adds back the named uploads volume

.cursor/rules/review-and-refine.mdc

@@ -1,179 +0,0 @@
----
-description: Apply these quality standards before finalizing code changes to ensure DRY principles, React best practices, TypeScript conventions, and maintainable code.
-globs:
-alwaysApply: false
----
-
-# Review & Refine
-
-Before finalizing any code changes, review your implementation against these quality standards:
-
-## Core Principles
-
-### DRY (Don't Repeat Yourself)
-
-- Extract duplicated logic into reusable functions or hooks
-- If the same code appears in multiple places, consolidate it
-- Create helper functions at appropriate scope (component-level, module-level, or utility files)
-- Avoid copy-pasting code blocks
-
-### Code Reduction
-
-- Remove unnecessary code, comments, and abstractions
-- Prefer built-in solutions over custom implementations
-- Consolidate similar logic
-- Remove dead code and unused imports
-- Question if every line of code is truly needed
-
-## React Best Practices
-
-### Component Design
-
-- Keep components focused on a single responsibility
-- Extract complex logic into custom hooks
-- Prefer composition over prop drilling
-- Use children props and render props when appropriate
-- Keep component files under 300 lines when possible
-
-### Hooks Usage
-
-- Follow Rules of Hooks (only call at top level, only in React functions)
-- Extract complex `useEffect` logic into custom hooks
-- Use `useMemo` and `useCallback` only when you have a measured performance issue
-- Declare dependencies arrays correctly - don't ignore exhaustive-deps warnings
-- Keep `useEffect` focused on a single concern
-
-### State Management
-
-- Colocate state as close as possible to where it's used
-- Lift state only when necessary
-- Use `useReducer` for complex state logic with multiple sub-values
-- Avoid derived state - compute values during render instead
-- Don't store values in state that can be computed from props
-
-### Event Handlers
-
-- Name event handlers with `handle` prefix (e.g., `handleClick`, `handleSubmit`)
-- Extract complex event handler logic into separate functions
-- Avoid inline arrow functions in JSX when they contain complex logic
-
-## TypeScript Best Practices
-
-### Type Safety
-
-- Prefer type inference over explicit types when possible
-- Use `const` assertions for literal types
-- Avoid `any` - use `unknown` if type is truly unknown
-- Use discriminated unions for complex conditional logic
-- Leverage type guards and narrowing
-
-### Interface & Type Usage
-
-- Use existing types from `@formbricks/types` - don't recreate them
-- Prefer `interface` for object shapes that might be extended
-- Prefer `type` for unions, intersections, and mapped types
-- Define types close to where they're used unless they're shared
-- Export types from index files for shared types
-
-### Type Assertions
-
-- Avoid type assertions (`as`) when possible
-- Use type guards instead of assertions
-- Only assert when you have more information than TypeScript
-
-## Code Organization
-
-### Separation of Concerns
-
-- Separate business logic from UI rendering
-- Extract API calls into separate functions or modules
-- Keep data transformation separate from component logic
-- Use custom hooks for stateful logic that doesn't render UI
-
-### Function Clarity
-
-- Functions should do one thing well
-- Name functions clearly and descriptively
-- Keep functions small (aim for under 20 lines)
-- Extract complex conditionals into named boolean variables or functions
-- Avoid deep nesting (max 3 levels)
-
-### File Structure
-
-- Group related functions together
-- Order declarations logically (types → hooks → helpers → component)
-- Keep imports organized (external → internal → relative)
-- Consider splitting large files by concern
-
-## Additional Quality Checks
-
-### Performance
-
-- Don't optimize prematurely - measure first
-- Avoid creating new objects/arrays/functions in render unnecessarily
-- Use keys properly in lists (stable, unique identifiers)
-- Lazy load heavy components when appropriate
-
-### Accessibility
-
-- Use semantic HTML elements
-- Include ARIA labels where needed
-- Ensure keyboard navigation works
-- Check color contrast and focus states
-
-### Error Handling
-
-- Handle error states in components
-- Provide user feedback for failed operations
-- Use error boundaries for component errors
-- Log errors appropriately (avoid swallowing errors silently)
-
-### Naming Conventions
-
-- Use descriptive names (avoid abbreviations unless very common)
-- Boolean variables/props should sound like yes/no questions (`isLoading`, `hasError`, `canEdit`)
-- Arrays should be plural (`users`, `choices`, `items`)
-- Event handlers: `handleX` in components, `onX` for props
-- Constants in UPPER_SNAKE_CASE only for true constants
-
-### Code Readability
-
-- Prefer early returns to reduce nesting
-- Use destructuring to make code clearer
-- Break complex expressions into named variables
-- Add comments only when code can't be made self-explanatory
-- Use whitespace to group related code
-
-### Testing Considerations
-
-- Write code that's easy to test (pure functions, clear inputs/outputs)
-- Avoid hard-to-mock dependencies when possible
-- Keep side effects at the edges of your code
-
-## Review Checklist
-
-Before submitting your changes, ask yourself:
-
-1. **DRY**: Is there any duplicated logic I can extract?
-2. **Clarity**: Would another developer understand this code easily?
-3. **Simplicity**: Is this the simplest solution that works?
-4. **Types**: Am I using TypeScript effectively?
-5. **React**: Am I following React idioms and best practices?
-6. **Performance**: Are there obvious performance issues?
-7. **Separation**: Are concerns properly separated?
-8. **Testing**: Is this code testable?
-9. **Maintenance**: Will this be easy to change in 6 months?
-10. **Deletion**: Can I remove any code and still accomplish the goal?
-
-## When to Apply This Rule
-
-Apply this rule:
-
-- After implementing a feature but before marking it complete
-- When you notice your code feels "messy" or complex
-- Before requesting code review
-- When you see yourself copy-pasting code
-- After receiving feedback about code quality
-
-Don't let perfect be the enemy of good, but always strive for:
-**Simple, readable, maintainable code that does one thing well.**

.github/actions/build-and-push-docker/action.yml

@@ -1,319 +0,0 @@
-name: Build and Push Docker Image
-description: |
-  Unified Docker build and push action for both ECR and GHCR registries.
-
-  Supports:
-  - ECR builds for Formbricks Cloud deployment
-  - GHCR builds for community self-hosting
-  - Automatic version resolution and tagging
-  - Conditional signing and deployment tags
-
-inputs:
-  registry_type:
-    description: "Registry type: 'ecr' or 'ghcr'"
-    required: true
-
-  # Version input
-  version:
-    description: "Explicit version (SemVer only, e.g., 1.2.3). If provided, this version is used directly. If empty, version is auto-generated from branch name."
-    required: false
-  experimental_mode:
-    description: "Enable experimental timestamped versions"
-    required: false
-    default: "false"
-
-  # ECR specific inputs
-  ecr_registry:
-    description: "ECR registry URL (required for ECR builds)"
-    required: false
-  ecr_repository:
-    description: "ECR repository name (required for ECR builds)"
-    required: false
-  ecr_region:
-    description: "ECR AWS region (required for ECR builds)"
-    required: false
-  aws_role_arn:
-    description: "AWS role ARN for ECR authentication (required for ECR builds)"
-    required: false
-
-  # GHCR specific inputs
-  ghcr_image_name:
-    description: "GHCR image name (required for GHCR builds)"
-    required: false
-
-  # Deployment options
-  deploy_production:
-    description: "Tag image for production deployment"
-    required: false
-    default: "false"
-  deploy_staging:
-    description: "Tag image for staging deployment"
-    required: false
-    default: "false"
-  is_prerelease:
-    description: "Whether this is a prerelease (auto-tags for staging/production)"
-    required: false
-    default: "false"
-  make_latest:
-    description: "Whether to tag as latest/production (from GitHub release 'Set as the latest release' option)"
-    required: false
-    default: "false"
-
-  # Build options
-  dockerfile:
-    description: "Path to Dockerfile"
-    required: false
-    default: "apps/web/Dockerfile"
-  context:
-    description: "Build context"
-    required: false
-    default: "."
-
-outputs:
-  image_tag:
-    description: "Resolved image tag used for the build"
-    value: ${{ steps.version.outputs.version }}
-  registry_tags:
-    description: "Complete registry tags that were pushed"
-    value: ${{ steps.build.outputs.tags }}
-  image_digest:
-    description: "Image digest from the build"
-    value: ${{ steps.build.outputs.digest }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Validate inputs
-      shell: bash
-      env:
-        REGISTRY_TYPE: ${{ inputs.registry_type }}
-        ECR_REGISTRY: ${{ inputs.ecr_registry }}
-        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
-        ECR_REGION: ${{ inputs.ecr_region }}
-        AWS_ROLE_ARN: ${{ inputs.aws_role_arn }}
-        GHCR_IMAGE_NAME: ${{ inputs.ghcr_image_name }}
-      run: |
-        set -euo pipefail
-
-        if [[ "$REGISTRY_TYPE" != "ecr" && "$REGISTRY_TYPE" != "ghcr" ]]; then
-          echo "ERROR: registry_type must be 'ecr' or 'ghcr', got: $REGISTRY_TYPE"
-          exit 1
-        fi
-
-        if [[ "$REGISTRY_TYPE" == "ecr" ]]; then
-          if [[ -z "$ECR_REGISTRY" || -z "$ECR_REPOSITORY" || -z "$ECR_REGION" || -z "$AWS_ROLE_ARN" ]]; then
-            echo "ERROR: ECR builds require ecr_registry, ecr_repository, ecr_region, and aws_role_arn"
-            exit 1
-          fi
-        fi
-
-        if [[ "$REGISTRY_TYPE" == "ghcr" ]]; then
-          if [[ -z "$GHCR_IMAGE_NAME" ]]; then
-            echo "ERROR: GHCR builds require ghcr_image_name"
-            exit 1
-          fi
-        fi
-
-        echo "SUCCESS: Input validation passed for $REGISTRY_TYPE build"
-
-    - name: Resolve Docker version
-      id: version
-      uses: ./.github/actions/resolve-docker-version
-      with:
-        version: ${{ inputs.version }}
-        current_branch: ${{ github.ref_name }}
-        experimental_mode: ${{ inputs.experimental_mode }}
-
-    - name: Update package.json version
-      uses: ./.github/actions/update-package-version
-      with:
-        version: ${{ steps.version.outputs.version }}
-
-    - name: Configure AWS credentials (ECR only)
-      if: ${{ inputs.registry_type == 'ecr' }}
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.2.0
-      with:
-        role-to-assume: ${{ inputs.aws_role_arn }}
-        aws-region: ${{ inputs.ecr_region }}
-
-    - name: Log in to Amazon ECR (ECR only)
-      if: ${{ inputs.registry_type == 'ecr' }}
-      uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
-
-    - name: Set up Docker build tools
-      uses: ./.github/actions/docker-build-setup
-      with:
-        registry: ${{ inputs.registry_type == 'ghcr' && 'ghcr.io' || '' }}
-        setup_cosign: ${{ inputs.registry_type == 'ghcr' && 'true' || 'false' }}
-        skip_login_on_pr: ${{ inputs.registry_type == 'ghcr' && 'true' || 'false' }}
-
-    - name: Build ECR tag list
-      if: ${{ inputs.registry_type == 'ecr' }}
-      id: ecr-tags
-      shell: bash
-      env:
-        IMAGE_TAG: ${{ steps.version.outputs.version }}
-        ECR_REGISTRY: ${{ inputs.ecr_registry }}
-        ECR_REPOSITORY: ${{ inputs.ecr_repository }}
-        DEPLOY_PRODUCTION: ${{ inputs.deploy_production }}
-        DEPLOY_STAGING: ${{ inputs.deploy_staging }}
-        IS_PRERELEASE: ${{ inputs.is_prerelease }}
-        MAKE_LATEST: ${{ inputs.make_latest }}
-      run: |
-        set -euo pipefail
-
-        # Start with the base image tag
-        TAGS="${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
-
-        # Handle automatic tagging based on release type
-        if [[ "${IS_PRERELEASE}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:staging"
-          echo "Adding staging tag for prerelease"
-        elif [[ "${IS_PRERELEASE}" == "false" && "${MAKE_LATEST}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:production"
-          echo "Adding production tag for stable release marked as latest"
-        fi
-
-        # Handle manual deployment overrides
-        if [[ "${DEPLOY_PRODUCTION}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:production"
-          echo "Adding production tag (manual override)"
-        fi
-        if [[ "${DEPLOY_STAGING}" == "true" ]]; then
-          TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:staging"
-          echo "Adding staging tag (manual override)"
-        fi
-
-        echo "ECR tags generated:"
-        echo -e "${TAGS}"
-
-        {
-          echo "tags<<EOF"
-          echo -e "${TAGS}"
-          echo "EOF"
-        } >> "${GITHUB_OUTPUT}"
-
-    - name: Generate additional GHCR tags for releases
-      if: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'false' && (github.event_name == 'workflow_call' || github.event_name == 'release' || github.event_name == 'workflow_dispatch') }}
-      id: ghcr-extra-tags
-      shell: bash
-      env:
-        VERSION: ${{ steps.version.outputs.version }}
-        IMAGE_NAME: ${{ inputs.ghcr_image_name }}
-        IS_PRERELEASE: ${{ inputs.is_prerelease }}
-        MAKE_LATEST: ${{ inputs.make_latest }}
-      run: |
-        set -euo pipefail
-
-        # Start with base version tag
-        TAGS="ghcr.io/${IMAGE_NAME}:${VERSION}"
-
-        # For proper SemVer releases, add major.minor and major tags
-        if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          # Extract major and minor versions
-          MAJOR=$(echo "${VERSION}" | cut -d. -f1)
-          MINOR=$(echo "${VERSION}" | cut -d. -f2)
-          
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:${MAJOR}.${MINOR}"
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:${MAJOR}"
-          
-          echo "Added SemVer tags: ${MAJOR}.${MINOR}, ${MAJOR}"
-        fi
-
-        # Add latest tag for stable releases marked as latest
-        if [[ "${IS_PRERELEASE}" == "false" && "${MAKE_LATEST}" == "true" ]]; then
-          TAGS="${TAGS}\nghcr.io/${IMAGE_NAME}:latest"
-          echo "Added latest tag for stable release marked as latest"
-        fi
-
-        echo "Generated GHCR tags:"
-        echo -e "${TAGS}"
-
-        # Debug: Show what will be passed to Docker build
-        echo "DEBUG: Tags for Docker build step:"
-        echo -e "${TAGS}"
-
-        {
-          echo "tags<<EOF"
-          echo -e "${TAGS}"
-          echo "EOF"
-        } >> "${GITHUB_OUTPUT}"
-
-    - name: Build GHCR metadata (experimental)
-      if: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' }}
-      id: ghcr-meta-experimental
-      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
-      with:
-        images: ghcr.io/${{ inputs.ghcr_image_name }}
-        tags: |
-          type=ref,event=branch
-          type=raw,value=${{ steps.version.outputs.version }}
-
-    - name: Debug Docker build tags
-      shell: bash
-      run: |
-        echo "=== DEBUG: Docker Build Configuration ==="
-        echo "Registry Type: ${{ inputs.registry_type }}"
-        echo "Experimental Mode: ${{ inputs.experimental_mode }}"
-        echo "Event Name: ${{ github.event_name }}"
-        echo "Is Prerelease: ${{ inputs.is_prerelease }}"
-        echo "Make Latest: ${{ inputs.make_latest }}"
-        echo "Version: ${{ steps.version.outputs.version }}"
-
-        if [[ "${{ inputs.registry_type }}" == "ecr" ]]; then
-          echo "ECR Tags: ${{ steps.ecr-tags.outputs.tags }}"
-        elif [[ "${{ inputs.experimental_mode }}" == "true" ]]; then
-          echo "GHCR Experimental Tags: ${{ steps.ghcr-meta-experimental.outputs.tags }}"
-        else
-          echo "GHCR Extra Tags: ${{ steps.ghcr-extra-tags.outputs.tags }}"
-        fi
-
-    - name: Build and push Docker image
-      id: build
-      uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
-      with:
-        project: tw0fqmsx3c
-        token: ${{ env.DEPOT_PROJECT_TOKEN }}
-        context: ${{ inputs.context }}
-        file: ${{ inputs.dockerfile }}
-        platforms: linux/amd64,linux/arm64
-        push: ${{ github.event_name != 'pull_request' }}
-        tags: ${{ inputs.registry_type == 'ecr' && steps.ecr-tags.outputs.tags || (inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.tags) || (inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'false' && steps.ghcr-extra-tags.outputs.tags) || (inputs.registry_type == 'ghcr' && format('ghcr.io/{0}:{1}', inputs.ghcr_image_name, steps.version.outputs.version)) || (inputs.registry_type == 'ecr' && format('{0}/{1}:{2}', inputs.ecr_registry, inputs.ecr_repository, steps.version.outputs.version)) }}
-        labels: ${{ inputs.registry_type == 'ghcr' && inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.labels || '' }}
-        secrets: |
-          database_url=${{ env.DUMMY_DATABASE_URL }}
-          encryption_key=${{ env.DUMMY_ENCRYPTION_KEY }}
-          redis_url=${{ env.DUMMY_REDIS_URL }}
-          sentry_auth_token=${{ env.SENTRY_AUTH_TOKEN }}
-      env:
-        DEPOT_PROJECT_TOKEN: ${{ env.DEPOT_PROJECT_TOKEN }}
-        DUMMY_DATABASE_URL: ${{ env.DUMMY_DATABASE_URL }}
-        DUMMY_ENCRYPTION_KEY: ${{ env.DUMMY_ENCRYPTION_KEY }}
-        DUMMY_REDIS_URL: ${{ env.DUMMY_REDIS_URL }}
-        SENTRY_AUTH_TOKEN: ${{ env.SENTRY_AUTH_TOKEN }}
-
-    - name: Sign GHCR image (GHCR only)
-      if: ${{ inputs.registry_type == 'ghcr' && (github.event_name == 'workflow_call' || github.event_name == 'release' || github.event_name == 'workflow_dispatch') }}
-      shell: bash
-      env:
-        TAGS: ${{ inputs.experimental_mode == 'true' && steps.ghcr-meta-experimental.outputs.tags || steps.ghcr-extra-tags.outputs.tags }}
-        DIGEST: ${{ steps.build.outputs.digest }}
-      run: |
-        set -euo pipefail
-        echo "${TAGS}" | xargs -I {} cosign sign --yes "{}@${DIGEST}"
-
-    - name: Output build summary
-      shell: bash
-      env:
-        REGISTRY_TYPE: ${{ inputs.registry_type }}
-        IMAGE_TAG: ${{ steps.version.outputs.version }}
-        VERSION_SOURCE: ${{ steps.version.outputs.source }}
-      run: |
-        echo "SUCCESS: Built and pushed Docker image to $REGISTRY_TYPE"
-        echo "Image Tag: $IMAGE_TAG (source: $VERSION_SOURCE)"
-        if [[ "$REGISTRY_TYPE" == "ecr" ]]; then
-          echo "ECR Registry: ${{ inputs.ecr_registry }}"
-          echo "ECR Repository: ${{ inputs.ecr_repository }}"
-        else
-          echo "GHCR Image: ghcr.io/${{ inputs.ghcr_image_name }}"
-        fi

.github/actions/docker-build-setup/action.yml

@@ -1,106 +0,0 @@
-name: Docker Build Setup
-description: |
-  Sets up common Docker build tools and authentication with security validation.
-
-  Security Features:
-  - Registry URL validation
-  - Input sanitization
-  - Conditional setup based on event type
-  - Post-setup verification
-
-  Supports Depot CLI, Cosign signing, and Docker registry authentication.
-
-inputs:
-  registry:
-    description: "Docker registry hostname to login to (e.g., ghcr.io, registry.example.com:5000). No paths allowed."
-    required: false
-    default: "ghcr.io"
-  setup_cosign:
-    description: "Whether to install cosign for image signing"
-    required: false
-    default: "true"
-  skip_login_on_pr:
-    description: "Whether to skip registry login on pull requests"
-    required: false
-    default: "true"
-
-runs:
-  using: "composite"
-  steps:
-    - name: Validate inputs
-      shell: bash
-      env:
-        REGISTRY: ${{ inputs.registry }}
-        SETUP_COSIGN: ${{ inputs.setup_cosign }}
-        SKIP_LOGIN_ON_PR: ${{ inputs.skip_login_on_pr }}
-      run: |
-        set -euo pipefail
-
-        # Security: Validate registry input - must be hostname[:port] only, no paths
-        # Allow empty registry for cases where login is handled externally (e.g., ECR)
-        if [[ -n "$REGISTRY" ]]; then
-          if [[ "$REGISTRY" =~ / ]]; then
-            echo "ERROR: Invalid registry format: $REGISTRY"
-            echo "Registry must be host[:port] with no path (e.g., 'ghcr.io' or 'registry.example.com:5000')"
-            echo "Path components like 'ghcr.io/org' are not allowed as they break docker login"
-            exit 1
-          fi
-
-          # Validate hostname with optional port format
-          if [[ ! "$REGISTRY" =~ ^[a-zA-Z0-9.-]+(\:[0-9]+)?$ ]]; then
-            echo "ERROR: Invalid registry hostname format: $REGISTRY"
-            echo "Registry must be a valid hostname optionally with port (e.g., 'ghcr.io' or 'registry.example.com:5000')"
-            exit 1
-          fi
-        fi
-
-        # Validate boolean inputs
-        if [[ "$SETUP_COSIGN" != "true" && "$SETUP_COSIGN" != "false" ]]; then
-          echo "ERROR: setup_cosign must be 'true' or 'false', got: $SETUP_COSIGN"
-          exit 1
-        fi
-
-        if [[ "$SKIP_LOGIN_ON_PR" != "true" && "$SKIP_LOGIN_ON_PR" != "false" ]]; then
-          echo "ERROR: skip_login_on_pr must be 'true' or 'false', got: $SKIP_LOGIN_ON_PR"
-          exit 1
-        fi
-
-        echo "SUCCESS: Input validation passed"
-
-    - name: Set up Depot CLI
-      uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
-
-    - name: Install cosign
-      # Install cosign when requested AND when we might actually sign images
-      # (i.e., non-PR contexts or when we login on PRs)
-      if: ${{ inputs.setup_cosign == 'true' && (inputs.skip_login_on_pr == 'false' || github.event_name != 'pull_request') }}
-      uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
-
-    - name: Log into registry
-      if: ${{ inputs.registry != '' && (inputs.skip_login_on_pr == 'false' || github.event_name != 'pull_request') }}
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-      with:
-        registry: ${{ inputs.registry }}
-        username: ${{ github.actor }}
-        password: ${{ github.token }}
-
-    - name: Verify setup completion
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        # Verify Depot CLI is available
-        if ! command -v depot >/dev/null 2>&1; then
-          echo "ERROR: Depot CLI not found in PATH"
-          exit 1
-        fi
-
-        # Verify cosign if it should be installed (same conditions as install step)
-        if [[ "${{ inputs.setup_cosign }}" == "true" ]] && [[ "${{ inputs.skip_login_on_pr }}" == "false" || "${{ github.event_name }}" != "pull_request" ]]; then
-          if ! command -v cosign >/dev/null 2>&1; then
-            echo "ERROR: Cosign not found in PATH despite being requested"
-            exit 1
-          fi
-        fi
-
-        echo "SUCCESS: Docker build setup completed successfully"

.github/actions/resolve-docker-version/action.yml

@@ -1,192 +0,0 @@
-name: Resolve Docker Version
-description: |
-  Resolves and validates Docker-compatible SemVer versions for container builds with comprehensive security.
-
-  Security Features:
-  - Command injection protection
-  - Input sanitization and validation
-  - Docker tag character restrictions
-  - Length limits and boundary checks
-  - Safe branch name handling
-
-  Supports multiple modes: release, manual override, branch auto-detection, and experimental timestamped versions.
-
-inputs:
-  version:
-    description: "Explicit version (SemVer only, e.g., 1.2.3-beta). If provided, this version is used directly. If empty, version is auto-generated from branch name."
-    required: false
-  current_branch:
-    description: "Current branch name for auto-detection"
-    required: true
-  experimental_mode:
-    description: "Enable experimental mode with timestamp-based versions"
-    required: false
-    default: "false"
-
-outputs:
-  version:
-    description: "Resolved Docker-compatible SemVer version"
-    value: ${{ steps.resolve.outputs.version }}
-  source:
-    description: "Source of version (release|override|branch)"
-    value: ${{ steps.resolve.outputs.source }}
-  normalized:
-    description: "Whether the version was normalized (true/false)"
-    value: ${{ steps.resolve.outputs.normalized }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Resolve and validate Docker version
-      id: resolve
-      shell: bash
-      env:
-        EXPLICIT_VERSION: ${{ inputs.version }}
-        CURRENT_BRANCH: ${{ inputs.current_branch }}
-        EXPERIMENTAL_MODE: ${{ inputs.experimental_mode }}
-      run: |
-        set -euo pipefail
-
-        # Function to validate SemVer format (Docker-compatible, no '+' build metadata)
-        validate_semver() {
-          local version="$1"
-          local context="$2"
-          
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "ERROR: Invalid $context format. Must be semver without build metadata (e.g., 1.2.3, 1.2.3-alpha)"
-            echo "Provided: $version"
-            echo "Note: Docker tags cannot contain '+' characters. Use prerelease identifiers instead."
-            exit 1
-          fi
-        }
-
-        # Function to generate branch-based version
-        generate_branch_version() {
-          local branch="$1"
-          local use_timestamp="${2:-true}"
-          local timestamp
-          
-          if [[ "$use_timestamp" == "true" ]]; then
-            timestamp=$(date +%s)
-          else
-            timestamp=""
-          fi
-          
-          # Sanitize branch name for Docker compatibility
-          local sanitized_branch=$(echo "$branch" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
-          
-          # Additional safety: truncate if too long (reserve space for prefix and timestamp)
-          if (( ${#sanitized_branch} > 80 )); then
-            sanitized_branch="${sanitized_branch:0:80}"
-            echo "INFO: Branch name truncated for Docker compatibility" >&2
-          fi
-          local version
-          
-          # Generate version based on branch name (unified approach)
-          # All branches get alpha versions with sanitized branch name
-          if [[ -n "$timestamp" ]]; then
-            version="0.0.0-alpha-$sanitized_branch-$timestamp"
-            echo "INFO: Branch '$branch' detected - alpha version: $version" >&2
-          else
-            version="0.0.0-alpha-$sanitized_branch"
-            echo "INFO: Branch '$branch' detected - alpha version: $version" >&2
-          fi
-          
-          echo "$version"
-        }
-
-
-        # Input validation and sanitization
-        if [[ -z "$CURRENT_BRANCH" ]]; then
-          echo "ERROR: current_branch input is required"
-          exit 1
-        fi
-
-        # Security: Validate inputs to prevent command injection
-        # Use grep to check for dangerous characters (more reliable than bash regex)
-        validate_input() {
-          local input="$1"
-          local name="$2"
-          
-          # Check for dangerous characters using grep
-          if echo "$input" | grep -q '[;|&`$(){}\\[:space:]]'; then
-            echo "ERROR: $name contains potentially dangerous characters: $input"
-            echo "Input should only contain letters, numbers, hyphens, underscores, dots, and forward slashes"
-            return 1
-          fi
-          
-          return 0
-        }
-
-        # Validate current branch
-        if ! validate_input "$CURRENT_BRANCH" "Branch name"; then
-          exit 1
-        fi
-
-        # Validate explicit version if provided
-        if [[ -n "$EXPLICIT_VERSION" ]] && ! validate_input "$EXPLICIT_VERSION" "Explicit version"; then
-          exit 1
-        fi
-
-        # Main resolution logic (ultra-simplified)
-        NORMALIZED="false"
-
-        if [[ -n "$EXPLICIT_VERSION" ]]; then
-          # Use provided explicit version (from either workflow_call or manual input)
-          validate_semver "$EXPLICIT_VERSION" "explicit version"
-          
-          # Normalize to lowercase for Docker/ECR compatibility
-          RESOLVED_VERSION="${EXPLICIT_VERSION,,}"
-          if [[ "$EXPLICIT_VERSION" != "$RESOLVED_VERSION" ]]; then
-            NORMALIZED="true"
-            echo "INFO: Original version contained uppercase characters, normalized: $EXPLICIT_VERSION -> $RESOLVED_VERSION"
-          fi
-          
-          SOURCE="explicit"
-          echo "INFO: Using explicit version: $RESOLVED_VERSION"
-          
-        else
-          # Auto-generate version from branch name
-          if [[ "$EXPERIMENTAL_MODE" == "true" ]]; then
-            # Use timestamped version generation
-            echo "INFO: Experimental mode: generating timestamped version from branch: $CURRENT_BRANCH"
-            RESOLVED_VERSION=$(generate_branch_version "$CURRENT_BRANCH" "true")
-            SOURCE="experimental"
-          else
-            # Standard branch version (no timestamp)
-            echo "INFO: Auto-detecting version from branch: $CURRENT_BRANCH"
-            RESOLVED_VERSION=$(generate_branch_version "$CURRENT_BRANCH" "false")
-            SOURCE="branch"
-          fi
-          echo "Generated version: $RESOLVED_VERSION"
-        fi
-
-        # Final validation - ensure result is valid Docker tag
-        if [[ -z "$RESOLVED_VERSION" ]]; then
-          echo "ERROR: Failed to resolve version"
-          exit 1
-        fi
-
-        if (( ${#RESOLVED_VERSION} > 128 )); then
-          echo "ERROR: Version must be at most 128 characters (Docker limitation)"
-          echo "Generated version: $RESOLVED_VERSION (${#RESOLVED_VERSION} chars)"
-          exit 1
-        fi
-
-        if [[ ! "$RESOLVED_VERSION" =~ ^[a-z0-9._-]+$ ]]; then
-          echo "ERROR: Version contains invalid characters for Docker tags"
-          echo "Version: $RESOLVED_VERSION"
-          exit 1
-        fi
-
-        if [[ "$RESOLVED_VERSION" =~ ^[.-] || "$RESOLVED_VERSION" =~ [.-]$ ]]; then
-          echo "ERROR: Version must not start or end with '.' or '-'"
-          echo "Version: $RESOLVED_VERSION"
-          exit 1
-        fi
-
-        # Output results
-        echo "SUCCESS: Resolved Docker version: $RESOLVED_VERSION (source: $SOURCE)"
-        echo "version=$RESOLVED_VERSION" >> $GITHUB_OUTPUT
-        echo "source=$SOURCE" >> $GITHUB_OUTPUT
-        echo "normalized=$NORMALIZED" >> $GITHUB_OUTPUT

.github/actions/update-package-version/action.yml

@@ -1,160 +0,0 @@
-name: Update Package Version
-description: |
-  Safely updates package.json version with comprehensive validation and atomic operations.
-
-  Security Features:
-  - Path traversal protection
-  - SemVer validation with length limits
-  - Atomic file operations with backup/recovery
-  - JSON validation before applying changes
-
-  This action is designed to be secure by default and prevent common attack vectors.
-
-inputs:
-  version:
-    description: "Version to set in package.json (must be valid SemVer)"
-    required: true
-  package_path:
-    description: "Path to package.json file"
-    required: false
-    default: "./apps/web/package.json"
-
-outputs:
-  updated_version:
-    description: "The version that was actually set in package.json"
-    value: ${{ steps.update.outputs.updated_version }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Update and verify package.json version
-      id: update
-      shell: bash
-      env:
-        VERSION: ${{ inputs.version }}
-        PACKAGE_PATH: ${{ inputs.package_path }}
-      run: |
-        set -euo pipefail
-
-        # Validate inputs
-        if [[ -z "$VERSION" ]]; then
-          echo "ERROR: version input is required"
-          exit 1
-        fi
-
-        # Security: Validate package_path to prevent path traversal attacks
-        # Only allow paths within the workspace and must end with package.json
-        if [[ "$PACKAGE_PATH" =~ \.\./|^/|^~ ]]; then
-          echo "ERROR: Invalid package path - path traversal detected: $PACKAGE_PATH"
-          echo "Package path must be relative to workspace root and cannot contain '../', start with '/', or '~'"
-          exit 1
-        fi
-
-        if [[ ! "$PACKAGE_PATH" =~ package\.json$ ]]; then
-          echo "ERROR: Package path must end with 'package.json': $PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Resolve to absolute path within workspace for additional security
-        WORKSPACE_ROOT="${GITHUB_WORKSPACE:-$(pwd)}"
-
-        # Use realpath to resolve both paths and handle symlinks properly
-        WORKSPACE_ROOT=$(realpath "$WORKSPACE_ROOT")
-        RESOLVED_PATH=$(realpath "${WORKSPACE_ROOT}/${PACKAGE_PATH}")
-
-        # Ensure WORKSPACE_ROOT has a trailing slash for proper prefix matching
-        WORKSPACE_ROOT="${WORKSPACE_ROOT}/"
-
-        # Use shell string matching to ensure RESOLVED_PATH is within workspace
-        # This is more secure than regex and handles edge cases properly
-        if [[ "$RESOLVED_PATH" != "$WORKSPACE_ROOT"* ]]; then
-          echo "ERROR: Resolved path is outside workspace: $RESOLVED_PATH"
-          echo "Workspace root: $WORKSPACE_ROOT"
-          exit 1
-        fi
-
-        if [[ ! -f "$RESOLVED_PATH" ]]; then
-          echo "ERROR: package.json not found at: $RESOLVED_PATH"
-          exit 1
-        fi
-
-        # Use resolved path for operations
-        PACKAGE_PATH="$RESOLVED_PATH"
-
-        # Validate SemVer format with additional security checks
-        if [[ ${#VERSION} -gt 128 ]]; then
-          echo "ERROR: Version string too long (${#VERSION} chars, max 128): $VERSION"
-          exit 1
-        fi
-
-        if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-          echo "ERROR: Invalid SemVer format: $VERSION"
-          echo "Expected format: MAJOR.MINOR.PATCH[-PRERELEASE]"
-          echo "Only alphanumeric characters, dots, and hyphens allowed in prerelease"
-          exit 1
-        fi
-
-        # Additional validation: Check for reasonable version component sizes
-        # Extract base version (MAJOR.MINOR.PATCH) without prerelease/build metadata
-        if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+) ]]; then
-          BASE_VERSION="${BASH_REMATCH[1]}"
-        else
-          echo "ERROR: Could not extract base version from: $VERSION"
-          exit 1
-        fi
-
-        # Split version components safely
-        IFS='.' read -ra VERSION_PARTS <<< "$BASE_VERSION"
-
-        # Validate component sizes (should have exactly 3 parts due to regex above)
-        if (( ${VERSION_PARTS[0]} > 999 || ${VERSION_PARTS[1]} > 999 || ${VERSION_PARTS[2]} > 999 )); then
-          echo "ERROR: Version components too large (max 999 each): $VERSION"
-          echo "Components: ${VERSION_PARTS[0]}.${VERSION_PARTS[1]}.${VERSION_PARTS[2]}"
-          exit 1
-        fi
-
-        echo "Updating package.json version to: $VERSION"
-
-        # Create backup for atomic operations
-        BACKUP_PATH="${PACKAGE_PATH}.backup.$$"
-        cp "$PACKAGE_PATH" "$BACKUP_PATH"
-
-        # Use jq to safely update the version field with error handling
-        if ! jq --arg version "$VERSION" '.version = $version' "$PACKAGE_PATH" > "${PACKAGE_PATH}.tmp"; then
-          echo "ERROR: jq failed to process package.json"
-          rm -f "${PACKAGE_PATH}.tmp" "$BACKUP_PATH"
-          exit 1
-        fi
-
-        # Validate the generated JSON before applying changes
-        if ! jq empty "${PACKAGE_PATH}.tmp" 2>/dev/null; then
-          echo "ERROR: Generated invalid JSON"
-          rm -f "${PACKAGE_PATH}.tmp" "$BACKUP_PATH"
-          exit 1
-        fi
-
-        # Atomic move operation
-        if ! mv "${PACKAGE_PATH}.tmp" "$PACKAGE_PATH"; then
-          echo "ERROR: Failed to update package.json"
-          # Restore backup
-          mv "$BACKUP_PATH" "$PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Verify the update was successful
-        UPDATED_VERSION=$(jq -r '.version' "$PACKAGE_PATH" 2>/dev/null)
-
-        if [[ "$UPDATED_VERSION" != "$VERSION" ]]; then
-          echo "ERROR: Version update failed!"
-          echo "Expected: $VERSION"
-          echo "Actual: $UPDATED_VERSION"
-          # Restore backup
-          mv "$BACKUP_PATH" "$PACKAGE_PATH"
-          exit 1
-        fi
-
-        # Clean up backup on success
-        rm -f "$BACKUP_PATH"
-
-        echo "SUCCESS: Updated package.json version to: $UPDATED_VERSION"
-        echo "updated_version=$UPDATED_VERSION" >> $GITHUB_OUTPUT

.github/workflows/build-and-push-ecr.yml

@@ -1,16 +1,12 @@
-name: Build Cloud Deployment Images
-
-# This workflow builds Formbricks Docker images for ECR deployment:
-# - workflow_call: Used by releases with explicit SemVer versions
-# - workflow_dispatch: Auto-detects version from current branch or uses override
+name: Build & Push Docker to ECR
 
 on:
   workflow_dispatch:
     inputs:
-      version_override:
-        description: "Override version (SemVer only, e.g., 1.2.3). Leave empty to auto-detect from branch."
-        required: false
-        type: string
+      image_tag:
+        description: "Image tag to push (e.g., v3.16.1, main)"
+        required: true
+        default: "v3.16.1"
       deploy_production:
         description: "Tag image for production deployment"
         required: false
@@ -21,29 +17,6 @@ on:
         required: false
         default: false
         type: boolean
-  workflow_call:
-    inputs:
-      image_tag:
-        description: "Image tag to push (required for workflow_call)"
-        required: true
-        type: string
-      IS_PRERELEASE:
-        description: "Whether this is a prerelease (auto-tags for staging/production)"
-        required: false
-        type: boolean
-        default: false
-      MAKE_LATEST:
-        description: "Whether to tag for production (from GitHub release 'Set as the latest release' option)"
-        required: false
-        type: boolean
-        default: false
-    outputs:
-      IMAGE_TAG:
-        description: "Normalized image tag used for the build"
-        value: ${{ jobs.build-and-push.outputs.IMAGE_TAG }}
-      TAGS:
-        description: "Newline-separated list of ECR tags pushed"
-        value: ${{ jobs.build-and-push.outputs.TAGS }}
 
 permissions:
   contents: read
@@ -54,15 +27,14 @@ env:
   # ECR settings are sourced from repository/environment variables for portability across envs/forks
   ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
   ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
+  DOCKERFILE: apps/web/Dockerfile
+  CONTEXT: .
 
 jobs:
   build-and-push:
     name: Build and Push
     runs-on: ubuntu-latest
     timeout-minutes: 45
-    outputs:
-      IMAGE_TAG: ${{ steps.build.outputs.image_tag }}
-      TAGS: ${{ steps.build.outputs.registry_tags }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
@@ -72,23 +44,125 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Build and push cloud deployment image
-        id: build
-        uses: ./.github/actions/build-and-push-docker
-        with:
-          registry_type: "ecr"
-          ecr_registry: ${{ env.ECR_REGISTRY }}
-          ecr_repository: ${{ env.ECR_REPOSITORY }}
-          ecr_region: ${{ env.ECR_REGION }}
-          aws_role_arn: ${{ secrets.AWS_ECR_PUSH_ROLE_ARN }}
-          version: ${{ inputs.version_override || inputs.image_tag }}
-          deploy_production: ${{ inputs.deploy_production }}
-          deploy_staging: ${{ inputs.deploy_staging }}
-          is_prerelease: ${{ inputs.IS_PRERELEASE }}
-          make_latest: ${{ inputs.MAKE_LATEST }}
+      - name: Validate image tag input
+        shell: bash
         env:
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${IMAGE_TAG}" ]]; then
+            echo "❌ Image tag is required (non-empty)."
+            exit 1
+          fi
+          if (( ${#IMAGE_TAG} > 128 )); then
+            echo "❌ Image tag must be at most 128 characters."
+            exit 1
+          fi
+          if [[ ! "${IMAGE_TAG}" =~ ^[a-z0-9._-]+$ ]]; then
+            echo "❌ Image tag may only contain lowercase letters, digits, '.', '_' and '-'."
+            exit 1
+          fi
+          if [[ "${IMAGE_TAG}" =~ ^[.-] || "${IMAGE_TAG}" =~ [.-]$ ]]; then
+            echo "❌ Image tag must not start or end with '.' or '-'."
+            exit 1
+          fi
+
+      - name: Validate required variables
+        shell: bash
+        env:
+          ECR_REGISTRY: ${{ env.ECR_REGISTRY }}
+          ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }}
+          ECR_REGION: ${{ env.ECR_REGION }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${ECR_REGISTRY}" || -z "${ECR_REPOSITORY}" || -z "${ECR_REGION}" ]]; then
+            echo "ECR_REGION, ECR_REGISTRY and ECR_REPOSITORY must be set via repository or environment variables (Settings → Variables)."
+            exit 1
+          fi
+
+      - name: Update package.json version
+        shell: bash
+        env:
+          IMAGE_TAG: ${{ inputs.image_tag }}
+        run: |
+          set -euo pipefail
+          
+          # Remove 'v' prefix if present (e.g., v3.16.1 -> 3.16.1)
+          VERSION="${IMAGE_TAG#v}"
+          
+          # Validate SemVer format (major.minor.patch with optional prerelease and build metadata)
+          if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "❌ Error: Invalid version format after extraction. Must be SemVer (e.g., 1.2.3, 1.2.3-alpha, 1.2.3+build.1)"
+            echo "Original input: ${IMAGE_TAG}"
+            echo "Extracted version: ${VERSION}"
+            echo "Expected format: MAJOR.MINOR.PATCH[-PRERELEASE][+BUILDMETADATA]"
+            exit 1
+          fi
+          
+          echo "✅ Valid SemVer format detected: ${VERSION}"
+          echo "Updating package.json version to: ${VERSION}"
+          sed -i "s/\"version\": \"0.0.0\"/\"version\": \"${VERSION}\"/" ./apps/web/package.json
+          cat ./apps/web/package.json | grep version
+
+      - name: Build tag list
+        id: tags
+        shell: bash
+        env:
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          DEPLOY_PRODUCTION: ${{ inputs.deploy_production }}
+          DEPLOY_STAGING: ${{ inputs.deploy_staging }}
+          ECR_REGISTRY: ${{ env.ECR_REGISTRY }}
+          ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }}
+        run: |
+          set -euo pipefail
+
+          # Start with the base image tag
+          TAGS="${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
+
+          # Add production tag if requested
+          if [[ "${DEPLOY_PRODUCTION}" == "true" ]]; then
+            TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:production"
+          fi
+
+          # Add staging tag if requested
+          if [[ "${DEPLOY_STAGING}" == "true" ]]; then
+            TAGS="${TAGS}\n${ECR_REGISTRY}/${ECR_REPOSITORY}:staging"
+          fi
+
+          # Output for debugging
+          echo "Generated tags:"
+          echo -e "${TAGS}"
+
+          # Set output for next step (escape newlines for GitHub Actions)
+          {
+            echo "tags<<EOF"
+            echo -e "${TAGS}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a
+        with:
+          role-to-assume: ${{ secrets.AWS_ECR_PUSH_ROLE_ARN }}
+          aws-region: ${{ env.ECR_REGION }}
+
+      - name: Log in to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      - name: Build and push image (Depot remote builder)
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: ${{ env.CONTEXT }}
+          file: ${{ env.DOCKERFILE }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}

.github/workflows/deploy-formbricks-cloud.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       VERSION:
-        description: "The version of the Docker image to release (clean SemVer, e.g., 1.2.3)"
+        description: "The version of the Docker image to release, full image tag if image tag is v0.0.0 enter v0.0.0."
         required: true
         type: string
       REPOSITORY:

.github/workflows/e2e.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 60
     services:
       postgres:
-        image: pgvector/pgvector@sha256:9ae02a756ba16a2d69dd78058e25915e36e189bb36ddf01ceae86390d7ed786a
+        image: pgvector/pgvector:pg17
         env:
           POSTGRES_DB: postgres
           POSTGRES_USER: postgres
@@ -41,7 +41,7 @@ jobs:
         ports:
           - 5432:5432
         options: >-
-          --health-cmd="pg_isready -U postgres"
+          --health-cmd="pg_isready -U testuser"
           --health-interval=10s
           --health-timeout=5s
           --health-retries=5
@@ -49,15 +49,25 @@ jobs:
         image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
         ports:
           - 6379:6379
+      minio:
+        image: bitnami/minio:2025.7.23-debian-12-r5
+        env:
+          MINIO_ROOT_USER: minioadmin
+          MINIO_ROOT_PASSWORD: minioadmin
+        ports:
+          - 9000:9000
+        options: >-
+          --health-cmd="curl -fsS http://localhost:9000/minio/health/live || exit 1"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=20
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
-          egress-policy: audit
+          egress-policy: allow
           allowed-endpoints: |
             ee.formbricks.com:443
-            registry-1.docker.io:443
-            docker.io:443
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/dangerous-git-checkout
@@ -91,8 +101,8 @@ jobs:
           echo "S3_REGION=us-east-1" >> .env
           echo "S3_BUCKET_NAME=formbricks-e2e" >> .env
           echo "S3_ENDPOINT_URL=http://localhost:9000" >> .env
-          echo "S3_ACCESS_KEY=devminio" >> .env
-          echo "S3_SECRET_KEY=devminio123" >> .env
+          echo "S3_ACCESS_KEY=minioadmin" >> .env
+          echo "S3_SECRET_KEY=minioadmin" >> .env
           echo "S3_FORCE_PATH_STYLE=1" >> .env
         shell: bash
 
@@ -112,22 +122,6 @@ jobs:
           chmod +x "${MC_BIN}"
           sudo mv "${MC_BIN}" /usr/local/bin/mc
 
-      - name: Start MinIO Server
-        run: |
-          set -euo pipefail
-          
-          # Start MinIO server in background
-          docker run -d \
-            --name minio-server \
-            -p 9000:9000 \
-            -p 9001:9001 \
-            -e MINIO_ROOT_USER=devminio \
-            -e MINIO_ROOT_PASSWORD=devminio123 \
-            minio/minio:RELEASE.2025-09-07T16-13-09Z \
-            server /data --console-address :9001
-          
-          echo "MinIO server started"
-
       - name: Wait for MinIO and create S3 bucket
         run: |
           set -euo pipefail
@@ -148,7 +142,7 @@ jobs:
             exit 1
           fi
 
-          mc alias set local http://localhost:9000 devminio devminio123
+          mc alias set local http://localhost:9000 minioadmin minioadmin
           mc mb --ignore-existing local/formbricks-e2e
 
       - name: Build App
@@ -166,12 +160,6 @@ jobs:
           cd apps/web && pnpm vitest run modules/core/rate-limit/rate-limit-load.test.ts
         shell: bash
 
-      - name: Run Cache Integration Tests
-        run: |
-          echo "Running cache integration tests with Redis/Valkey..."
-          cd packages/cache && pnpm vitest run src/cache-integration.test.ts
-        shell: bash
-
       - name: Check for Enterprise License
         run: |
           LICENSE_KEY=$(grep '^ENTERPRISE_LICENSE_KEY=' .env | cut -d'=' -f2-)
@@ -181,12 +169,6 @@ jobs:
           fi
           echo "License key length: ${#LICENSE_KEY}"
 
-      - name: Disable rate limiting for E2E tests
-        run: |
-          echo "RATE_LIMITING_DISABLED=1" >> .env
-          echo "Rate limiting disabled for E2E tests"
-        shell: bash
-
       - name: Run App
         run: |
           echo "Starting app with enterprise license..."
@@ -228,14 +210,11 @@ jobs:
         if: env.AZURE_ENABLED == 'true'
         env:
           PLAYWRIGHT_SERVICE_URL: ${{ secrets.PLAYWRIGHT_SERVICE_URL }}
-          CI: true
         run: |
           pnpm test-e2e:azure
 
       - name: Run E2E Tests (Local)
         if: env.AZURE_ENABLED == 'false'
-        env:
-          CI: true
         run: |
           pnpm test:e2e
 

.github/workflows/formbricks-release.yml

@@ -8,103 +8,16 @@ permissions:
   contents: read
 
 jobs:
-  check-latest-release:
-    name: Check if this is the latest release
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      is_latest: ${{ steps.compare_tags.outputs.is_latest }}
-    # This job determines if the current release was marked as "Set as the latest release"
-    # by comparing it with the latest release from GitHub API
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
-      - name: Get latest release tag from API
-        id: get_latest_release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          
-          # Get the latest release tag from GitHub API with error handling
-          echo "Fetching latest release from GitHub API..."
-          
-          # Use curl with error handling - API returns 404 if no releases exist
-          http_code=$(curl -s -w "%{http_code}" -H "Authorization: token ${GITHUB_TOKEN}" \
-            "https://api.github.com/repos/${REPO}/releases/latest" -o /tmp/latest_release.json)
-          
-          if [[ "$http_code" == "404" ]]; then
-            echo "⚠️  No previous releases found (404). This appears to be the first release."
-            echo "latest_release=" >> $GITHUB_OUTPUT
-          elif [[ "$http_code" == "200" ]]; then
-            latest_release=$(jq -r .tag_name /tmp/latest_release.json)
-            if [[ "$latest_release" == "null" || -z "$latest_release" ]]; then
-              echo "⚠️  API returned null/empty tag_name. Treating as first release."
-              echo "latest_release=" >> $GITHUB_OUTPUT
-            else
-              echo "Latest release from API: ${latest_release}"
-              echo "latest_release=${latest_release}" >> $GITHUB_OUTPUT
-            fi
-          else
-            echo "❌ GitHub API error (HTTP ${http_code}). Treating as first release."
-            echo "latest_release=" >> $GITHUB_OUTPUT
-          fi
-          
-          echo "Current release tag: ${{ github.event.release.tag_name }}"
-
-      - name: Compare release tags
-        id: compare_tags
-        env:
-          CURRENT_TAG: ${{ github.event.release.tag_name }}
-          LATEST_TAG: ${{ steps.get_latest_release.outputs.latest_release }}
-        run: |
-          set -euo pipefail
-          
-          # Handle first release case (no previous releases)
-          if [[ -z "${LATEST_TAG}" ]]; then
-            echo "🎉 This is the first release (${CURRENT_TAG}) - treating as latest"
-            echo "is_latest=true" >> $GITHUB_OUTPUT
-          elif [[ "${CURRENT_TAG}" == "${LATEST_TAG}" ]]; then
-            echo "✅ This release (${CURRENT_TAG}) is marked as the latest release"
-            echo "is_latest=true" >> $GITHUB_OUTPUT
-          else
-            echo "ℹ️  This release (${CURRENT_TAG}) is not the latest release (latest: ${LATEST_TAG})"
-            echo "is_latest=false" >> $GITHUB_OUTPUT
-          fi
-  docker-build-community:
-    name: Build & release community docker image
+  docker-build:
+    name: Build & release docker image
     permissions:
       contents: read
       packages: write
       id-token: write
     uses: ./.github/workflows/release-docker-github.yml
     secrets: inherit
-    needs:
-      - check-latest-release
     with:
       IS_PRERELEASE: ${{ github.event.release.prerelease }}
-      MAKE_LATEST: ${{ needs.check-latest-release.outputs.is_latest }}
-
-  docker-build-cloud:
-    name: Build & push Formbricks Cloud to ECR
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/build-and-push-ecr.yml
-    secrets: inherit
-    with:
-      image_tag: ${{ needs.docker-build-community.outputs.VERSION }}
-      IS_PRERELEASE: ${{ github.event.release.prerelease }}
-      MAKE_LATEST: ${{ needs.check-latest-release.outputs.is_latest }}
-    needs:
-      - check-latest-release
-      - docker-build-community
 
   helm-chart-release:
     name: Release Helm Chart
@@ -114,44 +27,32 @@ jobs:
     uses: ./.github/workflows/release-helm-chart.yml
     secrets: inherit
     needs:
-      - docker-build-community
+      - docker-build
     with:
-      VERSION: ${{ needs.docker-build-community.outputs.VERSION }}
+      VERSION: ${{ needs.docker-build.outputs.VERSION }}
 
-  verify-cloud-build:
-    name: Verify Cloud Build Outputs
-    runs-on: ubuntu-latest
-    timeout-minutes: 5 # Simple verification should be quick
+  deploy-formbricks-cloud:
+    name: Deploy Helm Chart to Formbricks Cloud
+    permissions:
+      contents: read
+      id-token: write
+    secrets: inherit
+    uses: ./.github/workflows/deploy-formbricks-cloud.yml
     needs:
-      - docker-build-cloud
-    steps:
-      - name: Harden the runner
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
-      - name: Display ECR build outputs
-        env:
-          IMAGE_TAG: ${{ needs.docker-build-cloud.outputs.IMAGE_TAG }}
-          TAGS: ${{ needs.docker-build-cloud.outputs.TAGS }}
-        run: |
-          set -euo pipefail
-
-          echo "✅ ECR Build Completed Successfully"
-          echo "Image Tag: ${IMAGE_TAG}"
-          echo "ECR Tags:"
-          printf '%s\n' "${TAGS}"
+      - docker-build
+      - helm-chart-release
+    with:
+      VERSION: v${{ needs.docker-build.outputs.VERSION }}
+      ENVIRONMENT: ${{ github.event.release.prerelease && 'staging' || 'production' }}
 
   move-stable-tag:
     name: Move stable tag to release
     permissions:
-      contents: write # Required for tag push operations in called workflow
+      contents: read
     uses: ./.github/workflows/move-stable-tag.yml
     needs:
-      - check-latest-release
-      - docker-build-community # Ensure release is successful first
+      - docker-build # Ensure release is successful first
     with:
       release_tag: ${{ github.event.release.tag_name }}
       commit_sha: ${{ github.sha }}
       is_prerelease: ${{ github.event.release.prerelease }}
-      make_latest: ${{ needs.check-latest-release.outputs.is_latest }}

.github/workflows/move-stable-tag.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       release_tag:
-        description: "The release tag name (e.g., 1.2.3)"
+        description: "The release tag name (e.g., v1.2.3)"
         required: true
         type: string
       commit_sha:
@@ -16,11 +16,6 @@ on:
         required: false
         type: boolean
         default: false
-      make_latest:
-        description: "Whether to move stable tag (from GitHub release 'Set as the latest release' option)"
-        required: false
-        type: boolean
-        default: false
 
 permissions:
   contents: read
@@ -37,8 +32,8 @@ jobs:
     timeout-minutes: 10 # Prevent hung git operations
     permissions:
       contents: write # Required to push tags
-    # Only move stable tag for non-prerelease versions AND when make_latest is true
-    if: ${{ !inputs.is_prerelease && inputs.make_latest }}
+    # Only move stable tag for non-prerelease versions
+    if: ${{ !inputs.is_prerelease }}
     steps:
       - name: Harden the runner
         uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
@@ -58,8 +53,8 @@ jobs:
           set -euo pipefail
 
           # Validate release tag format
-          if [[ ! "$RELEASE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "❌ Error: Invalid release tag format. Expected format: 1.2.3, 1.2.3-alpha"
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "❌ Error: Invalid release tag format. Expected format: v1.2.3, v1.2.3-alpha"
             echo "Provided: $RELEASE_TAG"
             exit 1
           fi

.github/workflows/release-docker-github-experimental.yml

@@ -1,31 +1,39 @@
-name: Build Community Testing Images
+name: Docker Release to Github Experimental
 
-# This workflow builds experimental/testing versions of Formbricks for self-hosting customers
-# to test fixes and features before official releases. Images are pushed to GHCR with
-# timestamped experimental versions for easy identification and testing.
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
 
 on:
   workflow_dispatch:
-    inputs:
-      version_override:
-        description: "Override version (SemVer only, e.g., 1.2.3-beta). Leave empty for auto-generated experimental version."
-        required: false
-        type: string
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}-experimental
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 permissions:
   contents: read
-  packages: write
-  id-token: write
 
 jobs:
-  build-community-testing:
-    name: Build Community Testing Image
+  build:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -34,17 +42,110 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build and push community testing image
-        uses: ./.github/actions/build-and-push-docker
-        with:
-          registry_type: "ghcr"
-          ghcr_image_name: "${{ github.repository }}-experimental"
-          experimental_mode: "true"
-          version: ${{ inputs.version_override }}
+      - name: Generate SemVer version from branch or tag
+        id: generate_version
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+        run: |
+          # Get reference name and type from environment variables
+          echo "Reference type: $REF_TYPE"
+          echo "Reference name: $REF_NAME"
+
+          # Create unique timestamped version for testing sourcemap resolution
+          TIMESTAMP=$(date +%s)
+          
+          if [[ "$REF_TYPE" == "tag" ]]; then
+            # If running from a tag, use the tag name + timestamp
+            if [[ "$REF_NAME" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
+              # Tag looks like a SemVer, use it directly (remove 'v' prefix if present)
+              BASE_VERSION=$(echo "$REF_NAME" | sed 's/^v//')
+              VERSION="${BASE_VERSION}-${TIMESTAMP}"
+              echo "Using SemVer tag with timestamp: $VERSION"
+            else
+              # Tag is not SemVer, treat as prerelease
+              SANITIZED_TAG=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
+              VERSION="0.0.0-${SANITIZED_TAG}-${TIMESTAMP}"
+              echo "Using tag as prerelease with timestamp: $VERSION"
+            fi
+          else
+            # Running from branch, use branch name as prerelease + timestamp
+            SANITIZED_BRANCH=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9.-]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
+            VERSION="0.0.0-${SANITIZED_BRANCH}-${TIMESTAMP}"
+            echo "Using branch as prerelease with timestamp: $VERSION"
+          fi
+
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+          echo "Generated SemVer version: $VERSION"
+
+      - name: Update package.json version
+        run: |
+          sed -i "s/\"version\": \"0.0.0\"/\"version\": \"${{ env.VERSION }}\"/" ./apps/web/package.json
+          cat ./apps/web/package.json | grep version
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=raw,value=${{ env.VERSION }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: .
+          file: ./apps/web/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+
+
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes "{}@${DIGEST}"

.github/workflows/release-docker-github.yml

@@ -1,4 +1,4 @@
-name: Release Community Docker Images
+name: Docker Release to Github
 
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
@@ -13,11 +13,6 @@ on:
         required: false
         type: boolean
         default: false
-      MAKE_LATEST:
-        description: "Whether to tag as latest (from GitHub release 'Set as the latest release' option)"
-        required: false
-        type: boolean
-        default: false
     outputs:
       VERSION:
         description: release version
@@ -28,6 +23,8 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
 permissions:
   contents: read
@@ -35,7 +32,6 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
     permissions:
       contents: read
       packages: write
@@ -48,61 +44,103 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Extract release version from tag
+      - name: Get Release Tag
         id: extract_release_tag
         run: |
-          set -euo pipefail
+          # Extract version from tag (e.g., refs/tags/v1.2.3 -> 1.2.3)
+          TAG="$GITHUB_REF"
+          TAG=${TAG#refs/tags/v}
 
-          # Extract tag name with fallback logic for different trigger contexts
-          if [[ -n "${RELEASE_TAG:-}" ]]; then
-            TAG="$RELEASE_TAG"
-            echo "Using RELEASE_TAG override: $TAG"
-          elif [[ "$GITHUB_REF_NAME" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]] || [[ "$GITHUB_REF_NAME" =~ ^v[0-9] ]]; then
-            TAG="$GITHUB_REF_NAME"
-            echo "Using GITHUB_REF_NAME (looks like tag): $TAG"
-          else
-            # Fallback: extract from GITHUB_REF for direct tag triggers
-            TAG="${GITHUB_REF#refs/tags/}"
-            if [[ -z "$TAG" || "$TAG" == "$GITHUB_REF" ]]; then
-              TAG="$GITHUB_REF_NAME"
-              echo "Using GITHUB_REF_NAME as final fallback: $TAG"
-            else
-              echo "Extracted from GITHUB_REF: $TAG"
-            fi
-          fi
-
-          # Strip v-prefix if present (normalize to clean SemVer)
-          TAG=${TAG#[vV]}
-
-          # Validate SemVer format (supports prereleases like 4.0.0-rc.1)
-          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
-            echo "ERROR: Invalid tag format '$TAG'. Expected SemVer (e.g., 1.2.3, 4.0.0-rc.1)"
+          # Validate the extracted tag format
+          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "❌ Error: Invalid release tag format after extraction. Must be semver (e.g., 1.2.3, 1.2.3-alpha)"
+            echo "Original ref: $GITHUB_REF"
+            echo "Extracted tag: $TAG"
             exit 1
           fi
 
-          echo "VERSION=$TAG" >> $GITHUB_OUTPUT
-          echo "Using version: $TAG"
+          # Safely add to environment variables
+          echo "RELEASE_TAG=$TAG" >> $GITHUB_ENV
 
-      - name: Build and push community release image
-        id: build
-        uses: ./.github/actions/build-and-push-docker
+          echo "VERSION=$TAG" >> $GITHUB_OUTPUT
+          echo "Using tag-based version: $TAG"
+
+      - name: Update package.json version
+        run: |
+          sed -i "s/\"version\": \"0.0.0\"/\"version\": \"${{ env.RELEASE_TAG }}\"/" ./apps/web/package.json
+          cat ./apps/web/package.json | grep version
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
-          registry_type: "ghcr"
-          ghcr_image_name: ${{ env.IMAGE_NAME }}
-          version: ${{ steps.extract_release_tag.outputs.VERSION }}
-          is_prerelease: ${{ inputs.IS_PRERELEASE }}
-          make_latest: ${{ inputs.MAKE_LATEST }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            # Default semver tags (version, major.minor, major)
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            # Only tag as 'latest' for stable releases (not prereleases)
+            type=raw,value=latest,enable=${{ !inputs.IS_PRERELEASE  }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: depot/build-push-action@636daae76684e38c301daa0c5eca1c095b24e780 # v1.14.0
+        with:
+          project: tw0fqmsx3c
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: .
+          file: ./apps/web/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            database_url=${{ secrets.DUMMY_DATABASE_URL }}
+            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPOT_PROJECT_TOKEN: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          DUMMY_DATABASE_URL: ${{ secrets.DUMMY_DATABASE_URL }}
-          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
-          DUMMY_REDIS_URL: ${{ secrets.DUMMY_REDIS_URL }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/release-helm-chart.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -59,35 +59,14 @@ jobs:
         uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
       - name: Update Chart.yaml with new version
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Updating Chart.yaml with version: ${VERSION}"
-          yq -i ".version = \"${VERSION}\"" helm-chart/Chart.yaml
-          yq -i ".appVersion = \"${VERSION}\"" helm-chart/Chart.yaml
-
-          echo "✅ Successfully updated Chart.yaml"
+          yq -i ".version = \"$VERSION\"" helm-chart/Chart.yaml
+          yq -i ".appVersion = \"v$VERSION\"" helm-chart/Chart.yaml
 
       - name: Package Helm chart
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Packaging Helm chart version: ${VERSION}"
           helm package ./helm-chart
 
-          echo "✅ Successfully packaged formbricks-${VERSION}.tgz"
-
       - name: Push Helm chart to GitHub Container Registry
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
-          set -euo pipefail
-
-          echo "Pushing Helm chart to registry: formbricks-${VERSION}.tgz"
-          helm push "formbricks-${VERSION}.tgz" oci://ghcr.io/formbricks/helm-charts
-
-          echo "✅ Successfully pushed Helm chart to registry"
+          helm push "formbricks-$VERSION.tgz" oci://ghcr.io/formbricks/helm-charts

apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/components/landing-sidebar.tsx

@@ -1,14 +1,8 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
-import { ArrowUpRightIcon, ChevronRightIcon, LogOutIcon } from "lucide-react";
-import Image from "next/image";
-import Link from "next/link";
-import { useState } from "react";
-import { TOrganization } from "@formbricks/types/organizations";
-import { TUser } from "@formbricks/types/user";
 import FBLogo from "@/images/formbricks-wordmark.svg";
 import { cn } from "@/lib/cn";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
 import { useSignOut } from "@/modules/auth/hooks/use-sign-out";
 import { CreateOrganizationModal } from "@/modules/organization/components/CreateOrganizationModal";
 import { ProfileAvatar } from "@/modules/ui/components/avatars";
@@ -18,6 +12,13 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from "@/modules/ui/components/dropdown-menu";
+import { useTranslate } from "@tolgee/react";
+import { ArrowUpRightIcon, ChevronRightIcon, LogOutIcon } from "lucide-react";
+import Image from "next/image";
+import Link from "next/link";
+import { useState } from "react";
+import { TOrganization } from "@formbricks/types/organizations";
+import { TUser } from "@formbricks/types/user";
 
 interface LandingSidebarProps {
   user: TUser;
@@ -65,8 +66,10 @@ export const LandingSidebar = ({ user, organization }: LandingSidebarProps) => {
                   )}>
                   {user?.name ? <span>{user?.name}</span> : <span>{user?.email}</span>}
                 </p>
-                <p title={organization?.name} className="truncate text-sm text-slate-500">
-                  {organization?.name}
+                <p
+                  title={capitalizeFirstLetter(organization?.name)}
+                  className="truncate text-sm text-slate-500">
+                  {capitalizeFirstLetter(organization?.name)}
                 </p>
               </div>
               <ChevronRightIcon className={cn("h-5 w-5 shrink-0 text-slate-700 hover:text-slate-500")} />

apps/web/app/(app)/environments/[environmentId]/project/integrations/notion/components/AddIntegrationModal.tsx

@@ -1,18 +1,5 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
-import { PlusIcon, TrashIcon } from "lucide-react";
-import Image from "next/image";
-import React, { useEffect, useMemo, useState } from "react";
-import { useForm } from "react-hook-form";
-import toast from "react-hot-toast";
-import { TIntegrationInput } from "@formbricks/types/integration";
-import {
-  TIntegrationNotion,
-  TIntegrationNotionConfigData,
-  TIntegrationNotionDatabase,
-} from "@formbricks/types/integration/notion";
-import { TSurvey, TSurveyQuestionTypeEnum } from "@formbricks/types/surveys/types";
 import { createOrUpdateIntegrationAction } from "@/app/(app)/environments/[environmentId]/project/integrations/actions";
 import {
   ERRORS,
@@ -36,6 +23,19 @@ import {
 } from "@/modules/ui/components/dialog";
 import { DropdownSelector } from "@/modules/ui/components/dropdown-selector";
 import { Label } from "@/modules/ui/components/label";
+import { useTranslate } from "@tolgee/react";
+import { PlusIcon, TrashIcon } from "lucide-react";
+import Image from "next/image";
+import React, { useEffect, useMemo, useState } from "react";
+import { useForm } from "react-hook-form";
+import toast from "react-hot-toast";
+import { TIntegrationInput } from "@formbricks/types/integration";
+import {
+  TIntegrationNotion,
+  TIntegrationNotionConfigData,
+  TIntegrationNotionDatabase,
+} from "@formbricks/types/integration/notion";
+import { TSurvey, TSurveyQuestionTypeEnum } from "@formbricks/types/surveys/types";
 
 interface AddIntegrationModalProps {
   environmentId: string;
@@ -134,12 +134,13 @@ export const AddIntegrationModal = ({
         type: TSurveyQuestionTypeEnum.OpenText,
       })) || [];
 
-    const hiddenFields =
-      selectedSurvey?.hiddenFields.fieldIds?.map((fId) => ({
-        id: fId,
-        name: `${t("common.hidden_field")} : ${fId}`,
-        type: TSurveyQuestionTypeEnum.OpenText,
-      })) || [];
+    const hiddenFields = selectedSurvey?.hiddenFields.enabled
+      ? selectedSurvey?.hiddenFields.fieldIds?.map((fId) => ({
+          id: fId,
+          name: `${t("common.hidden_field")} : ${fId}`,
+          type: TSurveyQuestionTypeEnum.OpenText,
+        })) || []
+      : [];
     const Metadata = [
       {
         id: "metadata",

apps/web/app/(app)/environments/[environmentId]/settings/(account)/notifications/components/IntegrationsTip.test.tsx

@@ -31,6 +31,6 @@ describe("IntegrationsTip", () => {
 
     const linkElement = screen.getByText("environments.settings.notifications.use_the_integration");
     expect(linkElement).toBeInTheDocument();
-    expect(linkElement).toHaveAttribute("href", `/environments/${environmentId}/project/integrations`);
+    expect(linkElement).toHaveAttribute("href", `/environments/${environmentId}/integrations`);
   });
 });

apps/web/app/(app)/environments/[environmentId]/settings/(account)/notifications/components/IntegrationsTip.tsx

@@ -16,7 +16,7 @@ export const IntegrationsTip = ({ environmentId }: IntegrationsTipProps) => {
         <p className="text-sm">
           {t("environments.settings.notifications.need_slack_or_discord_notifications")}?
           <a
-            href={`/environments/${environmentId}/project/integrations`}
+            href={`/environments/${environmentId}/integrations`}
             className="ml-1 cursor-pointer text-sm underline">
             {t("environments.settings.notifications.use_the_integration")}
           </a>

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/components/password-confirmation-modal.test.tsx

@@ -120,7 +120,7 @@ describe("PasswordConfirmationModal", () => {
     const confirmButton = screen.getByText("common.confirm");
     await user.click(confirmButton);
 
-    expect(screen.getByText("Password must be at least 8 characters long")).toBeInTheDocument();
+    expect(screen.getByText("String must contain at least 8 character(s)")).toBeInTheDocument();
   });
 
   test("handles cancel button click and resets form", async () => {

apps/web/app/(app)/environments/[environmentId]/settings/components/SettingsCard.tsx

@@ -1,10 +1,10 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
 import { cn } from "@/lib/cn";
 import { Badge } from "@/modules/ui/components/badge";
 import { Button } from "@/modules/ui/components/button";
 import { H4, Small } from "@/modules/ui/components/typography";
+import { useTranslate } from "@tolgee/react";
 
 interface ButtonInfo {
   text: string;
@@ -41,7 +41,7 @@ export const SettingsCard = ({
       id={title}>
       <div className="flex justify-between border-b border-slate-200 px-4 pb-4">
         <div>
-          <H4 className="font-medium tracking-normal">{title}</H4>
+          <H4 className="font-medium capitalize tracking-normal">{title}</H4>
           <div className="ml-2">
             {beta && <Badge size="normal" type="warning" text="Beta" />}
             {soon && (

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseCardModal.test.tsx

@@ -1,3 +1,5 @@
+import { ResponseCardModal } from "@/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseCardModal";
+import { SingleResponseCard } from "@/modules/analysis/components/SingleResponseCard";
 import { cleanup, render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
@@ -6,8 +8,6 @@ import { TResponse } from "@formbricks/types/responses";
 import { TSurvey } from "@formbricks/types/surveys/types";
 import { TTag } from "@formbricks/types/tags";
 import { TUser, TUserLocale } from "@formbricks/types/user";
-import { ResponseCardModal } from "@/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseCardModal";
-import { SingleResponseCard } from "@/modules/analysis/components/SingleResponseCard";
 
 vi.mock("@/modules/analysis/components/SingleResponseCard", () => ({
   SingleResponseCard: vi.fn(() => <div data-testid="single-response-card">SingleResponseCard</div>),
@@ -46,11 +46,6 @@ vi.mock("@/modules/ui/components/dialog", () => ({
   )),
   DialogBody: vi.fn(({ children }) => <div data-testid="dialog-body">{children}</div>),
   DialogFooter: vi.fn(({ children }) => <div data-testid="dialog-footer">{children}</div>),
-  DialogTitle: vi.fn(({ children }) => <div data-testid="dialog-title">{children}</div>),
-}));
-
-vi.mock("@radix-ui/react-visually-hidden", () => ({
-  VisuallyHidden: vi.fn(({ children }) => <div data-testid="visually-hidden">{children}</div>),
 }));
 
 const mockResponses = [

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/responses/components/ResponseCardModal.tsx

@@ -1,4 +1,6 @@
-import { VisuallyHidden } from "@radix-ui/react-visually-hidden";
+import { SingleResponseCard } from "@/modules/analysis/components/SingleResponseCard";
+import { Button } from "@/modules/ui/components/button";
+import { Dialog, DialogBody, DialogContent, DialogFooter } from "@/modules/ui/components/dialog";
 import { ChevronLeft, ChevronRight } from "lucide-react";
 import { useEffect, useState } from "react";
 import { TEnvironment } from "@formbricks/types/environment";
@@ -6,9 +8,6 @@ import { TResponse } from "@formbricks/types/responses";
 import { TSurvey } from "@formbricks/types/surveys/types";
 import { TTag } from "@formbricks/types/tags";
 import { TUser, TUserLocale } from "@formbricks/types/user";
-import { SingleResponseCard } from "@/modules/analysis/components/SingleResponseCard";
-import { Button } from "@/modules/ui/components/button";
-import { Dialog, DialogBody, DialogContent, DialogFooter, DialogTitle } from "@/modules/ui/components/dialog";
 
 interface ResponseCardModalProps {
   responses: TResponse[];
@@ -78,9 +77,6 @@ export const ResponseCardModal = ({
   return (
     <Dialog open={open} onOpenChange={handleClose}>
       <DialogContent width="wide">
-        <VisuallyHidden asChild>
-          <DialogTitle>Survey Response Details</DialogTitle>
-        </VisuallyHidden>
         <DialogBody>
           <SingleResponseCard
             survey={survey}

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/shareEmbedModal/success-view.tsx

@@ -75,7 +75,7 @@ export const SuccessView: React.FC<SuccessViewProps> = ({
             {t("environments.surveys.summary.configure_alerts")}
           </Link>
           <Link
-            href={`/environments/${environmentId}/project/integrations`}
+            href={`/environments/${environmentId}/integrations`}
             className="flex flex-col items-center gap-3 rounded-lg border border-slate-100 bg-white p-4 text-center text-sm text-slate-900 hover:border-slate-200 md:p-8">
             <BlocksIcon className="h-8 w-8 stroke-1 text-slate-900" />
             {t("environments.surveys.summary.setup_integrations")}

apps/web/app/api/(internal)/pipeline/lib/handleIntegrations.ts

@@ -357,10 +357,7 @@ const buildNotionPayloadProperties = (
 
 // notion requires specific payload for each column type
 // * TYPES NOT SUPPORTED BY NOTION API - rollup, created_by, created_time, last_edited_by, or last_edited_time
-const getValue = (
-  colType: string,
-  value: string | string[] | Date | number | Record<string, string> | undefined
-) => {
+const getValue = (colType: string, value: string | string[] | Date | number | Record<string, string>) => {
   try {
     switch (colType) {
       case "select":

apps/web/app/api/google-sheet/callback/route.ts

@@ -62,10 +62,9 @@ export const GET = async (req: Request) => {
   };
 
   const result = await createOrUpdateIntegration(environmentId, googleSheetIntegration);
+
   if (result) {
-    return Response.redirect(
-      `${WEBAPP_URL}/environments/${environmentId}/project/integrations/google-sheets`
-    );
+    return Response.redirect(`${WEBAPP_URL}/environments/${environmentId}/integrations/google-sheets`);
   }
 
   return responses.internalServerErrorResponse("Failed to create or update Google Sheets integration");

apps/web/app/api/v1/client/[environmentId]/environment/lib/environmentState.test.ts

@@ -1,3 +1,9 @@
+import { cache } from "@/lib/cache";
+import { getMonthlyOrganizationResponseCount } from "@/lib/organization/service";
+import {
+  capturePosthogEnvironmentEvent,
+  sendPlanLimitsReachedEventToPosthogWeekly,
+} from "@/lib/posthogServer";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import { logger } from "@formbricks/logger";
@@ -6,12 +12,6 @@ import { ResourceNotFoundError } from "@formbricks/types/errors";
 import { TJsEnvironmentState, TJsEnvironmentStateProject } from "@formbricks/types/js";
 import { TOrganization } from "@formbricks/types/organizations";
 import { TSurvey } from "@formbricks/types/surveys/types";
-import { cache } from "@/lib/cache";
-import { getMonthlyOrganizationResponseCount } from "@/lib/organization/service";
-import {
-  capturePosthogEnvironmentEvent,
-  sendPlanLimitsReachedEventToPosthogWeekly,
-} from "@/lib/posthogServer";
 import { EnvironmentStateData, getEnvironmentStateData } from "./data";
 import { getEnvironmentState } from "./environmentState";
 
@@ -285,7 +285,7 @@ describe("getEnvironmentState", () => {
     expect(cache.withCache).toHaveBeenCalledWith(
       expect.any(Function),
       "fb:env:test-environment-id:state",
-      60 * 1000 // 1 minutes in milliseconds
+      5 * 60 * 1000 // 5 minutes in milliseconds
     );
   });
 

apps/web/app/api/v1/client/[environmentId]/environment/lib/environmentState.ts

@@ -1,8 +1,4 @@
 import "server-only";
-import { createCacheKey } from "@formbricks/cache";
-import { prisma } from "@formbricks/database";
-import { logger } from "@formbricks/logger";
-import { TJsEnvironmentState } from "@formbricks/types/js";
 import { cache } from "@/lib/cache";
 import { IS_FORMBRICKS_CLOUD, IS_RECAPTCHA_CONFIGURED, RECAPTCHA_SITE_KEY } from "@/lib/constants";
 import { getMonthlyOrganizationResponseCount } from "@/lib/organization/service";
@@ -10,6 +6,10 @@ import {
   capturePosthogEnvironmentEvent,
   sendPlanLimitsReachedEventToPosthogWeekly,
 } from "@/lib/posthogServer";
+import { createCacheKey } from "@formbricks/cache";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { TJsEnvironmentState } from "@formbricks/types/js";
 import { getEnvironmentStateData } from "./data";
 
 /**
@@ -80,6 +80,6 @@ export const getEnvironmentState = async (
       return { data };
     },
     createCacheKey.environment.state(environmentId),
-    60 * 1000 // 1 minutes in milliseconds
+    5 * 60 * 1000 // 5 minutes in milliseconds
   );
 };

apps/web/app/api/v1/integrations/airtable/callback/route.ts

@@ -90,9 +90,7 @@ export const GET = withV1ApiWrapper({
       };
       await createOrUpdateIntegration(environmentId, airtableIntegrationInput);
       return {
-        response: Response.redirect(
-          `${WEBAPP_URL}/environments/${environmentId}/project/integrations/airtable`
-        ),
+        response: Response.redirect(`${WEBAPP_URL}/environments/${environmentId}/integrations/airtable`),
       };
     } catch (error) {
       logger.error({ error, url: req.url }, "Error in GET /api/v1/integrations/airtable/callback");

apps/web/app/api/v1/integrations/notion/callback/route.ts

@@ -86,15 +86,13 @@ export const GET = withV1ApiWrapper({
 
       if (result) {
         return {
-          response: Response.redirect(
-            `${WEBAPP_URL}/environments/${environmentId}/project/integrations/notion`
-          ),
+          response: Response.redirect(`${WEBAPP_URL}/environments/${environmentId}/integrations/notion`),
         };
       }
     } else if (error) {
       return {
         response: Response.redirect(
-          `${WEBAPP_URL}/environments/${environmentId}/project/integrations/notion?error=${error}`
+          `${WEBAPP_URL}/environments/${environmentId}/integrations/notion?error=${error}`
         ),
       };
     }

apps/web/app/api/v1/integrations/slack/callback/route.ts

@@ -93,15 +93,13 @@ export const GET = withV1ApiWrapper({
 
       if (result) {
         return {
-          response: Response.redirect(
-            `${WEBAPP_URL}/environments/${environmentId}/project/integrations/slack`
-          ),
+          response: Response.redirect(`${WEBAPP_URL}/environments/${environmentId}/integrations/slack`),
         };
       }
     } else if (error) {
       return {
         response: Response.redirect(
-          `${WEBAPP_URL}/environments/${environmentId}/project/integrations/slack?error=${error}`
+          `${WEBAPP_URL}/environments/${environmentId}/integrations/slack?error=${error}`
         ),
       };
     }

apps/web/app/api/v2/health/route.ts

@@ -1 +0,0 @@
-export { GET } from "@/modules/api/v2/health/route";

apps/web/app/lib/api/with-api-logging.test.ts

@@ -1,9 +1,9 @@
+import { AuthenticationMethod } from "@/app/middleware/endpoint-validator";
 import * as Sentry from "@sentry/nextjs";
 import { NextRequest } from "next/server";
 import { Mock, beforeEach, describe, expect, test, vi } from "vitest";
 import { logger } from "@formbricks/logger";
 import { TAuthenticationApiKey } from "@formbricks/types/auth";
-import { AuthenticationMethod } from "@/app/middleware/endpoint-validator";
 import { responses } from "./response";
 
 // Mocks
@@ -14,10 +14,6 @@ vi.mock("@/modules/ee/audit-logs/lib/handler", () => ({
 
 vi.mock("@sentry/nextjs", () => ({
   captureException: vi.fn(),
-  withScope: vi.fn((callback) => {
-    callback(mockSentryScope);
-    return mockSentryScope;
-  }),
 }));
 
 // Define these outside the mock factory so they can be referenced in tests and reset by clearAllMocks.
@@ -25,14 +21,6 @@ const mockContextualLoggerError = vi.fn();
 const mockContextualLoggerWarn = vi.fn();
 const mockContextualLoggerInfo = vi.fn();
 
-// Mock Sentry scope that can be referenced in tests
-const mockSentryScope = {
-  setTag: vi.fn(),
-  setExtra: vi.fn(),
-  setContext: vi.fn(),
-  setLevel: vi.fn(),
-};
-
 vi.mock("@formbricks/logger", () => {
   const mockWithContextInstance = vi.fn(() => ({
     error: mockContextualLoggerError,
@@ -122,12 +110,6 @@ describe("withV1ApiWrapper", () => {
     }));
 
     vi.clearAllMocks();
-
-    // Reset mock Sentry scope calls
-    mockSentryScope.setTag.mockClear();
-    mockSentryScope.setExtra.mockClear();
-    mockSentryScope.setContext.mockClear();
-    mockSentryScope.setLevel.mockClear();
   });
 
   test("logs and audits on error response with API key authentication", async () => {
@@ -179,9 +161,10 @@ describe("withV1ApiWrapper", () => {
         organizationId: "org-1",
       })
     );
-    expect(Sentry.withScope).toHaveBeenCalled();
-    expect(mockSentryScope.setExtra).toHaveBeenCalledWith("originalError", undefined);
-    expect(Sentry.captureException).toHaveBeenCalledWith(expect.any(Error));
+    expect(Sentry.captureException).toHaveBeenCalledWith(
+      expect.any(Error),
+      expect.objectContaining({ extra: expect.objectContaining({ correlationId: "abc-123" }) })
+    );
   });
 
   test("does not log Sentry if not 500", async () => {
@@ -286,8 +269,10 @@ describe("withV1ApiWrapper", () => {
         organizationId: "org-1",
       })
     );
-    expect(Sentry.withScope).toHaveBeenCalled();
-    expect(Sentry.captureException).toHaveBeenCalledWith(expect.any(Error));
+    expect(Sentry.captureException).toHaveBeenCalledWith(
+      expect.any(Error),
+      expect.objectContaining({ extra: expect.objectContaining({ correlationId: "err-1" }) })
+    );
   });
 
   test("does not log on success response but still audits", async () => {

apps/web/app/lib/api/with-api-logging.ts

@@ -1,8 +1,3 @@
-import * as Sentry from "@sentry/nextjs";
-import { Session, getServerSession } from "next-auth";
-import { NextRequest } from "next/server";
-import { logger } from "@formbricks/logger";
-import { TAuthenticationApiKey } from "@formbricks/types/auth";
 import { authenticateRequest } from "@/app/api/v1/auth";
 import { responses } from "@/app/lib/api/response";
 import {
@@ -19,6 +14,11 @@ import { rateLimitConfigs } from "@/modules/core/rate-limit/rate-limit-configs";
 import { TRateLimitConfig } from "@/modules/core/rate-limit/types/rate-limit";
 import { queueAuditEvent } from "@/modules/ee/audit-logs/lib/handler";
 import { TAuditAction, TAuditTarget, UNKNOWN_DATA } from "@/modules/ee/audit-logs/types/audit-log";
+import * as Sentry from "@sentry/nextjs";
+import { Session, getServerSession } from "next-auth";
+import { NextRequest } from "next/server";
+import { logger } from "@formbricks/logger";
+import { TAuthenticationApiKey } from "@formbricks/types/auth";
 
 export type TApiAuditLog = Parameters<typeof queueAuditEvent>[0];
 export type TApiV1Authentication = TAuthenticationApiKey | Session | null;
@@ -173,21 +173,8 @@ const logErrorDetails = (res: Response, req: NextRequest, correlationId: string,
   logger.withContext(logContext).error("V1 API Error Details");
 
   if (SENTRY_DSN && IS_PRODUCTION && res.status >= 500) {
-    // Set correlation ID as a tag for easy filtering
-    Sentry.withScope((scope) => {
-      scope.setTag("correlationId", correlationId);
-      scope.setLevel("error");
-
-      // If we have an actual error, capture it with full stacktrace
-      // Otherwise, create a generic error with context
-      if (error instanceof Error) {
-        Sentry.captureException(error);
-      } else {
-        scope.setExtra("originalError", error);
-        const genericError = new Error(`API V1 error, id: ${correlationId}`);
-        Sentry.captureException(genericError);
-      }
-    });
+    const err = new Error(`API V1 error, id: ${correlationId}`);
+    Sentry.captureException(err, { extra: { error, correlationId } });
   }
 };
 

apps/web/app/lib/survey-builder.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "vitest";
 import { TShuffleOption, TSurveyLogic, TSurveyQuestionTypeEnum } from "@formbricks/types/surveys/types";
+import { TTemplateRole } from "@formbricks/types/templates";
 import {
   buildCTAQuestion,
   buildConsentQuestion,

apps/web/app/lib/survey-builder.ts

@@ -19,7 +19,7 @@ import {
   TSurveyRatingQuestion,
   TSurveyWelcomeCard,
 } from "@formbricks/types/surveys/types";
-import { TTemplate, TTemplateRole } from "@formbricks/types/templates";
+import { TTemplate } from "@formbricks/types/templates";
 
 const getDefaultButtonLabel = (label: string | undefined, t: TFnType) =>
   createI18nString(label || t("common.next"), []);
@@ -391,7 +391,6 @@ export const buildSurvey = (
     name: string;
     industries: ("eCommerce" | "saas" | "other")[];
     channels: ("link" | "app" | "website")[];
-    role: TTemplateRole;
     description: string;
     questions: TSurveyQuestion[];
     endings?: TSurveyEnding[];
@@ -404,7 +403,6 @@ export const buildSurvey = (
     name: config.name,
     industries: config.industries,
     channels: config.channels,
-    role: config.role,
     description: config.description,
     preset: {
       ...localSurvey,

apps/web/app/lib/templates.ts

@@ -24,7 +24,6 @@ const cartAbandonmentSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.card_abandonment_survey"),
-      role: "productManager",
       industries: ["eCommerce"],
       channels: ["app", "website", "link"],
       description: t("templates.card_abandonment_survey_description"),
@@ -125,7 +124,6 @@ const siteAbandonmentSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.site_abandonment_survey"),
-      role: "productManager",
       industries: ["eCommerce"],
       channels: ["app", "website"],
       description: t("templates.site_abandonment_survey_description"),
@@ -223,7 +221,6 @@ const productMarketFitSuperhuman = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.product_market_fit_superhuman"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.product_market_fit_superhuman_description"),
@@ -298,7 +295,6 @@ const onboardingSegmentation = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.onboarding_segmentation"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.onboarding_segmentation_description"),
@@ -362,7 +358,6 @@ const churnSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.churn_survey"),
-      role: "sales",
       industries: ["saas", "eCommerce", "other"],
       channels: ["app", "link"],
       description: t("templates.churn_survey_description"),
@@ -452,7 +447,6 @@ const earnedAdvocacyScore = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.earned_advocacy_score_name"),
-      role: "customerSuccess",
       industries: ["saas", "eCommerce", "other"],
       channels: ["app", "link"],
       description: t("templates.earned_advocacy_score_description"),
@@ -525,7 +519,6 @@ const usabilityScoreRatingSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.usability_score_name"),
-      role: "customerSuccess",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.usability_rating_description"),
@@ -651,7 +644,6 @@ const improveTrialConversion = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.improve_trial_conversion_name"),
-      role: "sales",
       industries: ["saas"],
       channels: ["link", "app"],
       description: t("templates.improve_trial_conversion_description"),
@@ -753,7 +745,6 @@ const reviewPrompt = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.review_prompt_name"),
-      role: "marketing",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link", "app"],
       description: t("templates.review_prompt_description"),
@@ -832,7 +823,6 @@ const interviewPrompt = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.interview_prompt_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.interview_prompt_description"),
@@ -860,7 +850,6 @@ const improveActivationRate = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.improve_activation_rate_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["link"],
       description: t("templates.improve_activation_rate_description"),
@@ -951,7 +940,6 @@ const employeeSatisfaction = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.employee_satisfaction_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["app", "link"],
       description: t("templates.employee_satisfaction_description"),
@@ -1029,7 +1017,6 @@ const uncoverStrengthsAndWeaknesses = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.uncover_strengths_and_weaknesses_name"),
-      role: "productManager",
       industries: ["saas", "other"],
       channels: ["app", "link"],
       description: t("templates.uncover_strengths_and_weaknesses_description"),
@@ -1083,7 +1070,6 @@ const productMarketFitShort = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.product_market_fit_short_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.product_market_fit_short_description"),
@@ -1120,7 +1106,6 @@ const marketAttribution = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.market_attribution_name"),
-      role: "marketing",
       industries: ["saas", "eCommerce"],
       channels: ["website", "app", "link"],
       description: t("templates.market_attribution_description"),
@@ -1151,7 +1136,6 @@ const changingSubscriptionExperience = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.changing_subscription_experience_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.changing_subscription_experience_description"),
@@ -1194,7 +1178,6 @@ const identifyCustomerGoals = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.identify_customer_goals_name"),
-      role: "productManager",
       industries: ["saas", "other"],
       channels: ["app", "website"],
       description: t("templates.identify_customer_goals_description"),
@@ -1224,7 +1207,6 @@ const featureChaser = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.feature_chaser_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.feature_chaser_description"),
@@ -1263,7 +1245,6 @@ const fakeDoorFollowUp = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.fake_door_follow_up_name"),
-      role: "productManager",
       industries: ["saas", "eCommerce"],
       channels: ["app", "website"],
       description: t("templates.fake_door_follow_up_description"),
@@ -1307,7 +1288,6 @@ const feedbackBox = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.feedback_box_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.feedback_box_description"),
@@ -1377,7 +1357,6 @@ const integrationSetupSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.integration_setup_survey_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.integration_setup_survey_description"),
@@ -1450,7 +1429,6 @@ const newIntegrationSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.new_integration_survey_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.new_integration_survey_description"),
@@ -1482,7 +1460,6 @@ const docsFeedback = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.docs_feedback_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "website", "link"],
       description: t("templates.docs_feedback_description"),
@@ -1522,7 +1499,6 @@ const nps = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.nps_name"),
-      role: "customerSuccess",
       industries: ["saas", "eCommerce", "other"],
       channels: ["app", "link", "website"],
       description: t("templates.nps_description"),
@@ -1563,7 +1539,6 @@ const customerSatisfactionScore = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.csat_name"),
-      role: "customerSuccess",
       industries: ["saas", "eCommerce", "other"],
       channels: ["app", "link", "website"],
       description: t("templates.csat_description"),
@@ -1732,7 +1707,6 @@ const collectFeedback = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.collect_feedback_name"),
-      role: "productManager",
       industries: ["other", "eCommerce"],
       channels: ["website", "link"],
       description: t("templates.collect_feedback_description"),
@@ -1879,7 +1853,6 @@ const identifyUpsellOpportunities = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.identify_upsell_opportunities_name"),
-      role: "sales",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.identify_upsell_opportunities_description"),
@@ -1909,7 +1882,6 @@ const prioritizeFeatures = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.prioritize_features_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.prioritize_features_description"),
@@ -1962,7 +1934,6 @@ const gaugeFeatureSatisfaction = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.gauge_feature_satisfaction_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.gauge_feature_satisfaction_description"),
@@ -1996,7 +1967,6 @@ const marketSiteClarity = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.market_site_clarity_name"),
-      role: "marketing",
       industries: ["saas", "eCommerce", "other"],
       channels: ["website"],
       description: t("templates.market_site_clarity_description"),
@@ -2038,7 +2008,6 @@ const customerEffortScore = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.customer_effort_score_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app"],
       description: t("templates.customer_effort_score_description"),
@@ -2070,7 +2039,6 @@ const careerDevelopmentSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.career_development_survey_name"),
-      role: "productManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.career_development_survey_description"),
@@ -2157,7 +2125,6 @@ const professionalDevelopmentSurvey = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.professional_development_survey_name"),
-      role: "productManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.professional_development_survey_description"),
@@ -2245,7 +2212,6 @@ const rateCheckoutExperience = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.rate_checkout_experience_name"),
-      role: "productManager",
       industries: ["eCommerce"],
       channels: ["website", "app"],
       description: t("templates.rate_checkout_experience_description"),
@@ -2322,7 +2288,6 @@ const measureSearchExperience = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.measure_search_experience_name"),
-      role: "productManager",
       industries: ["saas", "eCommerce"],
       channels: ["app", "website"],
       description: t("templates.measure_search_experience_description"),
@@ -2399,7 +2364,6 @@ const evaluateContentQuality = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.evaluate_content_quality_name"),
-      role: "marketing",
       industries: ["other"],
       channels: ["website"],
       description: t("templates.evaluate_content_quality_description"),
@@ -2477,7 +2441,6 @@ const measureTaskAccomplishment = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.measure_task_accomplishment_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "website"],
       description: t("templates.measure_task_accomplishment_description"),
@@ -2660,7 +2623,6 @@ const identifySignUpBarriers = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.identify_sign_up_barriers_name"),
-      role: "marketing",
       industries: ["saas", "eCommerce", "other"],
       channels: ["website"],
       description: t("templates.identify_sign_up_barriers_description"),
@@ -2812,7 +2774,6 @@ const buildProductRoadmap = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.build_product_roadmap_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["app", "link"],
       description: t("templates.build_product_roadmap_description"),
@@ -2847,7 +2808,6 @@ const understandPurchaseIntention = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.understand_purchase_intention_name"),
-      role: "sales",
       industries: ["eCommerce"],
       channels: ["website", "link", "app"],
       description: t("templates.understand_purchase_intention_description"),
@@ -2903,7 +2863,6 @@ const improveNewsletterContent = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.improve_newsletter_content_name"),
-      role: "marketing",
       industries: ["eCommerce", "saas", "other"],
       channels: ["link"],
       description: t("templates.improve_newsletter_content_description"),
@@ -2994,7 +2953,6 @@ const evaluateAProductIdea = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.evaluate_a_product_idea_name"),
-      role: "productManager",
       industries: ["saas", "other"],
       channels: ["link", "app"],
       description: t("templates.evaluate_a_product_idea_description"),
@@ -3097,7 +3055,6 @@ const understandLowEngagement = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.understand_low_engagement_name"),
-      role: "productManager",
       industries: ["saas"],
       channels: ["link"],
       description: t("templates.understand_low_engagement_description"),
@@ -3183,7 +3140,6 @@ const employeeWellBeing = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.employee_well_being_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.employee_well_being_description"),
@@ -3233,7 +3189,6 @@ const longTermRetentionCheckIn = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.long_term_retention_check_in_name"),
-      role: "peopleManager",
       industries: ["saas", "other"],
       channels: ["app", "link"],
       description: t("templates.long_term_retention_check_in_description"),
@@ -3342,7 +3297,6 @@ const professionalDevelopmentGrowth = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.professional_development_growth_survey_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.professional_development_growth_survey_description"),
@@ -3392,7 +3346,6 @@ const recognitionAndReward = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.recognition_and_reward_survey_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.recognition_and_reward_survey_description"),
@@ -3441,7 +3394,6 @@ const alignmentAndEngagement = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.alignment_and_engagement_survey_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.alignment_and_engagement_survey_description"),
@@ -3490,7 +3442,6 @@ const supportiveWorkCulture = (t: TFnType): TTemplate => {
   return buildSurvey(
     {
       name: t("templates.supportive_work_culture_survey_name"),
-      role: "peopleManager",
       industries: ["saas", "eCommerce", "other"],
       channels: ["link"],
       description: t("templates.supportive_work_culture_survey_description"),

apps/web/lib/constants.ts

@@ -114,7 +114,7 @@ export const MAX_FILE_UPLOAD_SIZES = {
   standard: 1024 * 1024 * 10, // 10MB
   big: 1024 * 1024 * 1024, // 1GB
 } as const;
-export const IS_STORAGE_CONFIGURED = Boolean(S3_BUCKET_NAME);
+export const IS_STORAGE_CONFIGURED = Boolean(S3_ACCESS_KEY && S3_SECRET_KEY && S3_REGION && S3_BUCKET_NAME);
 
 // Colors for Survey Bg
 export const SURVEY_BG_COLORS = [

apps/web/lib/jwt.test.ts

@@ -1,7 +1,6 @@
-import jwt from "jsonwebtoken";
+import { env } from "@/lib/env";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
-import * as crypto from "@/lib/crypto";
 import {
   createEmailChangeToken,
   createEmailToken,
@@ -15,69 +14,12 @@ import {
   verifyTokenForLinkSurvey,
 } from "./jwt";
 
-const TEST_ENCRYPTION_KEY = "0".repeat(32); // 32-byte key for AES-256-GCM
-const TEST_NEXTAUTH_SECRET = "test-nextauth-secret";
-const DIFFERENT_SECRET = "different-secret";
-
-// Error message constants
-const NEXTAUTH_SECRET_ERROR = "NEXTAUTH_SECRET is not set";
-const ENCRYPTION_KEY_ERROR = "ENCRYPTION_KEY is not set";
-
-// Helper function to test error cases for missing secrets/keys
-const testMissingSecretsError = async (
-  testFn: (...args: any[]) => any,
-  args: any[],
-  options: {
-    testNextAuthSecret?: boolean;
-    testEncryptionKey?: boolean;
-    isAsync?: boolean;
-  } = {}
-) => {
-  const { testNextAuthSecret = true, testEncryptionKey = true, isAsync = false } = options;
-
-  if (testNextAuthSecret) {
-    const constants = await import("@/lib/constants");
-    const originalSecret = (constants as any).NEXTAUTH_SECRET;
-    (constants as any).NEXTAUTH_SECRET = undefined;
-
-    if (isAsync) {
-      await expect(testFn(...args)).rejects.toThrow(NEXTAUTH_SECRET_ERROR);
-    } else {
-      expect(() => testFn(...args)).toThrow(NEXTAUTH_SECRET_ERROR);
-    }
-
-    // Restore
-    (constants as any).NEXTAUTH_SECRET = originalSecret;
-  }
-
-  if (testEncryptionKey) {
-    const constants = await import("@/lib/constants");
-    const originalKey = (constants as any).ENCRYPTION_KEY;
-    (constants as any).ENCRYPTION_KEY = undefined;
-
-    if (isAsync) {
-      await expect(testFn(...args)).rejects.toThrow(ENCRYPTION_KEY_ERROR);
-    } else {
-      expect(() => testFn(...args)).toThrow(ENCRYPTION_KEY_ERROR);
-    }
-
-    // Restore
-    (constants as any).ENCRYPTION_KEY = originalKey;
-  }
-};
-
 // Mock environment variables
 vi.mock("@/lib/env", () => ({
   env: {
-    ENCRYPTION_KEY: "0".repeat(32),
+    ENCRYPTION_KEY: "0".repeat(32), // 32-byte key for AES-256-GCM
     NEXTAUTH_SECRET: "test-nextauth-secret",
-  },
-}));
-
-// Mock constants
-vi.mock("@/lib/constants", () => ({
-  NEXTAUTH_SECRET: "test-nextauth-secret",
-  ENCRYPTION_KEY: "0".repeat(32),
+  } as typeof env,
 }));
 
 // Mock prisma
@@ -89,65 +31,22 @@ vi.mock("@formbricks/database", () => ({
   },
 }));
 
-// Mock logger
-vi.mock("@formbricks/logger", () => ({
-  logger: {
-    error: vi.fn(),
-    warn: vi.fn(),
-    info: vi.fn(),
-  },
-}));
-
-describe("JWT Functions - Comprehensive Security Tests", () => {
+describe("JWT Functions", () => {
   const mockUser = {
     id: "test-user-id",
     email: "test@example.com",
   };
 
-  let mockSymmetricEncrypt: any;
-  let mockSymmetricDecrypt: any;
-
   beforeEach(() => {
     vi.clearAllMocks();
-
-    // Setup default crypto mocks
-    mockSymmetricEncrypt = vi
-      .spyOn(crypto, "symmetricEncrypt")
-      .mockImplementation((text: string) => `encrypted_${text}`);
-
-    mockSymmetricDecrypt = vi
-      .spyOn(crypto, "symmetricDecrypt")
-      .mockImplementation((encryptedText: string) => encryptedText.replace("encrypted_", ""));
-
     (prisma.user.findUnique as any).mockResolvedValue(mockUser);
   });
 
   describe("createToken", () => {
-    test("should create a valid token with encrypted user ID", () => {
-      const token = createToken(mockUser.id);
+    test("should create a valid token", () => {
+      const token = createToken(mockUser.id, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.id, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should accept custom options", () => {
-      const customOptions = { expiresIn: "1h" };
-      const token = createToken(mockUser.id, customOptions);
-      expect(token).toBeDefined();
-
-      // Verify the token contains the expected expiration
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 1 hour (3600 seconds)
-      expect(decoded.exp - decoded.iat).toBe(3600);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET is not set", async () => {
-      await testMissingSecretsError(createToken, [mockUser.id], {
-        testNextAuthSecret: true,
-        testEncryptionKey: false,
-      });
     });
   });
 
@@ -157,18 +56,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createTokenForLinkSurvey(surveyId, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should include surveyId in payload", () => {
-      const surveyId = "test-survey-id";
-      const token = createTokenForLinkSurvey(surveyId, mockUser.email);
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.surveyId).toBe(surveyId);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createTokenForLinkSurvey, ["survey-id", mockUser.email]);
     });
   });
 
@@ -177,30 +64,24 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createEmailToken(mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
     });
 
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createEmailToken, [mockUser.email]);
+    test("should throw error if NEXTAUTH_SECRET is not set", () => {
+      const originalSecret = env.NEXTAUTH_SECRET;
+      try {
+        (env as any).NEXTAUTH_SECRET = undefined;
+        expect(() => createEmailToken(mockUser.email)).toThrow("NEXTAUTH_SECRET is not set");
+      } finally {
+        (env as any).NEXTAUTH_SECRET = originalSecret;
+      }
     });
   });
 
-  describe("createEmailChangeToken", () => {
-    test("should create a valid email change token with 1 day expiration", () => {
-      const token = createEmailChangeToken(mockUser.id, mockUser.email);
-      expect(token).toBeDefined();
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.id, TEST_ENCRYPTION_KEY);
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 1 day (86400 seconds)
-      expect(decoded.exp - decoded.iat).toBe(86400);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createEmailChangeToken, [mockUser.id, mockUser.email]);
+  describe("getEmailFromEmailToken", () => {
+    test("should extract email from valid token", () => {
+      const token = createEmailToken(mockUser.email);
+      const extractedEmail = getEmailFromEmailToken(token);
+      expect(extractedEmail).toBe(mockUser.email);
     });
   });
 
@@ -210,50 +91,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const token = createInviteToken(inviteId, mockUser.email);
       expect(token).toBeDefined();
       expect(typeof token).toBe("string");
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(inviteId, TEST_ENCRYPTION_KEY);
-      expect(mockSymmetricEncrypt).toHaveBeenCalledWith(mockUser.email, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should accept custom options", () => {
-      const inviteId = "test-invite-id";
-      const customOptions = { expiresIn: "24h" };
-      const token = createInviteToken(inviteId, mockUser.email, customOptions);
-      expect(token).toBeDefined();
-
-      const decoded = jwt.decode(token) as any;
-      expect(decoded.exp).toBeDefined();
-      expect(decoded.iat).toBeDefined();
-      // Should expire in approximately 24 hours (86400 seconds)
-      expect(decoded.exp - decoded.iat).toBe(86400);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(createInviteToken, ["invite-id", mockUser.email]);
-    });
-  });
-
-  describe("getEmailFromEmailToken", () => {
-    test("should extract email from valid token", () => {
-      const token = createEmailToken(mockUser.email);
-      const extractedEmail = getEmailFromEmailToken(token);
-      expect(extractedEmail).toBe(mockUser.email);
-      expect(mockSymmetricDecrypt).toHaveBeenCalledWith(`encrypted_${mockUser.email}`, TEST_ENCRYPTION_KEY);
-    });
-
-    test("should fall back to original email if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementationOnce(() => {
-        throw new Error("Decryption failed");
-      });
-
-      // Create token manually with unencrypted email for legacy compatibility
-      const legacyToken = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      const extractedEmail = getEmailFromEmailToken(legacyToken);
-      expect(extractedEmail).toBe(mockUser.email);
-    });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      const token = jwt.sign({ email: "test@example.com" }, TEST_NEXTAUTH_SECRET);
-      await testMissingSecretsError(getEmailFromEmailToken, [token]);
     });
   });
 
@@ -269,194 +106,23 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       const result = verifyTokenForLinkSurvey("invalid-token", "test-survey-id");
       expect(result).toBeNull();
     });
-
-    test("should return null if NEXTAUTH_SECRET is not set", async () => {
-      const constants = await import("@/lib/constants");
-      const originalSecret = (constants as any).NEXTAUTH_SECRET;
-      (constants as any).NEXTAUTH_SECRET = undefined;
-
-      const result = verifyTokenForLinkSurvey("any-token", "test-survey-id");
-      expect(result).toBeNull();
-
-      // Restore
-      (constants as any).NEXTAUTH_SECRET = originalSecret;
-    });
-
-    test("should return null if surveyId doesn't match", () => {
-      const surveyId = "test-survey-id";
-      const differentSurveyId = "different-survey-id";
-      const token = createTokenForLinkSurvey(surveyId, mockUser.email);
-      const result = verifyTokenForLinkSurvey(token, differentSurveyId);
-      expect(result).toBeNull();
-    });
-
-    test("should return null if email is missing from payload", () => {
-      const tokenWithoutEmail = jwt.sign({ surveyId: "test-survey-id" }, TEST_NEXTAUTH_SECRET);
-      const result = verifyTokenForLinkSurvey(tokenWithoutEmail, "test-survey-id");
-      expect(result).toBeNull();
-    });
-
-    test("should fall back to original email if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementationOnce(() => {
-        throw new Error("Decryption failed");
-      });
-
-      // Create legacy token with unencrypted email
-      const legacyToken = jwt.sign(
-        {
-          email: mockUser.email,
-          surveyId: "test-survey-id",
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const result = verifyTokenForLinkSurvey(legacyToken, "test-survey-id");
-      expect(result).toBe(mockUser.email);
-    });
-
-    test("should fall back to original email if ENCRYPTION_KEY is not set", async () => {
-      const constants = await import("@/lib/constants");
-      const originalKey = (constants as any).ENCRYPTION_KEY;
-      (constants as any).ENCRYPTION_KEY = undefined;
-
-      // Create a token with unencrypted email (as it would be if ENCRYPTION_KEY was not set during creation)
-      const token = jwt.sign(
-        {
-          email: mockUser.email,
-          surveyId: "survey-id",
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const result = verifyTokenForLinkSurvey(token, "survey-id");
-      expect(result).toBe(mockUser.email);
-
-      // Restore
-      (constants as any).ENCRYPTION_KEY = originalKey;
-    });
-
-    test("should verify legacy survey tokens with surveyId-based secret", async () => {
-      const surveyId = "test-survey-id";
-
-      // Create legacy token with old format (NEXTAUTH_SECRET + surveyId)
-      const legacyToken = jwt.sign({ email: `encrypted_${mockUser.email}` }, TEST_NEXTAUTH_SECRET + surveyId);
-
-      const result = verifyTokenForLinkSurvey(legacyToken, surveyId);
-      expect(result).toBe(mockUser.email);
-    });
-
-    test("should reject survey tokens that fail both new and legacy verification", async () => {
-      const surveyId = "test-survey-id";
-      const invalidToken = jwt.sign({ email: "encrypted_test@example.com" }, "wrong-secret");
-
-      const result = verifyTokenForLinkSurvey(invalidToken, surveyId);
-      expect(result).toBeNull();
-
-      // Verify error logging
-      const { logger } = await import("@formbricks/logger");
-      expect(logger.error).toHaveBeenCalledWith(expect.any(Error), "Survey link token verification failed");
-    });
-
-    test("should reject legacy survey tokens for wrong survey", () => {
-      const correctSurveyId = "correct-survey-id";
-      const wrongSurveyId = "wrong-survey-id";
-
-      // Create legacy token for one survey
-      const legacyToken = jwt.sign(
-        { email: `encrypted_${mockUser.email}` },
-        TEST_NEXTAUTH_SECRET + correctSurveyId
-      );
-
-      // Try to verify with different survey ID
-      const result = verifyTokenForLinkSurvey(legacyToken, wrongSurveyId);
-      expect(result).toBeNull();
-    });
   });
 
   describe("verifyToken", () => {
     test("should verify valid token", async () => {
-      const token = createToken(mockUser.id);
+      const token = createToken(mockUser.id, mockUser.email);
       const verified = await verifyToken(token);
       expect(verified).toEqual({
-        id: mockUser.id, // Returns the decrypted user ID
+        id: mockUser.id,
         email: mockUser.email,
       });
     });
 
     test("should throw error if user not found", async () => {
       (prisma.user.findUnique as any).mockResolvedValue(null);
-      const token = createToken(mockUser.id);
+      const token = createToken(mockUser.id, mockUser.email);
       await expect(verifyToken(token)).rejects.toThrow("User not found");
     });
-
-    test("should throw error if NEXTAUTH_SECRET is not set", async () => {
-      await testMissingSecretsError(verifyToken, ["any-token"], {
-        testNextAuthSecret: true,
-        testEncryptionKey: false,
-        isAsync: true,
-      });
-    });
-
-    test("should throw error for invalid token signature", async () => {
-      const invalidToken = jwt.sign({ id: "test-id" }, DIFFERENT_SECRET);
-      await expect(verifyToken(invalidToken)).rejects.toThrow("Invalid token");
-    });
-
-    test("should throw error if token payload is missing id", async () => {
-      const tokenWithoutId = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyToken(tokenWithoutId)).rejects.toThrow("Invalid token");
-    });
-
-    test("should return raw id from payload", async () => {
-      // Create token with unencrypted id
-      const token = jwt.sign({ id: mockUser.id }, TEST_NEXTAUTH_SECRET);
-      const verified = await verifyToken(token);
-      expect(verified).toEqual({
-        id: mockUser.id, // Returns the raw ID from payload
-        email: mockUser.email,
-      });
-    });
-
-    test("should verify legacy tokens with email-based secret", async () => {
-      // Create legacy token with old format (NEXTAUTH_SECRET + userEmail)
-      const legacyToken = jwt.sign({ id: `encrypted_${mockUser.id}` }, TEST_NEXTAUTH_SECRET + mockUser.email);
-
-      const verified = await verifyToken(legacyToken);
-      expect(verified).toEqual({
-        id: mockUser.id, // Returns the decrypted user ID
-        email: mockUser.email,
-      });
-    });
-
-    test("should prioritize new tokens over legacy tokens", async () => {
-      // Create both new and legacy tokens for the same user
-      const newToken = createToken(mockUser.id);
-      const legacyToken = jwt.sign({ id: `encrypted_${mockUser.id}` }, TEST_NEXTAUTH_SECRET + mockUser.email);
-
-      // New token should verify without triggering legacy path
-      const verifiedNew = await verifyToken(newToken);
-      expect(verifiedNew.id).toBe(mockUser.id); // Returns decrypted user ID
-
-      // Legacy token should trigger legacy path
-      const verifiedLegacy = await verifyToken(legacyToken);
-      expect(verifiedLegacy.id).toBe(mockUser.id); // Returns decrypted user ID
-    });
-
-    test("should reject tokens that fail both new and legacy verification", async () => {
-      const invalidToken = jwt.sign({ id: "encrypted_test-id" }, "wrong-secret");
-      await expect(verifyToken(invalidToken)).rejects.toThrow("Invalid token");
-
-      // Verify both methods were attempted
-      const { logger } = await import("@formbricks/logger");
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.any(Error),
-        "Token verification failed with new method"
-      );
-      expect(logger.error).toHaveBeenCalledWith(
-        expect.any(Error),
-        "Token verification failed with legacy method"
-      );
-    });
   });
 
   describe("verifyInviteToken", () => {
@@ -473,53 +139,6 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
     test("should throw error for invalid token", () => {
       expect(() => verifyInviteToken("invalid-token")).toThrow("Invalid or expired invite token");
     });
-
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(verifyInviteToken, ["any-token"]);
-    });
-
-    test("should throw error if inviteId is missing", () => {
-      const tokenWithoutInviteId = jwt.sign({ email: mockUser.email }, TEST_NEXTAUTH_SECRET);
-      expect(() => verifyInviteToken(tokenWithoutInviteId)).toThrow("Invalid or expired invite token");
-    });
-
-    test("should throw error if email is missing", () => {
-      const tokenWithoutEmail = jwt.sign({ inviteId: "test-invite-id" }, TEST_NEXTAUTH_SECRET);
-      expect(() => verifyInviteToken(tokenWithoutEmail)).toThrow("Invalid or expired invite token");
-    });
-
-    test("should fall back to original values if decryption fails", () => {
-      mockSymmetricDecrypt.mockImplementation(() => {
-        throw new Error("Decryption failed");
-      });
-
-      const inviteId = "test-invite-id";
-      const legacyToken = jwt.sign(
-        {
-          inviteId,
-          email: mockUser.email,
-        },
-        TEST_NEXTAUTH_SECRET
-      );
-
-      const verified = verifyInviteToken(legacyToken);
-      expect(verified).toEqual({
-        inviteId,
-        email: mockUser.email,
-      });
-    });
-
-    test("should throw error for token with wrong signature", () => {
-      const invalidToken = jwt.sign(
-        {
-          inviteId: "test-invite-id",
-          email: mockUser.email,
-        },
-        DIFFERENT_SECRET
-      );
-
-      expect(() => verifyInviteToken(invalidToken)).toThrow("Invalid or expired invite token");
-    });
   });
 
   describe("verifyEmailChangeToken", () => {
@@ -531,478 +150,22 @@ describe("JWT Functions - Comprehensive Security Tests", () => {
       expect(result).toEqual({ id: userId, email });
     });
 
-    test("should throw error if NEXTAUTH_SECRET or ENCRYPTION_KEY is not set", async () => {
-      await testMissingSecretsError(verifyEmailChangeToken, ["any-token"], { isAsync: true });
-    });
-
     test("should throw error if token is invalid or missing fields", async () => {
-      const token = jwt.sign({ foo: "bar" }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyEmailChangeToken(token)).rejects.toThrow(
-        "Token is invalid or missing required fields"
-      );
-    });
-
-    test("should throw error if id is missing", async () => {
-      const token = jwt.sign({ email: "test@example.com" }, TEST_NEXTAUTH_SECRET);
-      await expect(verifyEmailChangeToken(token)).rejects.toThrow(
-        "Token is invalid or missing required fields"
-      );
-    });
-
-    test("should throw error if email is missing", async () => {
-      const token = jwt.sign({ id: "test-id" }, TEST_NEXTAUTH_SECRET);
+      // Create a token with missing fields
+      const jwt = await import("jsonwebtoken");
+      const token = jwt.sign({ foo: "bar" }, env.NEXTAUTH_SECRET as string);
       await expect(verifyEmailChangeToken(token)).rejects.toThrow(
         "Token is invalid or missing required fields"
       );
     });
 
     test("should return original id/email if decryption fails", async () => {
-      mockSymmetricDecrypt.mockImplementation(() => {
-        throw new Error("Decryption failed");
-      });
-
+      // Create a token with non-encrypted id/email
+      const jwt = await import("jsonwebtoken");
       const payload = { id: "plain-id", email: "plain@example.com" };
-      const token = jwt.sign(payload, TEST_NEXTAUTH_SECRET);
+      const token = jwt.sign(payload, env.NEXTAUTH_SECRET as string);
       const result = await verifyEmailChangeToken(token);
       expect(result).toEqual(payload);
     });
-
-    test("should throw error for token with wrong signature", async () => {
-      const invalidToken = jwt.sign(
-        {
-          id: "test-id",
-          email: "test@example.com",
-        },
-        DIFFERENT_SECRET
-      );
-
-      await expect(verifyEmailChangeToken(invalidToken)).rejects.toThrow();
-    });
-  });
-
-  // SECURITY SCENARIO TESTS
-  describe("Security Scenarios", () => {
-    describe("Algorithm Confusion Attack Prevention", () => {
-      test("should reject 'none' algorithm tokens in verifyToken", async () => {
-        // Create malicious token with "none" algorithm
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              id: "encrypted_malicious-id",
-            })
-          ).toString("base64url") +
-          ".";
-
-        await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject 'none' algorithm tokens in verifyTokenForLinkSurvey", () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              email: "encrypted_attacker@evil.com",
-              surveyId: "test-survey-id",
-            })
-          ).toString("base64url") +
-          ".";
-
-        const result = verifyTokenForLinkSurvey(maliciousToken, "test-survey-id");
-        expect(result).toBeNull();
-      });
-
-      test("should reject 'none' algorithm tokens in verifyInviteToken", () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              inviteId: "encrypted_malicious-invite",
-              email: "encrypted_attacker@evil.com",
-            })
-          ).toString("base64url") +
-          ".";
-
-        expect(() => verifyInviteToken(maliciousToken)).toThrow("Invalid or expired invite token");
-      });
-
-      test("should reject 'none' algorithm tokens in verifyEmailChangeToken", async () => {
-        const maliciousToken =
-          Buffer.from(
-            JSON.stringify({
-              alg: "none",
-              typ: "JWT",
-            })
-          ).toString("base64url") +
-          "." +
-          Buffer.from(
-            JSON.stringify({
-              id: "encrypted_malicious-id",
-              email: "encrypted_attacker@evil.com",
-            })
-          ).toString("base64url") +
-          ".";
-
-        await expect(verifyEmailChangeToken(maliciousToken)).rejects.toThrow();
-      });
-
-      test("should reject RS256 algorithm tokens (HS256/RS256 confusion)", async () => {
-        // Create malicious token with RS256 algorithm header but HS256 signature
-        const maliciousHeader = Buffer.from(
-          JSON.stringify({
-            alg: "RS256",
-            typ: "JWT",
-          })
-        ).toString("base64url");
-
-        const maliciousPayload = Buffer.from(
-          JSON.stringify({
-            id: "encrypted_malicious-id",
-          })
-        ).toString("base64url");
-
-        // Create signature using HMAC (as if it were HS256)
-        const crypto = require("crypto");
-        const signature = crypto
-          .createHmac("sha256", TEST_NEXTAUTH_SECRET)
-          .update(`${maliciousHeader}.${maliciousPayload}`)
-          .digest("base64url");
-
-        const maliciousToken = `${maliciousHeader}.${maliciousPayload}.${signature}`;
-
-        await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should only accept HS256 algorithm", async () => {
-        // Test that other valid algorithms are rejected
-        const otherAlgorithms = ["HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512"];
-
-        for (const alg of otherAlgorithms) {
-          const maliciousHeader = Buffer.from(
-            JSON.stringify({
-              alg,
-              typ: "JWT",
-            })
-          ).toString("base64url");
-
-          const maliciousPayload = Buffer.from(
-            JSON.stringify({
-              id: "encrypted_test-id",
-            })
-          ).toString("base64url");
-
-          const maliciousToken = `${maliciousHeader}.${maliciousPayload}.fake-signature`;
-
-          await expect(verifyToken(maliciousToken)).rejects.toThrow("Invalid token");
-        }
-      });
-    });
-
-    describe("Token Tampering", () => {
-      test("should reject tokens with modified payload", async () => {
-        const token = createToken(mockUser.id);
-        const [header, payload, signature] = token.split(".");
-
-        // Modify the payload
-        const decodedPayload = JSON.parse(Buffer.from(payload, "base64url").toString());
-        decodedPayload.id = "malicious-id";
-        const tamperedPayload = Buffer.from(JSON.stringify(decodedPayload)).toString("base64url");
-        const tamperedToken = `${header}.${tamperedPayload}.${signature}`;
-
-        await expect(verifyToken(tamperedToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject tokens with modified signature", async () => {
-        const token = createToken(mockUser.id);
-        const [header, payload] = token.split(".");
-        const tamperedToken = `${header}.${payload}.tamperedsignature`;
-
-        await expect(verifyToken(tamperedToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject malformed tokens", async () => {
-        const malformedTokens = [
-          "not.a.jwt",
-          "only.two.parts",
-          "too.many.parts.here.invalid",
-          "",
-          "invalid-base64",
-        ];
-
-        for (const malformedToken of malformedTokens) {
-          await expect(verifyToken(malformedToken)).rejects.toThrow();
-        }
-      });
-    });
-
-    describe("Cross-Survey Token Reuse", () => {
-      test("should reject survey tokens used for different surveys", () => {
-        const surveyId1 = "survey-1";
-        const surveyId2 = "survey-2";
-
-        const token = createTokenForLinkSurvey(surveyId1, mockUser.email);
-        const result = verifyTokenForLinkSurvey(token, surveyId2);
-
-        expect(result).toBeNull();
-      });
-    });
-
-    describe("Expired Tokens", () => {
-      test("should reject expired tokens", async () => {
-        const expiredToken = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            exp: Math.floor(Date.now() / 1000) - 3600, // Expired 1 hour ago
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        await expect(verifyToken(expiredToken)).rejects.toThrow("Invalid token");
-      });
-
-      test("should reject expired email change tokens", async () => {
-        const expiredToken = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            email: "encrypted_test@example.com",
-            exp: Math.floor(Date.now() / 1000) - 3600, // Expired 1 hour ago
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        await expect(verifyEmailChangeToken(expiredToken)).rejects.toThrow();
-      });
-    });
-
-    describe("Encryption Key Attacks", () => {
-      test("should fail gracefully with wrong encryption key", async () => {
-        mockSymmetricDecrypt.mockImplementation(() => {
-          throw new Error("Authentication tag verification failed");
-        });
-
-        // Mock findUnique to only return user for correct decrypted ID, not ciphertext
-        (prisma.user.findUnique as any).mockImplementation(({ where }: { where: { id: string } }) => {
-          if (where.id === mockUser.id) {
-            return Promise.resolve(mockUser);
-          }
-          return Promise.resolve(null); // Return null for ciphertext IDs
-        });
-
-        const token = createToken(mockUser.id);
-        // Should fail because ciphertext passed as userId won't match any user in DB
-        await expect(verifyToken(token)).rejects.toThrow(/User not found/i);
-      });
-
-      test("should handle encryption key not set gracefully", async () => {
-        const constants = await import("@/lib/constants");
-        const originalKey = (constants as any).ENCRYPTION_KEY;
-        (constants as any).ENCRYPTION_KEY = undefined;
-
-        const token = jwt.sign(
-          {
-            email: "test@example.com",
-            surveyId: "test-survey-id",
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        const result = verifyTokenForLinkSurvey(token, "test-survey-id");
-        expect(result).toBe("test@example.com");
-
-        // Restore
-        (constants as any).ENCRYPTION_KEY = originalKey;
-      });
-    });
-
-    describe("SQL Injection Attempts", () => {
-      test("should safely handle malicious user IDs", async () => {
-        const maliciousIds = [
-          "'; DROP TABLE users; --",
-          "1' OR '1'='1",
-          "admin'/*",
-          "<script>alert('xss')</script>",
-          "../../etc/passwd",
-        ];
-
-        for (const maliciousId of maliciousIds) {
-          mockSymmetricDecrypt.mockReturnValueOnce(maliciousId);
-
-          const token = jwt.sign({ id: "encrypted_malicious" }, TEST_NEXTAUTH_SECRET);
-
-          // The function should look up the user safely
-          await verifyToken(token);
-          expect(prisma.user.findUnique).toHaveBeenCalledWith({
-            where: { id: maliciousId },
-          });
-        }
-      });
-    });
-
-    describe("Token Reuse and Replay Attacks", () => {
-      test("should allow legitimate token reuse within validity period", async () => {
-        const token = createToken(mockUser.id);
-
-        // First use
-        const result1 = await verifyToken(token);
-        expect(result1.id).toBe(mockUser.id); // Returns decrypted user ID
-
-        // Second use (should still work)
-        const result2 = await verifyToken(token);
-        expect(result2.id).toBe(mockUser.id); // Returns decrypted user ID
-      });
-    });
-
-    describe("Legacy Token Compatibility", () => {
-      test("should handle legacy unencrypted tokens gracefully", async () => {
-        // Legacy token with plain text data
-        const legacyToken = jwt.sign({ id: mockUser.id }, TEST_NEXTAUTH_SECRET);
-        const result = await verifyToken(legacyToken);
-
-        expect(result.id).toBe(mockUser.id); // Returns raw ID from payload
-        expect(result.email).toBe(mockUser.email);
-      });
-
-      test("should handle mixed encrypted/unencrypted fields", async () => {
-        mockSymmetricDecrypt
-          .mockImplementationOnce(() => mockUser.id) // id decrypts successfully
-          .mockImplementationOnce(() => {
-            throw new Error("Email not encrypted");
-          }); // email fails
-
-        const token = jwt.sign(
-          {
-            id: "encrypted_test-id",
-            email: "plain-email@example.com",
-          },
-          TEST_NEXTAUTH_SECRET
-        );
-
-        const result = await verifyEmailChangeToken(token);
-        expect(result.id).toBe(mockUser.id);
-        expect(result.email).toBe("plain-email@example.com");
-      });
-
-      test("should verify old format user tokens with email-based secrets", async () => {
-        // Simulate old token format with per-user secret
-        const oldFormatToken = jwt.sign(
-          { id: `encrypted_${mockUser.id}` },
-          TEST_NEXTAUTH_SECRET + mockUser.email
-        );
-
-        const result = await verifyToken(oldFormatToken);
-        expect(result.id).toBe(mockUser.id); // Returns decrypted user ID
-        expect(result.email).toBe(mockUser.email);
-      });
-
-      test("should verify old format survey tokens with survey-based secrets", () => {
-        const surveyId = "legacy-survey-id";
-
-        // Simulate old survey token format
-        const oldFormatSurveyToken = jwt.sign(
-          { email: `encrypted_${mockUser.email}` },
-          TEST_NEXTAUTH_SECRET + surveyId
-        );
-
-        const result = verifyTokenForLinkSurvey(oldFormatSurveyToken, surveyId);
-        expect(result).toBe(mockUser.email);
-      });
-
-      test("should gracefully handle database errors during legacy verification", async () => {
-        // Create token that will fail new method
-        const legacyToken = jwt.sign(
-          { id: `encrypted_${mockUser.id}` },
-          TEST_NEXTAUTH_SECRET + mockUser.email
-        );
-
-        // Make database lookup fail
-        (prisma.user.findUnique as any).mockRejectedValueOnce(new Error("DB connection lost"));
-
-        await expect(verifyToken(legacyToken)).rejects.toThrow("DB connection lost");
-      });
-    });
-
-    describe("Edge Cases and Error Handling", () => {
-      test("should handle database connection errors gracefully", async () => {
-        (prisma.user.findUnique as any).mockRejectedValue(new Error("Database connection failed"));
-
-        const token = createToken(mockUser.id);
-        await expect(verifyToken(token)).rejects.toThrow("Database connection failed");
-      });
-
-      test("should handle crypto module errors", () => {
-        mockSymmetricEncrypt.mockImplementation(() => {
-          throw new Error("Crypto module error");
-        });
-
-        expect(() => createToken(mockUser.id)).toThrow("Crypto module error");
-      });
-
-      test("should validate email format in tokens", () => {
-        const invalidEmails = ["", "not-an-email", "missing@", "@missing-local.com", "spaces in@email.com"];
-
-        invalidEmails.forEach((invalidEmail) => {
-          expect(() => createEmailToken(invalidEmail)).not.toThrow();
-          // Note: JWT functions don't validate email format, they just encrypt/decrypt
-          // Email validation should happen at a higher level
-        });
-      });
-
-      test("should handle extremely long inputs", () => {
-        const longString = "a".repeat(10000);
-
-        expect(() => createToken(longString)).not.toThrow();
-        expect(() => createEmailToken(longString)).not.toThrow();
-      });
-
-      test("should handle special characters in user data", () => {
-        const specialChars = "!@#$%^&*()_+-=[]{}|;:'\",.<>?/~`";
-
-        expect(() => createToken(specialChars)).not.toThrow();
-        expect(() => createEmailToken(specialChars)).not.toThrow();
-      });
-    });
-
-    describe("Performance and Resource Exhaustion", () => {
-      test("should handle rapid token creation without memory leaks", () => {
-        const tokens: string[] = [];
-        for (let i = 0; i < 1000; i++) {
-          tokens.push(createToken(`user-${i}`));
-        }
-
-        expect(tokens.length).toBe(1000);
-        expect(tokens.every((token) => typeof token === "string")).toBe(true);
-      });
-
-      test("should handle rapid token verification", async () => {
-        const token = createToken(mockUser.id);
-
-        const verifications: Promise<any>[] = [];
-        for (let i = 0; i < 100; i++) {
-          verifications.push(verifyToken(token));
-        }
-
-        const results = await Promise.all(verifications);
-        expect(results.length).toBe(100);
-        expect(results.every((result: any) => result.id === mockUser.id)).toBe(true); // Returns decrypted user ID
-      });
-    });
   });
 });

apps/web/lib/jwt.ts

@@ -1,64 +1,43 @@
+import { symmetricDecrypt, symmetricEncrypt } from "@/lib/crypto";
+import { env } from "@/lib/env";
 import jwt, { JwtPayload } from "jsonwebtoken";
 import { prisma } from "@formbricks/database";
 import { logger } from "@formbricks/logger";
-import { ENCRYPTION_KEY, NEXTAUTH_SECRET } from "@/lib/constants";
-import { symmetricDecrypt, symmetricEncrypt } from "@/lib/crypto";
 
-// Helper function to decrypt with fallback to plain text
-const decryptWithFallback = (encryptedText: string, key: string): string => {
-  try {
-    return symmetricDecrypt(encryptedText, key);
-  } catch {
-    return encryptedText; // Return as-is if decryption fails (legacy format)
-  }
-};
-
-export const createToken = (userId: string, options = {}): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedUserId = symmetricEncrypt(userId, ENCRYPTION_KEY);
-  return jwt.sign({ id: encryptedUserId }, NEXTAUTH_SECRET, options);
+export const createToken = (userId: string, userEmail: string, options = {}): string => {
+  const encryptedUserId = symmetricEncrypt(userId, env.ENCRYPTION_KEY);
+  return jwt.sign({ id: encryptedUserId }, env.NEXTAUTH_SECRET + userEmail, options);
 };
 export const createTokenForLinkSurvey = (surveyId: string, userEmail: string): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedEmail = symmetricEncrypt(userEmail, ENCRYPTION_KEY);
-  return jwt.sign({ email: encryptedEmail, surveyId }, NEXTAUTH_SECRET);
+  const encryptedEmail = symmetricEncrypt(userEmail, env.ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, env.NEXTAUTH_SECRET + surveyId);
 };
 
 export const verifyEmailChangeToken = async (token: string): Promise<{ id: string; email: string }> => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as {
-    id: string;
-    email: string;
-  };
+  const payload = jwt.verify(token, env.NEXTAUTH_SECRET) as { id: string; email: string };
 
   if (!payload?.id || !payload?.email) {
     throw new Error("Token is invalid or missing required fields");
   }
 
-  // Decrypt both fields with fallback
-  const decryptedId = decryptWithFallback(payload.id, ENCRYPTION_KEY);
-  const decryptedEmail = decryptWithFallback(payload.email, ENCRYPTION_KEY);
+  let decryptedId: string;
+  let decryptedEmail: string;
+
+  try {
+    decryptedId = symmetricDecrypt(payload.id, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedId = payload.id;
+  }
+
+  try {
+    decryptedEmail = symmetricDecrypt(payload.email, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedEmail = payload.email;
+  }
 
   return {
     id: decryptedId,
@@ -67,230 +46,127 @@ export const verifyEmailChangeToken = async (token: string): Promise<{ id: strin
 };
 
 export const createEmailChangeToken = (userId: string, email: string): string => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedUserId = symmetricEncrypt(userId, ENCRYPTION_KEY);
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
+  const encryptedUserId = symmetricEncrypt(userId, env.ENCRYPTION_KEY);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
 
   const payload = {
     id: encryptedUserId,
     email: encryptedEmail,
   };
 
-  return jwt.sign(payload, NEXTAUTH_SECRET, {
+  return jwt.sign(payload, env.NEXTAUTH_SECRET as string, {
     expiresIn: "1d",
   });
 };
-
 export const createEmailToken = (email: string): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
-  return jwt.sign({ email: encryptedEmail }, NEXTAUTH_SECRET);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, env.NEXTAUTH_SECRET);
 };
 
 export const getEmailFromEmailToken = (token: string): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
 
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
+  const payload = jwt.verify(token, env.NEXTAUTH_SECRET) as JwtPayload;
+  try {
+    // Try to decrypt first (for newer tokens)
+    const decryptedEmail = symmetricDecrypt(payload.email, env.ENCRYPTION_KEY);
+    return decryptedEmail;
+  } catch {
+    // If decryption fails, return the original email (for older tokens)
+    return payload.email;
   }
-
-  const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-    email: string;
-  };
-  return decryptWithFallback(payload.email, ENCRYPTION_KEY);
 };
 
 export const createInviteToken = (inviteId: string, email: string, options = {}): string => {
-  if (!NEXTAUTH_SECRET) {
+  if (!env.NEXTAUTH_SECRET) {
     throw new Error("NEXTAUTH_SECRET is not set");
   }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
-  const encryptedInviteId = symmetricEncrypt(inviteId, ENCRYPTION_KEY);
-  const encryptedEmail = symmetricEncrypt(email, ENCRYPTION_KEY);
-  return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, NEXTAUTH_SECRET, options);
+  const encryptedInviteId = symmetricEncrypt(inviteId, env.ENCRYPTION_KEY);
+  const encryptedEmail = symmetricEncrypt(email, env.ENCRYPTION_KEY);
+  return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, env.NEXTAUTH_SECRET, options);
 };
 
 export const verifyTokenForLinkSurvey = (token: string, surveyId: string): string | null => {
-  if (!NEXTAUTH_SECRET) {
-    return null;
-  }
-
   try {
-    let payload: JwtPayload & { email: string; surveyId?: string };
-
-    // Try primary method first (consistent secret)
+    const { email } = jwt.verify(token, env.NEXTAUTH_SECRET + surveyId) as JwtPayload;
     try {
-      payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-        email: string;
-        surveyId: string;
-      };
-    } catch (primaryError) {
-      logger.error(primaryError, "Token verification failed with primary method");
-
-      // Fallback to legacy method (surveyId-based secret)
-      try {
-        payload = jwt.verify(token, NEXTAUTH_SECRET + surveyId, { algorithms: ["HS256"] }) as JwtPayload & {
-          email: string;
-        };
-      } catch (legacyError) {
-        logger.error(legacyError, "Token verification failed with legacy method");
-        throw new Error("Invalid token");
+      // Try to decrypt first (for newer tokens)
+      if (!env.ENCRYPTION_KEY) {
+        throw new Error("ENCRYPTION_KEY is not set");
       }
+      const decryptedEmail = symmetricDecrypt(email, env.ENCRYPTION_KEY);
+      return decryptedEmail;
+    } catch {
+      // If decryption fails, return the original email (for older tokens)
+      return email;
     }
-
-    // Verify the surveyId matches if present in payload (new format)
-    if (payload.surveyId && payload.surveyId !== surveyId) {
-      return null;
-    }
-
-    const { email } = payload;
-    if (!email) {
-      return null;
-    }
-
-    // Decrypt email with fallback to plain text
-    if (!ENCRYPTION_KEY) {
-      return email; // Return as-is if encryption key not set
-    }
-
-    return decryptWithFallback(email, ENCRYPTION_KEY);
-  } catch (error) {
-    logger.error(error, "Survey link token verification failed");
+  } catch (err) {
     return null;
   }
 };
 
-// Helper function to get user email for legacy verification
-const getUserEmailForLegacyVerification = async (
-  token: string,
-  userId?: string
-): Promise<{ userId: string; userEmail: string }> => {
-  if (!userId) {
-    const decoded = jwt.decode(token);
+export const verifyToken = async (token: string): Promise<JwtPayload> => {
+  // First decode to get the ID
+  const decoded = jwt.decode(token);
+  const payload: JwtPayload = decoded as JwtPayload;
 
-    // Validate decoded token structure before using it
-    if (
-      !decoded ||
-      typeof decoded !== "object" ||
-      !decoded.id ||
-      typeof decoded.id !== "string" ||
-      decoded.id.trim() === ""
-    ) {
-      logger.error("Invalid token: missing or invalid user ID");
-      throw new Error("Invalid token");
-    }
-
-    userId = decoded.id;
+  if (!payload) {
+    throw new Error("Token is invalid");
   }
 
-  const decryptedId = decryptWithFallback(userId, ENCRYPTION_KEY);
-
-  // Validate decrypted ID before database query
-  if (!decryptedId || typeof decryptedId !== "string" || decryptedId.trim() === "") {
-    logger.error("Invalid token: missing or invalid user ID");
-    throw new Error("Invalid token");
+  const { id } = payload;
+  if (!id) {
+    throw new Error("Token missing required field: id");
   }
 
+  // Try to decrypt the ID (for newer tokens), if it fails use the ID as-is (for older tokens)
+  let decryptedId: string;
+  try {
+    decryptedId = symmetricDecrypt(id, env.ENCRYPTION_KEY);
+  } catch {
+    decryptedId = id;
+  }
+
+  // If no email provided, look up the user
   const foundUser = await prisma.user.findUnique({
     where: { id: decryptedId },
   });
 
   if (!foundUser) {
-    const errorMessage = "User not found";
-    logger.error(errorMessage);
-    throw new Error(errorMessage);
+    throw new Error("User not found");
   }
 
-  return { userId: decryptedId, userEmail: foundUser.email };
-};
+  const userEmail = foundUser.email;
 
-export const verifyToken = async (token: string): Promise<JwtPayload> => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  let payload: JwtPayload & { id: string };
-  let userData: { userId: string; userEmail: string } | null = null;
-
-  // Try new method first, with smart fallback to legacy
-  try {
-    payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-      id: string;
-    };
-  } catch (newMethodError) {
-    logger.error(newMethodError, "Token verification failed with new method");
-
-    // Get user email for legacy verification
-    userData = await getUserEmailForLegacyVerification(token);
-
-    // Try legacy verification with email-based secret
-    try {
-      payload = jwt.verify(token, NEXTAUTH_SECRET + userData.userEmail, {
-        algorithms: ["HS256"],
-      }) as JwtPayload & {
-        id: string;
-      };
-    } catch (legacyMethodError) {
-      logger.error(legacyMethodError, "Token verification failed with legacy method");
-      throw new Error("Invalid token");
-    }
-  }
-
-  if (!payload?.id) {
-    throw new Error("Invalid token");
-  }
-
-  // Get user email if we don't have it yet
-  userData ??= await getUserEmailForLegacyVerification(token, payload.id);
-
-  return { id: userData.userId, email: userData.userEmail };
+  return { id: decryptedId, email: userEmail };
 };
 
 export const verifyInviteToken = (token: string): { inviteId: string; email: string } => {
-  if (!NEXTAUTH_SECRET) {
-    throw new Error("NEXTAUTH_SECRET is not set");
-  }
-
-  if (!ENCRYPTION_KEY) {
-    throw new Error("ENCRYPTION_KEY is not set");
-  }
-
   try {
-    const payload = jwt.verify(token, NEXTAUTH_SECRET, { algorithms: ["HS256"] }) as JwtPayload & {
-      inviteId: string;
-      email: string;
-    };
+    const decoded = jwt.decode(token);
+    const payload: JwtPayload = decoded as JwtPayload;
 
-    const { inviteId: encryptedInviteId, email: encryptedEmail } = payload;
+    const { inviteId, email } = payload;
 
-    if (!encryptedInviteId || !encryptedEmail) {
-      throw new Error("Invalid token");
+    let decryptedInviteId: string;
+    let decryptedEmail: string;
+
+    try {
+      // Try to decrypt first (for newer tokens)
+      decryptedInviteId = symmetricDecrypt(inviteId, env.ENCRYPTION_KEY);
+      decryptedEmail = symmetricDecrypt(email, env.ENCRYPTION_KEY);
+    } catch {
+      // If decryption fails, use original values (for older tokens)
+      decryptedInviteId = inviteId;
+      decryptedEmail = email;
     }
 
-    // Decrypt both fields with fallback to original values
-    const decryptedInviteId = decryptWithFallback(encryptedInviteId, ENCRYPTION_KEY);
-    const decryptedEmail = decryptWithFallback(encryptedEmail, ENCRYPTION_KEY);
-
     return {
       inviteId: decryptedInviteId,
       email: decryptedEmail,

apps/web/lib/responses.ts

@@ -1,11 +1,11 @@
 import { parseRecallInfo } from "@/lib/utils/recall";
-import { TResponse, TResponseDataValue } from "@formbricks/types/responses";
+import { TResponse } from "@formbricks/types/responses";
 import { TSurvey, TSurveyQuestion, TSurveyQuestionType } from "@formbricks/types/surveys/types";
 import { getLanguageCode, getLocalizedValue } from "./i18n/utils";
 
 // function to convert response value of type string | number | string[] or Record<string, string> to string | string[]
 export const convertResponseValue = (
-  answer: TResponseDataValue,
+  answer: string | number | string[] | Record<string, string>,
   question: TSurveyQuestion
 ): string | string[] => {
   switch (question.type) {
@@ -57,7 +57,9 @@ export const getQuestionResponseMapping = (
   return questionResponseMapping;
 };
 
-export const processResponseData = (responseData: TResponseDataValue): string => {
+export const processResponseData = (
+  responseData: string | number | string[] | Record<string, string>
+): string => {
   switch (typeof responseData) {
     case "string":
       return responseData;

apps/web/lib/surveyLogic/utils.ts

@@ -450,7 +450,7 @@ const evaluateSingleCondition = (
         return (
           Array.isArray(leftValue) &&
           Array.isArray(rightValue) &&
-          !rightValue.some((v) => leftValue.includes(v))
+          rightValue.some((v) => !leftValue.includes(v))
         );
       case "isAccepted":
         return leftValue === "accepted";

apps/web/lib/utils/strings.test.ts

@@ -1,7 +1,36 @@
 import { describe, expect, test } from "vitest";
-import { isCapitalized, sanitizeString, startsWithVowel, truncate, truncateText } from "./strings";
+import {
+  capitalizeFirstLetter,
+  isCapitalized,
+  sanitizeString,
+  startsWithVowel,
+  truncate,
+  truncateText,
+} from "./strings";
 
 describe("String Utilities", () => {
+  describe("capitalizeFirstLetter", () => {
+    test("capitalizes the first letter of a string", () => {
+      expect(capitalizeFirstLetter("hello")).toBe("Hello");
+    });
+
+    test("returns empty string if input is null", () => {
+      expect(capitalizeFirstLetter(null)).toBe("");
+    });
+
+    test("returns empty string if input is empty string", () => {
+      expect(capitalizeFirstLetter("")).toBe("");
+    });
+
+    test("doesn't change already capitalized string", () => {
+      expect(capitalizeFirstLetter("Hello")).toBe("Hello");
+    });
+
+    test("handles single character string", () => {
+      expect(capitalizeFirstLetter("a")).toBe("A");
+    });
+  });
+
   describe("truncate", () => {
     test("returns the string as is if length is less than the specified length", () => {
       expect(truncate("hello", 10)).toBe("hello");

apps/web/lib/utils/strings.ts

@@ -1,3 +1,10 @@
+export const capitalizeFirstLetter = (string: string | null = "") => {
+  if (string === null) {
+    return "";
+  }
+  return string.charAt(0).toUpperCase() + string.slice(1);
+};
+
 // write a function that takes a string and truncates it to the specified length
 export const truncate = (str: string, length: number) => {
   if (!str) return "";

apps/web/locales/de-DE.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Mitgliedschaft nicht gefunden",
     "metadata": "Metadaten",
     "minimum": "Minimum",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks funktioniert am besten auf einem größeren Bildschirm. Um Umfragen zu verwalten oder zu erstellen, wechsle zu einem anderen Gerät.",
-    "mobile_overlay_surveys_look_good": "Keine Sorge – deine Umfragen sehen auf jedem Gerät und jeder Bildschirmgröße großartig aus!",
-    "mobile_overlay_title": "Oops, Bildschirm zu klein erkannt!",
+    "mobile_overlay_text": "Formbricks ist für Geräte mit kleineren Auflösungen nicht verfügbar.",
     "move_down": "Nach unten bewegen",
     "move_up": "Nach oben bewegen",
     "multiple_languages": "Mehrsprachigkeit",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Zugriffskontrolle",
         "add_api_key": "API-Schlüssel hinzufügen",
         "api_key": "API-Schlüssel",
         "api_key_copied_to_clipboard": "API-Schlüssel in die Zwischenablage kopiert",
@@ -1204,7 +1203,7 @@
         "add_ending": "Abschluss hinzufügen",
         "add_ending_below": "Abschluss unten hinzufügen",
         "add_fallback": "Hinzufügen",
-        "add_fallback_placeholder": "Platzhalter hinzufügen, falls kein Wert zur Verfügung steht.",
+        "add_fallback_placeholder": "Hinzufügen eines Platzhalters, der angezeigt wird, wenn die Frage übersprungen wird:",
         "add_hidden_field_id": "Verstecktes Feld ID hinzufügen",
         "add_highlight_border": "Rahmen hinzufügen",
         "add_highlight_border_description": "Füge deiner Umfragekarte einen äußeren Rahmen hinzu.",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Betreff der E-Mail",
         "follow_ups_modal_action_to_description": "Empfänger-E-Mail-Adresse",
         "follow_ups_modal_action_to_label": "An",
-        "follow_ups_modal_action_to_warning": "Keine gültigen Optionen für den Versand von E-Mails gefunden, bitte fügen Sie einige Freitext- / Kontaktinformationen-Fragen oder versteckte Felder hinzu",
+        "follow_ups_modal_action_to_warning": "Kein E-Mail-Feld in der Umfrage gefunden.",
         "follow_ups_modal_create_heading": "Neues Follow-up erstellen",
-        "follow_ups_modal_created_successfull_toast": "Nachverfolgung erstellt und wird gespeichert, sobald du die Umfrage speicherst.",
         "follow_ups_modal_edit_heading": "Follow-up bearbeiten",
         "follow_ups_modal_edit_no_id": "Keine Survey Follow-up-ID angegeben, das Survey-Follow-up kann nicht aktualisiert werden",
         "follow_ups_modal_name_label": "Name des Follow-ups",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Auslöser",
         "follow_ups_modal_trigger_type_ending": "Teilnehmer sieht einen bestimmten Abschluss",
         "follow_ups_modal_trigger_type_ending_select": "Abschlüsse auswählen: ",
-        "follow_ups_modal_trigger_type_ending_warning": "Bitte wähle mindestens ein Ende aus oder ändere den Auslöser-Typ",
+        "follow_ups_modal_trigger_type_ending_warning": "Keine Abschlüsse in der Umfrage gefunden!",
         "follow_ups_modal_trigger_type_response": "Teilnehmer schließt Umfrage ab",
-        "follow_ups_modal_updated_successfull_toast": "Nachverfolgung aktualisiert und wird gespeichert, sobald du die Umfrage speicherst.",
         "follow_ups_new": "Neues Follow-up",
         "follow_ups_upgrade_button_text": "Upgrade, um Follow-ups zu aktivieren",
         "form_styling": "Umfrage Styling",

apps/web/locales/en-US.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Membership not found",
     "metadata": "Metadata",
     "minimum": "Minimum",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks works best on a bigger screen. To manage or build surveys, switch to another device.",
-    "mobile_overlay_surveys_look_good": "Don't worry – your surveys look great on every device and screen size!",
-    "mobile_overlay_title": "Oops, tiny screen detected!",
+    "mobile_overlay_text": "Formbricks is not available for devices with smaller resolutions.",
     "move_down": "Move down",
     "move_up": "Move up",
     "multiple_languages": "Multiple languages",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Access Control",
         "add_api_key": "Add API Key",
         "api_key": "API Key",
         "api_key_copied_to_clipboard": "API key copied to clipboard",
@@ -1204,7 +1203,7 @@
         "add_ending": "Add ending",
         "add_ending_below": "Add ending below",
         "add_fallback": "Add",
-        "add_fallback_placeholder": "Add a placeholder to show if there is no value to recall.",
+        "add_fallback_placeholder": "Add a placeholder to show if the question gets skipped:",
         "add_hidden_field_id": "Add hidden field ID",
         "add_highlight_border": "Add highlight border",
         "add_highlight_border_description": "Add an outer border to your survey card.",
@@ -1301,8 +1300,8 @@
         "contains": "Contains",
         "continue_to_settings": "Continue to Settings",
         "control_which_file_types_can_be_uploaded": "Control which file types can be uploaded.",
-        "convert_to_multiple_choice": "Convert to Multi-select",
-        "convert_to_single_choice": "Convert to Single-select",
+        "convert_to_multiple_choice": "Convert to Multiple Choice",
+        "convert_to_single_choice": "Convert to Single Choice",
         "country": "Country",
         "create_group": "Create group",
         "create_your_own_survey": "Create your own survey",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Subject of the email",
         "follow_ups_modal_action_to_description": "Email address to send the email to",
         "follow_ups_modal_action_to_label": "To",
-        "follow_ups_modal_action_to_warning": "No valid options found for sending emails, please add some open-text / contact-info questions or hidden fields",
+        "follow_ups_modal_action_to_warning": "No email field detected in the survey",
         "follow_ups_modal_create_heading": "Create a new follow-up",
-        "follow_ups_modal_created_successfull_toast": "Follow-up created and will be saved once you save the survey.",
         "follow_ups_modal_edit_heading": "Edit this follow-up",
         "follow_ups_modal_edit_no_id": "No survey follow up id provided, can't update the survey follow up",
         "follow_ups_modal_name_label": "Follow-up name",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Trigger",
         "follow_ups_modal_trigger_type_ending": "Respondent sees a specific ending",
         "follow_ups_modal_trigger_type_ending_select": "Select endings: ",
-        "follow_ups_modal_trigger_type_ending_warning": "Please select at least one ending or change the trigger type",
+        "follow_ups_modal_trigger_type_ending_warning": "No endings found in the survey!",
         "follow_ups_modal_trigger_type_response": "Respondent completes survey",
-        "follow_ups_modal_updated_successfull_toast": "Follow-up updated and will be saved once you save the survey.",
         "follow_ups_new": "New follow-up",
         "follow_ups_upgrade_button_text": "Upgrade to enable follow-ups",
         "form_styling": "Form styling",

apps/web/locales/fr-FR.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Abonnement non trouvé",
     "metadata": "Métadonnées",
     "minimum": "Min",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks fonctionne mieux sur un écran plus grand. Pour gérer ou créer des sondages, passez à un autre appareil.",
-    "mobile_overlay_surveys_look_good": "Ne t'inquiète pas – tes enquêtes sont superbes sur tous les appareils et tailles d'écran!",
-    "mobile_overlay_title": "Oups, écran minuscule détecté!",
+    "mobile_overlay_text": "Formbricks n'est pas disponible pour les appareils avec des résolutions plus petites.",
     "move_down": "Déplacer vers le bas",
     "move_up": "Déplacer vers le haut",
     "multiple_languages": "Plusieurs langues",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Contrôle d'accès",
         "add_api_key": "Ajouter une clé API",
         "api_key": "Clé API",
         "api_key_copied_to_clipboard": "Clé API copiée dans le presse-papiers",
@@ -1204,7 +1203,7 @@
         "add_ending": "Ajouter une fin",
         "add_ending_below": "Ajouter une fin ci-dessous",
         "add_fallback": "Ajouter",
-        "add_fallback_placeholder": "Ajouter un espace réservé à afficher s'il n'y a pas de valeur à rappeler.",
+        "add_fallback_placeholder": "Ajouter un espace réservé pour montrer si la question est ignorée :",
         "add_hidden_field_id": "Ajouter un champ caché ID",
         "add_highlight_border": "Ajouter une bordure de surlignage",
         "add_highlight_border_description": "Ajoutez une bordure extérieure à votre carte d'enquête.",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Objet de l'email",
         "follow_ups_modal_action_to_description": "Adresse e-mail à laquelle envoyer l'e-mail",
         "follow_ups_modal_action_to_label": "à",
-        "follow_ups_modal_action_to_warning": "Aucune option valable trouvée pour l'envoi d'emails, veuillez ajouter des questions à texte libre / info-contact ou des champs cachés",
+        "follow_ups_modal_action_to_warning": "Aucun champ d'email détecté dans l'enquête",
         "follow_ups_modal_create_heading": "Créer un nouveau suivi",
-        "follow_ups_modal_created_successfull_toast": "\"Suivi créé et sera enregistré une fois que vous sauvegarderez le sondage.\"",
         "follow_ups_modal_edit_heading": "Modifier ce suivi",
         "follow_ups_modal_edit_no_id": "Aucun identifiant de suivi d'enquête fourni, impossible de mettre à jour le suivi de l'enquête.",
         "follow_ups_modal_name_label": "Nom de suivi",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Déclencheur",
         "follow_ups_modal_trigger_type_ending": "Le répondant voit une fin spécifique",
         "follow_ups_modal_trigger_type_ending_select": "Choisir des fins :",
-        "follow_ups_modal_trigger_type_ending_warning": "Veuillez sélectionner au moins une fin ou changer le type de déclencheur.",
+        "follow_ups_modal_trigger_type_ending_warning": "Aucune fin trouvée dans l'enquête !",
         "follow_ups_modal_trigger_type_response": "Le répondant complète l'enquête",
-        "follow_ups_modal_updated_successfull_toast": "\"Suivi mis à jour et sera enregistré une fois que vous sauvegarderez le sondage.\"",
         "follow_ups_new": "Nouveau suivi",
         "follow_ups_upgrade_button_text": "Passez à la version supérieure pour activer les relances",
         "form_styling": "Style de formulaire",

apps/web/locales/ja-JP.json

@@ -262,9 +262,7 @@
     "membership_not_found": "メンバーシップが見つかりません",
     "metadata": "メタデータ",
     "minimum": "最小",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks は より 大きな 画面 で最適に 作動します。 フォーム を 管理または 構築する には、 別の デバイス に 切り替える 必要が あります。",
-    "mobile_overlay_surveys_look_good": "ご安心ください - お使い の デバイス や 画面 サイズ に 関係なく、 フォーム は 素晴らしく 見えます！",
-    "mobile_overlay_title": "おっと、 小さな 画面 が 検出されました！",
+    "mobile_overlay_text": "Formbricksは、解像度の小さいデバイスでは利用できません。",
     "move_down": "下に移動",
     "move_up": "上に移動",
     "multiple_languages": "多言語",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "アクセス制御",
         "add_api_key": "APIキーを追加",
         "api_key": "APIキー",
         "api_key_copied_to_clipboard": "APIキーをクリップボードにコピーしました",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "メールの件名",
         "follow_ups_modal_action_to_description": "メールを送信するメールアドレス",
         "follow_ups_modal_action_to_label": "宛先",
-        "follow_ups_modal_action_to_warning": "メールを送信するための有効な オプション が見つかりません 、いくつかの オープン テキスト / 連絡先 情報の質問 または 非表示 フィールドを追加してください",
+        "follow_ups_modal_action_to_warning": "フォームでメールアドレスのフィールドが検出されていません",
         "follow_ups_modal_create_heading": "新しいフォローアップを作成",
-        "follow_ups_modal_created_successfull_toast": "フォローアップ が 作成され、 アンケートを 保存すると保存されます。",
         "follow_ups_modal_edit_heading": "このフォローアップを編集",
         "follow_ups_modal_edit_no_id": "フォームのフォローアップIDが提供されていません。フォームのフォローアップを更新できません",
         "follow_ups_modal_name_label": "フォローアップ名",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "トリガー",
         "follow_ups_modal_trigger_type_ending": "回答者が特定の終了画面を見たとき",
         "follow_ups_modal_trigger_type_ending_select": "終了を選択:",
-        "follow_ups_modal_trigger_type_ending_warning": "少なくとも1つの終了を選択するか、 トリガー タイプを変更してください",
+        "follow_ups_modal_trigger_type_ending_warning": "フォームに終了画面が見つかりません！",
         "follow_ups_modal_trigger_type_response": "回答者がフォームを完了したとき",
-        "follow_ups_modal_updated_successfull_toast": "フォローアップ が 更新され、 アンケートを 保存すると保存されます。",
         "follow_ups_new": "新しいフォローアップ",
         "follow_ups_upgrade_button_text": "フォローアップを有効にするためにアップグレード",
         "form_styling": "フォームのスタイル",

apps/web/locales/pt-BR.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Assinatura não encontrada",
     "metadata": "metadados",
     "minimum": "Mínimo",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks funciona melhor em uma tela maior. Para gerenciar ou criar pesquisas, mude para outro dispositivo.",
-    "mobile_overlay_surveys_look_good": "Não se preocupe – suas pesquisas ficam ótimas em qualquer dispositivo e tamanho de tela!",
-    "mobile_overlay_title": "Eita, tela pequena detectada!",
+    "mobile_overlay_text": "O Formbricks não está disponível para dispositivos com resoluções menores.",
     "move_down": "Descer",
     "move_up": "Subir",
     "multiple_languages": "Vários idiomas",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Controle de Acesso",
         "add_api_key": "Adicionar Chave API",
         "api_key": "Chave de API",
         "api_key_copied_to_clipboard": "Chave da API copiada para a área de transferência",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Assunto do e-mail",
         "follow_ups_modal_action_to_description": "Endereço de e-mail para enviar o e-mail para",
         "follow_ups_modal_action_to_label": "Para",
-        "follow_ups_modal_action_to_warning": "Nenhuma opção válida encontrada para envio de emails, por favor, adicione algumas perguntas de texto livre / informações de contato ou campos ocultos",
+        "follow_ups_modal_action_to_warning": "Nenhum campo de e-mail detectado na pesquisa",
         "follow_ups_modal_create_heading": "Criar um novo acompanhamento",
-        "follow_ups_modal_created_successfull_toast": "Acompanhamento criado e será salvo assim que você salvar a pesquisa.",
         "follow_ups_modal_edit_heading": "Editar este acompanhamento",
         "follow_ups_modal_edit_no_id": "Nenhum ID de acompanhamento da pesquisa fornecido, não é possível atualizar o acompanhamento da pesquisa",
         "follow_ups_modal_name_label": "Nome do acompanhamento",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Gatilho",
         "follow_ups_modal_trigger_type_ending": "Respondente vê um final específico",
         "follow_ups_modal_trigger_type_ending_select": "Selecione os finais: ",
-        "follow_ups_modal_trigger_type_ending_warning": "Por favor, selecione pelo menos um encerramento ou altere o tipo de gatilho",
+        "follow_ups_modal_trigger_type_ending_warning": "Nenhum final encontrado na pesquisa!",
         "follow_ups_modal_trigger_type_response": "Respondente completa a pesquisa",
-        "follow_ups_modal_updated_successfull_toast": "Acompanhamento atualizado e será salvo assim que você salvar a pesquisa.",
         "follow_ups_new": "Novo acompanhamento",
         "follow_ups_upgrade_button_text": "Atualize para habilitar os Acompanhamentos",
         "form_styling": "Estilização de Formulários",

apps/web/locales/pt-PT.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Associação não encontrada",
     "metadata": "Metadados",
     "minimum": "Mínimo",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks funciona melhor num ecrã maior. Para gerir ou criar inquéritos, mude de dispositivo.",
-    "mobile_overlay_surveys_look_good": "Não se preocupe – os seus inquéritos têm uma ótima aparência em todos os dispositivos e tamanhos de ecrã!",
-    "mobile_overlay_title": "Oops, ecrã pequeno detectado!",
+    "mobile_overlay_text": "O Formbricks não está disponível para dispositivos com resoluções menores.",
     "move_down": "Mover para baixo",
     "move_up": "Mover para cima",
     "multiple_languages": "Várias línguas",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Controlo de Acesso",
         "add_api_key": "Adicionar Chave API",
         "api_key": "Chave API",
         "api_key_copied_to_clipboard": "Chave API copiada para a área de transferência",
@@ -1204,7 +1203,7 @@
         "add_ending": "Adicionar encerramento",
         "add_ending_below": "Adicionar encerramento abaixo",
         "add_fallback": "Adicionar",
-        "add_fallback_placeholder": "Adicionar um espaço reservado para mostrar se não houver valor para recordar.",
+        "add_fallback_placeholder": "Adicionar um espaço reservado para mostrar se a pergunta for ignorada:",
         "add_hidden_field_id": "Adicionar ID do campo oculto",
         "add_highlight_border": "Adicionar borda de destaque",
         "add_highlight_border_description": "Adicione uma borda externa ao seu cartão de inquérito.",
@@ -1301,8 +1300,8 @@
         "contains": "Contém",
         "continue_to_settings": "Continuar para Definições",
         "control_which_file_types_can_be_uploaded": "Controlar quais tipos de ficheiros podem ser carregados.",
-        "convert_to_multiple_choice": "Converter para Seleção Múltipla",
-        "convert_to_single_choice": "Converter para Seleção Única",
+        "convert_to_multiple_choice": "Converter para Escolha Múltipla",
+        "convert_to_single_choice": "Converter para Escolha Única",
         "country": "País",
         "create_group": "Criar grupo",
         "create_your_own_survey": "Crie o seu próprio inquérito",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Assunto do email",
         "follow_ups_modal_action_to_description": "Endereço de email para enviar o email",
         "follow_ups_modal_action_to_label": "Para",
-        "follow_ups_modal_action_to_warning": "Não foram encontradas opções válidas para envio de emails, por favor adicione algumas perguntas de texto livre / informações de contato ou campos escondidos",
+        "follow_ups_modal_action_to_warning": "Nenhum campo de email detetado no inquérito",
         "follow_ups_modal_create_heading": "Criar um novo acompanhamento",
-        "follow_ups_modal_created_successfull_toast": "Seguimento criado e será guardado assim que guardar o questionário.",
         "follow_ups_modal_edit_heading": "Editar este acompanhamento",
         "follow_ups_modal_edit_no_id": "Nenhum ID de acompanhamento do inquérito fornecido, não é possível atualizar o acompanhamento do inquérito",
         "follow_ups_modal_name_label": "Nome do acompanhamento",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Desencadeador",
         "follow_ups_modal_trigger_type_ending": "O respondente vê um final específico",
         "follow_ups_modal_trigger_type_ending_select": "Selecionar finais: ",
-        "follow_ups_modal_trigger_type_ending_warning": "Por favor, selecione pelo menos um final ou mude o tipo de gatilho",
+        "follow_ups_modal_trigger_type_ending_warning": "Não foram encontrados finais no inquérito!",
         "follow_ups_modal_trigger_type_response": "Respondente conclui inquérito",
-        "follow_ups_modal_updated_successfull_toast": "Seguimento atualizado e será guardado assim que guardar o questionário.",
         "follow_ups_new": "Novo acompanhamento",
         "follow_ups_upgrade_button_text": "Atualize para ativar os acompanhamentos",
         "form_styling": "Estilo do formulário",

apps/web/locales/ro-RO.json

@@ -262,9 +262,7 @@
     "membership_not_found": "Apartenența nu a fost găsită",
     "metadata": "Metadate",
     "minimum": "Minim",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks funcționează cel mai bine pe un ecran mai mare. Pentru a gestiona sau crea chestionare, treceți la un alt dispozitiv.",
-    "mobile_overlay_surveys_look_good": "Nu vă faceți griji – chestionarele dumneavoastră arată grozav pe orice dispozitiv și dimensiune a ecranului!",
-    "mobile_overlay_title": "Ups, ecran mic detectat!",
+    "mobile_overlay_text": "Formbricks nu este disponibil pentru dispozitive cu rezoluții mai mici.",
     "move_down": "Mută în jos",
     "move_up": "Mută sus",
     "multiple_languages": "Mai multe limbi",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "Control acces",
         "add_api_key": "Adaugă Cheie API",
         "api_key": "Cheie API",
         "api_key_copied_to_clipboard": "Cheia API a fost copiată în clipboard",
@@ -1204,7 +1203,7 @@
         "add_ending": "Adaugă finalizare",
         "add_ending_below": "Adaugă finalizare mai jos",
         "add_fallback": "Adaugă",
-        "add_fallback_placeholder": "Adaugă un placeholder pentru a afișa dacă nu există valoare de reamintit",
+        "add_fallback_placeholder": "Adaugă un substituent pentru a afișa dacă întrebarea este omisă:",
         "add_hidden_field_id": "Adăugați ID câmp ascuns",
         "add_highlight_border": "Adaugă bordură evidențiată",
         "add_highlight_border_description": "Adaugă o margine exterioară cardului tău de sondaj.",
@@ -1301,8 +1300,8 @@
         "contains": "Conține",
         "continue_to_settings": "Continuă către Setări",
         "control_which_file_types_can_be_uploaded": "Controlează ce tipuri de fișiere pot fi încărcate.",
-        "convert_to_multiple_choice": "Convertiți la selectare multiplă",
-        "convert_to_single_choice": "Convertiți la selectare unică",
+        "convert_to_multiple_choice": "Convertiți la alegere multiplă",
+        "convert_to_single_choice": "Convertiți la alegere unică",
         "country": "Țară",
         "create_group": "Creează grup",
         "create_your_own_survey": "Creează-ți propriul chestionar",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "Subiectul emailului",
         "follow_ups_modal_action_to_description": "Adresă de email către care se trimite emailul",
         "follow_ups_modal_action_to_label": "Către",
-        "follow_ups_modal_action_to_warning": "Nu s-au găsit opțiuni valide pentru trimiterea e-mailurilor, vă rugăm să adăugați întrebări de tip text deschis / informații de contact sau câmpuri ascunse",
+        "follow_ups_modal_action_to_warning": "Nu s-a detectat niciun câmp de e-mail în sondaj",
         "follow_ups_modal_create_heading": "Creați o nouă urmărire",
-        "follow_ups_modal_created_successfull_toast": "Urmărirea a fost creată și va fi salvată odată ce salvați sondajul.",
         "follow_ups_modal_edit_heading": "Editează acest follow-up",
         "follow_ups_modal_edit_no_id": "Nu a fost furnizat un ID de urmărire al chestionarului, nu pot actualiza urmărirea chestionarului",
         "follow_ups_modal_name_label": "Numele ",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "Declanșator",
         "follow_ups_modal_trigger_type_ending": "Respondentul vede un sfârșit specific",
         "follow_ups_modal_trigger_type_ending_select": "Selectează finalurile:",
-        "follow_ups_modal_trigger_type_ending_warning": "Vă rugăm să selectați cel puțin un sfârșit sau să schimbați tipul declanșatorului",
+        "follow_ups_modal_trigger_type_ending_warning": "Nu s-au găsit finalizări în sondaj!",
         "follow_ups_modal_trigger_type_response": "Respondent finalizează sondajul",
-        "follow_ups_modal_updated_successfull_toast": "Urmărirea a fost actualizată și va fi salvată odată ce salvați sondajul.",
         "follow_ups_new": "Follow-up nou",
         "follow_ups_upgrade_button_text": "Actualizați pentru a activa urmărările",
         "form_styling": "Stilizare formular",

apps/web/locales/zh-Hans-CN.json

@@ -262,9 +262,7 @@
     "membership_not_found": "未找到会员资格",
     "metadata": "元数据",
     "minimum": "最低",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks 在 更大 的 屏幕 上 效果 最佳。 若 需要 管理 或 构建 调查， 请 切换 到 其他 设备。",
-    "mobile_overlay_surveys_look_good": "别 担心 – 您 的 调查 在 每 一 种 设备 和 屏幕 尺寸 上 看起来 都 很 棒!",
-    "mobile_overlay_title": "噢, 检测 到 小 屏幕!",
+    "mobile_overlay_text": "Formbricks 不 适用 于 分辨率 较小 的 设备",
     "move_down": "下移",
     "move_up": "上移",
     "multiple_languages": "多种 语言",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "访问控制",
         "add_api_key": "添加 API 密钥",
         "api_key": "API Key",
         "api_key_copied_to_clipboard": "API 密钥 已复制到 剪贴板",
@@ -1204,7 +1203,7 @@
         "add_ending": "添加结尾",
         "add_ending_below": "在下方 添加 结尾",
         "add_fallback": "添加",
-        "add_fallback_placeholder": "添加 占位符 显示 如果 没有 值以 回忆",
+        "add_fallback_placeholder": "添加 一个 占位符，以显示该问题是否被跳过:",
         "add_hidden_field_id": "添加 隐藏 字段 ID",
         "add_highlight_border": "添加 高亮 边框",
         "add_highlight_border_description": "在 你的 调查 卡片 添加 外 边框。",
@@ -1301,8 +1300,8 @@
         "contains": "包含",
         "continue_to_settings": "继续 到 设置",
         "control_which_file_types_can_be_uploaded": "控制 可以 上传的 文件 类型",
-        "convert_to_multiple_choice": "转换为 多选",
-        "convert_to_single_choice": "转换为 单选",
+        "convert_to_multiple_choice": "转换为多选题",
+        "convert_to_single_choice": "转换为单选题",
         "country": "国家",
         "create_group": "创建 群组",
         "create_your_own_survey": "创建 你 的 调查",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "电子邮件主题",
         "follow_ups_modal_action_to_description": "发送邮件的电子邮箱地址",
         "follow_ups_modal_action_to_label": "到",
-        "follow_ups_modal_action_to_warning": "为 发送 邮件 找不到 有效 选项 ，请 增加 一些 开放文本 / 联系 信息 问题 或 隐藏 字段",
+        "follow_ups_modal_action_to_warning": "调查中未 检测到 电子邮件 字段",
         "follow_ups_modal_create_heading": "创建一个新的跟进",
-        "follow_ups_modal_created_successfull_toast": "后续 操作 已 创建， 并且 在 你 保存 调查 后 将 被 保存。",
         "follow_ups_modal_edit_heading": "编辑此跟进",
         "follow_ups_modal_edit_no_id": "未 提供 调查 跟进 id ，无法 更新 调查 跟进",
         "follow_ups_modal_name_label": "跟进 名称",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "触发",
         "follow_ups_modal_trigger_type_ending": "受访者 看到 一个 特定 的 结尾",
         "follow_ups_modal_trigger_type_ending_select": "选择结尾：",
-        "follow_ups_modal_trigger_type_ending_warning": "请选择至少 一个结束条件 或更改触发条件类型",
+        "follow_ups_modal_trigger_type_ending_warning": "在 调查 中 未找到 结尾 ！",
         "follow_ups_modal_trigger_type_response": "受访者 完成 调查",
-        "follow_ups_modal_updated_successfull_toast": "后续 操作 已 更新， 并且 在 你 保存 调查 后 将 被 保存。",
         "follow_ups_new": "新的跟进",
         "follow_ups_upgrade_button_text": "升级 以启用 跟进",
         "form_styling": "表单 样式",

apps/web/locales/zh-Hant-TW.json

@@ -262,9 +262,7 @@
     "membership_not_found": "找不到成員資格",
     "metadata": "元數據",
     "minimum": "最小值",
-    "mobile_overlay_app_works_best_on_desktop": "Formbricks 適合在大螢幕上使用。若要管理或建立問卷，請切換到其他裝置。",
-    "mobile_overlay_surveys_look_good": "別擔心 －你的 問卷 在每個 裝置 和 螢幕尺寸 上 都 很出色！",
-    "mobile_overlay_title": "糟糕 ，偵測到小螢幕！",
+    "mobile_overlay_text": "Formbricks 不適用於較小解析度的裝置。",
     "move_down": "下移",
     "move_up": "上移",
     "multiple_languages": "多種語言",
@@ -752,6 +750,7 @@
     },
     "project": {
       "api_keys": {
+        "access_control": "存取控制",
         "add_api_key": "新增 API 金鑰",
         "api_key": "API 金鑰",
         "api_key_copied_to_clipboard": "API 金鑰已複製到剪貼簿",
@@ -1204,7 +1203,7 @@
         "add_ending": "新增結尾",
         "add_ending_below": "在下方新增結尾",
         "add_fallback": "新增",
-        "add_fallback_placeholder": "新增 預設 以顯示是否沒 有 值 可 回憶 。",
+        "add_fallback_placeholder": "新增用于顯示問題被跳過時的佔位符",
         "add_hidden_field_id": "新增隱藏欄位 ID",
         "add_highlight_border": "新增醒目提示邊框",
         "add_highlight_border_description": "在您的問卷卡片新增外邊框。",
@@ -1375,9 +1374,8 @@
         "follow_ups_modal_action_subject_placeholder": "電子郵件主旨",
         "follow_ups_modal_action_to_description": "傳送電子郵件的電子郵件地址",
         "follow_ups_modal_action_to_label": "收件者",
-        "follow_ups_modal_action_to_warning": "未找到 發送電子郵件 有效選項，請添加 一些 開放文本 / 聯絡資訊 問題或隱藏欄位",
+        "follow_ups_modal_action_to_warning": "問卷中未偵測到電子郵件欄位",
         "follow_ups_modal_create_heading": "建立新的後續追蹤",
-        "follow_ups_modal_created_successfull_toast": "後續 動作 已 建立 並 將 在 你 儲存 調查 後 儲存",
         "follow_ups_modal_edit_heading": "編輯此後續追蹤",
         "follow_ups_modal_edit_no_id": "未提供問卷後續追蹤 ID，無法更新問卷後續追蹤",
         "follow_ups_modal_name_label": "後續追蹤名稱",
@@ -1387,9 +1385,8 @@
         "follow_ups_modal_trigger_label": "觸發器",
         "follow_ups_modal_trigger_type_ending": "回應者看到特定結尾",
         "follow_ups_modal_trigger_type_ending_select": "選取結尾：",
-        "follow_ups_modal_trigger_type_ending_warning": "請選擇至少一個結尾或更改觸發類型",
+        "follow_ups_modal_trigger_type_ending_warning": "問卷中找不到結尾！",
         "follow_ups_modal_trigger_type_response": "回應者完成問卷",
-        "follow_ups_modal_updated_successfull_toast": "後續 動作 已 更新 並 將 在 你 儲存 調查 後 儲存",
         "follow_ups_new": "新增後續追蹤",
         "follow_ups_upgrade_button_text": "升級以啟用後續追蹤",
         "form_styling": "表單樣式設定",

apps/web/modules/analysis/components/SingleResponseCard/components/RenderResponse.test.tsx

@@ -230,7 +230,7 @@ describe("RenderResponse", () => {
         showId={false}
       />
     );
-    expect(screen.getByTestId("ResponseBadges")).toHaveTextContent("value");
+    expect(screen.getByTestId("ResponseBadges")).toHaveTextContent("Value");
   });
 
   test("renders ResponseBadges for 'Consent' question (number)", () => {
@@ -258,7 +258,7 @@ describe("RenderResponse", () => {
         showId={false}
       />
     );
-    expect(screen.getByTestId("ResponseBadges")).toHaveTextContent("click");
+    expect(screen.getByTestId("ResponseBadges")).toHaveTextContent("Click");
   });
 
   test("renders ResponseBadges for 'MultipleChoiceSingle' question (string)", () => {

apps/web/modules/analysis/components/SingleResponseCard/components/RenderResponse.tsx

@@ -1,6 +1,18 @@
+import { cn } from "@/lib/cn";
+import { getLanguageCode, getLocalizedValue } from "@/lib/i18n/utils";
+import { getChoiceIdByValue } from "@/lib/response/utils";
+import { processResponseData } from "@/lib/responses";
+import { formatDateWithOrdinal } from "@/lib/utils/datetime";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
+import { renderHyperlinkedContent } from "@/modules/analysis/utils";
+import { ArrayResponse } from "@/modules/ui/components/array-response";
+import { FileUploadResponse } from "@/modules/ui/components/file-upload-response";
+import { PictureSelectionResponse } from "@/modules/ui/components/picture-selection-response";
+import { RankingResponse } from "@/modules/ui/components/ranking-response";
+import { RatingResponse } from "@/modules/ui/components/rating-response";
+import { ResponseBadges } from "@/modules/ui/components/response-badges";
 import { CheckCheckIcon, MousePointerClickIcon, PhoneIcon } from "lucide-react";
 import React from "react";
-import { TResponseDataValue } from "@formbricks/types/responses";
 import {
   TSurvey,
   TSurveyMatrixQuestion,
@@ -9,21 +21,9 @@ import {
   TSurveyQuestionTypeEnum,
   TSurveyRatingQuestion,
 } from "@formbricks/types/surveys/types";
-import { cn } from "@/lib/cn";
-import { getLanguageCode, getLocalizedValue } from "@/lib/i18n/utils";
-import { getChoiceIdByValue } from "@/lib/response/utils";
-import { processResponseData } from "@/lib/responses";
-import { formatDateWithOrdinal } from "@/lib/utils/datetime";
-import { renderHyperlinkedContent } from "@/modules/analysis/utils";
-import { ArrayResponse } from "@/modules/ui/components/array-response";
-import { FileUploadResponse } from "@/modules/ui/components/file-upload-response";
-import { PictureSelectionResponse } from "@/modules/ui/components/picture-selection-response";
-import { RankingResponse } from "@/modules/ui/components/ranking-response";
-import { RatingResponse } from "@/modules/ui/components/rating-response";
-import { ResponseBadges } from "@/modules/ui/components/response-badges";
 
 interface RenderResponseProps {
-  responseData: TResponseDataValue;
+  responseData: string | number | string[] | Record<string, string>;
   question: TSurveyQuestion;
   survey: TSurvey;
   language: string | null;
@@ -103,7 +103,9 @@ export const RenderResponse: React.FC<RenderResponseProps> = ({
               const rowValueInSelectedLanguage = getLocalizedValue(row.label, languagCode);
               if (!responseData[rowValueInSelectedLanguage]) return null;
               return (
-                <p key={rowValueInSelectedLanguage} className="ph-no-capture my-1 font-normal text-slate-700">
+                <p
+                  key={rowValueInSelectedLanguage}
+                  className="ph-no-capture my-1 font-normal capitalize text-slate-700">
                   {rowValueInSelectedLanguage}:{processResponseData(responseData[rowValueInSelectedLanguage])}
                 </p>
               );
@@ -123,7 +125,7 @@ export const RenderResponse: React.FC<RenderResponseProps> = ({
       if (typeof responseData === "string" || typeof responseData === "number") {
         return (
           <ResponseBadges
-            items={[{ value: responseData.toString() }]}
+            items={[{ value: capitalizeFirstLetter(responseData.toString()) }]}
             isExpanded={isExpanded}
             icon={<PhoneIcon className="h-4 w-4 text-slate-500" />}
             showId={showId}
@@ -135,7 +137,7 @@ export const RenderResponse: React.FC<RenderResponseProps> = ({
       if (typeof responseData === "string" || typeof responseData === "number") {
         return (
           <ResponseBadges
-            items={[{ value: responseData.toString() }]}
+            items={[{ value: capitalizeFirstLetter(responseData.toString()) }]}
             isExpanded={isExpanded}
             icon={<CheckCheckIcon className="h-4 w-4 text-slate-500" />}
             showId={showId}
@@ -147,7 +149,7 @@ export const RenderResponse: React.FC<RenderResponseProps> = ({
       if (typeof responseData === "string" || typeof responseData === "number") {
         return (
           <ResponseBadges
-            items={[{ value: responseData.toString() }]}
+            items={[{ value: capitalizeFirstLetter(responseData.toString()) }]}
             isExpanded={isExpanded}
             icon={<MousePointerClickIcon className="h-4 w-4 text-slate-500" />}
             showId={showId}

apps/web/modules/analysis/components/SingleResponseCard/components/SingleResponseCardBody.tsx

@@ -1,12 +1,12 @@
 "use client";
 
+import { getLocalizedValue } from "@/lib/i18n/utils";
+import { parseRecallInfo } from "@/lib/utils/recall";
+import { ResponseCardQuotas } from "@/modules/ee/quotas/components/single-response-card-quotas";
 import { useTranslate } from "@tolgee/react";
 import { CheckCircle2Icon } from "lucide-react";
 import { TResponseWithQuotas } from "@formbricks/types/responses";
 import { TSurvey } from "@formbricks/types/surveys/types";
-import { getLocalizedValue } from "@/lib/i18n/utils";
-import { parseRecallInfo } from "@/lib/utils/recall";
-import { ResponseCardQuotas } from "@/modules/ee/quotas/components/single-response-card-quotas";
 import { isValidValue } from "../util";
 import { HiddenFields } from "./HiddenFields";
 import { QuestionSkip } from "./QuestionSkip";
@@ -118,7 +118,7 @@ export const SingleResponseCardBody = ({
       {survey.variables.length > 0 && (
         <ResponseVariables variables={survey.variables} variablesData={response.variables} />
       )}
-      {survey.hiddenFields.fieldIds && (
+      {survey.hiddenFields.enabled && survey.hiddenFields.fieldIds && (
         <HiddenFields hiddenFields={survey.hiddenFields} responseData={response.data} />
       )}
 

apps/web/modules/analysis/components/SingleResponseCard/util.ts

@@ -1,6 +1,4 @@
-import { TResponseDataValue } from "@formbricks/types/responses";
-
-export const isValidValue = (value: TResponseDataValue) => {
+export const isValidValue = (value: string | number | Record<string, string> | string[]) => {
   return (
     (typeof value === "string" && value.trim() !== "") ||
     (Array.isArray(value) && value.length > 0) ||

apps/web/modules/api/v2/health/lib/health-checks.ts

@@ -1,101 +0,0 @@
-import { getCacheService } from "@formbricks/cache";
-import { prisma } from "@formbricks/database";
-import { logger } from "@formbricks/logger";
-import { Result, err, ok } from "@formbricks/types/error-handlers";
-import { type OverallHealthStatus } from "@/modules/api/v2/health/types/health-status";
-import { type ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
-
-/**
- * Check if the main database is reachable and responding
- * @returns Promise<Result<boolean, ApiErrorResponseV2>> - Result of the database health check
- */
-export const checkDatabaseHealth = async (): Promise<Result<boolean, ApiErrorResponseV2>> => {
-  try {
-    // Simple query to check if database is reachable
-    await prisma.$queryRaw`SELECT 1`;
-    return ok(true);
-  } catch (error) {
-    logger
-      .withContext({
-        component: "health_check",
-        check_type: "main_database",
-        error,
-      })
-      .error("Database health check failed");
-    return err({
-      type: "internal_server_error",
-      details: [{ field: "main_database", issue: "Database health check failed" }],
-    });
-  }
-};
-
-/**
- * Check if the Redis cache is reachable and responding
- * @returns Promise<Result<boolean, ApiErrorResponseV2>> - Result of the cache health check
- */
-export const checkCacheHealth = async (): Promise<Result<boolean, ApiErrorResponseV2>> => {
-  try {
-    const cacheServiceResult = await getCacheService();
-    if (!cacheServiceResult.ok) {
-      return err({
-        type: "internal_server_error",
-        details: [{ field: "cache_database", issue: "Cache service not available" }],
-      });
-    }
-
-    const isAvailable = await cacheServiceResult.data.isRedisAvailable();
-    if (isAvailable) {
-      return ok(true);
-    }
-
-    return err({
-      type: "internal_server_error",
-      details: [{ field: "cache_database", issue: "Redis not available" }],
-    });
-  } catch (error) {
-    logger
-      .withContext({
-        component: "health_check",
-        check_type: "cache_database",
-        error,
-      })
-      .error("Redis health check failed");
-    return err({
-      type: "internal_server_error",
-      details: [{ field: "cache_database", issue: "Redis health check failed" }],
-    });
-  }
-};
-
-/**
- * Perform all health checks and return the overall status
- * Always returns ok() with health status unless the health check endpoint itself fails
- * @returns Promise<Result<OverallHealthStatus, ApiErrorResponseV2>> - Overall health status of all dependencies
- */
-export const performHealthChecks = async (): Promise<Result<OverallHealthStatus, ApiErrorResponseV2>> => {
-  try {
-    const [databaseResult, cacheResult] = await Promise.all([checkDatabaseHealth(), checkCacheHealth()]);
-
-    const healthStatus: OverallHealthStatus = {
-      main_database: databaseResult.ok ? databaseResult.data : false,
-      cache_database: cacheResult.ok ? cacheResult.data : false,
-    };
-
-    // Always return ok() with the health status - individual dependency failures
-    // are reflected in the boolean values
-    return ok(healthStatus);
-  } catch (error) {
-    // Only return err() if the health check endpoint itself fails
-    logger
-      .withContext({
-        component: "health_check",
-        error,
-      })
-      .error("Health check endpoint failed");
-
-    return err({
-      type: "internal_server_error",
-      details: [{ field: "health", issue: "Failed to perform health checks" }],
-    });
-  }
-};

apps/web/modules/api/v2/health/lib/openapi.ts

@@ -1,29 +0,0 @@
-import { ZOverallHealthStatus } from "@/modules/api/v2/health/types/health-status";
-import { makePartialSchema } from "@/modules/api/v2/types/openapi-response";
-import { ZodOpenApiOperationObject } from "zod-openapi";
-
-export const healthCheckEndpoint: ZodOpenApiOperationObject = {
-  tags: ["Health"],
-  summary: "Health Check",
-  description: "Check the health status of critical application dependencies including database and cache.",
-  requestParams: {},
-  operationId: "healthCheck",
-  security: [],
-  responses: {
-    "200": {
-      description:
-        "Health check completed successfully. Check individual dependency status in response data.",
-      content: {
-        "application/json": {
-          schema: makePartialSchema(ZOverallHealthStatus),
-        },
-      },
-    },
-  },
-};
-
-export const healthPaths = {
-  "/health": {
-    get: healthCheckEndpoint,
-  },
-};

apps/web/modules/api/v2/health/lib/tests/health-checks.test.ts

@@ -1,288 +0,0 @@
-import { beforeEach, describe, expect, test, vi } from "vitest";
-import { ErrorCode, getCacheService } from "@formbricks/cache";
-import { prisma } from "@formbricks/database";
-import { err, ok } from "@formbricks/types/error-handlers";
-import { checkCacheHealth, checkDatabaseHealth, performHealthChecks } from "../health-checks";
-
-// Mock dependencies
-vi.mock("@formbricks/database", () => ({
-  prisma: {
-    $queryRaw: vi.fn(),
-  },
-}));
-
-vi.mock("@formbricks/cache", () => ({
-  getCacheService: vi.fn(),
-  ErrorCode: {
-    RedisConnectionError: "redis_connection_error",
-  },
-}));
-
-vi.mock("@formbricks/logger", () => ({
-  logger: {
-    error: vi.fn(),
-    info: vi.fn(),
-    withContext: vi.fn(() => ({
-      error: vi.fn(),
-      info: vi.fn(),
-    })),
-  },
-}));
-
-describe("Health Checks", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  // Helper function to create a mock CacheService
-  const createMockCacheService = (isRedisAvailable: boolean = true) => ({
-    getRedisClient: vi.fn(),
-    withTimeout: vi.fn(),
-    get: vi.fn(),
-    exists: vi.fn(),
-    set: vi.fn(),
-    del: vi.fn(),
-    keys: vi.fn(),
-    withCache: vi.fn(),
-    flush: vi.fn(),
-    tryGetCachedValue: vi.fn(),
-    trySetCache: vi.fn(),
-    isRedisAvailable: vi.fn().mockResolvedValue(isRedisAvailable),
-  });
-
-  describe("checkDatabaseHealth", () => {
-    test("should return healthy when database query succeeds", async () => {
-      vi.mocked(prisma.$queryRaw).mockResolvedValue([{ "?column?": 1 }]);
-
-      const result = await checkDatabaseHealth();
-
-      expect(result).toEqual({ ok: true, data: true });
-      expect(prisma.$queryRaw).toHaveBeenCalledWith(["SELECT 1"]);
-    });
-
-    test("should return unhealthy when database query fails", async () => {
-      const dbError = new Error("Database connection failed");
-      vi.mocked(prisma.$queryRaw).mockRejectedValue(dbError);
-
-      const result = await checkDatabaseHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([
-          { field: "main_database", issue: "Database health check failed" },
-        ]);
-      }
-    });
-
-    test("should handle different types of database errors", async () => {
-      const networkError = new Error("ECONNREFUSED");
-      vi.mocked(prisma.$queryRaw).mockRejectedValue(networkError);
-
-      const result = await checkDatabaseHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([
-          { field: "main_database", issue: "Database health check failed" },
-        ]);
-      }
-    });
-  });
-
-  describe("checkCacheHealth", () => {
-    test("should return healthy when Redis is available", async () => {
-      const mockCacheService = createMockCacheService(true);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const result = await checkCacheHealth();
-
-      expect(result).toEqual({ ok: true, data: true });
-      expect(getCacheService).toHaveBeenCalled();
-      expect(mockCacheService.isRedisAvailable).toHaveBeenCalled();
-    });
-
-    test("should return unhealthy when cache service fails to initialize", async () => {
-      const cacheError = { code: ErrorCode.RedisConnectionError };
-      vi.mocked(getCacheService).mockResolvedValue(err(cacheError));
-
-      const result = await checkCacheHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([
-          { field: "cache_database", issue: "Cache service not available" },
-        ]);
-      }
-    });
-
-    test("should return unhealthy when Redis is not available", async () => {
-      const mockCacheService = createMockCacheService(false);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const result = await checkCacheHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([{ field: "cache_database", issue: "Redis not available" }]);
-      }
-      expect(mockCacheService.isRedisAvailable).toHaveBeenCalled();
-    });
-
-    test("should handle Redis availability check exceptions", async () => {
-      const mockCacheService = createMockCacheService(true);
-      mockCacheService.isRedisAvailable.mockRejectedValue(new Error("Redis ping failed"));
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const result = await checkCacheHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([
-          { field: "cache_database", issue: "Redis health check failed" },
-        ]);
-      }
-    });
-
-    test("should handle cache service initialization exceptions", async () => {
-      const serviceException = new Error("Cache service unavailable");
-      vi.mocked(getCacheService).mockRejectedValue(serviceException);
-
-      const result = await checkCacheHealth();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([
-          { field: "cache_database", issue: "Redis health check failed" },
-        ]);
-      }
-    });
-
-    test("should verify isRedisAvailable is called asynchronously", async () => {
-      const mockCacheService = createMockCacheService(true);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      await checkCacheHealth();
-
-      // Verify the async method was called
-      expect(mockCacheService.isRedisAvailable).toHaveBeenCalledTimes(1);
-      expect(mockCacheService.isRedisAvailable).toReturnWith(Promise.resolve(true));
-    });
-  });
-
-  describe("performHealthChecks", () => {
-    test("should return all healthy when both checks pass", async () => {
-      // Mock successful database check
-      vi.mocked(prisma.$queryRaw).mockResolvedValue([{ "?column?": 1 }]);
-
-      // Mock successful cache check
-      const mockCacheService = createMockCacheService(true);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const result = await performHealthChecks();
-
-      expect(result).toEqual({
-        ok: true,
-        data: {
-          main_database: true,
-          cache_database: true,
-        },
-      });
-    });
-
-    test("should return mixed results when only database is healthy", async () => {
-      // Mock successful database check
-      vi.mocked(prisma.$queryRaw).mockResolvedValue([{ "?column?": 1 }]);
-
-      // Mock failed cache check
-      vi.mocked(getCacheService).mockResolvedValue(err({ code: ErrorCode.RedisConnectionError }));
-
-      const result = await performHealthChecks();
-
-      expect(result).toEqual({
-        ok: true,
-        data: {
-          main_database: true,
-          cache_database: false,
-        },
-      });
-    });
-
-    test("should return mixed results when only cache is healthy", async () => {
-      // Mock failed database check
-      vi.mocked(prisma.$queryRaw).mockRejectedValue(new Error("DB Error"));
-
-      // Mock successful cache check
-      const mockCacheService = createMockCacheService(true);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const result = await performHealthChecks();
-
-      expect(result).toEqual({
-        ok: true,
-        data: {
-          main_database: false,
-          cache_database: true,
-        },
-      });
-    });
-
-    test("should return all unhealthy when both checks fail", async () => {
-      // Mock failed database check
-      vi.mocked(prisma.$queryRaw).mockRejectedValue(new Error("DB Error"));
-
-      // Mock failed cache check
-      vi.mocked(getCacheService).mockResolvedValue(err({ code: ErrorCode.RedisConnectionError }));
-
-      const result = await performHealthChecks();
-
-      expect(result).toEqual({
-        ok: true,
-        data: {
-          main_database: false,
-          cache_database: false,
-        },
-      });
-    });
-
-    test("should run both checks in parallel", async () => {
-      const dbPromise = new Promise((resolve) => setTimeout(() => resolve([{ "?column?": 1 }]), 100));
-      const redisPromise = new Promise((resolve) => setTimeout(() => resolve(true), 100));
-
-      vi.mocked(prisma.$queryRaw).mockReturnValue(dbPromise as any);
-
-      const mockCacheService = createMockCacheService(true);
-      mockCacheService.isRedisAvailable.mockReturnValue(redisPromise as any);
-      vi.mocked(getCacheService).mockResolvedValue(ok(mockCacheService as any));
-
-      const startTime = Date.now();
-      await performHealthChecks();
-      const endTime = Date.now();
-
-      // Should complete in roughly 100ms (parallel) rather than 200ms (sequential)
-      expect(endTime - startTime).toBeLessThan(150);
-    });
-
-    test("should return error only on catastrophic failure (endpoint itself fails)", async () => {
-      // Mock a catastrophic failure in Promise.all itself
-      const originalPromiseAll = Promise.all;
-      vi.spyOn(Promise, "all").mockRejectedValue(new Error("Catastrophic system failure"));
-
-      const result = await performHealthChecks();
-
-      expect(result.ok).toBe(false);
-      if (!result.ok) {
-        expect(result.error.type).toBe("internal_server_error");
-        expect(result.error.details).toEqual([{ field: "health", issue: "Failed to perform health checks" }]);
-      }
-
-      // Restore original Promise.all
-      Promise.all = originalPromiseAll;
-    });
-  });
-});

apps/web/modules/api/v2/health/route.ts

@@ -1,15 +0,0 @@
-import { responses } from "@/modules/api/v2/lib/response";
-import { performHealthChecks } from "./lib/health-checks";
-
-export const GET = async () => {
-  const healthStatusResult = await performHealthChecks();
-  if (!healthStatusResult.ok) {
-    return responses.serviceUnavailableResponse({
-      details: healthStatusResult.error.details,
-    });
-  }
-
-  return responses.successResponse({
-    data: healthStatusResult.data,
-  });
-};

apps/web/modules/api/v2/health/types/health-status.ts

@@ -1,22 +0,0 @@
-import { z } from "zod";
-import { extendZodWithOpenApi } from "zod-openapi";
-
-extendZodWithOpenApi(z);
-
-export const ZOverallHealthStatus = z
-  .object({
-    main_database: z.boolean().openapi({
-      description: "Main database connection status - true if database is reachable and running",
-      example: true,
-    }),
-    cache_database: z.boolean().openapi({
-      description: "Cache database connection status - true if cache database is reachable and running",
-      example: true,
-    }),
-  })
-  .openapi({
-    title: "Health Check Response",
-    description: "Health check status for critical application dependencies",
-  });
-
-export type OverallHealthStatus = z.infer<typeof ZOverallHealthStatus>;

apps/web/modules/api/v2/lib/response.ts

@@ -232,35 +232,6 @@ const internalServerErrorResponse = ({
   );
 };
 
-const serviceUnavailableResponse = ({
-  details = [],
-  cors = false,
-  cache = "private, no-store",
-}: {
-  details?: ApiErrorDetails;
-  cors?: boolean;
-  cache?: string;
-} = {}) => {
-  const headers = {
-    ...(cors && corsHeaders),
-    "Cache-Control": cache,
-  };
-
-  return Response.json(
-    {
-      error: {
-        code: 503,
-        message: "Service Unavailable",
-        details,
-      },
-    },
-    {
-      status: 503,
-      headers,
-    }
-  );
-};
-
 const successResponse = ({
   data,
   meta,
@@ -354,7 +325,6 @@ export const responses = {
   unprocessableEntityResponse,
   tooManyRequestsResponse,
   internalServerErrorResponse,
-  serviceUnavailableResponse,
   successResponse,
   createdResponse,
   multiStatusResponse,

apps/web/modules/api/v2/lib/tests/utils.test.ts

@@ -1,8 +1,8 @@
+import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import * as Sentry from "@sentry/nextjs";
 import { describe, expect, test, vi } from "vitest";
 import { ZodError } from "zod";
 import { logger } from "@formbricks/logger";
-import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import { formatZodError, handleApiError, logApiError, logApiRequest } from "../utils";
 
 const mockRequest = new Request("http://localhost");
@@ -12,15 +12,6 @@ mockRequest.headers.set("x-request-id", "123");
 
 vi.mock("@sentry/nextjs", () => ({
   captureException: vi.fn(),
-  withScope: vi.fn((callback: (scope: any) => void) => {
-    const mockScope = {
-      setTag: vi.fn(),
-      setContext: vi.fn(),
-      setLevel: vi.fn(),
-      setExtra: vi.fn(),
-    };
-    callback(mockScope);
-  }),
 }));
 
 // Mock SENTRY_DSN constant
@@ -241,7 +232,7 @@ describe("utils", () => {
       });
 
       // Verify error was called on the child logger
-      expect(errorMock).toHaveBeenCalledWith("API V2 Error Details");
+      expect(errorMock).toHaveBeenCalledWith("API Error Details");
 
       // Restore the original method
       logger.withContext = originalWithContext;
@@ -275,7 +266,7 @@ describe("utils", () => {
       });
 
       // Verify error was called on the child logger
-      expect(errorMock).toHaveBeenCalledWith("API V2 Error Details");
+      expect(errorMock).toHaveBeenCalledWith("API Error Details");
 
       // Restore the original method
       logger.withContext = originalWithContext;
@@ -312,7 +303,7 @@ describe("utils", () => {
       });
 
       // Verify error was called on the child logger
-      expect(errorMock).toHaveBeenCalledWith("API V2 Error Details");
+      expect(errorMock).toHaveBeenCalledWith("API Error Details");
 
       // Verify Sentry.captureException was called
       expect(Sentry.captureException).toHaveBeenCalled();

apps/web/modules/api/v2/lib/utils-edge.ts

@@ -1,8 +1,8 @@
 // Function is this file can be used in edge runtime functions, like api routes.
-import * as Sentry from "@sentry/nextjs";
-import { logger } from "@formbricks/logger";
 import { IS_PRODUCTION, SENTRY_DSN } from "@/lib/constants";
 import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
+import * as Sentry from "@sentry/nextjs";
+import { logger } from "@formbricks/logger";
 
 export const logApiErrorEdge = (request: Request, error: ApiErrorResponseV2): void => {
   const correlationId = request.headers.get("x-request-id") ?? "";
@@ -10,14 +10,14 @@ export const logApiErrorEdge = (request: Request, error: ApiErrorResponseV2): vo
   // Send the error to Sentry if the DSN is set and the error type is internal_server_error
   // This is useful for tracking down issues without overloading Sentry with errors
   if (SENTRY_DSN && IS_PRODUCTION && error.type === "internal_server_error") {
-    // Use Sentry scope to add correlation ID as a tag for easy filtering
-    Sentry.withScope((scope) => {
-      scope.setTag("correlationId", correlationId);
-      scope.setLevel("error");
+    const err = new Error(`API V2 error, id: ${correlationId}`);
 
-      scope.setExtra("originalError", error);
-      const err = new Error(`API V2 error, id: ${correlationId}`);
-      Sentry.captureException(err);
+    Sentry.captureException(err, {
+      extra: {
+        details: error.details,
+        type: error.type,
+        correlationId,
+      },
     });
   }
 
@@ -26,5 +26,5 @@ export const logApiErrorEdge = (request: Request, error: ApiErrorResponseV2): vo
       correlationId,
       error,
     })
-    .error("API V2 Error Details");
+    .error("API Error Details");
 };

apps/web/modules/api/v2/lib/utils.ts

@@ -1,18 +1,17 @@
 // @ts-nocheck // We can remove this when we update the prisma client and the typescript version
 // if we don't add this we get build errors with prisma due to type-nesting
-import { ZodCustomIssue, ZodIssue } from "zod";
-import { logger } from "@formbricks/logger";
-import { TApiAuditLog } from "@/app/lib/api/with-api-logging";
 import { AUDIT_LOG_ENABLED } from "@/lib/constants";
 import { responses } from "@/modules/api/v2/lib/response";
 import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import { queueAuditEvent } from "@/modules/ee/audit-logs/lib/handler";
+import { ZodCustomIssue, ZodIssue } from "zod";
+import { logger } from "@formbricks/logger";
 import { logApiErrorEdge } from "./utils-edge";
 
 export const handleApiError = (
   request: Request,
   err: ApiErrorResponseV2,
-  auditLog?: TApiAuditLog
+  auditLog?: ApiAuditLog
 ): Response => {
   logApiError(request, err, auditLog);
 
@@ -56,7 +55,7 @@ export const formatZodError = (error: { issues: (ZodIssue | ZodCustomIssue)[] })
   });
 };
 
-export const logApiRequest = (request: Request, responseStatus: number, auditLog?: TApiAuditLog): void => {
+export const logApiRequest = (request: Request, responseStatus: number, auditLog?: ApiAuditLog): void => {
   const method = request.method;
   const url = new URL(request.url);
   const path = url.pathname;
@@ -83,13 +82,13 @@ export const logApiRequest = (request: Request, responseStatus: number, auditLog
   logAuditLog(request, auditLog);
 };
 
-export const logApiError = (request: Request, error: ApiErrorResponseV2, auditLog?: TApiAuditLog): void => {
+export const logApiError = (request: Request, error: ApiErrorResponseV2, auditLog?: ApiAuditLog): void => {
   logApiErrorEdge(request, error);
 
   logAuditLog(request, auditLog);
 };
 
-const logAuditLog = (request: Request, auditLog?: TApiAuditLog): void => {
+const logAuditLog = (request: Request, auditLog?: ApiAuditLog): void => {
   if (AUDIT_LOG_ENABLED && auditLog) {
     const correlationId = request.headers.get("x-request-id") ?? "";
     queueAuditEvent({

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/lib/openapi.ts

@@ -1,10 +1,7 @@
+import { ZContactLinkParams } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/types/survey";
+import { makePartialSchema } from "@/modules/api/v2/types/openapi-response";
 import { z } from "zod";
 import { ZodOpenApiOperationObject } from "zod-openapi";
-import {
-  ZContactLinkParams,
-  ZContactLinkQuery,
-} from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/types/survey";
-import { makePartialSchema } from "@/modules/api/v2/types/openapi-response";
 
 export const getPersonalizedSurveyLink: ZodOpenApiOperationObject = {
   operationId: "getPersonalizedSurveyLink",
@@ -12,7 +9,6 @@ export const getPersonalizedSurveyLink: ZodOpenApiOperationObject = {
   description: "Retrieves a personalized link for a specific survey.",
   requestParams: {
     path: ZContactLinkParams,
-    query: ZContactLinkQuery,
   },
   tags: ["Management API - Surveys - Contact Links"],
   responses: {
@@ -24,10 +20,6 @@ export const getPersonalizedSurveyLink: ZodOpenApiOperationObject = {
             z.object({
               data: z.object({
                 surveyUrl: z.string().url(),
-                expiresAt: z
-                  .string()
-                  .nullable()
-                  .describe("The date and time the link expires, null if no expiration"),
               }),
             })
           ),

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/route.ts

@@ -8,9 +8,7 @@ import { getSurvey } from "@/modules/api/v2/management/surveys/[surveyId]/contac
 import {
   TContactLinkParams,
   ZContactLinkParams,
-  ZContactLinkQuery,
 } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/types/survey";
-import { calculateExpirationDate } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/lib/utils";
 import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import { getContactSurveyLink } from "@/modules/ee/contacts/lib/contact-survey-link";
 import { hasPermission } from "@/modules/organization/settings/api-keys/lib/utils";
@@ -21,10 +19,9 @@ export const GET = async (request: Request, props: { params: Promise<TContactLin
     externalParams: props.params,
     schemas: {
       params: ZContactLinkParams,
-      query: ZContactLinkQuery,
     },
     handler: async ({ authentication, parsedInput }) => {
-      const { params, query } = parsedInput;
+      const { params } = parsedInput;
 
       if (!params) {
         return handleApiError(request, {
@@ -95,27 +92,12 @@ export const GET = async (request: Request, props: { params: Promise<TContactLin
         });
       }
 
-      // Calculate expiration date based on expirationDays
-      let expiresAt: string | null = null;
-      if (query?.expirationDays) {
-        expiresAt = calculateExpirationDate(query.expirationDays);
-      }
-
-      const surveyUrlResult = await getContactSurveyLink(
-        params.contactId,
-        params.surveyId,
-        query?.expirationDays || undefined
-      );
+      const surveyUrlResult = await getContactSurveyLink(params.contactId, params.surveyId, 7);
 
       if (!surveyUrlResult.ok) {
         return handleApiError(request, surveyUrlResult.error);
       }
 
-      return responses.successResponse({
-        data: {
-          surveyUrl: surveyUrlResult.data,
-          expiresAt,
-        },
-      });
+      return responses.successResponse({ data: { surveyUrl: surveyUrlResult.data } });
     },
   });

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/contacts/[contactId]/types/survey.ts

@@ -20,15 +20,4 @@ export const ZContactLinkParams = z.object({
     }),
 });
 
-export const ZContactLinkQuery = z.object({
-  expirationDays: z.coerce
-    .number()
-    .int()
-    .min(1)
-    .max(365)
-    .optional()
-    .describe("Number of days until the generated JWT expires. If not provided, there is no expiration."),
-});
-
 export type TContactLinkParams = z.infer<typeof ZContactLinkParams>;
-export type TContactLinkQuery = z.infer<typeof ZContactLinkQuery>;

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/lib/utils.test.ts

@@ -1,51 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
-import { calculateExpirationDate } from "./utils";
-
-describe("calculateExpirationDate", () => {
-  beforeEach(() => {
-    vi.useFakeTimers();
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  test("calculates expiration date for positive days", () => {
-    const baseDate = new Date("2024-01-15T12:00:00.000Z");
-    vi.setSystemTime(baseDate);
-
-    const result = calculateExpirationDate(7);
-    const expectedDate = new Date("2024-01-22T12:00:00.000Z");
-
-    expect(result).toBe(expectedDate.toISOString());
-  });
-
-  test("handles zero expiration days", () => {
-    const baseDate = new Date("2024-01-15T12:00:00.000Z");
-    vi.setSystemTime(baseDate);
-
-    const result = calculateExpirationDate(0);
-
-    expect(result).toBe(baseDate.toISOString());
-  });
-
-  test("handles negative expiration days", () => {
-    const baseDate = new Date("2024-01-15T12:00:00.000Z");
-    vi.setSystemTime(baseDate);
-
-    const result = calculateExpirationDate(-5);
-    const expectedDate = new Date("2024-01-10T12:00:00.000Z");
-
-    expect(result).toBe(expectedDate.toISOString());
-  });
-
-  test("returns valid ISO string format", () => {
-    const baseDate = new Date("2024-01-15T12:00:00.000Z");
-    vi.setSystemTime(baseDate);
-
-    const result = calculateExpirationDate(10);
-    const isoRegex = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-
-    expect(result).toMatch(isoRegex);
-  });
-});

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/lib/utils.ts

@@ -1,5 +0,0 @@
-export const calculateExpirationDate = (expirationDays: number) => {
-  const expirationDate = new Date();
-  expirationDate.setDate(expirationDate.getDate() + expirationDays);
-  return expirationDate.toISOString();
-};

apps/web/modules/api/v2/management/surveys/[surveyId]/contact-links/segments/[segmentId]/route.ts

@@ -1,9 +1,7 @@
-import { logger } from "@formbricks/logger";
 import { authenticatedApiClient } from "@/modules/api/v2/auth/authenticated-api-client";
 import { responses } from "@/modules/api/v2/lib/response";
 import { handleApiError } from "@/modules/api/v2/lib/utils";
 import { getEnvironmentId } from "@/modules/api/v2/management/lib/helper";
-import { calculateExpirationDate } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/lib/utils";
 import { getContactsInSegment } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/segments/[segmentId]/lib/contact";
 import {
   ZContactLinksBySegmentParams,
@@ -13,6 +11,7 @@ import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import { getContactSurveyLink } from "@/modules/ee/contacts/lib/contact-survey-link";
 import { getIsContactsEnabled } from "@/modules/ee/license-check/lib/utils";
 import { hasPermission } from "@/modules/organization/settings/api-keys/lib/utils";
+import { logger } from "@formbricks/logger";
 
 export const GET = async (
   request: Request,
@@ -77,7 +76,9 @@ export const GET = async (
       // Calculate expiration date based on expirationDays
       let expiresAt: string | null = null;
       if (query?.expirationDays) {
-        expiresAt = calculateExpirationDate(query.expirationDays);
+        const expirationDate = new Date();
+        expirationDate.setDate(expirationDate.getDate() + query.expirationDays);
+        expiresAt = expirationDate.toISOString();
       }
 
       // Generate survey links for each contact

apps/web/modules/api/v2/openapi-document.ts

@@ -1,5 +1,3 @@
-import { healthPaths } from "@/modules/api/v2/health/lib/openapi";
-import { ZOverallHealthStatus } from "@/modules/api/v2/health/types/health-status";
 import { contactAttributeKeyPaths } from "@/modules/api/v2/management/contact-attribute-keys/lib/openapi";
 import { responsePaths } from "@/modules/api/v2/management/responses/lib/openapi";
 import { surveyContactLinksBySegmentPaths } from "@/modules/api/v2/management/surveys/[surveyId]/contact-links/segments/lib/openapi";
@@ -37,7 +35,6 @@ const document = createDocument({
     version: "2.0.0",
   },
   paths: {
-    ...healthPaths,
     ...rolePaths,
     ...mePaths,
     ...responsePaths,
@@ -58,10 +55,6 @@ const document = createDocument({
     },
   ],
   tags: [
-    {
-      name: "Health",
-      description: "Operations for checking critical application dependencies health status.",
-    },
     {
       name: "Roles",
       description: "Operations for managing roles.",
@@ -121,7 +114,6 @@ const document = createDocument({
       },
     },
     schemas: {
-      health: ZOverallHealthStatus,
       role: ZRoles,
       me: ZApiKeyData,
       response: ZResponse,

apps/web/modules/auth/lib/authOptions.test.ts

@@ -1,12 +1,12 @@
-import { randomBytes } from "crypto";
-import { Provider } from "next-auth/providers/index";
-import { afterEach, describe, expect, test, vi } from "vitest";
-import { prisma } from "@formbricks/database";
 import { EMAIL_VERIFICATION_DISABLED } from "@/lib/constants";
 import { createToken } from "@/lib/jwt";
 // Import mocked rate limiting functions
 import { applyIPRateLimit } from "@/modules/core/rate-limit/helpers";
 import { rateLimitConfigs } from "@/modules/core/rate-limit/rate-limit-configs";
+import { randomBytes } from "crypto";
+import { Provider } from "next-auth/providers/index";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
 import { authOptions } from "./authOptions";
 import { mockUser } from "./mock-data";
 import { hashPassword } from "./utils";
@@ -31,7 +31,7 @@ vi.mock("@/lib/constants", () => ({
   SESSION_MAX_AGE: 86400,
   NEXTAUTH_SECRET: "test-secret",
   WEBAPP_URL: "http://localhost:3000",
-  ENCRYPTION_KEY: "12345678901234567890123456789012", // 32 bytes for AES-256
+  ENCRYPTION_KEY: "test-encryption-key-32-chars-long",
   REDIS_URL: undefined,
   AUDIT_LOG_ENABLED: false,
   AUDIT_LOG_GET_USER_IP: false,
@@ -261,7 +261,7 @@ describe("authOptions", () => {
       vi.mocked(applyIPRateLimit).mockResolvedValue(); // Rate limiting passes
       vi.spyOn(prisma.user, "findUnique").mockResolvedValue(mockUser as any);
 
-      const credentials = { token: createToken(mockUser.id) };
+      const credentials = { token: createToken(mockUser.id, mockUser.email) };
 
       await expect(tokenProvider.options.authorize(credentials, {})).rejects.toThrow(
         "Email already verified"
@@ -280,7 +280,7 @@ describe("authOptions", () => {
         groupId: null,
       } as any);
 
-      const credentials = { token: createToken(mockUserId) };
+      const credentials = { token: createToken(mockUserId, mockUser.email) };
 
       const result = await tokenProvider.options.authorize(credentials, {});
       expect(result.email).toBe(mockUser.email);
@@ -303,7 +303,7 @@ describe("authOptions", () => {
           groupId: null,
         } as any);
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await tokenProvider.options.authorize(credentials, {});
 
@@ -315,7 +315,7 @@ describe("authOptions", () => {
           new Error("Maximum number of requests reached. Please try again later.")
         );
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await expect(tokenProvider.options.authorize(credentials, {})).rejects.toThrow(
           "Maximum number of requests reached. Please try again later."
@@ -339,7 +339,7 @@ describe("authOptions", () => {
           groupId: null,
         } as any);
 
-        const credentials = { token: createToken(mockUserId) };
+        const credentials = { token: createToken(mockUserId, mockUser.email) };
 
         await tokenProvider.options.authorize(credentials, {});
 

apps/web/modules/auth/lib/authOptions.ts

@@ -66,21 +66,8 @@ export const authOptions: NextAuthOptions = {
           throw new Error("Invalid credentials");
         }
 
-        // Validate password length to prevent CPU DoS attacks
-        // bcrypt processes passwords up to 72 bytes, but we limit to 128 characters for security
-        if (credentials.password && credentials.password.length > 128) {
-          if (await shouldLogAuthFailure(identifier)) {
-            logAuthAttempt("password_too_long", "credentials", "password_validation", UNKNOWN_DATA, credentials?.email);
-          }
-          throw new Error("Invalid credentials");
-        }
-
-        // Use a control hash when user doesn't exist to maintain constant timing. 
-        const controlHash = "$2b$12$fzHf9le13Ss9UJ04xzmsjODXpFJxz6vsnupoepF5FiqDECkX2BH5q";
-        
         let user;
         try {
-          // Perform database lookup
           user = await prisma.user.findUnique({
             where: {
               email: credentials?.email,
@@ -92,12 +79,6 @@ export const authOptions: NextAuthOptions = {
           throw Error("Internal server error. Please try again later");
         }
 
-        // Always perform password verification to maintain constant timing. This is important to prevent timing attacks for user enumeration.
-        // Use actual hash if user exists, control hash if user doesn't exist
-        const hashToVerify = user?.password || controlHash;
-        const isValid = await verifyPassword(credentials.password, hashToVerify);
-
-        // Now check all conditions after constant-time operations are complete
         if (!user) {
           if (await shouldLogAuthFailure(identifier)) {
             logAuthAttempt("user_not_found", "credentials", "user_lookup", UNKNOWN_DATA, credentials?.email);
@@ -115,6 +96,8 @@ export const authOptions: NextAuthOptions = {
           throw new Error("Your account is currently inactive. Please contact the organization admin.");
         }
 
+        const isValid = await verifyPassword(credentials.password, user.password);
+
         if (!isValid) {
           if (await shouldLogAuthFailure(user.email)) {
             logAuthAttempt("invalid_password", "credentials", "password_validation", user.id, user.email);

apps/web/modules/auth/login/components/login-form.tsx

@@ -1,14 +1,5 @@
 "use client";
 
-import { zodResolver } from "@hookform/resolvers/zod";
-import { useTranslate } from "@tolgee/react";
-import { signIn } from "next-auth/react";
-import Link from "next/dist/client/link";
-import { useRouter, useSearchParams } from "next/navigation";
-import { useEffect, useMemo, useRef, useState } from "react";
-import { FormProvider, SubmitHandler, useForm } from "react-hook-form";
-import { toast } from "react-hot-toast";
-import { z } from "zod";
 import { cn } from "@/lib/cn";
 import { FORMBRICKS_LOGGED_IN_WITH_LS } from "@/lib/localStorage";
 import { getFormattedErrorMessage } from "@/lib/utils/helper";
@@ -19,13 +10,19 @@ import { TwoFactorBackup } from "@/modules/ee/two-factor-auth/components/two-fac
 import { Button } from "@/modules/ui/components/button";
 import { FormControl, FormError, FormField, FormItem } from "@/modules/ui/components/form";
 import { PasswordInput } from "@/modules/ui/components/password-input";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { useTranslate } from "@tolgee/react";
+import { signIn } from "next-auth/react";
+import Link from "next/dist/client/link";
+import { useRouter, useSearchParams } from "next/navigation";
+import { useEffect, useMemo, useRef, useState } from "react";
+import { FormProvider, SubmitHandler, useForm } from "react-hook-form";
+import { toast } from "react-hot-toast";
+import { z } from "zod";
 
 const ZLoginForm = z.object({
   email: z.string().email(),
-  password: z
-    .string()
-    .min(8, { message: "Password must be at least 8 characters long" })
-    .max(128, { message: "Password must be 128 characters or less" }),
+  password: z.string().min(8),
   totpCode: z.string().optional(),
   backupCode: z.string().optional(),
 });

apps/web/modules/core/rate-limit/rate-limit-configs.ts

@@ -1,7 +1,7 @@
 export const rateLimitConfigs = {
   // Authentication endpoints - stricter limits for security
   auth: {
-    login: { interval: 900, allowedPerInterval: 10, namespace: "auth:login" }, // 10 per 15 minutes
+    login: { interval: 900, allowedPerInterval: 30, namespace: "auth:login" }, // 30 per 15 minutes
     signup: { interval: 3600, allowedPerInterval: 30, namespace: "auth:signup" }, // 30 per hour
     forgotPassword: { interval: 3600, allowedPerInterval: 5, namespace: "auth:forgot" }, // 5 per hour
     verifyEmail: { interval: 3600, allowedPerInterval: 10, namespace: "auth:verify" }, // 10 per hour

apps/web/modules/ee/billing/components/pricing-card.tsx

@@ -1,13 +1,13 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
-import { CheckIcon } from "lucide-react";
-import { useMemo, useState } from "react";
-import { TOrganization, TOrganizationBillingPeriod } from "@formbricks/types/organizations";
 import { cn } from "@/lib/cn";
 import { Badge } from "@/modules/ui/components/badge";
 import { Button } from "@/modules/ui/components/button";
 import { ConfirmationModal } from "@/modules/ui/components/confirmation-modal";
+import { useTranslate } from "@tolgee/react";
+import { CheckIcon } from "lucide-react";
+import { useMemo, useState } from "react";
+import { TOrganization, TOrganizationBillingPeriod } from "@formbricks/types/organizations";
 import { TPricingPlan } from "../api/lib/constants";
 
 interface PricingCardProps {
@@ -170,13 +170,14 @@ export const PricingCard = ({
 
           {plan.id !== projectFeatureKeys.FREE && isCurrentPlan && (
             <Button
+              variant="secondary"
               loading={loading}
               onClick={async () => {
                 setLoading(true);
                 await onManageSubscription();
                 setLoading(false);
               }}
-              className="flex justify-center bg-[#635bff]">
+              className="flex justify-center">
               {t("environments.settings.billing.manage_subscription")}
             </Button>
           )}

apps/web/modules/ee/billing/components/pricing-table.tsx

@@ -1,13 +1,14 @@
 "use client";
 
+import { cn } from "@/lib/cn";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
+import { Badge } from "@/modules/ui/components/badge";
+import { Button } from "@/modules/ui/components/button";
 import { useTranslate } from "@tolgee/react";
 import { useRouter } from "next/navigation";
 import { useEffect, useState } from "react";
 import toast from "react-hot-toast";
 import { TOrganization, TOrganizationBillingPeriod } from "@formbricks/types/organizations";
-import { cn } from "@/lib/cn";
-import { Badge } from "@/modules/ui/components/badge";
-import { Button } from "@/modules/ui/components/button";
 import { isSubscriptionCancelledAction, manageSubscriptionAction, upgradePlanAction } from "../actions";
 import { getCloudPricingData } from "../api/lib/constants";
 import { BillingSlider } from "./billing-slider";
@@ -140,7 +141,7 @@ export const PricingTable = ({
           <div className="flex w-full">
             <h2 className="mb-3 mr-2 inline-flex w-full text-2xl font-bold text-slate-700">
               {t("environments.settings.billing.current_plan")}:{" "}
-              <span className="capitalize">{organization.billing.plan}</span>
+              {capitalizeFirstLetter(organization.billing.plan)}
               {cancellingOn && (
                 <Badge
                   className="mx-2"
@@ -174,7 +175,7 @@ export const PricingTable = ({
             )}
           </div>
 
-          <div className="mt-2 flex flex-col rounded-xl border border-slate-200 bg-white py-4 shadow-sm dark:bg-slate-800">
+          <div className="mt-2 flex flex-col rounded-xl border border-slate-200 bg-white py-4 capitalize shadow-sm dark:bg-slate-800">
             <div
               className={cn(
                 "relative mx-8 mb-8 flex flex-col gap-4",

apps/web/modules/ee/contacts/[contactId]/components/attributes-section.tsx

@@ -1,4 +1,5 @@
 import { getResponsesByContactId } from "@/lib/response/service";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
 import { getContactAttributes } from "@/modules/ee/contacts/lib/contact-attributes";
 import { getContact } from "@/modules/ee/contacts/lib/contacts";
 import { IdBadge } from "@/modules/ui/components/id-badge";
@@ -58,7 +59,7 @@ export const AttributesSection = async ({ contactId }: { contactId: string }) =>
         .map(([key, attributeData]) => {
           return (
             <div key={key}>
-              <dt className="text-sm font-medium text-slate-500">{key.toString()}</dt>
+              <dt className="text-sm font-medium text-slate-500">{capitalizeFirstLetter(key.toString())}</dt>
               <dd className="mt-1 text-sm text-slate-900">{attributeData}</dd>
             </div>
           );

apps/web/modules/ee/contacts/api/v1/client/[environmentId]/user/lib/segments.ts

@@ -1,3 +1,6 @@
+import { cache } from "@/lib/cache";
+import { validateInputs } from "@/lib/utils/validate";
+import { evaluateSegment } from "@/modules/ee/contacts/segments/lib/segments";
 import { Prisma } from "@prisma/client";
 import { cache as reactCache } from "react";
 import { createCacheKey } from "@formbricks/cache";
@@ -6,9 +9,6 @@ import { logger } from "@formbricks/logger";
 import { ZId, ZString } from "@formbricks/types/common";
 import { DatabaseError } from "@formbricks/types/errors";
 import { TBaseFilter } from "@formbricks/types/segment";
-import { cache } from "@/lib/cache";
-import { validateInputs } from "@/lib/utils/validate";
-import { evaluateSegment } from "@/modules/ee/contacts/segments/lib/segments";
 
 export const getSegments = reactCache(
   async (environmentId: string) =>
@@ -34,7 +34,7 @@ export const getSegments = reactCache(
         }
       },
       createCacheKey.environment.segments(environmentId),
-      60 * 1000 // 1 minutes in milliseconds
+      5 * 60 * 1000 // 5 minutes in milliseconds
     )
 );
 

apps/web/modules/ee/contacts/segments/components/segment-filter.tsx

@@ -1,5 +1,34 @@
 "use client";
 
+import { cn } from "@/lib/cn";
+import { structuredClone } from "@/lib/pollyfills/structuredClone";
+import { isCapitalized } from "@/lib/utils/strings";
+import {
+  convertOperatorToText,
+  convertOperatorToTitle,
+  toggleFilterConnector,
+  updateContactAttributeKeyInFilter,
+  updateDeviceTypeInFilter,
+  updateFilterValue,
+  updateOperatorInFilter,
+  updatePersonIdentifierInFilter,
+  updateSegmentIdInFilter,
+} from "@/modules/ee/contacts/segments/lib/utils";
+import { Button } from "@/modules/ui/components/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/modules/ui/components/dropdown-menu";
+import { Input } from "@/modules/ui/components/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/modules/ui/components/select";
 import { useTranslate } from "@tolgee/react";
 import {
   ArrowDownIcon,
@@ -35,35 +64,6 @@ import {
   DEVICE_OPERATORS,
   PERSON_OPERATORS,
 } from "@formbricks/types/segment";
-import { cn } from "@/lib/cn";
-import { structuredClone } from "@/lib/pollyfills/structuredClone";
-import { isCapitalized } from "@/lib/utils/strings";
-import {
-  convertOperatorToText,
-  convertOperatorToTitle,
-  toggleFilterConnector,
-  updateContactAttributeKeyInFilter,
-  updateDeviceTypeInFilter,
-  updateFilterValue,
-  updateOperatorInFilter,
-  updatePersonIdentifierInFilter,
-  updateSegmentIdInFilter,
-} from "@/modules/ee/contacts/segments/lib/utils";
-import { Button } from "@/modules/ui/components/button";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from "@/modules/ui/components/dropdown-menu";
-import { Input } from "@/modules/ui/components/input";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/modules/ui/components/select";
 import { AddFilterModal } from "./add-filter-modal";
 
 interface TSegmentFilterProps {
@@ -314,7 +314,7 @@ function AttributeSegmentFilter({
         }}
         value={attrKeyValue}>
         <SelectTrigger
-          className="flex w-auto items-center justify-center whitespace-nowrap bg-white"
+          className="flex w-auto items-center justify-center whitespace-nowrap bg-white capitalize"
           hideArrow>
           <SelectValue>
             <div className={cn("flex items-center gap-2", !isCapitalized(attrKeyValue ?? "") && "lowercase")}>
@@ -496,7 +496,7 @@ function PersonSegmentFilter({
         }}
         value={personIdentifier}>
         <SelectTrigger
-          className="flex w-auto items-center justify-center whitespace-nowrap bg-white"
+          className="flex w-auto items-center justify-center whitespace-nowrap bg-white capitalize"
           hideArrow>
           <SelectValue>
             <div className="flex items-center gap-1 lowercase">
@@ -647,7 +647,7 @@ function SegmentSegmentFilter({
         }}
         value={currentSegment?.id}>
         <SelectTrigger
-          className="flex w-auto items-center justify-center whitespace-nowrap bg-white"
+          className="flex w-auto items-center justify-center whitespace-nowrap bg-white capitalize"
           hideArrow>
           <div className="flex items-center gap-1">
             <Users2Icon className="h-4 w-4 text-sm" />

apps/web/modules/ee/quotas/components/quota-list.tsx

@@ -2,7 +2,6 @@
 
 import { Button } from "@/modules/ui/components/button";
 import { Label } from "@/modules/ui/components/label";
-import { TooltipRenderer } from "@/modules/ui/components/tooltip";
 import { useTranslate } from "@tolgee/react";
 import { CopyIcon, Trash2Icon } from "lucide-react";
 import { TSurveyQuota } from "@formbricks/types/quota";
@@ -38,30 +37,26 @@ export const QuotaList = ({ quotas, onEdit, deleteQuota, duplicateQuota }: Quota
           </div>
 
           <div className="flex items-center gap-2">
-            <TooltipRenderer tooltipContent={t("common.delete")}>
-              <Button
-                variant="ghost"
-                size="sm"
-                onClick={(e) => {
-                  e.stopPropagation();
-                  deleteQuota(quota);
-                }}
-                className="h-8 w-8 p-0 text-slate-500">
-                <Trash2Icon className="h-4 w-4" />
-              </Button>
-            </TooltipRenderer>
-            <TooltipRenderer tooltipContent={t("common.duplicate")}>
-              <Button
-                variant="ghost"
-                size="sm"
-                onClick={(e) => {
-                  e.stopPropagation();
-                  duplicateQuota(quota);
-                }}
-                className="h-8 w-8 p-0 text-slate-500">
-                <CopyIcon className="h-4 w-4" />
-              </Button>
-            </TooltipRenderer>
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={(e) => {
+                e.stopPropagation();
+                deleteQuota(quota);
+              }}
+              className="h-8 w-8 p-0 text-slate-500">
+              <Trash2Icon className="h-4 w-4" />
+            </Button>
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={(e) => {
+                e.stopPropagation();
+                duplicateQuota(quota);
+              }}
+              className="h-8 w-8 p-0 text-slate-500">
+              <CopyIcon className="h-4 w-4" />
+            </Button>
           </div>
         </div>
       ))}

apps/web/modules/ee/role-management/components/edit-membership-role.test.tsx

@@ -25,15 +25,6 @@ vi.mock("../actions", () => ({
   updateInviteAction: vi.fn(),
 }));
 
-vi.mock("@/lib/membership/utils", () => ({
-  getAccessFlags: (role: string) => ({
-    isOwner: role === "owner",
-    isManager: role === "manager",
-    isMember: role === "member",
-    isBilling: role === "billing",
-  }),
-}));
-
 describe("EditMembershipRole Component", () => {
   const mockRouter = {
     refresh: vi.fn(),
@@ -62,21 +53,15 @@ describe("EditMembershipRole Component", () => {
 
   describe("Rendering", () => {
     test("renders a dropdown when user is owner", () => {
-      render(<EditMembershipRole {...defaultProps} isUserManagementDisabledFromUi={false} />);
+      render(<EditMembershipRole {...defaultProps} />);
 
       const button = screen.queryByRole("button-role");
       expect(button).toBeInTheDocument();
-      expect(button).toHaveTextContent("member");
+      expect(button).toHaveTextContent("Member");
     });
 
     test("renders a badge when user is not owner or manager", () => {
-      render(
-        <EditMembershipRole
-          {...defaultProps}
-          currentUserRole="member"
-          isUserManagementDisabledFromUi={false}
-        />
-      );
+      render(<EditMembershipRole {...defaultProps} currentUserRole="member" />);
 
       const badge = screen.queryByRole("badge-role");
       expect(badge).toBeInTheDocument();
@@ -85,42 +70,21 @@ describe("EditMembershipRole Component", () => {
     });
 
     test("disables the dropdown when editing own role", () => {
-      render(
-        <EditMembershipRole
-          {...defaultProps}
-          memberId="user-456"
-          userId="user-456"
-          isUserManagementDisabledFromUi={false}
-        />
-      );
+      render(<EditMembershipRole {...defaultProps} memberId="user-456" userId="user-456" />);
 
       const button = screen.getByRole("button-role");
       expect(button).toBeDisabled();
     });
 
     test("disables the dropdown when the user is the only owner", () => {
-      render(
-        <EditMembershipRole
-          {...defaultProps}
-          memberRole="owner"
-          doesOrgHaveMoreThanOneOwner={false}
-          isUserManagementDisabledFromUi={false}
-        />
-      );
+      render(<EditMembershipRole {...defaultProps} memberRole="owner" doesOrgHaveMoreThanOneOwner={false} />);
 
       const button = screen.getByRole("button-role");
       expect(button).toBeDisabled();
     });
 
     test("disables the dropdown when a manager tries to edit an owner", () => {
-      render(
-        <EditMembershipRole
-          {...defaultProps}
-          currentUserRole="manager"
-          memberRole="owner"
-          isUserManagementDisabledFromUi={false}
-        />
-      );
+      render(<EditMembershipRole {...defaultProps} currentUserRole="manager" memberRole="owner" />);
 
       const button = screen.getByRole("button-role");
       expect(button).toBeDisabled();

apps/web/modules/ee/role-management/components/edit-membership-role.tsx

@@ -1,12 +1,7 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
-import { ChevronDownIcon } from "lucide-react";
-import { useRouter } from "next/navigation";
-import { useState } from "react";
-import toast from "react-hot-toast";
-import type { TOrganizationRole } from "@formbricks/types/memberships";
 import { getAccessFlags } from "@/lib/membership/utils";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
 import { Badge } from "@/modules/ui/components/badge";
 import { Button } from "@/modules/ui/components/button";
 import {
@@ -16,6 +11,12 @@ import {
   DropdownMenuRadioItem,
   DropdownMenuTrigger,
 } from "@/modules/ui/components/dropdown-menu";
+import { useTranslate } from "@tolgee/react";
+import { ChevronDownIcon } from "lucide-react";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import toast from "react-hot-toast";
+import type { TOrganizationRole } from "@formbricks/types/memberships";
 import { updateInviteAction, updateMembershipAction } from "../actions";
 
 interface Role {
@@ -103,7 +104,7 @@ export function EditMembershipRole({
             size="sm"
             variant="secondary"
             role="button-role">
-            <span className="ml-1 capitalize">{memberRole}</span>
+            <span className="ml-1">{capitalizeFirstLetter(memberRole)}</span>
             <ChevronDownIcon className="h-4 w-4" />
           </Button>
         </DropdownMenuTrigger>
@@ -127,5 +128,5 @@ export function EditMembershipRole({
     );
   }
 
-  return <Badge size="tiny" type="gray" role="badge-role" text={memberRole} className="capitalize" />;
+  return <Badge size="tiny" type="gray" role="badge-role" text={capitalizeFirstLetter(memberRole)} />;
 }

apps/web/modules/email/index.tsx

@@ -1,12 +1,3 @@
-import { render } from "@react-email/render";
-import { createTransport } from "nodemailer";
-import type SMTPTransport from "nodemailer/lib/smtp-transport";
-import { logger } from "@formbricks/logger";
-import type { TLinkSurveyEmailData } from "@formbricks/types/email";
-import { InvalidInputError } from "@formbricks/types/errors";
-import type { TResponse } from "@formbricks/types/responses";
-import type { TSurvey } from "@formbricks/types/surveys/types";
-import { TUserEmail, TUserLocale } from "@formbricks/types/user";
 import {
   DEBUG,
   MAIL_FROM,
@@ -26,6 +17,15 @@ import { getOrganizationByEnvironmentId } from "@/lib/organization/service";
 import NewEmailVerification from "@/modules/email/emails/auth/new-email-verification";
 import { EmailCustomizationPreviewEmail } from "@/modules/email/emails/general/email-customization-preview-email";
 import { getTranslate } from "@/tolgee/server";
+import { render } from "@react-email/render";
+import { createTransport } from "nodemailer";
+import type SMTPTransport from "nodemailer/lib/smtp-transport";
+import { logger } from "@formbricks/logger";
+import type { TLinkSurveyEmailData } from "@formbricks/types/email";
+import { InvalidInputError } from "@formbricks/types/errors";
+import type { TResponse } from "@formbricks/types/responses";
+import type { TSurvey } from "@formbricks/types/surveys/types";
+import { TUserEmail, TUserLocale } from "@formbricks/types/user";
 import { ForgotPasswordEmail } from "./emails/auth/forgot-password-email";
 import { PasswordResetNotifyEmail } from "./emails/auth/password-reset-notify-email";
 import { VerificationEmail } from "./emails/auth/verification-email";
@@ -111,7 +111,7 @@ export const sendVerificationEmail = async ({
 }): Promise<boolean> => {
   try {
     const t = await getTranslate();
-    const token = createToken(id, {
+    const token = createToken(id, email, {
       expiresIn: "1d",
     });
     const verifyLink = `${WEBAPP_URL}/auth/verify?token=${encodeURIComponent(token)}`;
@@ -136,7 +136,7 @@ export const sendForgotPasswordEmail = async (user: {
   locale: TUserLocale;
 }): Promise<boolean> => {
   const t = await getTranslate();
-  const token = createToken(user.id, {
+  const token = createToken(user.id, user.email, {
     expiresIn: "1d",
   });
   const verifyLink = `${WEBAPP_URL}/auth/forgot-password/reset?token=${encodeURIComponent(token)}`;

apps/web/modules/integrations/webhooks/components/webhook-overview-tab.tsx

@@ -1,10 +1,11 @@
 "use client";
 
+import { convertDateTimeStringShort } from "@/lib/time";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
+import { Label } from "@/modules/ui/components/label";
 import { Webhook } from "@prisma/client";
 import { TFnType, useTranslate } from "@tolgee/react";
 import { TSurvey } from "@formbricks/types/surveys/types";
-import { convertDateTimeStringShort } from "@/lib/time";
-import { Label } from "@/modules/ui/components/label";
 
 interface ActivityTabProps {
   webhook: Webhook;
@@ -49,8 +50,8 @@ export const WebhookOverviewTab = ({ webhook, surveys }: ActivityTabProps) => {
           <Label className="text-slate-500">
             {t("environments.integrations.webhooks.created_by_third_party")}
           </Label>
-          <p className="text-sm capitalize text-slate-900">
-            {webhook.source === "user" ? "No" : webhook.source}
+          <p className="text-sm text-slate-900">
+            {webhook.source === "user" ? "No" : capitalizeFirstLetter(webhook.source)}
           </p>
         </div>
 

apps/web/modules/integrations/webhooks/components/webhook-row-data.tsx

@@ -1,11 +1,12 @@
 "use client";
 
+import { timeSince } from "@/lib/time";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
+import { Badge } from "@/modules/ui/components/badge";
 import { Webhook } from "@prisma/client";
 import { TFnType, useTranslate } from "@tolgee/react";
 import { TSurvey } from "@formbricks/types/surveys/types";
 import { TUserLocale } from "@formbricks/types/user";
-import { timeSince } from "@/lib/time";
-import { Badge } from "@/modules/ui/components/badge";
 
 const renderSelectedSurveysText = (webhook: Webhook, allSurveys: TSurvey[]) => {
   if (webhook.surveyIds.length === 0) {
@@ -81,7 +82,7 @@ export const WebhookRowData = ({
         </div>
       </div>
       <div className="col-span-1 my-auto text-center text-sm text-slate-800">
-        <Badge type="gray" size="tiny" text={webhook.source || t("common.user")} className="capitalize" />
+        <Badge type="gray" size="tiny" text={capitalizeFirstLetter(webhook.source) || t("common.user")} />
       </div>
       <div className="col-span-4 my-auto text-center text-sm text-slate-800">
         {renderSelectedSurveysText(webhook, surveys)}

apps/web/modules/organization/settings/api-keys/components/add-api-key-modal.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { getOrganizationAccessKeyDisplayName } from "@/modules/organization/settings/api-keys/lib/utils";
 import { TOrganizationProject } from "@/modules/organization/settings/api-keys/types/api-keys";
 import { Alert, AlertTitle } from "@/modules/ui/components/alert";
 import { Button } from "@/modules/ui/components/button";
@@ -23,7 +24,7 @@ import { Switch } from "@/modules/ui/components/switch";
 import { ApiKeyPermission } from "@prisma/client";
 import { useTranslate } from "@tolgee/react";
 import { ChevronDownIcon, Trash2Icon } from "lucide-react";
-import { useState } from "react";
+import { Fragment, useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "react-hot-toast";
 import { TOrganizationAccess } from "@formbricks/types/api-key";
@@ -219,10 +220,10 @@ export const AddApiKeyModal = ({
     <Dialog open={open} onOpenChange={setOpen}>
       <DialogContent>
         <DialogHeader>
-          <DialogTitle className="px-1">{t("environments.project.api_keys.add_api_key")}</DialogTitle>
+          <DialogTitle>{t("environments.project.api_keys.add_api_key")}</DialogTitle>
         </DialogHeader>
         <form onSubmit={handleSubmit(submitAPIKey)} className="contents">
-          <DialogBody className="space-y-4 overflow-y-auto px-1 py-4">
+          <DialogBody className="space-y-4 overflow-y-auto py-4">
             <div className="space-y-2">
               <Label>{t("environments.project.api_keys.api_key_label")}</Label>
               <Input
@@ -347,31 +348,43 @@ export const AddApiKeyModal = ({
             </div>
 
             <div className="space-y-4">
-              <Label>{t("environments.project.api_keys.organization_access")}</Label>
-              {Object.keys(selectedOrganizationAccess).map((key) => (
-                <div key={key} className="mt-2 flex items-center gap-6">
-                  <div className="flex items-center gap-2">
-                    <Label>Read</Label>
-                    <Switch
-                      data-testid={`organization-access-${key}-read`}
-                      checked={selectedOrganizationAccess[key].read || selectedOrganizationAccess[key].write}
-                      onCheckedChange={(newVal) => setSelectedOrganizationAccessValue(key, "read", newVal)}
-                      disabled={selectedOrganizationAccess[key].write}
-                    />
-                  </div>
-                  <div className="flex items-center gap-2">
-                    <Label>Write</Label>
-                    <Switch
-                      data-testid={`organization-access-${key}-write`}
-                      checked={selectedOrganizationAccess[key].write}
-                      onCheckedChange={(newVal) => setSelectedOrganizationAccessValue(key, "write", newVal)}
-                    />
-                  </div>
+              <div>
+                <Label>{t("environments.project.api_keys.organization_access")}</Label>
+                <p className="text-sm text-slate-500">
+                  {t("environments.project.api_keys.organization_access_description")}
+                </p>
+              </div>
+              <div className="space-y-2">
+                <div className="grid grid-cols-[auto_100px_100px] gap-4">
+                  <div></div>
+                  <span className="flex items-center justify-center text-sm font-medium">Read</span>
+                  <span className="flex items-center justify-center text-sm font-medium">Write</span>
+
+                  {Object.keys(selectedOrganizationAccess).map((key) => (
+                    <Fragment key={key}>
+                      <div className="py-1 text-sm">{getOrganizationAccessKeyDisplayName(key, t)}</div>
+                      <div className="flex items-center justify-center py-1">
+                        <Switch
+                          data-testid={`organization-access-${key}-read`}
+                          checked={selectedOrganizationAccess[key].read}
+                          onCheckedChange={(newVal) =>
+                            setSelectedOrganizationAccessValue(key, "read", newVal)
+                          }
+                        />
+                      </div>
+                      <div className="flex items-center justify-center py-1">
+                        <Switch
+                          data-testid={`organization-access-${key}-write`}
+                          checked={selectedOrganizationAccess[key].write}
+                          onCheckedChange={(newVal) =>
+                            setSelectedOrganizationAccessValue(key, "write", newVal)
+                          }
+                        />
+                      </div>
+                    </Fragment>
+                  ))}
                 </div>
-              ))}
-              <p className="text-sm text-slate-500">
-                {t("environments.project.api_keys.organization_access_description")}
-              </p>
+              </div>
             </div>
             <Alert variant="warning">
               <AlertTitle>{t("environments.project.api_keys.api_key_security_warning")}</AlertTitle>

apps/web/modules/organization/settings/api-keys/components/view-permission-modal.test.tsx

@@ -1,6 +1,7 @@
 import { ApiKeyPermission } from "@prisma/client";
 import "@testing-library/jest-dom/vitest";
 import { cleanup, render, screen } from "@testing-library/react";
+import React from "react";
 import { afterEach, describe, expect, test, vi } from "vitest";
 import { TProject } from "@formbricks/types/project";
 import { TApiKeyWithEnvironmentPermission } from "../types/api-keys";
@@ -103,8 +104,6 @@ describe("ViewPermissionModal", () => {
     setOpen: vi.fn(),
     projects: mockProjects,
     apiKey: mockApiKey,
-    onSubmit: vi.fn(),
-    isUpdating: false,
   };
 
   test("renders the modal with correct title", () => {
@@ -155,7 +154,7 @@ describe("ViewPermissionModal", () => {
     expect(screen.getByTestId("organization-access-accessControl-read")).toBeDisabled();
     expect(screen.getByTestId("organization-access-accessControl-write")).not.toBeChecked();
     expect(screen.getByTestId("organization-access-accessControl-write")).toBeDisabled();
-    expect(screen.getByTestId("organization-access-otherAccess-read")).toBeChecked();
+    expect(screen.getByTestId("organization-access-otherAccess-read")).not.toBeChecked();
     expect(screen.getByTestId("organization-access-otherAccess-write")).toBeChecked();
   });
 });

apps/web/modules/organization/settings/api-keys/components/view-permission-modal.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { getOrganizationAccessKeyDisplayName } from "@/modules/organization/settings/api-keys/lib/utils";
 import {
   TApiKeyUpdateInput,
   TApiKeyWithEnvironmentPermission,
@@ -21,7 +22,7 @@ import { Label } from "@/modules/ui/components/label";
 import { Switch } from "@/modules/ui/components/switch";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useTranslate } from "@tolgee/react";
-import { useEffect } from "react";
+import { Fragment, useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { TOrganizationAccess } from "@formbricks/types/api-key";
 
@@ -167,28 +168,36 @@ export const ViewPermissionModal = ({
                   })}
                 </div>
               </div>
-              <div className="space-y-4">
+
+              <div className="space-y-2">
                 <Label>{t("environments.project.api_keys.organization_access")}</Label>
-                {Object.keys(organizationAccess).map((key) => (
-                  <div key={key} className="mb-2 flex items-center gap-6">
-                    <div className="flex items-center gap-2">
-                      <Label className="text-sm font-medium">Read</Label>
-                      <Switch
-                        disabled={true}
-                        data-testid={`organization-access-${key}-read`}
-                        checked={organizationAccess[key].read || organizationAccess[key].write}
-                      />
-                    </div>
-                    <div className="flex items-center gap-2">
-                      <Label className="text-sm font-medium">Write</Label>
-                      <Switch
-                        disabled={true}
-                        data-testid={`organization-access-${key}-write`}
-                        checked={organizationAccess[key].write}
-                      />
-                    </div>
+                <div className="space-y-2">
+                  <div className="grid grid-cols-[auto_100px_100px] gap-4">
+                    <div></div>
+                    <span className="flex items-center justify-center text-sm font-medium">Read</span>
+                    <span className="flex items-center justify-center text-sm font-medium">Write</span>
+
+                    {Object.keys(organizationAccess).map((key) => (
+                      <Fragment key={key}>
+                        <div className="py-1 text-sm">{getOrganizationAccessKeyDisplayName(key, t)}</div>
+                        <div className="flex items-center justify-center py-1">
+                          <Switch
+                            disabled={true}
+                            data-testid={`organization-access-${key}-read`}
+                            checked={organizationAccess[key].read}
+                          />
+                        </div>
+                        <div className="flex items-center justify-center py-1">
+                          <Switch
+                            disabled={true}
+                            data-testid={`organization-access-${key}-write`}
+                            checked={organizationAccess[key].write}
+                          />
+                        </div>
+                      </Fragment>
+                    ))}
                   </div>
-                ))}
+                </div>
               </div>
             </div>
           </form>

apps/web/modules/organization/settings/api-keys/lib/utils.test.ts

@@ -1,6 +1,6 @@
-import { describe, expect, test } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 import { TAPIKeyEnvironmentPermission } from "@formbricks/types/auth";
-import { hasPermission } from "./utils";
+import { getOrganizationAccessKeyDisplayName, hasPermission } from "./utils";
 
 describe("hasPermission", () => {
   const envId = "env1";
@@ -83,3 +83,17 @@ describe("hasPermission", () => {
     expect(hasPermission(permissions, "other", "GET")).toBe(false);
   });
 });
+
+describe("getOrganizationAccessKeyDisplayName", () => {
+  test("returns tolgee string for accessControl", () => {
+    const t = vi.fn((k) => k);
+    expect(getOrganizationAccessKeyDisplayName("accessControl", t)).toBe(
+      "environments.project.api_keys.access_control"
+    );
+    expect(t).toHaveBeenCalledWith("environments.project.api_keys.access_control");
+  });
+  test("returns tolgee string for other keys", () => {
+    const t = vi.fn((k) => k);
+    expect(getOrganizationAccessKeyDisplayName("otherKey", t)).toBe("otherKey");
+  });
+});

apps/web/modules/organization/settings/api-keys/lib/utils.ts

@@ -1,3 +1,4 @@
+import { TFnType } from "@tolgee/react";
 import { OrganizationAccessType } from "@formbricks/types/api-key";
 import { TAPIKeyEnvironmentPermission, TAuthenticationApiKey } from "@formbricks/types/auth";
 
@@ -42,6 +43,15 @@ export const hasPermission = (
   }
 };
 
+export const getOrganizationAccessKeyDisplayName = (key: string, t: TFnType) => {
+  switch (key) {
+    case "accessControl":
+      return t("environments.project.api_keys.access_control");
+    default:
+      return key;
+  }
+};
+
 export const hasOrganizationAccess = (
   authentication: TAuthenticationApiKey,
   accessType: OrganizationAccessType

apps/web/modules/projects/settings/(setup)/components/ActionActivityTab.test.tsx

@@ -1,11 +1,11 @@
+import { getActiveInactiveSurveysAction } from "@/modules/projects/settings/(setup)/app-connection/actions";
+import { createActionClassAction } from "@/modules/survey/editor/actions";
 import { cleanup, render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import toast from "react-hot-toast";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { TActionClass } from "@formbricks/types/action-classes";
 import { TEnvironment } from "@formbricks/types/environment";
-import { getActiveInactiveSurveysAction } from "@/modules/projects/settings/(setup)/app-connection/actions";
-import { createActionClassAction } from "@/modules/survey/editor/actions";
 import { ActionActivityTab } from "./ActionActivityTab";
 
 // Mock dependencies
@@ -51,6 +51,10 @@ vi.mock("@/lib/utils/helper", () => ({
   getFormattedErrorMessage: (error: any) => `Formatted error: ${error?.message || "Unknown error"}`,
 }));
 
+vi.mock("@/lib/utils/strings", () => ({
+  capitalizeFirstLetter: (str: string) => str.charAt(0).toUpperCase() + str.slice(1),
+}));
+
 vi.mock("@/modules/survey/editor/actions", () => ({
   createActionClassAction: vi.fn(),
 }));
@@ -205,7 +209,7 @@ describe("ActionActivityTab", () => {
     expect(screen.getByText(`formatted-${mockActionClass.createdAt.toString()}`)).toBeInTheDocument(); // Created on
     expect(screen.getByText(`formatted-${mockActionClass.updatedAt.toString()}`)).toBeInTheDocument(); // Last updated
     expect(screen.getByText("NoCodeIcon")).toBeInTheDocument(); // Type icon
-    expect(screen.getByText("noCode")).toBeInTheDocument(); // Type text (now lowercase, capitalized via CSS)
+    expect(screen.getByText("NoCode")).toBeInTheDocument(); // Type text
     expect(screen.getByText("Development")).toBeInTheDocument(); // Environment
     expect(screen.getByText("Copy to Production")).toBeInTheDocument(); // Copy button text
   });

apps/web/modules/projects/settings/(setup)/components/ActionActivityTab.tsx

@@ -1,12 +1,8 @@
 "use client";
 
-import { useTranslate } from "@tolgee/react";
-import { useEffect, useMemo, useState } from "react";
-import toast from "react-hot-toast";
-import { TActionClass, TActionClassInput, TActionClassInputCode } from "@formbricks/types/action-classes";
-import { TEnvironment } from "@formbricks/types/environment";
 import { convertDateTimeStringShort } from "@/lib/time";
 import { getFormattedErrorMessage } from "@/lib/utils/helper";
+import { capitalizeFirstLetter } from "@/lib/utils/strings";
 import { getActiveInactiveSurveysAction } from "@/modules/projects/settings/(setup)/app-connection/actions";
 import { ACTION_TYPE_ICON_LOOKUP } from "@/modules/projects/settings/(setup)/app-connection/utils";
 import { createActionClassAction } from "@/modules/survey/editor/actions";
@@ -14,6 +10,11 @@ import { Button } from "@/modules/ui/components/button";
 import { ErrorComponent } from "@/modules/ui/components/error-component";
 import { Label } from "@/modules/ui/components/label";
 import { LoadingSpinner } from "@/modules/ui/components/loading-spinner";
+import { useTranslate } from "@tolgee/react";
+import { useEffect, useMemo, useState } from "react";
+import toast from "react-hot-toast";
+import { TActionClass, TActionClassInput, TActionClassInputCode } from "@formbricks/types/action-classes";
+import { TEnvironment } from "@formbricks/types/environment";
 
 interface ActivityTabProps {
   actionClass: TActionClass;
@@ -151,7 +152,7 @@ export const ActionActivityTab = ({
           <Label className="block text-xs font-normal text-slate-500">Type</Label>
           <div className="mt-1 flex items-center">
             <div className="mr-1.5 h-4 w-4 text-slate-600">{ACTION_TYPE_ICON_LOOKUP[actionClass.type]}</div>
-            <p className="text-sm capitalize text-slate-700">{actionClass.type}</p>
+            <p className="text-sm text-slate-700">{capitalizeFirstLetter(actionClass.type)}</p>
           </div>
         </div>
         <div className="">

apps/web/modules/survey/components/question-form-input/index.tsx

@@ -1,19 +1,5 @@
 "use client";
 
-import { useAutoAnimate } from "@formkit/auto-animate/react";
-import { useTranslate } from "@tolgee/react";
-import { debounce } from "lodash";
-import { ImagePlusIcon, TrashIcon } from "lucide-react";
-import { useCallback, useMemo, useRef, useState } from "react";
-import {
-  TI18nString,
-  TSurvey,
-  TSurveyEndScreenCard,
-  TSurveyQuestion,
-  TSurveyQuestionChoice,
-  TSurveyRedirectUrlCard,
-} from "@formbricks/types/surveys/types";
-import { TUserLocale } from "@formbricks/types/user";
 import { createI18nString, extractLanguageCodes } from "@/lib/i18n/utils";
 import { useSyncScroll } from "@/lib/utils/hooks/useSyncScroll";
 import { recallToHeadline } from "@/lib/utils/recall";
@@ -24,6 +10,20 @@ import { FileInput } from "@/modules/ui/components/file-input";
 import { Input } from "@/modules/ui/components/input";
 import { Label } from "@/modules/ui/components/label";
 import { TooltipRenderer } from "@/modules/ui/components/tooltip";
+import { useAutoAnimate } from "@formkit/auto-animate/react";
+import { useTranslate } from "@tolgee/react";
+import { debounce } from "lodash";
+import { ImagePlusIcon, TrashIcon } from "lucide-react";
+import { RefObject, useCallback, useMemo, useRef, useState } from "react";
+import {
+  TI18nString,
+  TSurvey,
+  TSurveyEndScreenCard,
+  TSurveyQuestion,
+  TSurveyQuestionChoice,
+  TSurveyRedirectUrlCard,
+} from "@formbricks/types/surveys/types";
+import { TUserLocale } from "@formbricks/types/user";
 import {
   determineImageUploaderVisibility,
   getChoiceLabel,
@@ -50,6 +50,7 @@ interface QuestionFormInputProps {
   label: string;
   maxLength?: number;
   placeholder?: string;
+  ref?: RefObject<HTMLInputElement | null>;
   onBlur?: React.FocusEventHandler<HTMLInputElement>;
   className?: string;
   locale: TUserLocale;

apps/web/modules/survey/components/template-list/components/template-filters.test.tsx

@@ -32,7 +32,13 @@ describe("TemplateFilters", () => {
 
   test("renders all filter categories and options", () => {
     const setSelectedFilter = vi.fn();
-    render(<TemplateFilters selectedFilter={[null, null, null]} setSelectedFilter={setSelectedFilter} />);
+    render(
+      <TemplateFilters
+        selectedFilter={[null, null, null]}
+        setSelectedFilter={setSelectedFilter}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     expect(screen.getByText("environments.surveys.templates.all_channels")).toBeInTheDocument();
     expect(screen.getByText("environments.surveys.templates.all_industries")).toBeInTheDocument();
@@ -48,7 +54,13 @@ describe("TemplateFilters", () => {
     const setSelectedFilter = vi.fn();
     const user = userEvent.setup();
 
-    render(<TemplateFilters selectedFilter={[null, null, null]} setSelectedFilter={setSelectedFilter} />);
+    render(
+      <TemplateFilters
+        selectedFilter={[null, null, null]}
+        setSelectedFilter={setSelectedFilter}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     await user.click(screen.getByText("environments.surveys.templates.channel1"));
     expect(setSelectedFilter).toHaveBeenCalledWith(["channel1", null, null]);
@@ -62,7 +74,11 @@ describe("TemplateFilters", () => {
     const user = userEvent.setup();
 
     render(
-      <TemplateFilters selectedFilter={["link", "app", "website"]} setSelectedFilter={setSelectedFilter} />
+      <TemplateFilters
+        selectedFilter={["link", "app", "website"]}
+        setSelectedFilter={setSelectedFilter}
+        prefilledFilters={[null, null, null]}
+      />
     );
 
     await user.click(screen.getByText("environments.surveys.templates.all_channels"));
@@ -77,6 +93,7 @@ describe("TemplateFilters", () => {
         selectedFilter={[null, null, null]}
         setSelectedFilter={setSelectedFilter}
         templateSearch="search term"
+        prefilledFilters={[null, null, null]}
       />
     );
 
@@ -85,4 +102,20 @@ describe("TemplateFilters", () => {
       expect(button).toBeDisabled();
     });
   });
+
+  test("does not render filter categories that are prefilled", () => {
+    const setSelectedFilter = vi.fn();
+
+    render(
+      <TemplateFilters
+        selectedFilter={["link", null, null]}
+        setSelectedFilter={setSelectedFilter}
+        prefilledFilters={["link", null, null]}
+      />
+    );
+
+    expect(screen.queryByText("environments.surveys.templates.all_channels")).not.toBeInTheDocument();
+    expect(screen.getByText("environments.surveys.templates.all_industries")).toBeInTheDocument();
+    expect(screen.getByText("environments.surveys.templates.all_roles")).toBeInTheDocument();
+  });
 });

apps/web/modules/survey/components/template-list/components/template-filters.tsx

@@ -9,12 +9,14 @@ interface TemplateFiltersProps {
   selectedFilter: TTemplateFilter[];
   setSelectedFilter: (filter: TTemplateFilter[]) => void;
   templateSearch?: string;
+  prefilledFilters: TTemplateFilter[];
 }
 
 export const TemplateFilters = ({
   selectedFilter,
   setSelectedFilter,
   templateSearch,
+  prefilledFilters,
 }: TemplateFiltersProps) => {
   const { t } = useTranslate();
   const handleFilterSelect = (filterValue: TTemplateFilter, index: number) => {
@@ -29,6 +31,7 @@ export const TemplateFilters = ({
   return (
     <div className="mb-6 gap-3">
       {allFilters.map((filters, index) => {
+        if (prefilledFilters[index] !== null) return;
         return (
           <div key={filters[0]?.value || index} className="mt-2 flex flex-wrap gap-1 last:border-r-0">
             <button

apps/web/modules/survey/components/template-list/index.test.tsx

@@ -102,20 +102,41 @@ describe("TemplateList", () => {
   });
 
   test("renders correctly with default props", () => {
-    render(<TemplateList userId="user-id" environmentId="env-id" project={mockProject} />);
+    render(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     expect(screen.getByText("Start from scratch")).toBeInTheDocument();
   });
 
   test("renders filters when showFilters is true", () => {
-    render(<TemplateList userId="user-id" environmentId="env-id" project={mockProject} showFilters={true} />);
+    render(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+        showFilters={true}
+      />
+    );
 
     expect(screen.queryByTestId("template-filters")).toBeInTheDocument();
   });
 
   test("doesn't render filters when showFilters is false", () => {
     render(
-      <TemplateList userId="user-id" environmentId="env-id" project={mockProject} showFilters={false} />
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+        showFilters={false}
+      />
     );
 
     expect(screen.queryByTestId("template-filters")).not.toBeInTheDocument();
@@ -129,6 +150,7 @@ describe("TemplateList", () => {
         userId="user-id"
         environmentId="env-id"
         project={mockProject}
+        prefilledFilters={[null, null, null]}
         templateSearch="Template 1"
       />
     );
@@ -145,6 +167,7 @@ describe("TemplateList", () => {
         userId="user-id"
         environmentId="env-id"
         project={mockProject}
+        prefilledFilters={[null, null, null]}
         onTemplateClick={onTemplateClickMock}
         noPreview={true}
       />
@@ -163,7 +186,14 @@ describe("TemplateList", () => {
 
     const user = userEvent.setup();
 
-    render(<TemplateList userId="user-id" environmentId="env-id" project={mockProject} />);
+    render(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     // First select the template
     const selectButton = screen.getAllByText("Select")[0];
@@ -190,7 +220,14 @@ describe("TemplateList", () => {
 
     const user = userEvent.setup();
 
-    render(<TemplateList userId="user-id" environmentId="env-id" project={mockProject} />);
+    render(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     // First select the template
     const selectButton = screen.getAllByText("Select")[0];
@@ -213,7 +250,12 @@ describe("TemplateList", () => {
     };
 
     const { rerender } = render(
-      <TemplateList userId="user-id" environmentId="env-id" project={mobileProject as Project} />
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mobileProject as Project}
+        prefilledFilters={[null, null, null]}
+      />
     );
 
     // Test with no channel config
@@ -222,7 +264,14 @@ describe("TemplateList", () => {
       config: {},
     };
 
-    rerender(<TemplateList userId="user-id" environmentId="env-id" project={noChannelProject as Project} />);
+    rerender(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={noChannelProject as Project}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     expect(screen.getByText("Template 1")).toBeInTheDocument();
   });
@@ -230,7 +279,14 @@ describe("TemplateList", () => {
   test("development mode shows templates correctly", () => {
     vi.stubEnv("NODE_ENV", "development");
 
-    render(<TemplateList userId="user-id" environmentId="env-id" project={mockProject} />);
+    render(
+      <TemplateList
+        userId="user-id"
+        environmentId="env-id"
+        project={mockProject}
+        prefilledFilters={[null, null, null]}
+      />
+    );
 
     expect(screen.getByText("Template 1")).toBeInTheDocument();
     expect(screen.getByText("Template 2")).toBeInTheDocument();

apps/web/modules/survey/components/template-list/index.tsx

@@ -21,6 +21,7 @@ interface TemplateListProps {
   project: Project;
   templateSearch?: string;
   showFilters?: boolean;
+  prefilledFilters: TTemplateFilter[];
   onTemplateClick?: (template: TTemplate) => void;
   noPreview?: boolean; // single click to create survey
 }
@@ -31,6 +32,7 @@ export const TemplateList = ({
   environmentId,
   showFilters = true,
   templateSearch,
+  prefilledFilters,
   onTemplateClick = () => {},
   noPreview,
 }: TemplateListProps) => {
@@ -38,7 +40,7 @@ export const TemplateList = ({
   const router = useRouter();
   const [activeTemplate, setActiveTemplate] = useState<TTemplate | null>(null);
   const [loading, setLoading] = useState(false);
-  const [selectedFilter, setSelectedFilter] = useState<TTemplateFilter[]>([null, null, null]);
+  const [selectedFilter, setSelectedFilter] = useState<TTemplateFilter[]>(prefilledFilters);
   const surveyType: TSurveyType = useMemo(() => {
     if (project.config.channel) {
       if (project.config.channel === "website") {
@@ -109,6 +111,7 @@ export const TemplateList = ({
           selectedFilter={selectedFilter}
           setSelectedFilter={setSelectedFilter}
           templateSearch={templateSearch}
+          prefilledFilters={prefilledFilters}
         />
       )}
       <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">

apps/web/modules/survey/editor/components/conditional-logic.test.tsx

@@ -241,40 +241,4 @@ describe("ConditionalLogic", () => {
 
     expect(screen.getAllByTestId("logic-editor").length).toBe(2);
   });
-
-  test("should clear logicFallback when logic array is empty and logicFallback exists (useEffect)", () => {
-    const mockUpdateQuestion = vi.fn();
-    const mockQuestion: TSurveyQuestion = {
-      id: "testQuestionId",
-      type: TSurveyQuestionTypeEnum.OpenText,
-      headline: { default: "Test Question" },
-      required: false,
-      inputType: "text",
-      charLimit: { enabled: false },
-      logic: [], // Empty logic array
-      logicFallback: "someTarget", // Has logicFallback but no logic
-    };
-    const mockSurvey = {
-      id: "testSurveyId",
-      name: "Test Survey",
-      type: "link",
-      createdAt: new Date(),
-      updatedAt: new Date(),
-      environmentId: "testEnvId",
-      status: "inProgress",
-      questions: [mockQuestion],
-      endings: [],
-    } as unknown as TSurvey;
-
-    render(
-      <ConditionalLogic
-        localSurvey={mockSurvey}
-        question={mockQuestion}
-        questionIdx={0}
-        updateQuestion={mockUpdateQuestion}
-      />
-    );
-
-    expect(mockUpdateQuestion).toHaveBeenCalledWith(0, { logicFallback: undefined });
-  });
 });

apps/web/modules/survey/editor/components/conditional-logic.tsx

@@ -1,19 +1,5 @@
 "use client";
 
-import { useAutoAnimate } from "@formkit/auto-animate/react";
-import { createId } from "@paralleldrive/cuid2";
-import { useTranslate } from "@tolgee/react";
-import {
-  ArrowDownIcon,
-  ArrowUpIcon,
-  CopyIcon,
-  EllipsisVerticalIcon,
-  PlusIcon,
-  SplitIcon,
-  TrashIcon,
-} from "lucide-react";
-import { useEffect, useMemo } from "react";
-import { TSurvey, TSurveyLogic, TSurveyQuestion } from "@formbricks/types/surveys/types";
 import { duplicateLogicItem } from "@/lib/surveyLogic/utils";
 import { replaceHeadlineRecall } from "@/lib/utils/recall";
 import { LogicEditor } from "@/modules/survey/editor/components/logic-editor";
@@ -29,6 +15,20 @@ import {
   DropdownMenuTrigger,
 } from "@/modules/ui/components/dropdown-menu";
 import { Label } from "@/modules/ui/components/label";
+import { useAutoAnimate } from "@formkit/auto-animate/react";
+import { createId } from "@paralleldrive/cuid2";
+import { useTranslate } from "@tolgee/react";
+import {
+  ArrowDownIcon,
+  ArrowUpIcon,
+  CopyIcon,
+  EllipsisVerticalIcon,
+  PlusIcon,
+  SplitIcon,
+  TrashIcon,
+} from "lucide-react";
+import { useMemo } from "react";
+import { TSurvey, TSurveyLogic, TSurveyQuestion } from "@formbricks/types/surveys/types";
 
 interface ConditionalLogicProps {
   localSurvey: TSurvey;
@@ -117,12 +117,6 @@ export function ConditionalLogic({
   };
   const [parent] = useAutoAnimate();
 
-  useEffect(() => {
-    if (question.logic?.length === 0 && question.logicFallback) {
-      updateQuestion(questionIdx, { logicFallback: undefined });
-    }
-  }, [question.logic, questionIdx, question.logicFallback, updateQuestion]);
-
   return (
     <div className="mt-4" ref={parent}>
       <Label className="flex gap-2">