains":
+          meta.push({
+            meta: {
+              path: updatedKey,
+              string_contains: val.value,
+            },
+          });
+          break;
+        case "doesNotContain":
+          meta.push({
+            NOT: {
+              meta: {
+                path: updatedKey,
+                string_contains: val.value,
+              },
+            },
+          });
+          break;
+        case "startsWith":
+          meta.push({
+            meta: {
+              path: updatedKey,
+              string_starts_with: val.value,
+            },
+          });
+          break;
+        case "doesNotStartWith":
+          meta.push({
+            NOT: {
+              meta: {
+                path: updatedKey,
+                string_starts_with: val.value,
+              },
+            },
+          });
+          break;
+        case "endsWith":
+          meta.push({
+            meta: {
+              path: updatedKey,
+              string_ends_with: val.value,
+            },
+          });
+          break;
+        case "doesNotEndWith":
+          meta.push({
+            NOT: {
+              meta: {
+                path: updatedKey,
+                string_ends_with: val.value,
+              },
+            },
+          });
+          break;
       }
     });
 
@@ -571,7 +625,7 @@ export const extractSurveyDetails = (survey: TSurvey, responses: TResponse[]) =>
     const headline = getLocalizedValue(question.headline, "default") ?? question.id;
     if (question.type === "matrix") {
       return question.rows.map((row) => {
-        return `${idx + 1}. ${headline} - ${getLocalizedValue(row, "default")}`;
+        return `${idx + 1}. ${headline} - ${getLocalizedValue(row.label, "default")}`;
       });
     } else if (
       question.type === "multipleChoiceMulti" ||
@@ -638,8 +692,8 @@ export const getResponsesJson = (
         questionHeadline.forEach((headline, index) => {
           if (answer) {
             const row = question.rows[index];
-            if (row && row.default && answer[row.default] !== undefined) {
-              jsonData[idx][headline] = answer[row.default];
+            if (row && row.label.default && answer[row.label.default] !== undefined) {
+              jsonData[idx][headline] = answer[row.label.default];
             } else {
               jsonData[idx][headline] = "";
             }
@@ -726,10 +780,13 @@ export const getResponseMeta = (
 
     responses.forEach((response) => {
       Object.entries(response.meta).forEach(([key, value]) => {
-        // skip url
-        if (key === "url") return;
-
         // Handling nested objects (like userAgent)
+        if (key === "url") {
+          if (!meta[key]) {
+            meta[key] = new Set();
+          }
+          return;
+        }
         if (typeof value === "object" && value !== null) {
           Object.entries(value).forEach(([nestedKey, nestedValue]) => {
             if (typeof nestedValue === "string" && nestedValue) {

apps/web/lib/survey/__mock__/survey.mock.ts

@@ -122,7 +122,6 @@ export const mockUser: TUser = {
   name: "mock User",
   email: "test@unit.com",
   emailVerified: currentDate,
-  imageUrl: "https://www.google.com",
   createdAt: currentDate,
   updatedAt: currentDate,
   twoFactorEnabled: false,

apps/web/lib/surveyLogic/utils.test.ts

@@ -1,12 +1,12 @@
 import { describe, expect, test, vi } from "vitest";
 import { TJsEnvironmentStateSurvey } from "@formbricks/types/js";
 import { TResponseData, TResponseVariables } from "@formbricks/types/responses";
+import { TSurveyQuestionTypeEnum } from "@formbricks/types/surveys/types";
 import {
   TConditionGroup,
   TSingleCondition,
   TSurveyLogic,
   TSurveyLogicAction,
-  TSurveyQuestionTypeEnum,
 } from "@formbricks/types/surveys/types";
 import {
   addConditionBelow,
@@ -109,7 +109,6 @@ describe("surveyLogic", () => {
     languages: [],
     triggers: [],
     segment: null,
-    recaptcha: null,
   };
 
   const simpleGroup = (): TConditionGroup => ({
@@ -176,8 +175,7 @@ describe("surveyLogic", () => {
         },
       ],
     };
-    const result = removeCondition(group, "c");
-    expect(result).toBe(true);
+    removeCondition(group, "c");
     expect(group.conditions).toHaveLength(0);
   });
 
@@ -435,8 +433,6 @@ describe("surveyLogic", () => {
       )
     ).toBe(true);
     expect(evaluateLogic(mockSurvey, { f: "foo" }, vars, group(baseCond("isSet")), "en")).toBe(true);
-    expect(evaluateLogic(mockSurvey, { f: "foo" }, vars, group(baseCond("isNotEmpty")), "en")).toBe(true);
-    expect(evaluateLogic(mockSurvey, { f: "" }, vars, group(baseCond("isNotSet")), "en")).toBe(true);
     expect(evaluateLogic(mockSurvey, { f: "" }, vars, group(baseCond("isEmpty")), "en")).toBe(true);
     expect(
       evaluateLogic(mockSurvey, { f: "foo" }, vars, group({ ...baseCond("isAnyOf", ["foo", "bar"]) }), "en")
@@ -514,8 +510,7 @@ describe("surveyLogic", () => {
     expect(group.conditions.length).toBe(2);
     toggleGroupConnector(group, "notfound");
     expect(group.connector).toBe("and");
-    const result = removeCondition(group, "notfound");
-    expect(result).toBe(false);
+    removeCondition(group, "notfound");
     expect(group.conditions.length).toBe(2);
     duplicateCondition(group, "notfound");
     expect(group.conditions.length).toBe(2);
@@ -525,192 +520,6 @@ describe("surveyLogic", () => {
     expect(group.conditions.length).toBe(2);
   });
 
-  test("removeCondition returns false when condition not found in nested groups", () => {
-    const nestedGroup: TConditionGroup = {
-      id: "nested",
-      connector: "and",
-      conditions: [
-        {
-          id: "nestedC1",
-          leftOperand: { type: "hiddenField", value: "nf1" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "nv1" },
-        },
-      ],
-    };
-
-    const group: TConditionGroup = {
-      id: "parent",
-      connector: "and",
-      conditions: [nestedGroup],
-    };
-
-    const result = removeCondition(group, "nonexistent");
-    expect(result).toBe(false);
-    expect(group.conditions).toHaveLength(1);
-  });
-
-  test("removeCondition successfully removes from nested groups and cleans up", () => {
-    const nestedGroup: TConditionGroup = {
-      id: "nested",
-      connector: "and",
-      conditions: [
-        {
-          id: "nestedC1",
-          leftOperand: { type: "hiddenField", value: "nf1" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "nv1" },
-        },
-        {
-          id: "nestedC2",
-          leftOperand: { type: "hiddenField", value: "nf2" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "nv2" },
-        },
-      ],
-    };
-
-    const otherCondition: TSingleCondition = {
-      id: "otherCondition",
-      leftOperand: { type: "hiddenField", value: "other" },
-      operator: "equals",
-      rightOperand: { type: "static", value: "value" },
-    };
-
-    const group: TConditionGroup = {
-      id: "parent",
-      connector: "and",
-      conditions: [nestedGroup, otherCondition],
-    };
-
-    const result = removeCondition(group, "nestedC1");
-    expect(result).toBe(true);
-    expect(group.conditions).toHaveLength(2);
-    expect((group.conditions[0] as TConditionGroup).conditions).toHaveLength(1);
-    expect((group.conditions[0] as TConditionGroup).conditions[0].id).toBe("nestedC2");
-    expect(group.conditions[1].id).toBe("otherCondition");
-  });
-
-  test("removeCondition flattens group when nested group has only one condition left", () => {
-    const deeplyNestedGroup: TConditionGroup = {
-      id: "deepNested",
-      connector: "or",
-      conditions: [
-        {
-          id: "deepC1",
-          leftOperand: { type: "hiddenField", value: "df1" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "dv1" },
-        },
-      ],
-    };
-
-    const nestedGroup: TConditionGroup = {
-      id: "nested",
-      connector: "and",
-      conditions: [
-        {
-          id: "nestedC1",
-          leftOperand: { type: "hiddenField", value: "nf1" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "nv1" },
-        },
-        deeplyNestedGroup,
-      ],
-    };
-
-    const otherCondition: TSingleCondition = {
-      id: "otherCondition",
-      leftOperand: { type: "hiddenField", value: "other" },
-      operator: "equals",
-      rightOperand: { type: "static", value: "value" },
-    };
-
-    const group: TConditionGroup = {
-      id: "parent",
-      connector: "and",
-      conditions: [nestedGroup, otherCondition],
-    };
-
-    // Remove the regular condition, leaving only the deeply nested group in the nested group
-    const result = removeCondition(group, "nestedC1");
-    expect(result).toBe(true);
-
-    // The parent group should still have 2 conditions: the nested group and the other condition
-    expect(group.conditions).toHaveLength(2);
-    // The nested group should still be there but now contain only the deeply nested group
-    expect(group.conditions[0].id).toBe("nested");
-    expect((group.conditions[0] as TConditionGroup).conditions).toHaveLength(1);
-    // The nested group should contain the flattened content from the deeply nested group
-    expect((group.conditions[0] as TConditionGroup).conditions[0].id).toBe("deepC1");
-    expect(group.conditions[1].id).toBe("otherCondition");
-  });
-
-  test("removeCondition removes empty groups after cleanup", () => {
-    const emptyNestedGroup: TConditionGroup = {
-      id: "emptyNested",
-      connector: "and",
-      conditions: [
-        {
-          id: "toBeRemoved",
-          leftOperand: { type: "hiddenField", value: "f1" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "v1" },
-        },
-      ],
-    };
-
-    const group: TConditionGroup = {
-      id: "parent",
-      connector: "and",
-      conditions: [
-        emptyNestedGroup,
-        {
-          id: "keepThis",
-          leftOperand: { type: "hiddenField", value: "f2" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "v2" },
-        },
-      ],
-    };
-
-    // Remove the only condition from the nested group
-    const result = removeCondition(group, "toBeRemoved");
-    expect(result).toBe(true);
-
-    // The empty nested group should be removed, leaving only the other condition
-    expect(group.conditions).toHaveLength(1);
-    expect(group.conditions[0].id).toBe("keepThis");
-  });
-
-  test("deleteEmptyGroups with complex nested structure", () => {
-    const deepEmptyGroup: TConditionGroup = { id: "deepEmpty", connector: "and", conditions: [] };
-    const middleGroup: TConditionGroup = {
-      id: "middle",
-      connector: "or",
-      conditions: [deepEmptyGroup],
-    };
-    const topGroup: TConditionGroup = {
-      id: "top",
-      connector: "and",
-      conditions: [
-        middleGroup,
-        {
-          id: "validCondition",
-          leftOperand: { type: "hiddenField", value: "f" },
-          operator: "equals",
-          rightOperand: { type: "static", value: "v" },
-        },
-      ],
-    };
-
-    deleteEmptyGroups(topGroup);
-
-    // Should remove the nested empty groups and keep only the valid condition
-    expect(topGroup.conditions).toHaveLength(1);
-    expect(topGroup.conditions[0].id).toBe("validCondition");
-  });
-
   // Additional tests for complete coverage
 
   test("addConditionBelow with nested group correctly adds condition", () => {
@@ -788,8 +597,14 @@ describe("surveyLogic", () => {
           type: TSurveyQuestionTypeEnum.Matrix,
           headline: { default: "Matrix Question" },
           required: true,
-          rows: [{ default: "Row 1" }, { default: "Row 2" }],
-          columns: [{ default: "Column 1" }, { default: "Column 2" }],
+          rows: [
+            { id: "row-1", label: { default: "Row 1" } },
+            { id: "row-2", label: { default: "Row 2" } },
+          ],
+          columns: [
+            { id: "col-1", label: { default: "Column 1" } },
+            { id: "col-2", label: { default: "Column 2" } },
+          ],
           buttonLabel: { default: "Next" },
           shuffleOption: "none",
         },

apps/web/lib/surveyLogic/utils.ts

@@ -94,48 +94,21 @@ export const toggleGroupConnector = (group: TConditionGroup, resourceId: string)
   }
 };
 
-export const removeCondition = (group: TConditionGroup, resourceId: string): boolean => {
-  for (let i = group.conditions.length - 1; i >= 0; i--) {
+export const removeCondition = (group: TConditionGroup, resourceId: string) => {
+  for (let i = 0; i < group.conditions.length; i++) {
     const item = group.conditions[i];
 
     if (item.id === resourceId) {
       group.conditions.splice(i, 1);
-      cleanupGroup(group);
-      return true;
+      return;
     }
 
-    if (isConditionGroup(item) && removeCondition(item, resourceId)) {
-      cleanupGroup(group);
-      return true;
+    if (isConditionGroup(item)) {
+      removeCondition(item, resourceId);
     }
   }
 
-  return false;
-};
-
-const cleanupGroup = (group: TConditionGroup) => {
-  // Remove empty condition groups first
-  for (let i = group.conditions.length - 1; i >= 0; i--) {
-    const condition = group.conditions[i];
-    if (isConditionGroup(condition)) {
-      cleanupGroup(condition);
-
-      // Remove if empty after cleanup
-      if (condition.conditions.length === 0) {
-        group.conditions.splice(i, 1);
-      }
-    }
-  }
-
-  // Flatten if group has only one condition and it's a condition group
-  if (group.conditions.length === 1 && isConditionGroup(group.conditions[0])) {
-    group.connector = group.conditions[0].connector || "and";
-    group.conditions = group.conditions[0].conditions;
-  }
-};
-
-export const deleteEmptyGroups = (group: TConditionGroup) => {
-  cleanupGroup(group);
+  deleteEmptyGroups(group);
 };
 
 export const duplicateCondition = (group: TConditionGroup, resourceId: string) => {
@@ -157,6 +130,18 @@ export const duplicateCondition = (group: TConditionGroup, resourceId: string) =
   }
 };
 
+export const deleteEmptyGroups = (group: TConditionGroup) => {
+  for (let i = 0; i < group.conditions.length; i++) {
+    const resource = group.conditions[i];
+
+    if (isConditionGroup(resource) && resource.conditions.length === 0) {
+      group.conditions.splice(i, 1);
+    } else if (isConditionGroup(resource)) {
+      deleteEmptyGroups(resource);
+    }
+  }
+};
+
 export const createGroupFromResource = (group: TConditionGroup, resourceId: string) => {
   for (let i = 0; i < group.conditions.length; i++) {
     const item = group.conditions[i];
@@ -517,7 +502,11 @@ const getLeftOperandValue = (
       const responseValue = data[leftOperand.value];
 
       if (currentQuestion.type === "openText" && currentQuestion.inputType === "number") {
-        return Number(responseValue) || undefined;
+        if (responseValue === undefined) return undefined;
+        if (typeof responseValue === "string" && responseValue.trim() === "") return undefined;
+
+        const numberValue = typeof responseValue === "number" ? responseValue : Number(responseValue);
+        return isNaN(numberValue) ? undefined : numberValue;
       }
 
       if (currentQuestion.type === "multipleChoiceSingle" || currentQuestion.type === "multipleChoiceMulti") {
@@ -567,14 +556,14 @@ const getLeftOperandValue = (
           if (isNaN(rowIndex) || rowIndex < 0 || rowIndex >= currentQuestion.rows.length) {
             return undefined;
           }
-          const row = getLocalizedValue(currentQuestion.rows[rowIndex], selectedLanguage);
+          const row = getLocalizedValue(currentQuestion.rows[rowIndex].label, selectedLanguage);
 
           const rowValue = responseValue[row];
           if (rowValue === "") return "";
 
           if (rowValue) {
             const columnIndex = currentQuestion.columns.findIndex((column) => {
-              return getLocalizedValue(column, selectedLanguage) === rowValue;
+              return getLocalizedValue(column.label, selectedLanguage) === rowValue;
             });
             if (columnIndex === -1) return undefined;
             return columnIndex.toString();
@@ -685,9 +674,8 @@ const performCalculation = (
       if (typeof val === "number" || typeof val === "string") {
         if (variable.type === "number" && !isNaN(Number(val))) {
           operandValue = Number(val);
-        } else {
-          operandValue = val;
         }
+        operandValue = val;
       }
       break;
   }

apps/web/lib/user/service.test.ts

@@ -3,7 +3,7 @@ import { IdentityProvider, Objective, Prisma, Role } from "@prisma/client";
 import { afterEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import { PrismaErrorType } from "@formbricks/database/types/error";
-import { DatabaseError, InvalidInputError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { DatabaseError, ResourceNotFoundError } from "@formbricks/types/errors";
 import { TOrganization } from "@formbricks/types/organizations";
 import { TUserLocale, TUserUpdateInput } from "@formbricks/types/user";
 import { deleteUser, getUser, getUserByEmail, getUsersWithOrganization, updateUser } from "./service";
@@ -20,10 +20,6 @@ vi.mock("@formbricks/database", () => ({
   },
 }));
 
-vi.mock("@/lib/fileValidation", () => ({
-  isValidImageFile: vi.fn(),
-}));
-
 vi.mock("@/lib/organization/service", () => ({
   getOrganizationsWhereUserIsSingleOwner: vi.fn(),
   deleteOrganization: vi.fn(),
@@ -39,7 +35,6 @@ describe("User Service", () => {
     name: "Test User",
     email: "test@example.com",
     emailVerified: new Date(),
-    imageUrl: null,
     createdAt: new Date(),
     updatedAt: new Date(),
     role: Role.project_manager,
@@ -200,13 +195,6 @@ describe("User Service", () => {
 
       await expect(updateUser("nonexistent", { name: "New Name" })).rejects.toThrow(ResourceNotFoundError);
     });
-
-    test("should throw InvalidInputError when invalid image URL is provided", async () => {
-      const { isValidImageFile } = await import("@/lib/fileValidation");
-      vi.mocked(isValidImageFile).mockReturnValue(false);
-
-      await expect(updateUser("user1", { imageUrl: "invalid-image-url" })).rejects.toThrow(InvalidInputError);
-    });
   });
 
   describe("deleteUser", () => {

apps/web/lib/user/service.ts

@@ -1,5 +1,4 @@
 import "server-only";
-import { isValidImageFile } from "@/lib/fileValidation";
 import { deleteOrganization, getOrganizationsWhereUserIsSingleOwner } from "@/lib/organization/service";
 import { deleteBrevoCustomerByEmail } from "@/modules/auth/lib/brevo";
 import { Prisma } from "@prisma/client";
@@ -8,7 +7,7 @@ import { z } from "zod";
 import { prisma } from "@formbricks/database";
 import { PrismaErrorType } from "@formbricks/database/types/error";
 import { ZId } from "@formbricks/types/common";
-import { DatabaseError, InvalidInputError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { DatabaseError, ResourceNotFoundError } from "@formbricks/types/errors";
 import { TUser, TUserLocale, TUserUpdateInput, ZUserUpdateInput } from "@formbricks/types/user";
 import { validateInputs } from "../utils/validate";
 
@@ -17,7 +16,6 @@ const responseSelection = {
   name: true,
   email: true,
   emailVerified: true,
-  imageUrl: true,
   createdAt: true,
   updatedAt: true,
   role: true,
@@ -79,7 +77,6 @@ export const getUserByEmail = reactCache(async (email: string): Promise<TUser |
 // function to update a user's user
 export const updateUser = async (personId: string, data: TUserUpdateInput): Promise<TUser> => {
   validateInputs([personId, ZId], [data, ZUserUpdateInput.partial()]);
-  if (data.imageUrl && !isValidImageFile(data.imageUrl)) throw new InvalidInputError("Invalid image file");
 
   try {
     const updatedUser = await prisma.user.update({

apps/web/lib/utils/logger-helpers.test.ts

@@ -112,7 +112,6 @@ describe("withAuditLogging", () => {
         name: "Test User",
         email: "test@example.com",
         emailVerified: null,
-        imageUrl: null,
         twoFactorEnabled: false,
         identityProvider: "email" as const,
         createdAt: new Date(),
@@ -151,7 +150,6 @@ describe("withAuditLogging", () => {
         name: "Test User",
         email: "test@example.com",
         emailVerified: null,
-        imageUrl: null,
         twoFactorEnabled: false,
         identityProvider: "email" as const,
         createdAt: new Date(),

apps/web/modules/analysis/components/SingleResponseCard/components/RenderResponse.test.tsx

@@ -59,7 +59,7 @@ vi.mock("@/lib/cn", () => ({
   cn: (...classes: (string | boolean | undefined)[]) => classes.filter(Boolean).join(" "),
 }));
 vi.mock("@/lib/i18n/utils", () => ({
-  getLocalizedValue: vi.fn((val, _) => val),
+  getLocalizedValue: vi.fn((val, _) => val["default"]),
   getLanguageCode: vi.fn().mockReturnValue("default"),
 }));
 
@@ -178,7 +178,18 @@ describe("RenderResponse", () => {
   });
 
   test("renders Matrix response", () => {
-    const question = { id: "q1", type: "matrix", rows: ["row1", "row2"] } as any;
+    const question = {
+      id: "q1",
+      type: "matrix",
+      rows: [
+        { id: "row1", label: { default: "row1" } },
+        { id: "row2", label: { default: "row2" } },
+      ],
+      columns: [
+        { id: "col1", label: { default: "answer1" } },
+        { id: "col2", label: { default: "answer2" } },
+      ],
+    } as any;
     // getLocalizedValue returns the row value itself
     const responseData = { row1: "answer1", row2: "answer2" };
     render(

apps/web/modules/analysis/components/SingleResponseCard/components/RenderResponse.tsx

@@ -100,7 +100,7 @@ export const RenderResponse: React.FC<RenderResponseProps> = ({
           <>
             {(question as TSurveyMatrixQuestion).rows.map((row) => {
               const languagCode = getLanguageCode(survey.languages, language);
-              const rowValueInSelectedLanguage = getLocalizedValue(row, languagCode);
+              const rowValueInSelectedLanguage = getLocalizedValue(row.label, languagCode);
               if (!responseData[rowValueInSelectedLanguage]) return null;
               return (
                 <p

apps/web/modules/api/v2/me/route.ts

@@ -1,6 +1,7 @@
 import { authenticatedApiClient } from "@/modules/api/v2/auth/authenticated-api-client";
 import { responses } from "@/modules/api/v2/lib/response";
 import { handleApiError } from "@/modules/api/v2/lib/utils";
+import { hasOrganizationAccess } from "@/modules/organization/settings/api-keys/lib/utils";
 import { NextRequest } from "next/server";
 import { OrganizationAccessType } from "@formbricks/types/api-key";
 
@@ -8,7 +9,7 @@ export const GET = async (request: NextRequest) =>
   authenticatedApiClient({
     request,
     handler: async ({ authentication }) => {
-      if (!authentication.organizationAccess?.accessControl?.[OrganizationAccessType.Read]) {
+      if (!hasOrganizationAccess(authentication, OrganizationAccessType.Read)) {
         return handleApiError(request, {
           type: "unauthorized",
           details: [{ field: "organizationId", issue: "unauthorized" }],

apps/web/modules/api/v2/organizations/[organizationId]/lib/utils.ts

@@ -1,3 +1,4 @@
+import { hasOrganizationAccess } from "@/modules/organization/settings/api-keys/lib/utils";
 import { logger } from "@formbricks/logger";
 import { OrganizationAccessType } from "@formbricks/types/api-key";
 import { TAuthenticationApiKey } from "@formbricks/types/auth";
@@ -13,9 +14,5 @@ export const hasOrganizationIdAndAccess = (
     return false;
   }
 
-  if (!authentication.organizationAccess?.accessControl?.[accessType]) {
-    return false;
-  }
-
-  return true;
+  return hasOrganizationAccess(authentication, accessType);
 };

apps/web/modules/auth/lib/authOptions.test.ts

@@ -31,7 +31,7 @@ vi.mock("@/lib/constants", () => ({
   SESSION_MAX_AGE: 86400,
   NEXTAUTH_SECRET: "test-secret",
   WEBAPP_URL: "http://localhost:3000",
-  ENCRYPTION_KEY: "12345678901234567890123456789012", // 32 bytes for AES-256
+  ENCRYPTION_KEY: "test-encryption-key-32-chars-long",
   REDIS_URL: undefined,
   AUDIT_LOG_ENABLED: false,
   AUDIT_LOG_GET_USER_IP: false,
@@ -261,7 +261,7 @@ describe("authOptions", () => {
       vi.mocked(applyIPRateLimit).mockResolvedValue(); // Rate limiting passes
       vi.spyOn(prisma.user, "findUnique").mockResolvedValue(mockUser as any);
 
-      const credentials = { token: createToken(mockUser.id) };
+      const credentials = { token: createToken(mockUser.id, mockUser.email) };
 
       await expect(tokenProvider.options.authorize(credentials, {})).rejects.toThrow(
         "Email already verified"
@@ -280,7 +280,7 @@ describe("authOptions", () => {
         groupId: null,
       } as any);
 
-      const credentials = { token: createToken(mockUserId) };
+      const credentials = { token: createToken(mockUserId, mockUser.email) };
 
       const result = await tokenProvider.options.authorize(credentials, {});
       expect(result.email).toBe(mockUser.email);
@@ -303,7 +303,7 @@ describe("authOptions", () => {
           groupId: null,
         } as any);
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await tokenProvider.options.authorize(credentials, {});
 
@@ -315,7 +315,7 @@ describe("authOptions", () => {
           new Error("Maximum number of requests reached. Please try again later.")
         );
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await expect(tokenProvider.options.authorize(credentials, {})).rejects.toThrow(
           "Maximum number of requests reached. Please try again later."
@@ -339,7 +339,7 @@ describe("authOptions", () => {
           groupId: null,
         } as any);
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await tokenProvider.options.authorize(credentials, {});
 

apps/web/modules/auth/lib/authOptions.ts

@@ -206,7 +206,6 @@ export const authOptions: NextAuthOptions = {
           id: user.id,
           email: user.email,
           emailVerified: user.emailVerified,
-          imageUrl: user.imageUrl,
         };
       },
     }),

apps/web/modules/auth/lib/mock-data.ts

@@ -5,7 +5,6 @@ export const mockUser: TUser = {
   name: "mock User",
   email: "john.doe@example.com",
   emailVerified: new Date("2024-01-01T00:00:00.000Z"),
-  imageUrl: "https://www.google.com",
   createdAt: new Date("2024-01-01T00:00:00.000Z"),
   updatedAt: new Date("2024-01-01T00:00:00.000Z"),
   twoFactorEnabled: false,

apps/web/modules/auth/lib/user.ts

@@ -1,4 +1,3 @@
-import { isValidImageFile } from "@/lib/fileValidation";
 import { validateInputs } from "@/lib/utils/validate";
 import { Prisma } from "@prisma/client";
 import { cache as reactCache } from "react";
@@ -11,10 +10,6 @@ import { TUserCreateInput, TUserUpdateInput, ZUserEmail, ZUserUpdateInput } from
 export const updateUser = async (id: string, data: TUserUpdateInput) => {
   validateInputs([id, ZId], [data, ZUserUpdateInput.partial()]);
 
-  if (data.imageUrl && !isValidImageFile(data.imageUrl)) {
-    throw new InvalidInputError("Invalid image file");
-  }
-
   try {
     const updatedUser = await prisma.user.update({
       where: {

apps/web/modules/core/rate-limit/rate-limit-configs.test.ts

@@ -71,7 +71,7 @@ describe("rateLimitConfigs", () => {
 
     test("should have all action configurations", () => {
       const actionConfigs = Object.keys(rateLimitConfigs.actions);
-      expect(actionConfigs).toEqual(["emailUpdate", "surveyFollowUp"]);
+      expect(actionConfigs).toEqual(["emailUpdate", "surveyFollowUp", "sendLinkSurveyEmail"]);
     });
   });
 

apps/web/modules/core/rate-limit/rate-limit-configs.ts

@@ -23,5 +23,10 @@ export const rateLimitConfigs = {
   actions: {
     emailUpdate: { interval: 3600, allowedPerInterval: 3, namespace: "action:email" }, // 3 per hour
     surveyFollowUp: { interval: 3600, allowedPerInterval: 50, namespace: "action:followup" }, // 50 per hour
+    sendLinkSurveyEmail: {
+      interval: 3600,
+      allowedPerInterval: 10,
+      namespace: "action:send-link-survey-email",
+    }, // 10 per hour
   },
 };

apps/web/modules/ee/audit-logs/lib/handler.test.ts

@@ -94,7 +94,6 @@ const fullUser = {
   updatedAt: new Date(),
   email: "test@example.com",
   emailVerified: null,
-  imageUrl: null,
   twoFactorEnabled: false,
   identityProvider: "email",
   organizationId: "org1",

apps/web/modules/ee/contacts/[contactId]/components/response-timeline.test.tsx

@@ -28,7 +28,6 @@ describe("ResponseTimeline", () => {
     name: "Test User",
     createdAt: new Date(),
     updatedAt: new Date(),
-    imageUrl: null,
     objective: null,
     role: "founder",
     email: "test@example.com",

apps/web/modules/ee/sso/lib/providers.ts

@@ -51,7 +51,6 @@ export const getSSOProviders = () => [
         id: profile.sub,
         name: profile.name,
         email: profile.email,
-        image: profile.picture,
       };
     },
   },
@@ -76,7 +75,6 @@ export const getSSOProviders = () => [
         id: profile.id,
         email: profile.email,
         name: [profile.firstName, profile.lastName].filter(Boolean).join(" "),
-        image: null,
       };
     },
     options: {

apps/web/modules/ee/sso/lib/tests/__mock__/sso-handlers.mock.ts

@@ -13,7 +13,6 @@ export const mockUser: TUser = {
     unsubscribedOrganizationIds: [],
   },
   emailVerified: new Date(),
-  imageUrl: "https://example.com/image.png",
   twoFactorEnabled: false,
   identityProvider: "google",
   locale: "en-US",

apps/web/modules/email/components/preview-email-template.tsx

@@ -380,8 +380,8 @@ export async function PreviewEmailTemplate({
                   return (
                     <Column
                       className="text-question-color max-w-40 break-words px-4 py-2 text-center"
-                      key={getLocalizedValue(column, "default")}>
-                      {getLocalizedValue(column, "default")}
+                      key={column.id}>
+                      {getLocalizedValue(column.label, "default")}
                     </Column>
                   );
                 })}
@@ -390,15 +390,13 @@ export async function PreviewEmailTemplate({
                 return (
                   <Row
                     className={`${rowIndex % 2 === 0 ? "bg-input-color" : ""} rounded-custom`}
-                    key={getLocalizedValue(row, "default")}>
+                    key={row.id}>
                     <Column className="w-40 break-words px-4 py-2">
-                      {getLocalizedValue(row, "default")}
+                      {getLocalizedValue(row.label, "default")}
                     </Column>
-                    {firstQuestion.columns.map((_) => {
+                    {firstQuestion.columns.map((column) => {
                       return (
-                        <Column
-                          className="text-question-color px-4 py-2"
-                          key={getLocalizedValue(_, "default")}>
+                        <Column className="text-question-color px-4 py-2" key={column.id}>
                           <Section className="bg-card-bg-color h-4 w-4 rounded-full p-2 outline" />
                         </Column>
                       );

apps/web/modules/email/index.tsx

@@ -111,7 +111,7 @@ export const sendVerificationEmail = async ({
 }): Promise<boolean> => {
   try {
     const t = await getTranslate();
-    const token = createToken(id, {
+    const token = createToken(id, email, {
       expiresIn: "1d",
     });
     const verifyLink = `${WEBAPP_URL}/auth/verify?token=${encodeURIComponent(token)}`;
@@ -136,7 +136,7 @@ export const sendForgotPasswordEmail = async (user: {
   locale: TUserLocale;
 }): Promise<boolean> => {
   const t = await getTranslate();
-  const token = createToken(user.id, {
+  const token = createToken(user.id, user.email, {
     expiresIn: "1d",
   });
   const verifyLink = `${WEBAPP_URL}/auth/forgot-password/reset?token=${encodeURIComponent(token)}`;

apps/web/modules/organization/settings/api-keys/lib/utils.ts

@@ -1,5 +1,6 @@
 import { TFnType } from "@tolgee/react";
-import { TAPIKeyEnvironmentPermission } from "@formbricks/types/auth";
+import { OrganizationAccessType } from "@formbricks/types/api-key";
+import { TAPIKeyEnvironmentPermission, TAuthenticationApiKey } from "@formbricks/types/auth";
 
 // Permission level required for different HTTP methods
 const methodPermissionMap = {
@@ -50,3 +51,19 @@ export const getOrganizationAccessKeyDisplayName = (key: string, t: TFnType) =>
       return key;
   }
 };
+
+export const hasOrganizationAccess = (
+  authentication: TAuthenticationApiKey,
+  accessType: OrganizationAccessType
+): boolean => {
+  const organizationAccess = authentication.organizationAccess?.accessControl;
+
+  switch (accessType) {
+    case OrganizationAccessType.Read:
+      return organizationAccess?.read === true || organizationAccess?.write === true;
+    case OrganizationAccessType.Write:
+      return organizationAccess?.write === true;
+    default:
+      return false;
+  }
+};

apps/web/modules/projects/settings/look/components/edit-logo.tsx

@@ -179,6 +179,7 @@ export const EditLogo = ({ project, environmentId, isReadOnly }: EditLogoProps)
               description={t("environments.project.look.add_background_color_description")}
               childBorder
               customContainerClass="p-0"
+              childrenContainerClass="overflow-visible"
               disabled={!isEditing}>
               {isBgColorEnabled && (
                 <div className="px-2">

apps/web/modules/setup/organization/create/components/removed-from-organization.test.tsx

@@ -56,7 +56,6 @@ const mockUser = {
   id: "user-123",
   name: "Test User",
   email: "test@example.com",
-  imageUrl: null,
   twoFactorEnabled: false,
   identityProvider: "email",
   createdAt: new Date(),

apps/web/modules/setup/organization/create/page.test.tsx

@@ -131,7 +131,6 @@ describe("CreateOrganizationPage", () => {
     name: "Test User",
     email: "test@example.com",
     emailVerified: null,
-    imageUrl: null,
     twoFactorEnabled: false,
     identityProvider: "email" as const,
     createdAt: new Date(),

apps/web/modules/survey/components/question-form-input/index.tsx

@@ -85,6 +85,10 @@ export const QuestionFormInput = ({
   const isChoice = id.includes("choice");
   const isMatrixLabelRow = id.includes("row");
   const isMatrixLabelColumn = id.includes("column");
+  const inputId = useMemo(() => {
+    return isChoice || isMatrixLabelColumn || isMatrixLabelRow ? id.split("-")[0] : id;
+  }, [id, isChoice, isMatrixLabelColumn, isMatrixLabelRow]);
+
   const isEndingCard = questionIdx >= localSurvey.questions.length;
   const isWelcomeCard = questionIdx === -1;
   const index = getIndex(id, isChoice || isMatrixLabelColumn || isMatrixLabelRow);
@@ -104,8 +108,8 @@ export const QuestionFormInput = ({
     [localSurvey.languages]
   );
   const isTranslationIncomplete = useMemo(
-    () => isValueIncomplete(id, isInvalid, surveyLanguageCodes, value),
-    [value, id, isInvalid, surveyLanguageCodes]
+    () => isValueIncomplete(inputId, isInvalid, surveyLanguageCodes, value),
+    [value, inputId, isInvalid, surveyLanguageCodes]
   );
 
   const elementText = useMemo((): TI18nString => {

apps/web/modules/survey/components/question-form-input/utils.test.ts

@@ -87,12 +87,12 @@ describe("utils", () => {
         headline: createI18nString("Matrix Question", surveyLanguageCodes),
         required: true,
         rows: [
-          createI18nString("Row 1", surveyLanguageCodes),
-          createI18nString("Row 2", surveyLanguageCodes),
+          { id: "row-1", label: createI18nString("Row 1", surveyLanguageCodes) },
+          { id: "row-2", label: createI18nString("Row 2", surveyLanguageCodes) },
         ],
         columns: [
-          createI18nString("Column 1", surveyLanguageCodes),
-          createI18nString("Column 2", surveyLanguageCodes),
+          { id: "col-1", label: createI18nString("Column 1", surveyLanguageCodes) },
+          { id: "col-2", label: createI18nString("Column 2", surveyLanguageCodes) },
         ],
       } as unknown as TSurveyQuestion;
 
@@ -108,12 +108,12 @@ describe("utils", () => {
         headline: createI18nString("Matrix Question", surveyLanguageCodes),
         required: true,
         rows: [
-          createI18nString("Row 1", surveyLanguageCodes),
-          createI18nString("Row 2", surveyLanguageCodes),
+          { id: "row-1", label: createI18nString("Row 1", surveyLanguageCodes) },
+          { id: "row-2", label: createI18nString("Row 2", surveyLanguageCodes) },
         ],
         columns: [
-          createI18nString("Column 1", surveyLanguageCodes),
-          createI18nString("Column 2", surveyLanguageCodes),
+          { id: "col-1", label: createI18nString("Column 1", surveyLanguageCodes) },
+          { id: "col-2", label: createI18nString("Column 2", surveyLanguageCodes) },
         ],
       } as unknown as TSurveyQuestion;
 

apps/web/modules/survey/components/question-form-input/utils.ts

@@ -36,8 +36,8 @@ export const getMatrixLabel = (
   type: "row" | "column"
 ): TI18nString => {
   const matrixQuestion = question as TSurveyMatrixQuestion;
-  const labels = type === "row" ? matrixQuestion.rows : matrixQuestion.columns;
-  return labels[idx] || createI18nString("", surveyLanguageCodes);
+  const matrixFields = type === "row" ? matrixQuestion.rows : matrixQuestion.columns;
+  return matrixFields[idx]?.label || createI18nString("", surveyLanguageCodes);
 };
 
 export const getWelcomeCardText = (
@@ -94,6 +94,9 @@ export const isValueIncomplete = (
 ) => {
   // Define a list of IDs for which a default value needs to be checked.
   const labelIds = [
+    "row",
+    "column",
+    "choice",
     "label",
     "headline",
     "subheader",

apps/web/modules/survey/components/template-list/lib/user.test.ts

@@ -1,9 +1,8 @@
-import { isValidImageFile } from "@/lib/fileValidation";
 import { Prisma } from "@prisma/client";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import { PrismaErrorType } from "@formbricks/database/types/error";
-import { InvalidInputError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { ResourceNotFoundError } from "@formbricks/types/errors";
 import { TUser } from "@formbricks/types/user";
 import { updateUser } from "./user";
 
@@ -24,7 +23,6 @@ describe("updateUser", () => {
     id: "user-123",
     name: "Test User",
     email: "test@example.com",
-    imageUrl: "https://example.com/image.png",
     createdAt: new Date(),
     updatedAt: new Date(),
     role: "project_manager",
@@ -41,7 +39,6 @@ describe("updateUser", () => {
   });
 
   test("successfully updates a user", async () => {
-    vi.mocked(isValidImageFile).mockReturnValue(true);
     vi.mocked(prisma.user.update).mockResolvedValue(mockUser as any);
 
     const updateData = { name: "Updated Name" };
@@ -55,7 +52,6 @@ describe("updateUser", () => {
         name: true,
         email: true,
         emailVerified: true,
-        imageUrl: true,
         createdAt: true,
         updatedAt: true,
         role: true,
@@ -72,17 +68,7 @@ describe("updateUser", () => {
     expect(result).toEqual(mockUser);
   });
 
-  test("throws InvalidInputError when image file is invalid", async () => {
-    vi.mocked(isValidImageFile).mockReturnValue(false);
-
-    const updateData = { imageUrl: "invalid-image.xyz" };
-    await expect(updateUser("user-123", updateData)).rejects.toThrow(InvalidInputError);
-    expect(prisma.user.update).not.toHaveBeenCalled();
-  });
-
   test("throws ResourceNotFoundError when user does not exist", async () => {
-    vi.mocked(isValidImageFile).mockReturnValue(true);
-
     const prismaError = new Prisma.PrismaClientKnownRequestError("Record not found", {
       code: PrismaErrorType.RecordDoesNotExist,
       clientVersion: "1.0.0",
@@ -96,8 +82,6 @@ describe("updateUser", () => {
   });
 
   test("re-throws other errors", async () => {
-    vi.mocked(isValidImageFile).mockReturnValue(true);
-
     const otherError = new Error("Some other error");
     vi.mocked(prisma.user.update).mockRejectedValue(otherError);
 

apps/web/modules/survey/components/template-list/lib/user.ts

@@ -1,14 +1,11 @@
-import { isValidImageFile } from "@/lib/fileValidation";
 import { Prisma } from "@prisma/client";
 import { prisma } from "@formbricks/database";
 import { PrismaErrorType } from "@formbricks/database/types/error";
-import { InvalidInputError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { ResourceNotFoundError } from "@formbricks/types/errors";
 import { TUser, TUserUpdateInput } from "@formbricks/types/user";
 
 // function to update a user's user
 export const updateUser = async (personId: string, data: TUserUpdateInput): Promise<TUser> => {
-  if (data.imageUrl && !isValidImageFile(data.imageUrl)) throw new InvalidInputError("Invalid image file");
-
   try {
     const updatedUser = await prisma.user.update({
       where: {
@@ -20,7 +17,6 @@ export const updateUser = async (personId: string, data: TUserUpdateInput): Prom
         name: true,
         email: true,
         emailVerified: true,
-        imageUrl: true,
         createdAt: true,
         updatedAt: true,
         role: true,

apps/web/modules/survey/editor/components/matrix-question-form.test.tsx

@@ -2,8 +2,7 @@ import { createI18nString } from "@/lib/i18n/utils";
 import { findOptionUsedInLogic } from "@/modules/survey/editor/lib/utils";
 import { cleanup, render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import React from "react";
-import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { afterEach, describe, expect, test, vi } from "vitest";
 import {
   TSurvey,
   TSurveyLanguage,
@@ -14,12 +13,11 @@ import { TUserLocale } from "@formbricks/types/user";
 import { MatrixQuestionForm } from "./matrix-question-form";
 
 // Mock cuid2 to track CUID generation
-const mockCuids = ["cuid1", "cuid2", "cuid3", "cuid4", "cuid5", "cuid6"];
 let cuidIndex = 0;
 
 vi.mock("@paralleldrive/cuid2", () => ({
   default: {
-    createId: vi.fn(() => mockCuids[cuidIndex++]),
+    createId: vi.fn(() => `cuid${cuidIndex++}`),
   },
 }));
 
@@ -160,14 +158,14 @@ const mockMatrixQuestion: TSurveyMatrixQuestion = {
   required: false,
   logic: [],
   rows: [
-    createI18nString("Row 1", ["en"]),
-    createI18nString("Row 2", ["en"]),
-    createI18nString("Row 3", ["en"]),
+    { id: "row-1", label: createI18nString("Row 1", ["en"]) },
+    { id: "row-2", label: createI18nString("Row 2", ["en"]) },
+    { id: "row-3", label: createI18nString("Row 3", ["en"]) },
   ],
   columns: [
-    createI18nString("Column 1", ["en"]),
-    createI18nString("Column 2", ["en"]),
-    createI18nString("Column 3", ["en"]),
+    { id: "col-1", label: createI18nString("Column 1", ["en"]) },
+    { id: "col-2", label: createI18nString("Column 2", ["en"]) },
+    { id: "col-3", label: createI18nString("Column 3", ["en"]) },
   ],
   shuffleOption: "none",
 };
@@ -197,6 +195,7 @@ describe("MatrixQuestionForm", () => {
   afterEach(() => {
     cleanup();
     vi.clearAllMocks();
+    cuidIndex = 0;
   });
 
   test("renders the matrix question form with rows and columns", () => {
@@ -240,40 +239,6 @@ describe("MatrixQuestionForm", () => {
     expect(screen.getByTestId("question-input-subheader")).toBeInTheDocument();
   });
 
-  test("adds a new row when 'Add Row' button is clicked", async () => {
-    const user = userEvent.setup();
-    const { getByText } = render(<MatrixQuestionForm {...defaultProps} />);
-
-    const addRowButton = getByText("environments.surveys.edit.add_row");
-    await user.click(addRowButton);
-
-    expect(mockUpdateQuestion).toHaveBeenCalledWith(0, {
-      rows: [
-        mockMatrixQuestion.rows[0],
-        mockMatrixQuestion.rows[1],
-        mockMatrixQuestion.rows[2],
-        { default: "" },
-      ],
-    });
-  });
-
-  test("adds a new column when 'Add Column' button is clicked", async () => {
-    const user = userEvent.setup();
-    const { getByText } = render(<MatrixQuestionForm {...defaultProps} />);
-
-    const addColumnButton = getByText("environments.surveys.edit.add_column");
-    await user.click(addColumnButton);
-
-    expect(mockUpdateQuestion).toHaveBeenCalledWith(0, {
-      columns: [
-        mockMatrixQuestion.columns[0],
-        mockMatrixQuestion.columns[1],
-        mockMatrixQuestion.columns[2],
-        { default: "" },
-      ],
-    });
-  });
-
   test("deletes a row when delete button is clicked", async () => {
     const user = userEvent.setup();
     const { findAllByTestId } = render(<MatrixQuestionForm {...defaultProps} />);
@@ -294,7 +259,10 @@ describe("MatrixQuestionForm", () => {
       ...defaultProps,
       question: {
         ...mockMatrixQuestion,
-        rows: [createI18nString("Row 1", ["en"]), createI18nString("Row 2", ["en"])],
+        rows: [
+          { id: "row-1", label: createI18nString("Row 1", ["en"]) },
+          { id: "row-2", label: createI18nString("Row 2", ["en"]) },
+        ],
       },
     };
 
@@ -334,42 +302,6 @@ describe("MatrixQuestionForm", () => {
     expect(mockUpdateQuestion).toHaveBeenCalled();
   });
 
-  test("handles Enter key to add a new row from row input", async () => {
-    const user = userEvent.setup();
-    const { getByTestId } = render(<MatrixQuestionForm {...defaultProps} />);
-
-    const rowInput = getByTestId("input-row-0");
-    await user.click(rowInput);
-    await user.keyboard("{Enter}");
-
-    expect(mockUpdateQuestion).toHaveBeenCalledWith(0, {
-      rows: [
-        mockMatrixQuestion.rows[0],
-        mockMatrixQuestion.rows[1],
-        mockMatrixQuestion.rows[2],
-        expect.any(Object),
-      ],
-    });
-  });
-
-  test("handles Enter key to add a new column from column input", async () => {
-    const user = userEvent.setup();
-    const { getByTestId } = render(<MatrixQuestionForm {...defaultProps} />);
-
-    const columnInput = getByTestId("input-column-0");
-    await user.click(columnInput);
-    await user.keyboard("{Enter}");
-
-    expect(mockUpdateQuestion).toHaveBeenCalledWith(0, {
-      columns: [
-        mockMatrixQuestion.columns[0],
-        mockMatrixQuestion.columns[1],
-        mockMatrixQuestion.columns[2],
-        expect.any(Object),
-      ],
-    });
-  });
-
   test("prevents deletion of a row used in logic", async () => {
     const { findOptionUsedInLogic } = await import("@/modules/survey/editor/lib/utils");
     vi.mocked(findOptionUsedInLogic).mockReturnValueOnce(1); // Mock that this row is used in logic
@@ -397,223 +329,4 @@ describe("MatrixQuestionForm", () => {
 
     expect(mockUpdateQuestion).not.toHaveBeenCalled();
   });
-
-  // CUID functionality tests
-  describe("CUID Management", () => {
-    beforeEach(() => {
-      // Reset CUID index before each test
-      cuidIndex = 0;
-    });
-
-    test("generates stable CUIDs for rows and columns on initial render", () => {
-      const { rerender } = render(<MatrixQuestionForm {...defaultProps} />);
-
-      // Check that CUIDs are generated for initial items
-      expect(cuidIndex).toBe(6); // 3 rows + 3 columns
-
-      // Rerender with the same props - no new CUIDs should be generated
-      rerender(<MatrixQuestionForm {...defaultProps} />);
-      expect(cuidIndex).toBe(6); // Should remain the same
-    });
-
-    test("maintains stable CUIDs across rerenders", () => {
-      const TestComponent = ({ question }: { question: TSurveyMatrixQuestion }) => {
-        return <MatrixQuestionForm {...defaultProps} question={question} />;
-      };
-
-      const { rerender } = render(<TestComponent question={mockMatrixQuestion} />);
-
-      // Check initial CUID count
-      expect(cuidIndex).toBe(6); // 3 rows + 3 columns
-
-      // Rerender multiple times
-      rerender(<TestComponent question={mockMatrixQuestion} />);
-      rerender(<TestComponent question={mockMatrixQuestion} />);
-      rerender(<TestComponent question={mockMatrixQuestion} />);
-
-      // CUIDs should remain stable
-      expect(cuidIndex).toBe(6); // Should not increase
-    });
-
-    test("generates new CUIDs only when rows are added", async () => {
-      const user = userEvent.setup();
-
-      // Create a test component that can update its props
-      const TestComponent = () => {
-        const [question, setQuestion] = React.useState(mockMatrixQuestion);
-
-        const handleUpdateQuestion = (_: number, updates: Partial<TSurveyMatrixQuestion>) => {
-          setQuestion((prev) => ({ ...prev, ...updates }));
-        };
-
-        return (
-          <MatrixQuestionForm {...defaultProps} question={question} updateQuestion={handleUpdateQuestion} />
-        );
-      };
-
-      const { getByText } = render(<TestComponent />);
-
-      // Initial render should generate 6 CUIDs (3 rows + 3 columns)
-      expect(cuidIndex).toBe(6);
-
-      // Add a new row
-      const addRowButton = getByText("environments.surveys.edit.add_row");
-      await user.click(addRowButton);
-
-      // Should generate 1 new CUID for the new row
-      expect(cuidIndex).toBe(7);
-    });
-
-    test("generates new CUIDs only when columns are added", async () => {
-      const user = userEvent.setup();
-
-      // Create a test component that can update its props
-      const TestComponent = () => {
-        const [question, setQuestion] = React.useState(mockMatrixQuestion);
-
-        const handleUpdateQuestion = (_: number, updates: Partial<TSurveyMatrixQuestion>) => {
-          setQuestion((prev) => ({ ...prev, ...updates }));
-        };
-
-        return (
-          <MatrixQuestionForm {...defaultProps} question={question} updateQuestion={handleUpdateQuestion} />
-        );
-      };
-
-      const { getByText } = render(<TestComponent />);
-
-      // Initial render should generate 6 CUIDs (3 rows + 3 columns)
-      expect(cuidIndex).toBe(6);
-
-      // Add a new column
-      const addColumnButton = getByText("environments.surveys.edit.add_column");
-      await user.click(addColumnButton);
-
-      // Should generate 1 new CUID for the new column
-      expect(cuidIndex).toBe(7);
-    });
-
-    test("maintains CUID stability when items are deleted", async () => {
-      const user = userEvent.setup();
-      const { findAllByTestId, rerender } = render(<MatrixQuestionForm {...defaultProps} />);
-
-      // Mock that no items are used in logic
-      vi.mocked(findOptionUsedInLogic).mockReturnValue(-1);
-
-      // Initial render: 6 CUIDs generated
-      expect(cuidIndex).toBe(6);
-
-      // Delete a row
-      const deleteButtons = await findAllByTestId("tooltip-renderer");
-      await user.click(deleteButtons[0].querySelector("button") as HTMLButtonElement);
-
-      // No new CUIDs should be generated for deletion
-      expect(cuidIndex).toBe(6);
-
-      // Rerender should not generate new CUIDs
-      rerender(<MatrixQuestionForm {...defaultProps} />);
-      expect(cuidIndex).toBe(6);
-    });
-
-    test("handles mixed operations maintaining CUID stability", async () => {
-      const user = userEvent.setup();
-
-      // Create a test component that can update its props
-      const TestComponent = () => {
-        const [question, setQuestion] = React.useState(mockMatrixQuestion);
-
-        const handleUpdateQuestion = (_: number, updates: Partial<TSurveyMatrixQuestion>) => {
-          setQuestion((prev) => ({ ...prev, ...updates }));
-        };
-
-        return (
-          <MatrixQuestionForm {...defaultProps} question={question} updateQuestion={handleUpdateQuestion} />
-        );
-      };
-
-      const { getByText, findAllByTestId } = render(<TestComponent />);
-
-      // Mock that no items are used in logic
-      vi.mocked(findOptionUsedInLogic).mockReturnValue(-1);
-
-      // Initial: 6 CUIDs
-      expect(cuidIndex).toBe(6);
-
-      // Add a row: +1 CUID
-      const addRowButton = getByText("environments.surveys.edit.add_row");
-      await user.click(addRowButton);
-      expect(cuidIndex).toBe(7);
-
-      // Add a column: +1 CUID
-      const addColumnButton = getByText("environments.surveys.edit.add_column");
-      await user.click(addColumnButton);
-      expect(cuidIndex).toBe(8);
-
-      // Delete a row: no new CUIDs
-      const deleteButtons = await findAllByTestId("tooltip-renderer");
-      await user.click(deleteButtons[0].querySelector("button") as HTMLButtonElement);
-      expect(cuidIndex).toBe(8);
-
-      // Delete a column: no new CUIDs
-      const updatedDeleteButtons = await findAllByTestId("tooltip-renderer");
-      await user.click(updatedDeleteButtons[2].querySelector("button") as HTMLButtonElement);
-      expect(cuidIndex).toBe(8);
-    });
-
-    test("CUID arrays are properly maintained when items are deleted in order", async () => {
-      const user = userEvent.setup();
-      const propsWithManyRows = {
-        ...defaultProps,
-        question: {
-          ...mockMatrixQuestion,
-          rows: [
-            createI18nString("Row 1", ["en"]),
-            createI18nString("Row 2", ["en"]),
-            createI18nString("Row 3", ["en"]),
-            createI18nString("Row 4", ["en"]),
-          ],
-        },
-      };
-
-      const { findAllByTestId } = render(<MatrixQuestionForm {...propsWithManyRows} />);
-
-      // Mock that no items are used in logic
-      vi.mocked(findOptionUsedInLogic).mockReturnValue(-1);
-
-      // Initial: 7 CUIDs (4 rows + 3 columns)
-      expect(cuidIndex).toBe(7);
-
-      // Delete first row
-      const deleteButtons = await findAllByTestId("tooltip-renderer");
-      await user.click(deleteButtons[0].querySelector("button") as HTMLButtonElement);
-
-      // Verify the correct row was deleted (should be Row 2, Row 3, Row 4 remaining)
-      expect(mockUpdateQuestion).toHaveBeenLastCalledWith(0, {
-        rows: [
-          propsWithManyRows.question.rows[1],
-          propsWithManyRows.question.rows[2],
-          propsWithManyRows.question.rows[3],
-        ],
-      });
-
-      // No new CUIDs should be generated
-      expect(cuidIndex).toBe(7);
-    });
-
-    test("CUID generation is consistent across component instances", () => {
-      // Reset CUID index
-      cuidIndex = 0;
-
-      // Render first instance
-      const { unmount } = render(<MatrixQuestionForm {...defaultProps} />);
-      expect(cuidIndex).toBe(6);
-
-      // Unmount and render second instance
-      unmount();
-      render(<MatrixQuestionForm {...defaultProps} />);
-
-      // Should generate 6 more CUIDs for the new instance
-      expect(cuidIndex).toBe(12);
-    });
-  });
 });

apps/web/modules/survey/editor/components/matrix-question-form.tsx

@@ -2,16 +2,18 @@
 
 import { createI18nString, extractLanguageCodes } from "@/lib/i18n/utils";
 import { QuestionFormInput } from "@/modules/survey/components/question-form-input";
+import { MatrixSortableItem } from "@/modules/survey/editor/components/matrix-sortable-item";
 import { findOptionUsedInLogic } from "@/modules/survey/editor/lib/utils";
 import { Button } from "@/modules/ui/components/button";
 import { Label } from "@/modules/ui/components/label";
 import { ShuffleOptionSelect } from "@/modules/ui/components/shuffle-option-select";
-import { TooltipRenderer } from "@/modules/ui/components/tooltip";
+import { DndContext, type DragEndEvent } from "@dnd-kit/core";
+import { SortableContext, verticalListSortingStrategy } from "@dnd-kit/sortable";
 import { useAutoAnimate } from "@formkit/auto-animate/react";
-import cuid2 from "@paralleldrive/cuid2";
+import { createId } from "@paralleldrive/cuid2";
 import { useTranslate } from "@tolgee/react";
-import { PlusIcon, TrashIcon } from "lucide-react";
-import { type JSX, useMemo, useRef } from "react";
+import { PlusIcon } from "lucide-react";
+import { type JSX, useCallback } from "react";
 import toast from "react-hot-toast";
 import { TI18nString, TSurvey, TSurveyMatrixQuestion } from "@formbricks/types/surveys/types";
 import { TUserLocale } from "@formbricks/types/user";
@@ -41,51 +43,16 @@ export const MatrixQuestionForm = ({
   const languageCodes = extractLanguageCodes(localSurvey.languages);
   const { t } = useTranslate();
 
-  // Refs to maintain stable CUIDs across renders
-  const cuidRefs = useRef<{
-    rows: string[];
-    columns: string[];
-  }>({
-    rows: [],
-    columns: [],
-  });
-
-  // Generic function to ensure CUIDs are synchronized with the current state
-  const ensureCuids = (type: "rows" | "columns", currentItems: TI18nString[]) => {
-    const currentCuids = cuidRefs.current[type];
-    if (currentCuids.length !== currentItems.length) {
-      if (currentItems.length > currentCuids.length) {
-        // Add new CUIDs for added items
-        const newCuids = Array(currentItems.length - currentCuids.length)
-          .fill(null)
-          .map(() => cuid2.createId());
-        cuidRefs.current[type] = [...currentCuids, ...newCuids];
-      } else {
-        // Remove CUIDs for deleted items (keep the remaining ones in order)
-        cuidRefs.current[type] = currentCuids.slice(0, currentItems.length);
-      }
-    }
-  };
-
-  // Generic function to get items with CUIDs
-  const getItemsWithCuid = (type: "rows" | "columns", items: TI18nString[]) => {
-    ensureCuids(type, items);
-    return items.map((item, index) => ({
-      ...item,
-      id: cuidRefs.current[type][index],
-    }));
-  };
-
-  const rowsWithCuid = useMemo(() => getItemsWithCuid("rows", question.rows), [question.rows]);
-  const columnsWithCuid = useMemo(() => getItemsWithCuid("columns", question.columns), [question.columns]);
-
   // Function to add a new Label input field
   const handleAddLabel = (type: "row" | "column") => {
     if (type === "row") {
-      const updatedRows = [...question.rows, createI18nString("", languageCodes)];
+      const updatedRows = [...question.rows, { id: createId(), label: createI18nString("", languageCodes) }];
       updateQuestion(questionIdx, { rows: updatedRows });
     } else {
-      const updatedColumns = [...question.columns, createI18nString("", languageCodes)];
+      const updatedColumns = [
+        ...question.columns,
+        { id: createId(), label: createI18nString("", languageCodes) },
+      ];
       updateQuestion(questionIdx, { columns: updatedColumns });
     }
   };
@@ -120,10 +87,6 @@ export const MatrixQuestionForm = ({
 
     const updatedLabels = labels.filter((_, idx) => idx !== index);
 
-    // Update the CUID arrays when deleting
-    const cuidType = type === "row" ? "rows" : "columns";
-    cuidRefs.current[cuidType] = cuidRefs.current[cuidType].filter((_, idx) => idx !== index);
-
     if (type === "row") {
       updateQuestion(questionIdx, { rows: updatedLabels });
     } else {
@@ -136,9 +99,9 @@ export const MatrixQuestionForm = ({
 
     // Update the label at the given index, or add a new label if index is undefined
     if (index !== undefined) {
-      labels[index] = matrixLabel;
+      labels[index].label = matrixLabel;
     } else {
-      labels.push(matrixLabel);
+      labels.push({ id: createId(), label: matrixLabel });
     }
     if (type === "row") {
       updateQuestion(questionIdx, { rows: labels });
@@ -154,6 +117,27 @@ export const MatrixQuestionForm = ({
     }
   };
 
+  const handleMatrixDragEnd = useCallback(
+    (type: "row" | "column", event: DragEndEvent) => {
+      const { active, over } = event;
+
+      if (!active || !over || active.id === over.id) return;
+
+      const items = type === "row" ? [...question.rows] : [...question.columns];
+      const activeIndex = items.findIndex((item) => item.id === active.id);
+      const overIndex = items.findIndex((item) => item.id === over.id);
+
+      if (activeIndex === -1 || overIndex === -1) return;
+
+      const movedItem = items[activeIndex];
+      items.splice(activeIndex, 1);
+      items.splice(overIndex, 0, movedItem);
+
+      updateQuestion(questionIdx, type === "row" ? { rows: items } : { columns: items });
+    },
+    [questionIdx, updateQuestion, question.rows, question.columns]
+  );
+
   const shuffleOptionsTypes = {
     none: {
       id: "none",
@@ -173,6 +157,7 @@ export const MatrixQuestionForm = ({
   };
   /// Auto animate
   const [parent] = useAutoAnimate();
+
   return (
     <form>
       <QuestionFormInput
@@ -226,44 +211,39 @@ export const MatrixQuestionForm = ({
         <div>
           {/* Rows section */}
           <Label htmlFor="rows">{t("environments.surveys.edit.rows")}</Label>
-          <div className="mt-2 flex flex-col gap-2" ref={parent}>
-            {rowsWithCuid.map((row, index) => (
-              <div className="flex items-center" key={row.id}>
-                <QuestionFormInput
-                  id={`row-${index}`}
-                  label={""}
-                  localSurvey={localSurvey}
-                  questionIdx={questionIdx}
-                  value={question.rows[index]}
-                  updateMatrixLabel={updateMatrixLabel}
-                  selectedLanguageCode={selectedLanguageCode}
-                  setSelectedLanguageCode={setSelectedLanguageCode}
-                  isInvalid={
-                    isInvalid && !isLabelValidForAllLanguages(question.rows[index], localSurvey.languages)
-                  }
-                  locale={locale}
-                  onKeyDown={(e) => handleKeyDown(e, "row")}
-                />
-                {question.rows.length > 2 && (
-                  <TooltipRenderer data-testid="tooltip-renderer" tooltipContent={t("common.delete")}>
-                    <Button
-                      variant="ghost"
-                      size="icon"
-                      className="ml-2"
-                      onClick={(e) => {
-                        e.preventDefault();
-                        handleDeleteLabel("row", index);
-                      }}>
-                      <TrashIcon />
-                    </Button>
-                  </TooltipRenderer>
-                )}
-              </div>
-            ))}
+          <div className="mt-2">
+            <DndContext id="matrix-rows" onDragEnd={(e) => handleMatrixDragEnd("row", e)}>
+              <SortableContext items={question.rows} strategy={verticalListSortingStrategy}>
+                <div className="flex flex-col gap-2" ref={parent}>
+                  {question.rows.map((row, index) => (
+                    <MatrixSortableItem
+                      key={row.id}
+                      choice={row}
+                      index={index}
+                      type="row"
+                      localSurvey={localSurvey}
+                      question={question}
+                      questionIdx={questionIdx}
+                      updateMatrixLabel={updateMatrixLabel}
+                      onDelete={(index) => handleDeleteLabel("row", index)}
+                      onKeyDown={(e) => handleKeyDown(e, "row")}
+                      canDelete={question.rows.length > 2}
+                      selectedLanguageCode={selectedLanguageCode}
+                      setSelectedLanguageCode={setSelectedLanguageCode}
+                      isInvalid={
+                        isInvalid &&
+                        !isLabelValidForAllLanguages(question.rows[index].label, localSurvey.languages)
+                      }
+                      locale={locale}
+                    />
+                  ))}
+                </div>
+              </SortableContext>
+            </DndContext>
             <Button
               variant="secondary"
               size="sm"
-              className="w-fit"
+              className="mt-2 w-fit"
               onClick={(e) => {
                 e.preventDefault();
                 handleAddLabel("row");
@@ -276,44 +256,39 @@ export const MatrixQuestionForm = ({
         <div>
           {/* Columns section */}
           <Label htmlFor="columns">{t("environments.surveys.edit.columns")}</Label>
-          <div className="mt-2 flex flex-col gap-2" ref={parent}>
-            {columnsWithCuid.map((column, index) => (
-              <div className="flex items-center" key={column.id}>
-                <QuestionFormInput
-                  id={`column-${index}`}
-                  label={""}
-                  localSurvey={localSurvey}
-                  questionIdx={questionIdx}
-                  value={question.columns[index]}
-                  updateMatrixLabel={updateMatrixLabel}
-                  selectedLanguageCode={selectedLanguageCode}
-                  setSelectedLanguageCode={setSelectedLanguageCode}
-                  isInvalid={
-                    isInvalid && !isLabelValidForAllLanguages(question.columns[index], localSurvey.languages)
-                  }
-                  locale={locale}
-                  onKeyDown={(e) => handleKeyDown(e, "column")}
-                />
-                {question.columns.length > 2 && (
-                  <TooltipRenderer data-testid="tooltip-renderer" tooltipContent={t("common.delete")}>
-                    <Button
-                      variant="ghost"
-                      size="icon"
-                      className="ml-2"
-                      onClick={(e) => {
-                        e.preventDefault();
-                        handleDeleteLabel("column", index);
-                      }}>
-                      <TrashIcon />
-                    </Button>
-                  </TooltipRenderer>
-                )}
-              </div>
-            ))}
+          <div className="mt-2">
+            <DndContext id="matrix-columns" onDragEnd={(e) => handleMatrixDragEnd("column", e)}>
+              <SortableContext items={question.columns} strategy={verticalListSortingStrategy}>
+                <div className="flex flex-col gap-2" ref={parent}>
+                  {question.columns.map((column, index) => (
+                    <MatrixSortableItem
+                      key={column.id}
+                      choice={column}
+                      index={index}
+                      type="column"
+                      localSurvey={localSurvey}
+                      question={question}
+                      questionIdx={questionIdx}
+                      updateMatrixLabel={updateMatrixLabel}
+                      onDelete={(index) => handleDeleteLabel("column", index)}
+                      onKeyDown={(e) => handleKeyDown(e, "column")}
+                      canDelete={question.columns.length > 2}
+                      selectedLanguageCode={selectedLanguageCode}
+                      setSelectedLanguageCode={setSelectedLanguageCode}
+                      isInvalid={
+                        isInvalid &&
+                        !isLabelValidForAllLanguages(question.columns[index].label, localSurvey.languages)
+                      }
+                      locale={locale}
+                    />
+                  ))}
+                </div>
+              </SortableContext>
+            </DndContext>
             <Button
               variant="secondary"
               size="sm"
-              className="w-fit"
+              className="mt-2 w-fit"
               onClick={(e) => {
                 e.preventDefault();
                 handleAddLabel("column");

apps/web/modules/survey/editor/components/matrix-sortable-item.tsx

@@ -0,0 +1,100 @@
+"use client";
+
+import { QuestionFormInput } from "@/modules/survey/components/question-form-input";
+import { Button } from "@/modules/ui/components/button";
+import { TooltipRenderer } from "@/modules/ui/components/tooltip";
+import { useSortable } from "@dnd-kit/sortable";
+import { CSS } from "@dnd-kit/utilities";
+import { useTranslate } from "@tolgee/react";
+import { GripVerticalIcon, TrashIcon } from "lucide-react";
+import type { JSX } from "react";
+import {
+  TI18nString,
+  TSurvey,
+  TSurveyMatrixQuestion,
+  TSurveyMatrixQuestionChoice,
+} from "@formbricks/types/surveys/types";
+import { TUserLocale } from "@formbricks/types/user";
+
+interface MatrixSortableItemProps {
+  choice: TSurveyMatrixQuestionChoice;
+  type: "row" | "column";
+  index: number;
+  localSurvey: TSurvey;
+  question: TSurveyMatrixQuestion;
+  questionIdx: number;
+  updateMatrixLabel: (index: number, type: "row" | "column", matrixLabel: TI18nString) => void;
+  onDelete: (index: number) => void;
+  onKeyDown: (e: React.KeyboardEvent) => void;
+  canDelete: boolean;
+  selectedLanguageCode: string;
+  setSelectedLanguageCode: (language: string) => void;
+  isInvalid: boolean;
+  locale: TUserLocale;
+}
+
+export const MatrixSortableItem = ({
+  choice,
+  type,
+  index,
+  localSurvey,
+  questionIdx,
+  updateMatrixLabel,
+  onDelete,
+  onKeyDown,
+  canDelete,
+  selectedLanguageCode,
+  setSelectedLanguageCode,
+  isInvalid,
+  locale,
+}: MatrixSortableItemProps): JSX.Element => {
+  const { t } = useTranslate();
+
+  const { attributes, listeners, setNodeRef, transform, transition } = useSortable({
+    id: choice.id,
+  });
+
+  const style = {
+    transition: transition ?? "transform 100ms ease",
+    transform: CSS.Translate.toString(transform),
+  };
+
+  return (
+    <div className="flex w-full items-center gap-2" ref={setNodeRef} style={style}>
+      <div {...listeners} {...attributes}>
+        <GripVerticalIcon className="h-4 w-4 cursor-move text-slate-400" />
+      </div>
+
+      <div className="flex w-full items-center">
+        <QuestionFormInput
+          key={choice.id}
+          id={`${type}-${index}`}
+          label=""
+          localSurvey={localSurvey}
+          questionIdx={questionIdx}
+          value={choice.label}
+          updateMatrixLabel={updateMatrixLabel}
+          selectedLanguageCode={selectedLanguageCode}
+          setSelectedLanguageCode={setSelectedLanguageCode}
+          isInvalid={isInvalid}
+          locale={locale}
+          onKeyDown={onKeyDown}
+        />
+        {canDelete && (
+          <TooltipRenderer data-testid="tooltip-renderer" tooltipContent={t("common.delete")}>
+            <Button
+              variant="ghost"
+              size="icon"
+              className="ml-2"
+              onClick={(e) => {
+                e.preventDefault();
+                onDelete(index);
+              }}>
+              <TrashIcon />
+            </Button>
+          </TooltipRenderer>
+        )}
+      </div>
+    </div>
+  );
+};

apps/web/modules/survey/editor/lib/utils.tsx

@@ -118,7 +118,7 @@ export const getConditionValueOptions = (
         // Rows submenu
         const rows = question.rows.map((row, rowIdx) => ({
           icon: getQuestionIconMapping(t)[question.type],
-          label: `${getLocalizedValue(row, "default")} (${getLocalizedValue(question.headline, "default")})`,
+          label: `${getLocalizedValue(row.label, "default")} (${getLocalizedValue(question.headline, "default")})`,
           value: `${question.id}.${rowIdx}`,
           meta: {
             type: "question",
@@ -629,7 +629,7 @@ export const getMatchValueProps = (
     } else if (selectedQuestion?.type === TSurveyQuestionTypeEnum.Matrix) {
       const choices = selectedQuestion.columns.map((column, colIdx) => {
         return {
-          label: getLocalizedValue(column, "default"),
+          label: getLocalizedValue(column.label, "default"),
           value: colIdx.toString(),
           meta: {
             type: "static",

apps/web/modules/survey/editor/lib/validation.ts

@@ -61,14 +61,20 @@ const handleI18nCheckForMatrixLabels = (
 ): boolean => {
   const rowsAndColumns = [...question.rows, ...question.columns];
 
-  const invalidRowsLangCodes = findLanguageCodesForDuplicateLabels(question.rows, languages);
-  const invalidColumnsLangCodes = findLanguageCodesForDuplicateLabels(question.columns, languages);
+  const invalidRowsLangCodes = findLanguageCodesForDuplicateLabels(
+    question.rows.map((row) => row.label),
+    languages
+  );
+  const invalidColumnsLangCodes = findLanguageCodesForDuplicateLabels(
+    question.columns.map((column) => column.label),
+    languages
+  );
 
   if (invalidRowsLangCodes.length > 0 || invalidColumnsLangCodes.length > 0) {
     return false;
   }
 
-  return rowsAndColumns.every((label) => isLabelValidForAllLanguages(label, languages));
+  return rowsAndColumns.every((choice) => isLabelValidForAllLanguages(choice.label, languages));
 };
 
 const handleI18nCheckForContactAndAddressFields = (

apps/web/modules/survey/lib/questions.tsx

@@ -181,8 +181,14 @@ export const getQuestionTypes = (t: TFnType): TQuestion[] => [
     icon: Grid3X3Icon,
     preset: {
       headline: createI18nString("", []),
-      rows: [createI18nString("", []), createI18nString("", [])],
-      columns: [createI18nString("", []), createI18nString("", [])],
+      rows: [
+        { id: createId(), label: createI18nString("", []) },
+        { id: createId(), label: createI18nString("", []) },
+      ],
+      columns: [
+        { id: createId(), label: createI18nString("", []) },
+        { id: createId(), label: createI18nString("", []) },
+      ],
       buttonLabel: createI18nString(t("templates.next"), []),
       backButtonLabel: createI18nString(t("templates.back"), []),
       shuffleOption: "none",

apps/web/modules/survey/link/actions.ts

@@ -2,6 +2,8 @@
 
 import { actionClient } from "@/lib/utils/action-client";
 import { getOrganizationIdFromSurveyId } from "@/lib/utils/helper";
+import { applyIPRateLimit } from "@/modules/core/rate-limit/helpers";
+import { rateLimitConfigs } from "@/modules/core/rate-limit/rate-limit-configs";
 import { getOrganizationLogoUrl } from "@/modules/ee/whitelabel/email-customization/lib/organization";
 import { sendLinkSurveyToVerifiedEmail } from "@/modules/email";
 import { getSurveyWithMetadata, isSurveyResponsePresent } from "@/modules/survey/link/lib/data";
@@ -12,6 +14,14 @@ import { InvalidInputError, ResourceNotFoundError } from "@formbricks/types/erro
 export const sendLinkSurveyEmailAction = actionClient
   .schema(ZLinkSurveyEmailData)
   .action(async ({ parsedInput }) => {
+    await applyIPRateLimit(rateLimitConfigs.actions.sendLinkSurveyEmail);
+
+    const survey = await getSurveyWithMetadata(parsedInput.surveyId);
+
+    if (!survey.isVerifyEmailEnabled) {
+      throw new InvalidInputError("EMAIL_VERIFICATION_NOT_ENABLED");
+    }
+
     const organizationId = await getOrganizationIdFromSurveyId(parsedInput.surveyId);
     const organizationLogoUrl = await getOrganizationLogoUrl(organizationId);
 

apps/web/modules/survey/link/lib/metadata-utils.ts

@@ -52,7 +52,7 @@ export const getBasicSurveyMetadata = async (
       : undefined;
   let title = titleFromMetadata || titleFromWelcome || survey.name;
 
-  // Set description - priority: custom link metadata > welcome card > default
+  // Set description - priority: custom link metadata > default
   const descriptionFromMetadata = metadata?.description
     ? getLocalizedValue(metadata.description, langCode) || ""
     : undefined;

apps/web/modules/ui/components/advanced-option-toggle/index.tsx

@@ -12,6 +12,7 @@ interface AdvancedOptionToggleProps {
   childBorder?: boolean;
   customContainerClass?: string;
   disabled?: boolean;
+  childrenContainerClass?: string;
 }
 
 export const AdvancedOptionToggle = ({
@@ -24,6 +25,7 @@ export const AdvancedOptionToggle = ({
   childBorder,
   customContainerClass,
   disabled = false,
+  childrenContainerClass,
 }: AdvancedOptionToggleProps) => {
   return (
     <div className={cn("px-4 py-2", customContainerClass)}>
@@ -40,7 +42,8 @@ export const AdvancedOptionToggle = ({
         <div
           className={cn(
             "mt-4 flex w-full items-center space-x-1 overflow-hidden rounded-lg bg-slate-50",
-            childBorder && "border"
+            childBorder && "border",
+            childrenContainerClass
           )}>
           {children}
         </div>

apps/web/modules/ui/components/avatars/index.test.tsx

@@ -12,13 +12,6 @@ vi.mock("boring-avatars", () => ({
   ),
 }));
 
-// Mock next/image
-vi.mock("next/image", () => ({
-  default: ({ src, width, height, className, alt }: any) => (
-    <img src={src} width={width} height={height} className={className} alt={alt} data-testid="next-image" />
-  ),
-}));
-
 describe("Avatar Components", () => {
   afterEach(() => {
     cleanup();
@@ -44,7 +37,7 @@ describe("Avatar Components", () => {
   });
 
   describe("ProfileAvatar", () => {
-    test("renders Boring Avatar when imageUrl is not provided", () => {
+    test("renders Boring Avatar", () => {
       render(<ProfileAvatar userId="user-123" />);
 
       const avatar = screen.getByTestId("boring-avatar-bauhaus");
@@ -52,32 +45,5 @@ describe("Avatar Components", () => {
       expect(avatar).toHaveAttribute("data-size", "40");
       expect(avatar).toHaveAttribute("data-name", "user-123");
     });
-
-    test("renders Boring Avatar when imageUrl is null", () => {
-      render(<ProfileAvatar userId="user-123" imageUrl={null} />);
-
-      const avatar = screen.getByTestId("boring-avatar-bauhaus");
-      expect(avatar).toBeInTheDocument();
-    });
-
-    test("renders Image component when imageUrl is provided", () => {
-      render(<ProfileAvatar userId="user-123" imageUrl="https://example.com/avatar.jpg" />);
-
-      const image = screen.getByTestId("next-image");
-      expect(image).toBeInTheDocument();
-      expect(image).toHaveAttribute("src", "https://example.com/avatar.jpg");
-      expect(image).toHaveAttribute("width", "40");
-      expect(image).toHaveAttribute("height", "40");
-      expect(image).toHaveAttribute("alt", "Avatar placeholder");
-      expect(image).toHaveClass("h-10", "w-10", "rounded-full", "object-cover");
-    });
-
-    test("renders Image component with different imageUrl", () => {
-      render(<ProfileAvatar userId="user-123" imageUrl="https://example.com/different-avatar.png" />);
-
-      const image = screen.getByTestId("next-image");
-      expect(image).toBeInTheDocument();
-      expect(image).toHaveAttribute("src", "https://example.com/different-avatar.png");
-    });
   });
 });

apps/web/modules/ui/components/avatars/index.tsx

@@ -1,5 +1,4 @@
 import Avatar from "boring-avatars";
-import Image from "next/image";
 
 const colors = ["#00C4B8", "#ccfbf1", "#334155"];
 
@@ -13,20 +12,8 @@ export const PersonAvatar: React.FC<PersonAvatarProps> = ({ personId }) => {
 
 interface ProfileAvatar {
   userId: string;
-  imageUrl?: string | null;
 }
 
-export const ProfileAvatar: React.FC<ProfileAvatar> = ({ userId, imageUrl }) => {
-  if (imageUrl) {
-    return (
-      <Image
-        src={imageUrl}
-        width="40"
-        height="40"
-        className="h-10 w-10 rounded-full object-cover"
-        alt="Avatar placeholder"
-      />
-    );
-  }
+export const ProfileAvatar: React.FC<ProfileAvatar> = ({ userId }) => {
   return <Avatar size={40} name={userId} variant="bauhaus" colors={colors} />;
 };

apps/web/modules/ui/components/conditions-editor/index.test.tsx

@@ -233,31 +233,12 @@ describe("ConditionsEditor", () => {
     expect(mockCallbacks.onDuplicateCondition).toHaveBeenCalledWith("cond1");
   });
 
-  test("calls onCreateGroup from the dropdown menu when enabled", async () => {
+  test("calls onCreateGroup from the dropdown menu", async () => {
     const user = userEvent.setup();
-    render(
-      <ConditionsEditor conditions={multipleConditions} config={mockConfig} callbacks={mockCallbacks} />
-    );
-    const createGroupButtons = screen.getAllByText("environments.surveys.edit.create_group");
-    await user.click(createGroupButtons[0]); // Click the first one
-    expect(mockCallbacks.onCreateGroup).toHaveBeenCalledWith("cond1");
-  });
-
-  test("disables the 'Create Group' button when there's only one condition", () => {
     render(<ConditionsEditor conditions={singleCondition} config={mockConfig} callbacks={mockCallbacks} />);
     const createGroupButton = screen.getByText("environments.surveys.edit.create_group");
-    expect(createGroupButton).toBeDisabled();
-  });
-
-  test("enables the 'Create Group' button when there are multiple conditions", () => {
-    render(
-      <ConditionsEditor conditions={multipleConditions} config={mockConfig} callbacks={mockCallbacks} />
-    );
-    const createGroupButtons = screen.getAllByText("environments.surveys.edit.create_group");
-    // Both buttons should be enabled since the main group has multiple conditions
-    createGroupButtons.forEach((button) => {
-      expect(button).not.toBeDisabled();
-    });
+    await user.click(createGroupButton);
+    expect(mockCallbacks.onCreateGroup).toHaveBeenCalledWith("cond1");
   });
 
   test("calls onToggleGroupConnector when the connector is changed", async () => {

apps/web/modules/ui/components/conditions-editor/index.tsx

@@ -233,8 +233,7 @@ export function ConditionsEditor({ conditions, config, callbacks, depth = 0 }: C
             </DropdownMenuItem>
             <DropdownMenuItem
               onClick={() => callbacks.onCreateGroup(condition.id)}
-              icon={<WorkflowIcon className="h-4 w-4" />}
-              disabled={conditions.conditions.length <= 1}>
+              icon={<WorkflowIcon className="h-4 w-4" />}>
               {t("environments.surveys.edit.create_group")}
             </DropdownMenuItem>
           </DropdownMenuContent>

apps/web/modules/ui/components/tooltip/stories.tsx

@@ -0,0 +1,217 @@
+import { Meta, StoryObj } from "@storybook/react-vite";
+import { Button } from "../button";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "./index";
+
+interface StoryOptions {
+  side: "top" | "right" | "bottom" | "left";
+  delayDuration: number;
+  sideOffset: number;
+  buttonText: string;
+  tooltipText: string;
+  className?: string;
+}
+
+type TooltipStoryProps = StoryOptions;
+
+const meta: Meta<TooltipStoryProps> = {
+  title: "UI/Tooltip",
+  tags: ["autodocs"],
+  parameters: {
+    layout: "centered",
+    controls: { sort: "alpha", exclude: [] },
+    docs: {
+      description: {
+        component:
+          "The **Tooltip** component provides contextual information in a compact overlay. Use tooltips to explain buttons, provide additional context, or show helpful hints without cluttering the interface.",
+      },
+    },
+  },
+  argTypes: {
+    tooltipText: {
+      control: "text",
+      description: "The text content to display in the tooltip",
+      table: {
+        category: "Content",
+        type: { summary: "string" },
+      },
+      order: 1,
+    },
+    buttonText: {
+      control: "text",
+      description: "The text to display on the button trigger",
+      table: {
+        category: "Content",
+        type: { summary: "string" },
+      },
+      order: 2,
+    },
+    side: {
+      control: "select",
+      options: ["top", "right", "bottom", "left"],
+      description: "Side where the tooltip appears relative to the trigger",
+      table: {
+        category: "Behavior",
+        type: { summary: "string" },
+        defaultValue: { summary: "top" },
+      },
+      order: 3,
+    },
+    delayDuration: {
+      control: { type: "number", min: 0, max: 1000, step: 100 },
+      description: "Delay in milliseconds before tooltip appears",
+      table: {
+        category: "Behavior",
+        type: { summary: "number" },
+        defaultValue: { summary: "700" },
+      },
+      order: 4,
+    },
+    sideOffset: {
+      control: { type: "number", min: 0, max: 20, step: 1 },
+      description: "Distance in pixels from the trigger",
+      table: {
+        category: "Appearance",
+        type: { summary: "number" },
+        defaultValue: { summary: "4" },
+      },
+      order: 5,
+    },
+    className: {
+      control: "text",
+      description: "Additional CSS classes for the tooltip content",
+      table: {
+        category: "Appearance",
+        type: { summary: "string" },
+      },
+      order: 6,
+    },
+  },
+};
+
+export default meta;
+type Story = StoryObj<TooltipStoryProps>;
+
+const renderTooltip = (args: TooltipStoryProps) => {
+  const { side, delayDuration, sideOffset, buttonText, tooltipText, className } = args;
+
+  return (
+    <TooltipProvider delayDuration={delayDuration}>
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <Button variant="outline">{buttonText}</Button>
+        </TooltipTrigger>
+        <TooltipContent side={side} sideOffset={sideOffset} className={className}>
+          {tooltipText}
+        </TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+};
+
+export const Default: Story = {
+  render: renderTooltip,
+  args: {
+    tooltipText: "This is a helpful tooltip",
+    buttonText: "Hover me",
+    side: "top",
+    delayDuration: 0,
+    sideOffset: 4,
+    className: "",
+  },
+};
+
+export const WithButton: Story = {
+  render: renderTooltip,
+  args: {
+    tooltipText: "Create a new survey to collect responses",
+    buttonText: "Create Survey",
+    side: "top",
+    delayDuration: 700,
+    sideOffset: 4,
+    className: "",
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use tooltips with buttons to provide additional context about the action.",
+      },
+    },
+  },
+};
+
+export const BottomPosition: Story = {
+  render: renderTooltip,
+  args: {
+    tooltipText: "This tooltip appears below the button",
+    buttonText: "Bottom tooltip",
+    side: "bottom",
+    delayDuration: 700,
+    sideOffset: 8,
+    className: "",
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Position tooltips on different sides of the trigger element.",
+      },
+    },
+  },
+};
+
+export const NoDelay: Story = {
+  render: renderTooltip,
+  args: {
+    tooltipText: "This tooltip shows immediately",
+    buttonText: "Instant tooltip",
+    side: "top",
+    delayDuration: 0,
+    sideOffset: 4,
+    className: "",
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Remove delay for immediate tooltip display.",
+      },
+    },
+  },
+};
+
+export const LongContent: Story = {
+  render: renderTooltip,
+  args: {
+    tooltipText:
+      "This is a very long tooltip content that demonstrates how tooltips handle extended text. It provides comprehensive information that might be needed by users to understand the feature better.",
+    buttonText: "Long tooltip",
+    side: "top",
+    delayDuration: 700,
+    sideOffset: 4,
+    className: "",
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Tooltips automatically handle longer content and wrap text appropriately.",
+      },
+    },
+  },
+};
+
+export const CustomStyling: StoryObj = {
+  render: renderTooltip,
+  args: {
+    tooltipText: "This tooltip has custom styling",
+    buttonText: "Custom styling",
+    side: "top",
+    delayDuration: 700,
+    sideOffset: 4,
+    className: "bg-blue-900 text-blue-50 border-blue-700",
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Customize the appearance of tooltips with custom CSS classes.",
+      },
+    },
+  },
+};

apps/web/package.json

@@ -52,7 +52,7 @@
     "@opentelemetry/sdk-logs": "0.200.0",
     "@opentelemetry/sdk-metrics": "2.0.0",
     "@paralleldrive/cuid2": "2.2.2",
-    "@prisma/client": "6.7.0",
+    "@prisma/client": "6.13.0",
     "@radix-ui/react-accordion": "1.2.10",
     "@radix-ui/react-checkbox": "1.3.1",
     "@radix-ui/react-collapsible": "1.1.10",
@@ -82,7 +82,7 @@
     "@vercel/functions": "2.2.8",
     "@vercel/og": "0.8.5",
     "bcryptjs": "3.0.2",
-    "boring-avatars": "1.11.2",
+    "boring-avatars": "2.0.1",
     "cache-manager": "6.4.3",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",

docker/formbricks.sh

@@ -256,7 +256,7 @@ EOT
   fi
 
   echo "📥 Downloading docker-compose.yml from Formbricks GitHub repository..."
-  curl -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/docker-compose.yml
+  curl -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/main/docker/docker-compose.yml
 
   echo "🚙 Updating docker-compose.yml with your custom inputs..."
   sed -i "/WEBAPP_URL:/s|WEBAPP_URL:.*|WEBAPP_URL: \"https://$domain_name\"|" docker-compose.yml