chore: add no-cache to docker build actions

Co-authored-by: pandeymangg <anshuman.pandey9999@gmail.com>

.env.example

@@ -93,10 +93,6 @@ EMAIL_VERIFICATION_DISABLED=1
 # Password Reset. If you enable Password Reset functionality you have to setup SMTP-Settings, too.
 PASSWORD_RESET_DISABLED=1
 
-# Signup. Disable the ability for new users to create an account.
-# Note: This variable is only available to the SaaS setup of Formbricks Cloud. Signup is disable by default for self-hosting.
-# SIGNUP_DISABLED=1
-
 # Email login. Disable the ability for users to login with email.
 # EMAIL_AUTH_DISABLED=1
 
@@ -120,6 +116,10 @@ IMPRINT_ADDRESS=
 # TURNSTILE_SITE_KEY=
 # TURNSTILE_SECRET_KEY=
 
+# Google reCAPTCHA v3 keys
+RECAPTCHA_SITE_KEY=
+RECAPTCHA_SECRET_KEY=
+
 # Configure Github Login
 GITHUB_ID=
 GITHUB_SECRET=
@@ -154,10 +154,6 @@ NOTION_OAUTH_CLIENT_SECRET=
 STRIPE_SECRET_KEY=
 STRIPE_WEBHOOK_SECRET=
 
-# Configure Formbricks usage within Formbricks
-FORMBRICKS_API_HOST=
-FORMBRICKS_ENVIRONMENT_ID=
-
 # Oauth credentials for Google sheet integration
 GOOGLE_SHEETS_CLIENT_ID=
 GOOGLE_SHEETS_CLIENT_SECRET=
@@ -176,8 +172,9 @@ ENTERPRISE_LICENSE_KEY=
 # Automatically assign new users to a specific organization and role within that organization
 # Insert an existing organization id or generate a valid CUID for a new one at https://www.getuniqueid.com/cuid (e.g. cjld2cjxh0000qzrmn831i7rn)
 # (Role Management is an Enterprise feature)
-# DEFAULT_ORGANIZATION_ID=
 # DEFAULT_ORGANIZATION_ROLE=owner
+# AUTH_SSO_DEFAULT_TEAM_ID=
+# AUTH_SKIP_INVITE_FOR_SSO=
 
 # Send new users to Brevo
 # BREVO_API_KEY=
@@ -218,3 +215,6 @@ UNKEY_ROOT_KEY=
 # The SENTRY_AUTH_TOKEN variable is picked up by the Sentry Build Plugin.
 # It's used automatically by Sentry during the build for authentication when uploading source maps.
 # SENTRY_AUTH_TOKEN=
+
+# Disable the user management from UI 
+# DISABLE_USER_MANAGEMENT=1

.github/copilot-instructions.md

@@ -2,6 +2,7 @@
 
 When generating test files inside the "/app/web" path, follow these rules:
 
+- You are an experienced senior software engineer
 - Use vitest
 - Ensure 100% code coverage
 - Add as few comments as possible
@@ -10,8 +11,10 @@ When generating test files inside the "/app/web" path, follow these rules:
 - Follow the same test pattern used for other files in the package where the file is located
 - All imports should be at the top of the file, not inside individual tests
 - For mocking inside "test" blocks use "vi.mocked"
-- Add the original file path to the "test.coverage.include"array in the "apps/web/vite.config.mts" file
+- Add the original file path to the "test.coverage.include"array in the "apps/web/vite.config.mts" file. Do this only when the test file is created.
 - Don't mock functions that are already mocked in the "apps/web/vitestSetup.ts" file
+- When using "screen.getByText" check for the tolgee string if it is being used in the file.
+- When mocking data check if the properties added are part of the type of the object being mocked. Don't add properties that are not part of the type.
   
 If it's a test for a ".tsx" file, follow these extra instructions:
 
@@ -21,6 +24,7 @@ afterEach(() => {
     cleanup();
 });
 
-- the "afterEach" function should only have "cleanup()" inside it and should be adde to the "vitest" imports
+- The "afterEach" function should only have the "cleanup()" line inside it and should be adde to the "vitest" imports.
 - For click events, import userEvent from "@testing-library/user-event"
 - Mock other components that can make the text more complex and but at the same time mocking it wouldn't make the test flaky. It's ok to leave basic and simple components.
+- You don't need to mock @tolgee/react

.github/workflows/apply-issue-labels-to-pr.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/build-web.yml

@@ -13,11 +13,11 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/dangerous-git-checkout
 
       - name: Build & Cache Web Binaries

.github/workflows/chromatic.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/dependency-review.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0

.github/workflows/deploy-formbricks-cloud.yml

@@ -44,7 +44,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
+
+      - name: Tailscale
+        uses: tailscale/github-action@v3
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:github
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2

.github/workflows/docker-build-validation.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.2.2
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.github/workflows/e2e.yml

@@ -46,11 +46,11 @@ jobs:
           --health-retries=5
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/dangerous-git-checkout
 
       - name: Setup Node.js 20.x

.github/workflows/labeler.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/lint.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/pr.yml

@@ -51,7 +51,7 @@ jobs:
       statuses: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
         with:
           egress-policy: audit
       - name: fail if conditional jobs failed

.github/workflows/release-docker-github-experimental.yml

@@ -31,12 +31,12 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Depot CLI
         uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
@@ -45,7 +45,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
@@ -82,6 +82,7 @@ jobs:
           secrets: |
             database_url=${{ secrets.DUMMY_DATABASE_URL }}
             encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+          no-cache: true
 
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker

.github/workflows/release-docker-github.yml

@@ -38,12 +38,12 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Get Release Tag
         id: extract_release_tag
@@ -65,7 +65,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
@@ -102,6 +102,7 @@ jobs:
           secrets: |
             database_url=${{ secrets.DUMMY_DATABASE_URL }}
             encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
+          no-cache: true
 
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker

.github/workflows/release-helm-chart.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/scorecard.yml

@@ -35,12 +35,12 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 

.github/workflows/semantic-pull-requests.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/sonarqube.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/terraform-plan-and-apply.yml

@@ -26,13 +26,20 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: Tailscale
+        uses: tailscale/github-action@v3
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:github
+
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:

.github/workflows/test.yml

@@ -14,11 +14,11 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/dangerous-git-checkout
 
       - name: Setup Node.js 20.x

.github/workflows/tolgee-missing-key-check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/tolgee.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/welcome-new-contributors.yml

@@ -18,7 +18,7 @@ jobs:
     if: github.event.action == 'opened'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

LICENSE

@@ -3,7 +3,7 @@ Copyright (c) 2024 Formbricks GmbH
 Portions of this software are licensed as follows:
 
 - All content that resides under the "apps/web/modules/ee" directory of this repository, if these directories exist, is licensed under the license defined in "apps/web/modules/ee/LICENSE".
-- All content that resides under the "packages/js/", "packages/react-native/", "packages/android/", "packages/ios/" and "packages/api/" directories of this repository, if that directories exist, is licensed under the "MIT" license as defined in the "LICENSE" files of these packages.
+- All content that resides under the "packages/js/", "packages/android/", "packages/ios/" and "packages/api/" directories of this repository, if that directories exist, is licensed under the "MIT" license as defined in the "LICENSE" files of these packages.
 - All third party components incorporated into the Formbricks Software are licensed under the original license provided by the owner of the applicable component.
 - Content outside of the above mentioned directories or restrictions above is available under the "AGPLv3" license as defined below.
 

apps/demo-react-native/.env.example

@@ -1,2 +0,0 @@
-EXPO_PUBLIC_APP_URL=http://192.168.0.197:3000
-EXPO_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=cm5p0cs7r000819182b32j0a1

apps/demo-react-native/.eslintrc.js

@@ -1,7 +0,0 @@
-module.exports = {
-  extends: ["@formbricks/eslint-config/react.js"],
-  parserOptions: {
-    project: "tsconfig.json",
-    tsconfigRootDir: __dirname,
-  },
-};

apps/demo-react-native/.gitignore

@@ -1,35 +0,0 @@
-# Learn more https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files
-
-# dependencies
-node_modules/
-
-# Expo
-.expo/
-dist/
-web-build/
-
-# Native
-*.orig.*
-*.jks
-*.p8
-*.p12
-*.key
-*.mobileprovision
-
-# Metro
-.metro-health-check*
-
-# debug
-npm-debug.*
-yarn-debug.*
-yarn-error.*
-
-# macOS
-.DS_Store
-*.pem
-
-# local env files
-.env*.local
-
-# typescript
-*.tsbuildinfo

apps/demo-react-native/app.json

@@ -1,35 +0,0 @@
-{
-  "expo": {
-    "android": {
-      "adaptiveIcon": {
-        "backgroundColor": "#ffffff",
-        "foregroundImage": "./assets/adaptive-icon.png"
-      }
-    },
-    "assetBundlePatterns": ["**/*"],
-    "icon": "./assets/icon.png",
-    "ios": {
-      "infoPlist": {
-        "NSCameraUsageDescription": "Take pictures for certain activities.",
-        "NSMicrophoneUsageDescription": "Need microphone access for recording videos.",
-        "NSPhotoLibraryUsageDescription": "Select pictures for certain activities."
-      },
-      "supportsTablet": true
-    },
-    "jsEngine": "hermes",
-    "name": "react-native-demo",
-    "newArchEnabled": true,
-    "orientation": "portrait",
-    "slug": "react-native-demo",
-    "splash": {
-      "backgroundColor": "#ffffff",
-      "image": "./assets/splash.png",
-      "resizeMode": "contain"
-    },
-    "userInterfaceStyle": "light",
-    "version": "1.0.0",
-    "web": {
-      "favicon": "./assets/favicon.png"
-    }
-  }
-}

apps/demo-react-native/babel.config.js

@@ -1,6 +0,0 @@
-module.exports = function babel(api) {
-  api.cache(true);
-  return {
-    presets: ["babel-preset-expo"],
-  };
-};

apps/demo-react-native/index.js

@@ -1,7 +0,0 @@
-import { registerRootComponent } from "expo";
-import { LogBox } from "react-native";
-import App from "./src/app";
-
-registerRootComponent(App);
-
-LogBox.ignoreAllLogs();

apps/demo-react-native/metro.config.js

@@ -1,21 +0,0 @@
-// Learn more https://docs.expo.io/guides/customizing-metro
-const path = require("node:path");
-const { getDefaultConfig } = require("expo/metro-config");
-
-// Find the workspace root, this can be replaced with `find-yarn-workspace-root`
-const workspaceRoot = path.resolve(__dirname, "../..");
-const projectRoot = __dirname;
-
-const config = getDefaultConfig(projectRoot);
-
-// 1. Watch all files within the monorepo
-config.watchFolders = [workspaceRoot];
-// 2. Let Metro know where to resolve packages, and in what order
-config.resolver.nodeModulesPaths = [
-  path.resolve(projectRoot, "node_modules"),
-  path.resolve(workspaceRoot, "node_modules"),
-];
-// 3. Force Metro to resolve (sub)dependencies only from the `nodeModulesPaths`
-config.resolver.disableHierarchicalLookup = true;
-
-module.exports = config;

apps/demo-react-native/package.json

@@ -1,30 +0,0 @@
-{
-  "name": "@formbricks/demo-react-native",
-  "version": "1.0.0",
-  "main": "./index.js",
-  "scripts": {
-    "dev": "expo start",
-    "android": "expo start --android",
-    "ios": "expo start --ios",
-    "web": "expo start --web",
-    "eject": "expo eject",
-    "clean": "rimraf .turbo node_modules .expo"
-  },
-  "dependencies": {
-    "@formbricks/js": "workspace:*",
-    "@formbricks/react-native": "workspace:*",
-    "@react-native-async-storage/async-storage": "2.1.0",
-    "expo": "52.0.28",
-    "expo-status-bar": "2.0.1",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
-    "react-native": "0.76.6",
-    "react-native-webview": "13.12.5"
-  },
-  "devDependencies": {
-    "@babel/core": "7.26.0",
-    "@types/react": "18.3.18",
-    "typescript": "5.7.2"
-  },
-  "private": true
-}

apps/demo-react-native/src/app.tsx

@@ -1,117 +0,0 @@
-import { StatusBar } from "expo-status-bar";
-import React, { type JSX } from "react";
-import { Button, LogBox, StyleSheet, Text, View } from "react-native";
-import Formbricks, {
-  logout,
-  setAttribute,
-  setAttributes,
-  setLanguage,
-  setUserId,
-  track,
-} from "@formbricks/react-native";
-
-LogBox.ignoreAllLogs();
-
-export default function App(): JSX.Element {
-  if (!process.env.EXPO_PUBLIC_FORMBRICKS_ENVIRONMENT_ID) {
-    throw new Error("EXPO_PUBLIC_FORMBRICKS_ENVIRONMENT_ID is required");
-  }
-
-  if (!process.env.EXPO_PUBLIC_APP_URL) {
-    throw new Error("EXPO_PUBLIC_APP_URL is required");
-  }
-
-  return (
-    <View style={styles.container}>
-      <Text>Formbricks React Native SDK Demo</Text>
-
-      <View
-        style={{
-          display: "flex",
-          flexDirection: "column",
-          gap: 10,
-        }}>
-        <Button
-          title="Trigger Code Action"
-          onPress={() => {
-            track("code").catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error tracking event:", error);
-            });
-          }}
-        />
-
-        <Button
-          title="Set User Id"
-          onPress={() => {
-            setUserId("random-user-id").catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error setting user id:", error);
-            });
-          }}
-        />
-
-        <Button
-          title="Set User Attributess (multiple)"
-          onPress={() => {
-            setAttributes({
-              testAttr: "attr-test",
-              testAttr2: "attr-test-2",
-              testAttr3: "attr-test-3",
-              testAttr4: "attr-test-4",
-            }).catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error setting user attributes:", error);
-            });
-          }}
-        />
-
-        <Button
-          title="Set User Attributes (single)"
-          onPress={() => {
-            setAttribute("testSingleAttr", "testSingleAttr").catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error setting user attributes:", error);
-            });
-          }}
-        />
-
-        <Button
-          title="Logout"
-          onPress={() => {
-            logout().catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error logging out:", error);
-            });
-          }}
-        />
-
-        <Button
-          title="Set Language (de)"
-          onPress={() => {
-            setLanguage("de").catch((error: unknown) => {
-              // eslint-disable-next-line no-console -- logging is allowed in demo apps
-              console.error("Error setting language:", error);
-            });
-          }}
-        />
-      </View>
-
-      <StatusBar style="auto" />
-
-      <Formbricks
-        appUrl={process.env.EXPO_PUBLIC_APP_URL as string}
-        environmentId={process.env.EXPO_PUBLIC_FORMBRICKS_ENVIRONMENT_ID as string}
-      />
-    </View>
-  );
-}
-
-const styles = StyleSheet.create({
-  container: {
-    flex: 1,
-    backgroundColor: "#fff",
-    alignItems: "center",
-    justifyContent: "center",
-  },
-});

apps/demo-react-native/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "compilerOptions": {
-    "strict": true
-  },
-  "extends": "expo/tsconfig.base"
-}

apps/demo/.env.example

@@ -1,5 +0,0 @@
-NEXT_PUBLIC_FORMBRICKS_API_HOST=http://localhost:3000
-NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=YOUR_ENVIRONMENT_ID
-
-# Copy the environment ID for the URL of your Formbricks App and
-# paste it above to connect your Formbricks App with the Demo App.

apps/demo/.eslintrc.js

@@ -1,7 +0,0 @@
-module.exports = {
-  extends: ["@formbricks/eslint-config/next.js"],
-  parserOptions: {
-    project: "tsconfig.json",
-    tsconfigRootDir: __dirname,
-  },
-};

apps/demo/.gitignore

@@ -1,36 +0,0 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# dependencies
-/node_modules
-/.pnp
-.pnp.js
-
-# testing
-/coverage
-
-# next.js
-/.next/
-/out/
-
-# production
-/build
-
-# misc
-.DS_Store
-*.pem
-
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.pnpm-debug.log*
-
-# local env files
-.env*.local
-
-# vercel
-.vercel
-
-# typescript
-*.tsbuildinfo
-next-env.d.ts

apps/demo/components/layout-app.tsx

@@ -1,13 +0,0 @@
-import { Sidebar } from "./sidebar";
-
-export function LayoutApp({ children }: { children: React.ReactNode }): React.JSX.Element {
-  return (
-    <div className="min-h-full">
-      {/* Static sidebar for desktop */}
-      <div className="hidden lg:fixed lg:inset-y-0 lg:flex lg:w-64 lg:flex-col">
-        <Sidebar />
-      </div>
-      <div className="flex flex-1 flex-col lg:pl-64">{children}</div>
-    </div>
-  );
-}

apps/demo/components/sidebar.tsx

@@ -1,65 +0,0 @@
-import {
-  ClockIcon,
-  CogIcon,
-  CreditCardIcon,
-  FileBarChartIcon,
-  HelpCircleIcon,
-  HomeIcon,
-  ScaleIcon,
-  ShieldCheckIcon,
-  UsersIcon,
-} from "lucide-react";
-import { classNames } from "../lib/utils";
-
-const navigation = [
-  { name: "Home", href: "#", icon: HomeIcon, current: true },
-  { name: "History", href: "#", icon: ClockIcon, current: false },
-  { name: "Balances", href: "#", icon: ScaleIcon, current: false },
-  { name: "Cards", href: "#", icon: CreditCardIcon, current: false },
-  { name: "Recipients", href: "#", icon: UsersIcon, current: false },
-  { name: "Reports", href: "#", icon: FileBarChartIcon, current: false },
-];
-const secondaryNavigation = [
-  { name: "Settings", href: "#", icon: CogIcon },
-  { name: "Help", href: "#", icon: HelpCircleIcon },
-  { name: "Privacy", href: "#", icon: ShieldCheckIcon },
-];
-
-export function Sidebar(): React.JSX.Element {
-  return (
-    <div className="flex grow flex-col overflow-y-auto bg-cyan-700 pt-5 pb-4">
-      <nav
-        className="mt-5 flex flex-1 flex-col divide-y divide-cyan-800 overflow-y-auto"
-        aria-label="Sidebar">
-        <div className="space-y-1 px-2">
-          {navigation.map((item) => (
-            <a
-              key={item.name}
-              href={item.href}
-              className={classNames(
-                item.current ? "bg-cyan-800 text-white" : "text-cyan-100 hover:bg-cyan-600 hover:text-white",
-                "group flex items-center rounded-md px-2 py-2 text-sm leading-6 font-medium"
-              )}
-              aria-current={item.current ? "page" : undefined}>
-              <item.icon className="mr-4 h-6 w-6 shrink-0 text-cyan-200" aria-hidden="true" />
-              {item.name}
-            </a>
-          ))}
-        </div>
-        <div className="mt-6 pt-6">
-          <div className="space-y-1 px-2">
-            {secondaryNavigation.map((item) => (
-              <a
-                key={item.name}
-                href={item.href}
-                className="group flex items-center rounded-md px-2 py-2 text-sm leading-6 font-medium text-cyan-100 hover:bg-cyan-600 hover:text-white">
-                <item.icon className="mr-4 h-6 w-6 text-cyan-200" aria-hidden="true" />
-                {item.name}
-              </a>
-            ))}
-          </div>
-        </div>
-      </nav>
-    </div>
-  );
-}

apps/demo/globals.css

@@ -1,23 +0,0 @@
-@import 'tailwindcss';
-
-@plugin '@tailwindcss/forms';
-
-@custom-variant dark (&:is(.dark *));
-
-/*
-  The default border color has changed to `currentcolor` in Tailwind CSS v4,
-  so we've added these compatibility styles to make sure everything still
-  looks the same as it did with Tailwind CSS v3.
-
-  If we ever want to remove these styles, we need to add an explicit border
-  color utility to any element that depends on these defaults.
-*/
-@layer base {
-  *,
-  ::after,
-  ::before,
-  ::backdrop,
-  ::file-selector-button {
-    border-color: var(--color-gray-200, currentcolor);
-  }
-}

apps/demo/lib/utils.ts

@@ -1,3 +0,0 @@
-export function classNames(...classes: string[]): string {
-  return classes.filter(Boolean).join(" ");
-}

apps/demo/next-env.d.ts

@@ -1,5 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/pages/api-reference/config/typescript for more information.

apps/demo/next.config.mjs

@@ -1,17 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {
-  images: {
-    remotePatterns: [
-      {
-        protocol: "https",
-        hostname: "tailwindui.com",
-      },
-      {
-        protocol: "https",
-        hostname: "images.unsplash.com",
-      },
-    ],
-  },
-};
-
-export default nextConfig;

apps/demo/package.json

@@ -1,28 +0,0 @@
-{
-  "name": "@formbricks/demo",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "clean": "rimraf .turbo node_modules .next",
-    "dev": "next dev -p 3002 --turbopack",
-    "go": "next dev -p 3002 --turbopack",
-    "build": "next build",
-    "start": "next start",
-    "lint": "next lint"
-  },
-  "dependencies": {
-    "@formbricks/js": "workspace:*",
-    "@tailwindcss/forms": "0.5.9",
-    "@tailwindcss/postcss": "4.1.3",
-    "lucide-react": "0.486.0",
-    "next": "15.2.4",
-    "postcss": "8.5.3",
-    "react": "19.1.0",
-    "react-dom": "19.1.0",
-    "tailwindcss": "4.1.3"
-  },
-  "devDependencies": {
-    "@formbricks/config-typescript": "workspace:*",
-    "@formbricks/eslint-config": "workspace:*"
-  }
-}

apps/demo/pages/_app.tsx

@@ -1,20 +0,0 @@
-import type { AppProps } from "next/app";
-import Head from "next/head";
-import "../globals.css";
-
-export default function App({ Component, pageProps }: AppProps): React.JSX.Element {
-  return (
-    <>
-      <Head>
-        <title>Demo App</title>
-      </Head>
-      {(!process.env.NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID ||
-        !process.env.NEXT_PUBLIC_FORMBRICKS_API_HOST) && (
-        <div className="w-full bg-red-500 p-3 text-center text-sm text-white">
-          Please set Formbricks environment variables in apps/demo/.env
-        </div>
-      )}
-      <Component {...pageProps} />
-    </>
-  );
-}

apps/demo/pages/_document.tsx

@@ -1,13 +0,0 @@
-import { Head, Html, Main, NextScript } from "next/document";
-
-export default function Document(): React.JSX.Element {
-  return (
-    <Html lang="en" className="h-full bg-slate-50">
-      <Head />
-      <body className="h-full">
-        <Main />
-        <NextScript />
-      </body>
-    </Html>
-  );
-}

apps/demo/pages/index.tsx

@@ -1,359 +0,0 @@
-import Image from "next/image";
-import { useRouter } from "next/router";
-import { useEffect, useState } from "react";
-import formbricks from "@formbricks/js";
-import fbsetup from "../public/fb-setup.png";
-
-declare const window: Window;
-
-export default function AppPage(): React.JSX.Element {
-  const [darkMode, setDarkMode] = useState(false);
-  const router = useRouter();
-  const userId = "THIS-IS-A-VERY-LONG-USER-ID-FOR-TESTING";
-  const userAttributes = {
-    "Attribute 1": "one",
-    "Attribute 2": "two",
-    "Attribute 3": "three",
-  };
-
-  useEffect(() => {
-    if (darkMode) {
-      document.body.classList.add("dark");
-    } else {
-      document.body.classList.remove("dark");
-    }
-  }, [darkMode]);
-
-  useEffect(() => {
-    const initFormbricks = () => {
-      // enable Formbricks debug mode by adding formbricksDebug=true GET parameter
-      const addFormbricksDebugParam = (): void => {
-        const urlParams = new URLSearchParams(window.location.search);
-        if (!urlParams.has("formbricksDebug")) {
-          urlParams.set("formbricksDebug", "true");
-          const newUrl = `${window.location.pathname}?${urlParams.toString()}`;
-          window.history.replaceState({}, "", newUrl);
-        }
-      };
-
-      addFormbricksDebugParam();
-
-      if (process.env.NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID && process.env.NEXT_PUBLIC_FORMBRICKS_API_HOST) {
-        void formbricks.setup({
-          environmentId: process.env.NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID,
-          appUrl: process.env.NEXT_PUBLIC_FORMBRICKS_API_HOST,
-        });
-      }
-
-      // Connect next.js router to Formbricks
-      if (process.env.NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID && process.env.NEXT_PUBLIC_FORMBRICKS_API_HOST) {
-        const handleRouteChange = formbricks.registerRouteChange;
-
-        router.events.on("routeChangeComplete", () => {
-          void handleRouteChange();
-        });
-
-        return () => {
-          router.events.off("routeChangeComplete", () => {
-            void handleRouteChange();
-          });
-        };
-      }
-    };
-
-    initFormbricks();
-  }, [router.events]);
-
-  return (
-    <div className="min-h-screen bg-white px-12 py-6 dark:bg-slate-800">
-      <div className="flex flex-col justify-between md:flex-row">
-        <div className="flex flex-col items-center gap-2 sm:flex-row">
-          <div>
-            <h1 className="text-2xl font-bold text-slate-900 dark:text-white">
-              Formbricks In-product Survey Demo App
-            </h1>
-            <p className="text-slate-700 dark:text-slate-300">
-              This app helps you test your app surveys. You can create and test user actions, create and
-              update user attributes, etc.
-            </p>
-          </div>
-        </div>
-
-        <button
-          type="button"
-          className="mt-2 rounded-lg bg-slate-200 px-6 py-1 dark:bg-slate-700 dark:text-slate-100"
-          onClick={() => {
-            setDarkMode(!darkMode);
-          }}>
-          {darkMode ? "Toggle Light Mode" : "Toggle Dark Mode"}
-        </button>
-      </div>
-
-      <div className="my-4 grid grid-cols-1 gap-6 md:grid-cols-2">
-        <div>
-          <div className="rounded-lg border border-slate-300 bg-slate-100 p-6 dark:border-slate-600 dark:bg-slate-900">
-            <h3 className="text-lg font-semibold text-slate-900 dark:text-white">1. Setup .env</h3>
-            <p className="text-slate-700 dark:text-slate-300">
-              Copy the environment ID of your Formbricks app to the env variable in /apps/demo/.env
-            </p>
-            <Image src={fbsetup} alt="fb setup" className="mt-4 rounded-xs" priority />
-
-            <div className="mt-4 flex-col items-start text-sm text-slate-700 sm:flex sm:items-center sm:text-base dark:text-slate-300">
-              <p className="mb-1 sm:mr-2 sm:mb-0">You&apos;re connected with env:</p>
-              <div className="flex items-center">
-                <strong className="w-32 truncate sm:w-auto">
-                  {process.env.NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID}
-                </strong>
-                <span className="relative ml-2 flex h-3 w-3">
-                  <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-green-500 opacity-75" />
-                  <span className="relative inline-flex h-3 w-3 rounded-full bg-green-500" />
-                </span>
-              </div>
-            </div>
-          </div>
-          <div className="mt-4 rounded-lg border border-slate-300 bg-slate-100 p-6 dark:border-slate-600 dark:bg-slate-900">
-            <h3 className="text-lg font-semibold text-slate-900 dark:text-white">2. Widget Logs</h3>
-            <p className="text-slate-700 dark:text-slate-300">
-              Look at the logs to understand how the widget works.{" "}
-              <strong className="dark:text-white">Open your browser console</strong> to see the logs.
-            </p>
-          </div>
-        </div>
-
-        <div className="md:grid md:grid-cols-3">
-          <div className="col-span-3 self-start rounded-lg border border-slate-300 bg-slate-100 p-6 dark:border-slate-600 dark:bg-slate-900">
-            <h3 className="text-lg font-semibold dark:text-white">
-              Set a user ID / pull data from Formbricks app
-            </h3>
-            <p className="text-slate-700 dark:text-slate-300">
-              On formbricks.setUserId() the user state will <strong>be fetched from Formbricks</strong> and
-              the local state gets <strong>updated with the user state</strong>.
-            </p>
-            <button
-              className="my-4 rounded-lg bg-slate-500 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600"
-              type="button"
-              onClick={() => {
-                void formbricks.setUserId(userId);
-              }}>
-              Set user ID
-            </button>
-            <p className="text-xs text-slate-700 dark:text-slate-300">
-              If you made a change in Formbricks app and it does not seem to work, hit &apos;Reset&apos; and
-              try again.
-            </p>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                No-Code Action
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sends a{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/actions#setting-up-no-code-actions"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500"
-                  target="_blank">
-                  No Code Action
-                </a>{" "}
-                as long as you created it beforehand in the Formbricks App.{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/actions#setting-up-no-code-actions"
-                  rel="noopener noreferrer"
-                  target="_blank"
-                  className="underline dark:text-blue-500">
-                  Here are instructions on how to do it.
-                </a>
-              </p>
-            </div>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                onClick={() => {
-                  void formbricks.setAttribute("Plan", "Free");
-                }}
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                Set Plan to &apos;Free&apos;
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sets the{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/user-identification#setting-custom-user-attributes"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500">
-                  attribute
-                </a>{" "}
-                &apos;Plan&apos; to &apos;Free&apos;. If the attribute does not exist, it creates it.
-              </p>
-            </div>
-          </div>
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                onClick={() => {
-                  void formbricks.setAttribute("Plan", "Paid");
-                }}
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                Set Plan to &apos;Paid&apos;
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sets the{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/user-identification#setting-custom-user-attributes"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500">
-                  attribute
-                </a>{" "}
-                &apos;Plan&apos; to &apos;Paid&apos;. If the attribute does not exist, it creates it.
-              </p>
-            </div>
-          </div>
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                onClick={() => {
-                  void formbricks.setEmail("test@web.com");
-                }}
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                Set Email
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sets the{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/user-identification"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500">
-                  user email
-                </a>{" "}
-                &apos;test@web.com&apos;
-              </p>
-            </div>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                onClick={() => {
-                  void formbricks.setAttributes(userAttributes);
-                }}
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                Set Multiple Attributes
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sets the{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/user-identification#setting-custom-user-attributes"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500">
-                  user attributes
-                </a>{" "}
-                to &apos;one&apos;, &apos;two&apos;, &apos;three&apos;.
-              </p>
-            </div>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                onClick={() => {
-                  void formbricks.setLanguage("de");
-                }}
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600">
-                Set Language to &apos;de&apos;
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sets the{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/general-features/multi-language-surveys"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500">
-                  language
-                </a>{" "}
-                to &apos;de&apos;.
-              </p>
-            </div>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600"
-                onClick={() => {
-                  void formbricks.track("code");
-                }}>
-                Code Action
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button sends a{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/actions#setting-up-code-actions"
-                  rel="noopener noreferrer"
-                  className="underline dark:text-blue-500"
-                  target="_blank">
-                  Code Action
-                </a>{" "}
-                as long as you created it beforehand in the Formbricks App.{" "}
-                <a
-                  href="https://formbricks.com/docs/xm-and-surveys/surveys/website-app-surveys/actions#setting-up-code-actions"
-                  rel="noopener noreferrer"
-                  target="_blank"
-                  className="underline dark:text-blue-500">
-                  Here are instructions on how to do it.
-                </a>
-              </p>
-            </div>
-          </div>
-
-          <div className="p-6">
-            <div>
-              <button
-                type="button"
-                className="mb-4 rounded-lg bg-slate-800 px-6 py-3 text-white hover:bg-slate-700 dark:bg-slate-700 dark:hover:bg-slate-600"
-                onClick={() => {
-                  void formbricks.logout();
-                }}>
-                Logout
-              </button>
-            </div>
-            <div>
-              <p className="text-xs text-slate-700 dark:text-slate-300">
-                This button logs out the user and syncs the local state with Formbricks. (Only works if a
-                userId is set)
-              </p>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}

apps/demo/postcss.config.js

@@ -1,5 +0,0 @@
-module.exports = {
-  plugins: {
-    "@tailwindcss/postcss": {},
-  },
-};

apps/demo/public/next.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>

apps/demo/public/thirteen.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="40" height="31" fill="none"><g opacity=".9"><path fill="url(#a)" d="M13 .4v29.3H7V6.3h-.2L0 10.5V5L7.2.4H13Z"/><path fill="url(#b)" d="M28.8 30.1c-2.2 0-4-.3-5.7-1-1.7-.8-3-1.8-4-3.1a7.7 7.7 0 0 1-1.4-4.6h6.2c0 .8.3 1.4.7 2 .4.5 1 .9 1.7 1.2.7.3 1.6.4 2.5.4 1 0 1.7-.2 2.5-.5.7-.3 1.3-.8 1.7-1.4.4-.6.6-1.2.6-2s-.2-1.5-.7-2.1c-.4-.6-1-1-1.8-1.4-.8-.4-1.8-.5-2.9-.5h-2.7v-4.6h2.7a6 6 0 0 0 2.5-.5 4 4 0 0 0 1.7-1.3c.4-.6.6-1.3.6-2a3.5 3.5 0 0 0-2-3.3 5.6 5.6 0 0 0-4.5 0 4 4 0 0 0-1.7 1.2c-.4.6-.6 1.2-.6 2h-6c0-1.7.6-3.2 1.5-4.5 1-1.3 2.2-2.3 3.8-3C25 .4 26.8 0 28.8 0s3.8.4 5.3 1.1c1.5.7 2.7 1.7 3.6 3a7.2 7.2 0 0 1 1.2 4.2c0 1.6-.5 3-1.5 4a7 7 0 0 1-4 2.2v.2c2.2.3 3.8 1 5 2.2a6.4 6.4 0 0 1 1.6 4.6c0 1.7-.5 3.1-1.4 4.4a9.7 9.7 0 0 1-4 3.1c-1.7.8-3.7 1.1-5.8 1.1Z"/></g><defs><linearGradient id="a" x1="20" x2="20" y1="0" y2="30.1" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-color="#3D3D3D"/></linearGradient><linearGradient id="b" x1="20" x2="20" y1="0" y2="30.1" gradientUnits="userSpaceOnUse"><stop/><stop offset="1" stop-color="#3D3D3D"/></linearGradient></defs></svg>

apps/demo/public/vercel.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 283 64"><path fill="black" d="M141 16c-11 0-19 7-19 18s9 18 20 18c7 0 13-3 16-7l-7-5c-2 3-6 4-9 4-5 0-9-3-10-7h28v-3c0-11-8-18-19-18zm-9 15c1-4 4-7 9-7s8 3 9 7h-18zm117-15c-11 0-19 7-19 18s9 18 20 18c6 0 12-3 16-7l-8-5c-2 3-5 4-8 4-5 0-9-3-11-7h28l1-3c0-11-8-18-19-18zm-10 15c2-4 5-7 10-7s8 3 9 7h-19zm-39 3c0 6 4 10 10 10 4 0 7-2 9-5l8 5c-3 5-9 8-17 8-11 0-19-7-19-18s8-18 19-18c8 0 14 3 17 8l-8 5c-2-3-5-5-9-5-6 0-10 4-10 10zm83-29v46h-9V5h9zM37 0l37 64H0L37 0zm92 5-27 48L74 5h10l18 30 17-30h10zm59 12v10l-3-1c-6 0-10 4-10 10v15h-9V17h9v9c0-5 6-9 13-9z"/></svg>

apps/demo/tsconfig.json

@@ -1,5 +0,0 @@
-{
-  "exclude": ["node_modules"],
-  "extends": "@formbricks/config-typescript/nextjs.json",
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx"]
-}

apps/storybook/package.json

@@ -11,13 +11,12 @@
     "clean": "rimraf .turbo node_modules dist storybook-static"
   },
   "dependencies": {
-    "eslint-plugin-react-refresh": "0.4.19",
+    "eslint-plugin-react-refresh": "0.4.20",
     "react": "19.1.0",
     "react-dom": "19.1.0"
   },
   "devDependencies": {
     "@chromatic-com/storybook": "3.2.6",
-    "@formbricks/config-typescript": "workspace:*",
     "@storybook/addon-a11y": "8.6.12",
     "@storybook/addon-essentials": "8.6.12",
     "@storybook/addon-interactions": "8.6.12",
@@ -27,14 +26,13 @@
     "@storybook/react": "8.6.12",
     "@storybook/react-vite": "8.6.12",
     "@storybook/test": "8.6.12",
-    "@typescript-eslint/eslint-plugin": "8.29.1",
-    "@typescript-eslint/parser": "8.29.1",
-    "@vitejs/plugin-react": "4.3.4",
+    "@typescript-eslint/eslint-plugin": "8.31.1",
+    "@typescript-eslint/parser": "8.31.1",
+    "@vitejs/plugin-react": "4.4.1",
     "esbuild": "0.25.2",
     "eslint-plugin-storybook": "0.12.0",
     "prop-types": "15.8.1",
     "storybook": "8.6.12",
-    "tsup": "8.4.0",
-    "vite": "6.2.5"
+    "vite": "6.3.5"
   }
 }

apps/web/.eslintrc.js

@@ -3,13 +3,13 @@ module.exports = {
   ignorePatterns: ["**/package.json", "**/tsconfig.json"],
   overrides: [
     {
-      files: ["lib/messages/**/*.json"],
+      files: ["locales/*.json"],
       plugins: ["i18n-json"],
       rules: {
         "i18n-json/identical-keys": [
           "error",
           {
-            filePath: require("path").join(__dirname, "messages", "en-US.json"),
+            filePath: require("path").join(__dirname, "locales", "en-US.json"),
             checkExtraKeys: false,
             checkMissingKeys: true,
           },

apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/components/landing-sidebar.tsx

@@ -1,6 +1,5 @@
 "use client";
 
-import { formbricksLogout } from "@/app/lib/formbricks";
 import FBLogo from "@/images/formbricks-wordmark.svg";
 import { cn } from "@/lib/cn";
 import { capitalizeFirstLetter } from "@/lib/utils/strings";
@@ -125,7 +124,6 @@ export const LandingSidebar = ({
             <DropdownMenuItem
               onClick={async () => {
                 await signOut({ callbackUrl: "/auth/login" });
-                await formbricksLogout();
               }}
               icon={<LogOutIcon className="mr-2 h-4 w-4" strokeWidth={1.5} />}>
               {t("common.logout")}

apps/web/app/(app)/components/FormbricksClient.test.tsx

@@ -1,81 +0,0 @@
-import { render } from "@testing-library/react";
-import { describe, expect, test, vi } from "vitest";
-import formbricks from "@formbricks/js";
-import { FormbricksClient } from "./FormbricksClient";
-
-// Mock next/navigation hooks.
-vi.mock("next/navigation", () => ({
-  usePathname: () => "/test-path",
-  useSearchParams: () => new URLSearchParams("foo=bar"),
-}));
-
-// Mock the flag that enables Formbricks.
-vi.mock("@/app/lib/formbricks", () => ({
-  formbricksEnabled: true,
-}));
-
-// Mock the Formbricks SDK module.
-vi.mock("@formbricks/js", () => ({
-  __esModule: true,
-  default: {
-    setup: vi.fn(),
-    setUserId: vi.fn(),
-    setEmail: vi.fn(),
-    registerRouteChange: vi.fn(),
-  },
-}));
-
-describe("FormbricksClient", () => {
-  test("calls setup, setUserId, setEmail and registerRouteChange on mount when enabled", () => {
-    const mockSetup = vi.spyOn(formbricks, "setup");
-    const mockSetUserId = vi.spyOn(formbricks, "setUserId");
-    const mockSetEmail = vi.spyOn(formbricks, "setEmail");
-    const mockRegisterRouteChange = vi.spyOn(formbricks, "registerRouteChange");
-
-    render(
-      <FormbricksClient
-        userId="user-123"
-        email="test@example.com"
-        formbricksEnvironmentId="env-test"
-        formbricksApiHost="https://api.test.com"
-        formbricksEnabled={true}
-      />
-    );
-
-    // Expect the first effect to call setup and assign the provided user details.
-    expect(mockSetup).toHaveBeenCalledWith({
-      environmentId: "env-test",
-      appUrl: "https://api.test.com",
-    });
-    expect(mockSetUserId).toHaveBeenCalledWith("user-123");
-    expect(mockSetEmail).toHaveBeenCalledWith("test@example.com");
-
-    // And the second effect should always register the route change when Formbricks is enabled.
-    expect(mockRegisterRouteChange).toHaveBeenCalled();
-  });
-
-  test("does not call setup, setUserId, or setEmail if userId is not provided yet still calls registerRouteChange", () => {
-    const mockSetup = vi.spyOn(formbricks, "setup");
-    const mockSetUserId = vi.spyOn(formbricks, "setUserId");
-    const mockSetEmail = vi.spyOn(formbricks, "setEmail");
-    const mockRegisterRouteChange = vi.spyOn(formbricks, "registerRouteChange");
-
-    render(
-      <FormbricksClient
-        userId=""
-        email="test@example.com"
-        formbricksEnvironmentId="env-test"
-        formbricksApiHost="https://api.test.com"
-        formbricksEnabled={true}
-      />
-    );
-
-    // Since userId is falsy, the first effect should not call setup or assign user details.
-    expect(mockSetup).not.toHaveBeenCalled();
-    expect(mockSetUserId).not.toHaveBeenCalled();
-    expect(mockSetEmail).not.toHaveBeenCalled();
-
-    // The second effect only checks formbricksEnabled, so registerRouteChange should be called.
-    expect(mockRegisterRouteChange).toHaveBeenCalled();
-  });
-});

apps/web/app/(app)/components/FormbricksClient.tsx

@@ -1,44 +0,0 @@
-"use client";
-
-import { usePathname, useSearchParams } from "next/navigation";
-import { useEffect } from "react";
-import formbricks from "@formbricks/js";
-
-interface FormbricksClientProps {
-  userId: string;
-  email: string;
-  formbricksEnvironmentId?: string;
-  formbricksApiHost?: string;
-  formbricksEnabled?: boolean;
-}
-
-export const FormbricksClient = ({
-  userId,
-  email,
-  formbricksEnvironmentId,
-  formbricksApiHost,
-  formbricksEnabled,
-}: FormbricksClientProps) => {
-  const pathname = usePathname();
-  const searchParams = useSearchParams();
-
-  useEffect(() => {
-    if (formbricksEnabled && userId) {
-      formbricks.setup({
-        environmentId: formbricksEnvironmentId ?? "",
-        appUrl: formbricksApiHost ?? "",
-      });
-
-      formbricks.setUserId(userId);
-      formbricks.setEmail(email);
-    }
-  }, [userId, email, formbricksEnvironmentId, formbricksApiHost, formbricksEnabled]);
-
-  useEffect(() => {
-    if (formbricksEnabled) {
-      formbricks.registerRouteChange();
-    }
-  }, [pathname, searchParams, formbricksEnabled]);
-
-  return null;
-};

apps/web/app/(app)/environments/[environmentId]/components/MainNavigation.tsx

@@ -2,7 +2,6 @@
 
 import { getLatestStableFbReleaseAction } from "@/app/(app)/environments/[environmentId]/actions/actions";
 import { NavigationLink } from "@/app/(app)/environments/[environmentId]/components/NavigationLink";
-import { formbricksLogout } from "@/app/lib/formbricks";
 import FBLogo from "@/images/formbricks-wordmark.svg";
 import { cn } from "@/lib/cn";
 import { getAccessFlags } from "@/lib/membership/utils";
@@ -265,7 +264,7 @@ export const MainNavigation = ({
                 size="icon"
                 onClick={toggleSidebar}
                 className={cn(
-                  "rounded-xl bg-slate-50 p-1 text-slate-600 transition-all hover:bg-slate-100 focus:ring-0 focus:ring-transparent focus:outline-none"
+                  "rounded-xl bg-slate-50 p-1 text-slate-600 transition-all hover:bg-slate-100 focus:outline-none focus:ring-0 focus:ring-transparent"
                 )}>
                 {isCollapsed ? (
                   <PanelLeftOpenIcon strokeWidth={1.5} />
@@ -392,7 +391,6 @@ export const MainNavigation = ({
                     onClick={async () => {
                       const route = await signOut({ redirect: false, callbackUrl: "/auth/login" });
                       router.push(route.url);
-                      await formbricksLogout();
                     }}
                     icon={<LogOutIcon className="mr-2 h-4 w-4" strokeWidth={1.5} />}>
                     {t("common.logout")}

apps/web/app/(app)/environments/[environmentId]/layout.test.tsx

@@ -26,13 +26,6 @@ vi.mock("@/modules/ui/components/environmentId-base-layout", () => ({
 vi.mock("@/modules/ui/components/toaster-client", () => ({
   ToasterClient: () => <div data-testid="ToasterClient" />,
 }));
-vi.mock("../../components/FormbricksClient", () => ({
-  FormbricksClient: ({ userId, email }: any) => (
-    <div data-testid="FormbricksClient">
-      {userId}-{email}
-    </div>
-  ),
-}));
 vi.mock("./components/EnvironmentStorageHandler", () => ({
   default: ({ environmentId }: any) => <div data-testid="EnvironmentStorageHandler">{environmentId}</div>,
 }));

apps/web/app/(app)/environments/[environmentId]/settings/(account)/profile/components/DeleteAccount.tsx

@@ -1,6 +1,5 @@
 "use client";
 
-import { formbricksLogout } from "@/app/lib/formbricks";
 import { DeleteAccountModal } from "@/modules/account/components/DeleteAccountModal";
 import { Button } from "@/modules/ui/components/button";
 import { TooltipRenderer } from "@/modules/ui/components/tooltip";
@@ -37,7 +36,6 @@ export const DeleteAccount = ({
         setOpen={setModalOpen}
         user={user}
         isFormbricksCloud={IS_FORMBRICKS_CLOUD}
-        formbricksLogout={formbricksLogout}
         organizationsWithSingleOwner={organizationsWithSingleOwner}
       />
       <p className="text-sm text-slate-700">

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/lib/surveySummary.ts

@@ -409,7 +409,7 @@ export const getQuestionSummary = async (
           }
         });
 
-        Object.entries(choiceCountMap).map(([label, count]) => {
+        Object.entries(choiceCountMap).forEach(([label, count]) => {
           values.push({
             value: label,
             count,
@@ -508,7 +508,7 @@ export const getQuestionSummary = async (
           }
         });
 
-        Object.entries(choiceCountMap).map(([label, count]) => {
+        Object.entries(choiceCountMap).forEach(([label, count]) => {
           values.push({
             rating: parseInt(label),
             count,

apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/actions.ts

@@ -9,6 +9,7 @@ import { checkAuthorizationUpdated } from "@/lib/utils/action-client-middleware"
 import { getOrganizationIdFromSurveyId, getProjectIdFromSurveyId } from "@/lib/utils/helper";
 import { checkMultiLanguagePermission } from "@/modules/ee/multi-language-surveys/lib/actions";
 import { getSurveyFollowUpsPermission } from "@/modules/survey/follow-ups/lib/utils";
+import { checkSpamProtectionPermission } from "@/modules/survey/lib/permission";
 import { z } from "zod";
 import { ZId } from "@formbricks/types/common";
 import { OperationNotAllowedError, ResourceNotFoundError } from "@formbricks/types/errors";
@@ -123,6 +124,10 @@ export const updateSurveyAction = authenticatedActionClient
 
     const { followUps } = parsedInput;
 
+    if (parsedInput.recaptcha?.enabled) {
+      await checkSpamProtectionPermission(organizationId);
+    }
+
     if (followUps?.length) {
       await checkSurveyFollowUpsPermission(organizationId);
     }

apps/web/app/(app)/layout.test.tsx

@@ -36,14 +36,10 @@ vi.mock("@/lib/constants", () => ({
   IS_POSTHOG_CONFIGURED: true,
   POSTHOG_API_HOST: "test-posthog-api-host",
   POSTHOG_API_KEY: "test-posthog-api-key",
-  FORMBRICKS_API_HOST: "mock-formbricks-api-host",
   FORMBRICKS_ENVIRONMENT_ID: "mock-formbricks-environment-id",
   IS_FORMBRICKS_ENABLED: true,
 }));
 
-vi.mock("@/app/(app)/components/FormbricksClient", () => ({
-  FormbricksClient: () => <div data-testid="formbricks-client" />,
-}));
 vi.mock("@/app/intercom/IntercomClientWrapper", () => ({
   IntercomClientWrapper: () => <div data-testid="mock-intercom-wrapper" />,
 }));
@@ -74,17 +70,5 @@ describe("(app) AppLayout", () => {
     expect(screen.getByTestId("mock-intercom-wrapper")).toBeInTheDocument();
     expect(screen.getByTestId("toaster-client")).toBeInTheDocument();
     expect(screen.getByTestId("child-content")).toHaveTextContent("Hello from children");
-    expect(screen.getByTestId("formbricks-client")).toBeInTheDocument();
-  });
-
-  test("skips FormbricksClient if no user is present", async () => {
-    vi.mocked(getServerSession).mockResolvedValueOnce(null);
-
-    const element = await AppLayout({
-      children: <div data-testid="child-content">Hello from children</div>,
-    });
-    render(element);
-
-    expect(screen.queryByTestId("formbricks-client")).not.toBeInTheDocument();
   });
 });

apps/web/app/(app)/layout.tsx

@@ -1,13 +1,5 @@
-import { FormbricksClient } from "@/app/(app)/components/FormbricksClient";
 import { IntercomClientWrapper } from "@/app/intercom/IntercomClientWrapper";
-import {
-  FORMBRICKS_API_HOST,
-  FORMBRICKS_ENVIRONMENT_ID,
-  IS_FORMBRICKS_ENABLED,
-  IS_POSTHOG_CONFIGURED,
-  POSTHOG_API_HOST,
-  POSTHOG_API_KEY,
-} from "@/lib/constants";
+import { IS_POSTHOG_CONFIGURED, POSTHOG_API_HOST, POSTHOG_API_KEY } from "@/lib/constants";
 import { getUser } from "@/lib/user/service";
 import { authOptions } from "@/modules/auth/lib/authOptions";
 import { ClientLogout } from "@/modules/ui/components/client-logout";
@@ -38,15 +30,6 @@ const AppLayout = async ({ children }) => {
       </Suspense>
       <PHProvider posthogEnabled={IS_POSTHOG_CONFIGURED}>
         <>
-          {user ? (
-            <FormbricksClient
-              userId={user.id}
-              email={user.email}
-              formbricksApiHost={FORMBRICKS_API_HOST}
-              formbricksEnvironmentId={FORMBRICKS_ENVIRONMENT_ID}
-              formbricksEnabled={IS_FORMBRICKS_ENABLED}
-            />
-          ) : null}
           <IntercomClientWrapper user={user} />
           <ToasterClient />
           {children}

apps/web/app/api/(internal)/pipeline/lib/tests/__mocks__/survey-follow-up.mock.ts

@@ -156,6 +156,7 @@ export const mockSurvey: TSurvey = {
   isVerifyEmailEnabled: false,
   isSingleResponsePerEmailEnabled: false,
   isBackButtonHidden: false,
+  recaptcha: null,
   projectOverwrites: null,
   styling: null,
   surveyClosedMessage: null,

apps/web/app/api/cron/weekly-summary/lib/notificationResponse.test.ts

@@ -0,0 +1,276 @@
+import { convertResponseValue } from "@/lib/responses";
+import { cleanup } from "@testing-library/react";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { TSurvey, TSurveyQuestion } from "@formbricks/types/surveys/types";
+import {
+  TWeeklyEmailResponseData,
+  TWeeklySummaryEnvironmentData,
+  TWeeklySummarySurveyData,
+} from "@formbricks/types/weekly-summary";
+import { getNotificationResponse } from "./notificationResponse";
+
+vi.mock("@/lib/responses", () => ({
+  convertResponseValue: vi.fn(),
+}));
+
+vi.mock("@/lib/utils/recall", () => ({
+  replaceHeadlineRecall: vi.fn((survey) => survey),
+}));
+
+describe("getNotificationResponse", () => {
+  afterEach(() => {
+    cleanup();
+  });
+
+  test("should return a notification response with calculated insights and survey data when provided with an environment containing multiple surveys", () => {
+    const mockSurveys = [
+      {
+        id: "survey1",
+        name: "Survey 1",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question1",
+            headline: { default: "Question 1" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display1" }],
+        responses: [
+          { id: "response1", finished: true, data: { question1: "Answer 1" } },
+          { id: "response2", finished: false, data: { question1: "Answer 2" } },
+        ],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+      {
+        id: "survey2",
+        name: "Survey 2",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question2",
+            headline: { default: "Question 2" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display2" }],
+        responses: [
+          { id: "response3", finished: true, data: { question2: "Answer 3" } },
+          { id: "response4", finished: true, data: { question2: "Answer 4" } },
+          { id: "response5", finished: false, data: { question2: "Answer 5" } },
+        ],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+    ] as unknown as TWeeklySummarySurveyData[];
+
+    const mockEnvironment = {
+      id: "env1",
+      surveys: mockSurveys,
+    } as unknown as TWeeklySummaryEnvironmentData;
+
+    const projectName = "Project Name";
+
+    const notificationResponse = getNotificationResponse(mockEnvironment, projectName);
+
+    expect(notificationResponse).toBeDefined();
+    expect(notificationResponse.environmentId).toBe("env1");
+    expect(notificationResponse.projectName).toBe(projectName);
+    expect(notificationResponse.surveys).toHaveLength(2);
+
+    expect(notificationResponse.insights.totalCompletedResponses).toBe(3);
+    expect(notificationResponse.insights.totalDisplays).toBe(2);
+    expect(notificationResponse.insights.totalResponses).toBe(5);
+    expect(notificationResponse.insights.completionRate).toBe(60);
+    expect(notificationResponse.insights.numLiveSurvey).toBe(2);
+
+    expect(notificationResponse.surveys[0].id).toBe("survey1");
+    expect(notificationResponse.surveys[0].name).toBe("Survey 1");
+    expect(notificationResponse.surveys[0].status).toBe("inProgress");
+    expect(notificationResponse.surveys[0].responseCount).toBe(2);
+
+    expect(notificationResponse.surveys[1].id).toBe("survey2");
+    expect(notificationResponse.surveys[1].name).toBe("Survey 2");
+    expect(notificationResponse.surveys[1].status).toBe("inProgress");
+    expect(notificationResponse.surveys[1].responseCount).toBe(3);
+  });
+
+  test("should calculate the correct completion rate and other insights when surveys have responses with varying statuses", () => {
+    const mockSurveys = [
+      {
+        id: "survey1",
+        name: "Survey 1",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question1",
+            headline: { default: "Question 1" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display1" }],
+        responses: [
+          { id: "response1", finished: true, data: { question1: "Answer 1" } },
+          { id: "response2", finished: false, data: { question1: "Answer 2" } },
+        ],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+      {
+        id: "survey2",
+        name: "Survey 2",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question2",
+            headline: { default: "Question 2" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display2" }],
+        responses: [
+          { id: "response3", finished: true, data: { question2: "Answer 3" } },
+          { id: "response4", finished: true, data: { question2: "Answer 4" } },
+          { id: "response5", finished: false, data: { question2: "Answer 5" } },
+        ],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+      {
+        id: "survey3",
+        name: "Survey 3",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question3",
+            headline: { default: "Question 3" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display3" }],
+        responses: [{ id: "response6", finished: false, data: { question3: "Answer 6" } }],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+    ] as unknown as TWeeklySummarySurveyData[];
+
+    const mockEnvironment = {
+      id: "env1",
+      surveys: mockSurveys,
+    } as unknown as TWeeklySummaryEnvironmentData;
+
+    const projectName = "Project Name";
+
+    const notificationResponse = getNotificationResponse(mockEnvironment, projectName);
+
+    expect(notificationResponse).toBeDefined();
+    expect(notificationResponse.environmentId).toBe("env1");
+    expect(notificationResponse.projectName).toBe(projectName);
+    expect(notificationResponse.surveys).toHaveLength(3);
+
+    expect(notificationResponse.insights.totalCompletedResponses).toBe(3);
+    expect(notificationResponse.insights.totalDisplays).toBe(3);
+    expect(notificationResponse.insights.totalResponses).toBe(6);
+    expect(notificationResponse.insights.completionRate).toBe(50);
+    expect(notificationResponse.insights.numLiveSurvey).toBe(3);
+
+    expect(notificationResponse.surveys[0].id).toBe("survey1");
+    expect(notificationResponse.surveys[0].name).toBe("Survey 1");
+    expect(notificationResponse.surveys[0].status).toBe("inProgress");
+    expect(notificationResponse.surveys[0].responseCount).toBe(2);
+
+    expect(notificationResponse.surveys[1].id).toBe("survey2");
+    expect(notificationResponse.surveys[1].name).toBe("Survey 2");
+    expect(notificationResponse.surveys[1].status).toBe("inProgress");
+    expect(notificationResponse.surveys[1].responseCount).toBe(3);
+
+    expect(notificationResponse.surveys[2].id).toBe("survey3");
+    expect(notificationResponse.surveys[2].name).toBe("Survey 3");
+    expect(notificationResponse.surveys[2].status).toBe("inProgress");
+    expect(notificationResponse.surveys[2].responseCount).toBe(1);
+  });
+
+  test("should return default insights and an empty surveys array when the environment contains no surveys", () => {
+    const mockEnvironment = {
+      id: "env1",
+      surveys: [],
+    } as unknown as TWeeklySummaryEnvironmentData;
+
+    const projectName = "Project Name";
+
+    const notificationResponse = getNotificationResponse(mockEnvironment, projectName);
+
+    expect(notificationResponse).toBeDefined();
+    expect(notificationResponse.environmentId).toBe("env1");
+    expect(notificationResponse.projectName).toBe(projectName);
+    expect(notificationResponse.surveys).toHaveLength(0);
+
+    expect(notificationResponse.insights.totalCompletedResponses).toBe(0);
+    expect(notificationResponse.insights.totalDisplays).toBe(0);
+    expect(notificationResponse.insights.totalResponses).toBe(0);
+    expect(notificationResponse.insights.completionRate).toBe(0);
+    expect(notificationResponse.insights.numLiveSurvey).toBe(0);
+  });
+
+  test("should handle missing response data gracefully when a response doesn't contain data for a question ID", () => {
+    const mockSurveys = [
+      {
+        id: "survey1",
+        name: "Survey 1",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question1",
+            headline: { default: "Question 1" },
+            type: "text",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display1" }],
+        responses: [
+          { id: "response1", finished: true, data: {} }, // Response missing data for question1
+        ],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+    ] as unknown as TWeeklySummarySurveyData[];
+
+    const mockEnvironment = {
+      id: "env1",
+      surveys: mockSurveys,
+    } as unknown as TWeeklySummaryEnvironmentData;
+
+    const projectName = "Project Name";
+
+    // Mock the convertResponseValue function to handle the missing data case
+    vi.mocked(convertResponseValue).mockReturnValue("");
+
+    const notificationResponse = getNotificationResponse(mockEnvironment, projectName);
+
+    expect(notificationResponse).toBeDefined();
+    expect(notificationResponse.surveys).toHaveLength(1);
+    expect(notificationResponse.surveys[0].responses).toHaveLength(1);
+    expect(notificationResponse.surveys[0].responses[0].responseValue).toBe("");
+  });
+
+  test("should handle unsupported question types gracefully", () => {
+    const mockSurveys = [
+      {
+        id: "survey1",
+        name: "Survey 1",
+        status: "inProgress",
+        questions: [
+          {
+            id: "question1",
+            headline: { default: "Question 1" },
+            type: "unsupported",
+          } as unknown as TSurveyQuestion,
+        ],
+        displays: [{ id: "display1" }],
+        responses: [{ id: "response1", finished: true, data: { question1: "Answer 1" } }],
+      } as unknown as TSurvey & { responses: TWeeklyEmailResponseData[] },
+    ] as unknown as TWeeklySummarySurveyData[];
+
+    const mockEnvironment = {
+      id: "env1",
+      surveys: mockSurveys,
+    } as unknown as TWeeklySummaryEnvironmentData;
+
+    const projectName = "Project Name";
+
+    vi.mocked(convertResponseValue).mockReturnValue("Unsupported Response");
+
+    const notificationResponse = getNotificationResponse(mockEnvironment, projectName);
+
+    expect(notificationResponse).toBeDefined();
+    expect(notificationResponse.surveys[0].responses[0].responseValue).toBe("Unsupported Response");
+  });
+});

apps/web/app/api/cron/weekly-summary/lib/organization.test.ts

@@ -0,0 +1,48 @@
+import { cleanup } from "@testing-library/react";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { getOrganizationIds } from "./organization";
+
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    organization: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+describe("Organization", () => {
+  afterEach(() => {
+    cleanup();
+  });
+
+  test("getOrganizationIds should return an array of organization IDs when the database contains multiple organizations", async () => {
+    const mockOrganizations = [{ id: "org1" }, { id: "org2" }, { id: "org3" }];
+
+    vi.mocked(prisma.organization.findMany).mockResolvedValue(mockOrganizations);
+
+    const organizationIds = await getOrganizationIds();
+
+    expect(organizationIds).toEqual(["org1", "org2", "org3"]);
+    expect(prisma.organization.findMany).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.findMany).toHaveBeenCalledWith({
+      select: {
+        id: true,
+      },
+    });
+  });
+
+  test("getOrganizationIds should return an empty array when the database contains no organizations", async () => {
+    vi.mocked(prisma.organization.findMany).mockResolvedValue([]);
+
+    const organizationIds = await getOrganizationIds();
+
+    expect(organizationIds).toEqual([]);
+    expect(prisma.organization.findMany).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.findMany).toHaveBeenCalledWith({
+      select: {
+        id: true,
+      },
+    });
+  });
+});

apps/web/app/api/cron/weekly-summary/lib/project.test.ts

@@ -0,0 +1,570 @@
+import { cleanup } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { getProjectsByOrganizationId } from "./project";
+
+const mockProjects = [
+  {
+    id: "project1",
+    name: "Project 1",
+    environments: [
+      {
+        id: "env1",
+        type: "production",
+        surveys: [],
+        attributeKeys: [],
+      },
+    ],
+    organization: {
+      memberships: [
+        {
+          user: {
+            id: "user1",
+            email: "test@example.com",
+            notificationSettings: {
+              weeklySummary: {
+                project1: true,
+              },
+            },
+            locale: "en",
+          },
+        },
+      ],
+    },
+  },
+];
+
+const sevenDaysAgo = new Date();
+sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 6); // Set to 6 days ago to be within the last 7 days
+
+const mockProjectsWithNoEnvironments = [
+  {
+    id: "project3",
+    name: "Project 3",
+    environments: [],
+    organization: {
+      memberships: [
+        {
+          user: {
+            id: "user1",
+            email: "test@example.com",
+            notificationSettings: {
+              weeklySummary: {
+                project3: true,
+              },
+            },
+            locale: "en",
+          },
+        },
+      ],
+    },
+  },
+];
+
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    project: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+describe("Project Management", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  describe("getProjectsByOrganizationId", () => {
+    test("retrieves projects with environments, surveys, and organization memberships for a valid organization ID", async () => {
+      vi.mocked(prisma.project.findMany).mockResolvedValueOnce(mockProjects);
+
+      const organizationId = "testOrgId";
+      const projects = await getProjectsByOrganizationId(organizationId);
+
+      expect(projects).toEqual(mockProjects);
+      expect(prisma.project.findMany).toHaveBeenCalledWith({
+        where: {
+          organizationId: organizationId,
+        },
+        select: {
+          id: true,
+          name: true,
+          environments: {
+            where: {
+              type: "production",
+            },
+            select: {
+              id: true,
+              surveys: {
+                where: {
+                  NOT: {
+                    AND: [
+                      { status: "completed" },
+                      {
+                        responses: {
+                          none: {
+                            createdAt: {
+                              gte: expect.any(Date),
+                            },
+                          },
+                        },
+                      },
+                    ],
+                  },
+                  status: {
+                    not: "draft",
+                  },
+                },
+                select: {
+                  id: true,
+                  name: true,
+                  questions: true,
+                  status: true,
+                  responses: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                      createdAt: true,
+                      updatedAt: true,
+                      finished: true,
+                      data: true,
+                    },
+                    orderBy: {
+                      createdAt: "desc",
+                    },
+                  },
+                  displays: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                    },
+                  },
+                  hiddenFields: true,
+                },
+              },
+              attributeKeys: {
+                select: {
+                  id: true,
+                  createdAt: true,
+                  updatedAt: true,
+                  name: true,
+                  description: true,
+                  type: true,
+                  environmentId: true,
+                  key: true,
+                  isUnique: true,
+                },
+              },
+            },
+          },
+          organization: {
+            select: {
+              memberships: {
+                select: {
+                  user: {
+                    select: {
+                      id: true,
+                      email: true,
+                      notificationSettings: true,
+                      locale: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+
+    test("handles date calculations correctly across DST boundaries", async () => {
+      const mockDate = new Date(2024, 10, 3, 0, 0, 0); // November 3, 2024, 00:00:00 (example DST boundary)
+      const sevenDaysAgo = new Date(mockDate);
+      sevenDaysAgo.setDate(mockDate.getDate() - 7);
+
+      vi.useFakeTimers();
+      vi.setSystemTime(mockDate);
+
+      vi.mocked(prisma.project.findMany).mockResolvedValueOnce(mockProjects);
+
+      const organizationId = "testOrgId";
+      await getProjectsByOrganizationId(organizationId);
+
+      expect(prisma.project.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: {
+            organizationId: organizationId,
+          },
+          select: expect.objectContaining({
+            environments: expect.objectContaining({
+              select: expect.objectContaining({
+                surveys: expect.objectContaining({
+                  where: expect.objectContaining({
+                    NOT: expect.objectContaining({
+                      AND: expect.arrayContaining([
+                        expect.objectContaining({ status: "completed" }),
+                        expect.objectContaining({
+                          responses: expect.objectContaining({
+                            none: expect.objectContaining({
+                              createdAt: expect.objectContaining({
+                                gte: sevenDaysAgo,
+                              }),
+                            }),
+                          }),
+                        }),
+                      ]),
+                    }),
+                  }),
+                }),
+              }),
+            }),
+          }),
+        })
+      );
+
+      vi.useRealTimers();
+    });
+
+    test("includes surveys with 'completed' status but responses within the last 7 days", async () => {
+      vi.mocked(prisma.project.findMany).mockResolvedValueOnce(mockProjects);
+
+      const organizationId = "testOrgId";
+      const projects = await getProjectsByOrganizationId(organizationId);
+
+      expect(projects).toEqual(mockProjects);
+      expect(prisma.project.findMany).toHaveBeenCalledWith({
+        where: {
+          organizationId: organizationId,
+        },
+        select: {
+          id: true,
+          name: true,
+          environments: {
+            where: {
+              type: "production",
+            },
+            select: {
+              id: true,
+              surveys: {
+                where: {
+                  NOT: {
+                    AND: [
+                      { status: "completed" },
+                      {
+                        responses: {
+                          none: {
+                            createdAt: {
+                              gte: expect.any(Date),
+                            },
+                          },
+                        },
+                      },
+                    ],
+                  },
+                  status: {
+                    not: "draft",
+                  },
+                },
+                select: {
+                  id: true,
+                  name: true,
+                  questions: true,
+                  status: true,
+                  responses: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                      createdAt: true,
+                      updatedAt: true,
+                      finished: true,
+                      data: true,
+                    },
+                    orderBy: {
+                      createdAt: "desc",
+                    },
+                  },
+                  displays: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                    },
+                  },
+                  hiddenFields: true,
+                },
+              },
+              attributeKeys: {
+                select: {
+                  id: true,
+                  createdAt: true,
+                  updatedAt: true,
+                  name: true,
+                  description: true,
+                  type: true,
+                  environmentId: true,
+                  key: true,
+                  isUnique: true,
+                },
+              },
+            },
+          },
+          organization: {
+            select: {
+              memberships: {
+                select: {
+                  user: {
+                    select: {
+                      id: true,
+                      email: true,
+                      notificationSettings: true,
+                      locale: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+
+    test("returns an empty array when an invalid organization ID is provided", async () => {
+      vi.mocked(prisma.project.findMany).mockResolvedValueOnce([]);
+
+      const invalidOrganizationId = "invalidOrgId";
+      const projects = await getProjectsByOrganizationId(invalidOrganizationId);
+
+      expect(projects).toEqual([]);
+      expect(prisma.project.findMany).toHaveBeenCalledWith({
+        where: {
+          organizationId: invalidOrganizationId,
+        },
+        select: {
+          id: true,
+          name: true,
+          environments: {
+            where: {
+              type: "production",
+            },
+            select: {
+              id: true,
+              surveys: {
+                where: {
+                  NOT: {
+                    AND: [
+                      { status: "completed" },
+                      {
+                        responses: {
+                          none: {
+                            createdAt: {
+                              gte: expect.any(Date),
+                            },
+                          },
+                        },
+                      },
+                    ],
+                  },
+                  status: {
+                    not: "draft",
+                  },
+                },
+                select: {
+                  id: true,
+                  name: true,
+                  questions: true,
+                  status: true,
+                  responses: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                      createdAt: true,
+                      updatedAt: true,
+                      finished: true,
+                      data: true,
+                    },
+                    orderBy: {
+                      createdAt: "desc",
+                    },
+                  },
+                  displays: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                    },
+                  },
+                  hiddenFields: true,
+                },
+              },
+              attributeKeys: {
+                select: {
+                  id: true,
+                  createdAt: true,
+                  updatedAt: true,
+                  name: true,
+                  description: true,
+                  type: true,
+                  environmentId: true,
+                  key: true,
+                  isUnique: true,
+                },
+              },
+            },
+          },
+          organization: {
+            select: {
+              memberships: {
+                select: {
+                  user: {
+                    select: {
+                      id: true,
+                      email: true,
+                      notificationSettings: true,
+                      locale: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+
+    test("handles projects with no environments", async () => {
+      vi.mocked(prisma.project.findMany).mockResolvedValueOnce(mockProjectsWithNoEnvironments);
+
+      const organizationId = "testOrgId";
+      const projects = await getProjectsByOrganizationId(organizationId);
+
+      expect(projects).toEqual(mockProjectsWithNoEnvironments);
+      expect(prisma.project.findMany).toHaveBeenCalledWith({
+        where: {
+          organizationId: organizationId,
+        },
+        select: {
+          id: true,
+          name: true,
+          environments: {
+            where: {
+              type: "production",
+            },
+            select: {
+              id: true,
+              surveys: {
+                where: {
+                  NOT: {
+                    AND: [
+                      { status: "completed" },
+                      {
+                        responses: {
+                          none: {
+                            createdAt: {
+                              gte: expect.any(Date),
+                            },
+                          },
+                        },
+                      },
+                    ],
+                  },
+                  status: {
+                    not: "draft",
+                  },
+                },
+                select: {
+                  id: true,
+                  name: true,
+                  questions: true,
+                  status: true,
+                  responses: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                      createdAt: true,
+                      updatedAt: true,
+                      finished: true,
+                      data: true,
+                    },
+                    orderBy: {
+                      createdAt: "desc",
+                    },
+                  },
+                  displays: {
+                    where: {
+                      createdAt: {
+                        gte: expect.any(Date),
+                      },
+                    },
+                    select: {
+                      id: true,
+                    },
+                  },
+                  hiddenFields: true,
+                },
+              },
+              attributeKeys: {
+                select: {
+                  id: true,
+                  createdAt: true,
+                  updatedAt: true,
+                  name: true,
+                  description: true,
+                  type: true,
+                  environmentId: true,
+                  key: true,
+                  isUnique: true,
+                },
+              },
+            },
+          },
+          organization: {
+            select: {
+              memberships: {
+                select: {
+                  user: {
+                    select: {
+                      id: true,
+                      email: true,
+                      notificationSettings: true,
+                      locale: true,
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+  });
+});

apps/web/app/api/v1/client/[environmentId]/app/sync/lib/contact.test.ts

@@ -0,0 +1,99 @@
+import { cache } from "@/lib/cache";
+import { TContact } from "@/modules/ee/contacts/types/contact";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { getContactByUserId } from "./contact";
+
+// Mock prisma
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    contact: {
+      findFirst: vi.fn(),
+    },
+  },
+}));
+
+// Mock cache\
+vi.mock("@/lib/cache", async () => {
+  const actual = await vi.importActual("@/lib/cache");
+  return {
+    ...(actual as any),
+    cache: vi.fn((fn) => fn()), // Mock cache function to just execute the passed function
+  };
+});
+
+const environmentId = "test-environment-id";
+const userId = "test-user-id";
+const contactId = "test-contact-id";
+
+const contactMock: Partial<TContact> & {
+  attributes: { value: string; attributeKey: { key: string } }[];
+} = {
+  id: contactId,
+  attributes: [
+    { attributeKey: { key: "userId" }, value: userId },
+    { attributeKey: { key: "email" }, value: "test@example.com" },
+  ],
+};
+
+describe("getContactByUserId", () => {
+  beforeEach(() => {
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should return contact if found", async () => {
+    vi.mocked(prisma.contact.findFirst).mockResolvedValue(contactMock as any);
+
+    const contact = await getContactByUserId(environmentId, userId);
+
+    expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+      where: {
+        attributes: {
+          some: {
+            attributeKey: {
+              key: "userId",
+              environmentId,
+            },
+            value: userId,
+          },
+        },
+      },
+      select: {
+        id: true,
+        attributes: { select: { attributeKey: { select: { key: true } }, value: true } },
+      },
+    });
+    expect(contact).toEqual(contactMock);
+  });
+
+  test("should return null if contact not found", async () => {
+    vi.mocked(prisma.contact.findFirst).mockResolvedValue(null);
+
+    const contact = await getContactByUserId(environmentId, userId);
+
+    expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+      where: {
+        attributes: {
+          some: {
+            attributeKey: {
+              key: "userId",
+              environmentId,
+            },
+            value: userId,
+          },
+        },
+      },
+      select: {
+        id: true,
+        attributes: { select: { attributeKey: { select: { key: true } }, value: true } },
+      },
+    });
+    expect(contact).toBeNull();
+  });
+});

apps/web/app/api/v1/client/[environmentId]/app/sync/lib/survey.test.ts

@@ -0,0 +1,309 @@
+import { cache } from "@/lib/cache";
+import { getProjectByEnvironmentId } from "@/lib/project/service";
+import { getSurveys } from "@/lib/survey/service";
+import { anySurveyHasFilters } from "@/lib/survey/utils";
+import { diffInDays } from "@/lib/utils/datetime";
+import { evaluateSegment } from "@/modules/ee/contacts/segments/lib/segments";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError } from "@formbricks/types/errors";
+import { TProject } from "@formbricks/types/project";
+import { TSegment } from "@formbricks/types/segment";
+import { TSurvey } from "@formbricks/types/surveys/types";
+import { getSyncSurveys } from "./survey";
+
+// Mock dependencies
+vi.mock("@/lib/cache", async () => {
+  const actual = await vi.importActual("@/lib/cache");
+  return {
+    ...(actual as any),
+    cache: vi.fn((fn) => fn()), // Mock cache function to just execute the passed function
+  };
+});
+
+vi.mock("@/lib/project/service", () => ({
+  getProjectByEnvironmentId: vi.fn(),
+}));
+vi.mock("@/lib/survey/service", () => ({
+  getSurveys: vi.fn(),
+}));
+vi.mock("@/lib/survey/utils", () => ({
+  anySurveyHasFilters: vi.fn(),
+}));
+vi.mock("@/lib/utils/datetime", () => ({
+  diffInDays: vi.fn(),
+}));
+vi.mock("@/lib/utils/validate", () => ({
+  validateInputs: vi.fn(),
+}));
+vi.mock("@/modules/ee/contacts/segments/lib/segments", () => ({
+  evaluateSegment: vi.fn(),
+}));
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    display: {
+      findMany: vi.fn(),
+    },
+    response: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+
+const environmentId = "test-env-id";
+const contactId = "test-contact-id";
+const contactAttributes = { userId: "user1", email: "test@example.com" };
+const deviceType = "desktop";
+
+const mockProject = {
+  id: "proj1",
+  name: "Test Project",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  organizationId: "org1",
+  environments: [],
+  recontactDays: 10,
+  inAppSurveyBranding: true,
+  linkSurveyBranding: true,
+  placement: "bottomRight",
+  clickOutsideClose: true,
+  darkOverlay: false,
+  languages: [],
+} as unknown as TProject;
+
+const baseSurvey: TSurvey = {
+  id: "survey1",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  name: "Test Survey 1",
+  environmentId: environmentId,
+  type: "app",
+  status: "inProgress",
+  questions: [],
+  displayOption: "displayOnce",
+  recontactDays: null,
+  autoClose: null,
+  closeOnDate: null,
+  delay: 0,
+  displayPercentage: null,
+  autoComplete: null,
+  segment: null,
+  surveyClosedMessage: null,
+  singleUse: null,
+  styling: null,
+  pin: null,
+  resultShareKey: null,
+  displayLimit: null,
+  welcomeCard: { enabled: false } as TSurvey["welcomeCard"],
+  endings: [],
+  triggers: [],
+  languages: [],
+  variables: [],
+  hiddenFields: { enabled: false },
+  createdBy: null,
+  isSingleResponsePerEmailEnabled: false,
+  isVerifyEmailEnabled: false,
+  projectOverwrites: null,
+  runOnDate: null,
+  showLanguageSwitch: false,
+  isBackButtonHidden: false,
+  followUps: [],
+  recaptcha: { enabled: false, threshold: 0.5 },
+};
+
+describe("getSyncSurveys", () => {
+  beforeEach(() => {
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+    vi.mocked(getProjectByEnvironmentId).mockResolvedValue(mockProject);
+    vi.mocked(prisma.display.findMany).mockResolvedValue([]);
+    vi.mocked(prisma.response.findMany).mockResolvedValue([]);
+    vi.mocked(anySurveyHasFilters).mockReturnValue(false);
+    vi.mocked(evaluateSegment).mockResolvedValue(true);
+    vi.mocked(diffInDays).mockReturnValue(100); // Assume enough days passed
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should throw error if product not found", async () => {
+    vi.mocked(getProjectByEnvironmentId).mockResolvedValue(null);
+    await expect(getSyncSurveys(environmentId, contactId, contactAttributes, deviceType)).rejects.toThrow(
+      "Product not found"
+    );
+  });
+
+  test("should return empty array if no surveys found", async () => {
+    vi.mocked(getSurveys).mockResolvedValue([]);
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+  });
+
+  test("should return empty array if no 'app' type surveys in progress", async () => {
+    const surveys: TSurvey[] = [
+      { ...baseSurvey, id: "s1", type: "link", status: "inProgress" },
+      { ...baseSurvey, id: "s2", type: "app", status: "paused" },
+    ];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+  });
+
+  test("should filter by displayOption 'displayOnce'", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", displayOption: "displayOnce" }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(prisma.display.findMany).mockResolvedValue([{ id: "d1", surveyId: "s1", contactId }]); // Already displayed
+
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+
+    vi.mocked(prisma.display.findMany).mockResolvedValue([]); // Not displayed yet
+    const result2 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result2).toEqual(surveys);
+  });
+
+  test("should filter by displayOption 'displayMultiple'", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", displayOption: "displayMultiple" }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(prisma.response.findMany).mockResolvedValue([{ id: "r1", surveyId: "s1", contactId }]); // Already responded
+
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+
+    vi.mocked(prisma.response.findMany).mockResolvedValue([]); // Not responded yet
+    const result2 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result2).toEqual(surveys);
+  });
+
+  test("should filter by displayOption 'displaySome'", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", displayOption: "displaySome", displayLimit: 2 }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(prisma.display.findMany).mockResolvedValue([
+      { id: "d1", surveyId: "s1", contactId },
+      { id: "d2", surveyId: "s1", contactId },
+    ]); // Display limit reached
+
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+
+    vi.mocked(prisma.display.findMany).mockResolvedValue([{ id: "d1", surveyId: "s1", contactId }]); // Within limit
+    const result2 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result2).toEqual(surveys);
+
+    // Test with response already submitted
+    vi.mocked(prisma.response.findMany).mockResolvedValue([{ id: "r1", surveyId: "s1", contactId }]);
+    const result3 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result3).toEqual([]);
+  });
+
+  test("should not filter by displayOption 'respondMultiple'", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", displayOption: "respondMultiple" }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(prisma.display.findMany).mockResolvedValue([{ id: "d1", surveyId: "s1", contactId }]);
+    vi.mocked(prisma.response.findMany).mockResolvedValue([{ id: "r1", surveyId: "s1", contactId }]);
+
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual(surveys);
+  });
+
+  test("should filter by product recontactDays if survey recontactDays is null", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", recontactDays: null }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    const displayDate = new Date();
+    vi.mocked(prisma.display.findMany).mockResolvedValue([
+      { id: "d1", surveyId: "s2", contactId, createdAt: displayDate }, // Display for another survey
+    ]);
+
+    vi.mocked(diffInDays).mockReturnValue(5); // Not enough days passed (product.recontactDays = 10)
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]);
+    expect(diffInDays).toHaveBeenCalledWith(expect.any(Date), displayDate);
+
+    vi.mocked(diffInDays).mockReturnValue(15); // Enough days passed
+    const result2 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result2).toEqual(surveys);
+  });
+
+  test("should return surveys if no segment filters exist", async () => {
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1" }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(anySurveyHasFilters).mockReturnValue(false);
+
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual(surveys);
+    expect(evaluateSegment).not.toHaveBeenCalled();
+  });
+
+  test("should evaluate segment filters if they exist", async () => {
+    const segment = { id: "seg1", filters: [{}] } as TSegment; // Mock filter structure
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", segment }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(anySurveyHasFilters).mockReturnValue(true);
+
+    // Case 1: Segment evaluation matches
+    vi.mocked(evaluateSegment).mockResolvedValue(true);
+    const result1 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result1).toEqual(surveys);
+    expect(evaluateSegment).toHaveBeenCalledWith(
+      {
+        attributes: contactAttributes,
+        deviceType,
+        environmentId,
+        contactId,
+        userId: contactAttributes.userId,
+      },
+      segment.filters
+    );
+
+    // Case 2: Segment evaluation does not match
+    vi.mocked(evaluateSegment).mockResolvedValue(false);
+    const result2 = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result2).toEqual([]);
+  });
+
+  test("should handle Prisma errors", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Test Prisma Error", {
+      code: "P2025",
+      clientVersion: "test",
+    });
+    vi.mocked(getSurveys).mockRejectedValue(prismaError);
+
+    await expect(getSyncSurveys(environmentId, contactId, contactAttributes, deviceType)).rejects.toThrow(
+      DatabaseError
+    );
+    expect(logger.error).toHaveBeenCalledWith(prismaError);
+  });
+
+  test("should handle general errors", async () => {
+    const generalError = new Error("Something went wrong");
+    vi.mocked(getSurveys).mockRejectedValue(generalError);
+
+    await expect(getSyncSurveys(environmentId, contactId, contactAttributes, deviceType)).rejects.toThrow(
+      generalError
+    );
+  });
+
+  test("should throw ResourceNotFoundError if resolved surveys are null after filtering", async () => {
+    const segment = { id: "seg1", filters: [{}] } as TSegment; // Mock filter structure
+    const surveys: TSurvey[] = [{ ...baseSurvey, id: "s1", segment }];
+    vi.mocked(getSurveys).mockResolvedValue(surveys);
+    vi.mocked(anySurveyHasFilters).mockReturnValue(true);
+    vi.mocked(evaluateSegment).mockResolvedValue(false); // Ensure all surveys are filtered out
+
+    // This scenario is tricky to force directly as the code checks `if (!surveys)` before returning.
+    // However, if `Promise.all` somehow resolved to null/undefined (highly unlikely), it should throw.
+    // We can simulate this by mocking `Promise.all` if needed, but the current code structure makes this hard to test.
+    // Let's assume the filter logic works correctly and test the intended path.
+    const result = await getSyncSurveys(environmentId, contactId, contactAttributes, deviceType);
+    expect(result).toEqual([]); // Expect empty array, not an error in this case.
+  });
+});

apps/web/app/api/v1/client/[environmentId]/app/sync/lib/utils.test.ts

@@ -0,0 +1,247 @@
+import { parseRecallInfo } from "@/lib/utils/recall";
+import { describe, expect, test, vi } from "vitest";
+import { TAttributes } from "@formbricks/types/attributes";
+import { TLanguage } from "@formbricks/types/project";
+import {
+  TSurvey,
+  TSurveyEnding,
+  TSurveyQuestion,
+  TSurveyQuestionTypeEnum,
+} from "@formbricks/types/surveys/types";
+import { replaceAttributeRecall } from "./utils";
+
+vi.mock("@/lib/utils/recall", () => ({
+  parseRecallInfo: vi.fn((text, attributes) => {
+    const recallPattern = /recall:([a-zA-Z0-9_-]+)/;
+    const match = text.match(recallPattern);
+    if (match && match[1]) {
+      const recallKey = match[1];
+      const attributeValue = attributes[recallKey];
+      if (attributeValue !== undefined) {
+        return text.replace(recallPattern, `parsed-${attributeValue}`);
+      }
+    }
+    return text; // Return original text if no match or attribute not found
+  }),
+}));
+
+const baseSurvey: TSurvey = {
+  id: "survey1",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  name: "Test Survey",
+  environmentId: "env1",
+  type: "app",
+  status: "inProgress",
+  questions: [],
+  endings: [],
+  welcomeCard: { enabled: false } as TSurvey["welcomeCard"],
+  languages: [
+    { language: { id: "lang1", code: "en" } as unknown as TLanguage, default: true, enabled: true },
+  ],
+  triggers: [],
+  recontactDays: null,
+  displayLimit: null,
+  singleUse: null,
+  styling: null,
+  surveyClosedMessage: null,
+  hiddenFields: { enabled: false },
+  variables: [],
+  createdBy: null,
+  isSingleResponsePerEmailEnabled: false,
+  isVerifyEmailEnabled: false,
+  projectOverwrites: null,
+  runOnDate: null,
+  showLanguageSwitch: false,
+  isBackButtonHidden: false,
+  followUps: [],
+  recaptcha: { enabled: false, threshold: 0.5 },
+  displayOption: "displayOnce",
+  autoClose: null,
+  closeOnDate: null,
+  delay: 0,
+  displayPercentage: null,
+  autoComplete: null,
+  segment: null,
+  pin: null,
+  resultShareKey: null,
+};
+
+const attributes: TAttributes = {
+  name: "John Doe",
+  email: "john.doe@example.com",
+  plan: "premium",
+};
+
+describe("replaceAttributeRecall", () => {
+  test("should replace recall info in question headlines and subheaders", () => {
+    const surveyWithRecall: TSurvey = {
+      ...baseSurvey,
+      questions: [
+        {
+          id: "q1",
+          type: TSurveyQuestionTypeEnum.OpenText,
+          headline: { default: "Hello recall:name!" },
+          subheader: { default: "Your email is recall:email" },
+          required: true,
+          buttonLabel: { default: "Next" },
+          placeholder: { default: "Type here..." },
+          longAnswer: false,
+          logic: [],
+        } as unknown as TSurveyQuestion,
+      ],
+    };
+
+    const result = replaceAttributeRecall(surveyWithRecall, attributes);
+    expect(result.questions[0].headline.default).toBe("Hello parsed-John Doe!");
+    expect(result.questions[0].subheader?.default).toBe("Your email is parsed-john.doe@example.com");
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Hello recall:name!", attributes);
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Your email is recall:email", attributes);
+  });
+
+  test("should replace recall info in welcome card headline", () => {
+    const surveyWithRecall: TSurvey = {
+      ...baseSurvey,
+      welcomeCard: {
+        enabled: true,
+        headline: { default: "Welcome, recall:name!" },
+        html: { default: "<p>Some content</p>" },
+        buttonLabel: { default: "Start" },
+        timeToFinish: false,
+        showResponseCount: false,
+      },
+    };
+
+    const result = replaceAttributeRecall(surveyWithRecall, attributes);
+    expect(result.welcomeCard.headline?.default).toBe("Welcome, parsed-John Doe!");
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Welcome, recall:name!", attributes);
+  });
+
+  test("should replace recall info in end screen headlines and subheaders", () => {
+    const surveyWithRecall: TSurvey = {
+      ...baseSurvey,
+      endings: [
+        {
+          type: "endScreen",
+          headline: { default: "Thank you, recall:name!" },
+          subheader: { default: "Your plan: recall:plan" },
+          buttonLabel: { default: "Finish" },
+          buttonLink: "https://example.com",
+        } as unknown as TSurveyEnding,
+      ],
+    };
+
+    const result = replaceAttributeRecall(surveyWithRecall, attributes);
+    expect(result.endings[0].type).toBe("endScreen");
+    if (result.endings[0].type === "endScreen") {
+      expect(result.endings[0].headline?.default).toBe("Thank you, parsed-John Doe!");
+      expect(result.endings[0].subheader?.default).toBe("Your plan: parsed-premium");
+      expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Thank you, recall:name!", attributes);
+      expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Your plan: recall:plan", attributes);
+    }
+  });
+
+  test("should handle multiple languages", () => {
+    const surveyMultiLang: TSurvey = {
+      ...baseSurvey,
+      languages: [
+        { language: { id: "lang1", code: "en" } as unknown as TLanguage, default: true, enabled: true },
+        { language: { id: "lang2", code: "es" } as unknown as TLanguage, default: false, enabled: true },
+      ],
+      questions: [
+        {
+          id: "q1",
+          type: TSurveyQuestionTypeEnum.OpenText,
+          headline: { default: "Hello recall:name!", es: "Hola recall:name!" },
+          required: true,
+          buttonLabel: { default: "Next", es: "Siguiente" },
+          placeholder: { default: "Type here...", es: "Escribe aquí..." },
+          longAnswer: false,
+          logic: [],
+        } as unknown as TSurveyQuestion,
+      ],
+    };
+
+    const result = replaceAttributeRecall(surveyMultiLang, attributes);
+    expect(result.questions[0].headline.default).toBe("Hello parsed-John Doe!");
+    expect(result.questions[0].headline.es).toBe("Hola parsed-John Doe!");
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Hello recall:name!", attributes);
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Hola recall:name!", attributes);
+  });
+
+  test("should not replace if recall key is not in attributes", () => {
+    const surveyWithRecall: TSurvey = {
+      ...baseSurvey,
+      questions: [
+        {
+          id: "q1",
+          type: TSurveyQuestionTypeEnum.OpenText,
+          headline: { default: "Your company: recall:company" },
+          required: true,
+          buttonLabel: { default: "Next" },
+          placeholder: { default: "Type here..." },
+          longAnswer: false,
+          logic: [],
+        } as unknown as TSurveyQuestion,
+      ],
+    };
+
+    const result = replaceAttributeRecall(surveyWithRecall, attributes);
+    expect(result.questions[0].headline.default).toBe("Your company: recall:company");
+    expect(vi.mocked(parseRecallInfo)).toHaveBeenCalledWith("Your company: recall:company", attributes);
+  });
+
+  test("should handle surveys with no recall information", async () => {
+    const surveyNoRecall: TSurvey = {
+      ...baseSurvey,
+      questions: [
+        {
+          id: "q1",
+          type: TSurveyQuestionTypeEnum.OpenText,
+          headline: { default: "Just a regular question" },
+          required: true,
+          buttonLabel: { default: "Next" },
+          placeholder: { default: "Type here..." },
+          longAnswer: false,
+          logic: [],
+        } as unknown as TSurveyQuestion,
+      ],
+      welcomeCard: {
+        enabled: true,
+        headline: { default: "Welcome!" },
+        html: { default: "<p>Some content</p>" },
+        buttonLabel: { default: "Start" },
+        timeToFinish: false,
+        showResponseCount: false,
+      },
+      endings: [
+        {
+          type: "endScreen",
+          headline: { default: "Thank you!" },
+          buttonLabel: { default: "Finish" },
+        } as unknown as TSurveyEnding,
+      ],
+    };
+    const parseRecallInfoSpy = vi.spyOn(await import("@/lib/utils/recall"), "parseRecallInfo");
+
+    const result = replaceAttributeRecall(surveyNoRecall, attributes);
+    expect(result).toEqual(surveyNoRecall); // Should be unchanged
+    expect(parseRecallInfoSpy).not.toHaveBeenCalled();
+    parseRecallInfoSpy.mockRestore();
+  });
+
+  test("should handle surveys with empty questions, endings, or disabled welcome card", async () => {
+    const surveyEmpty: TSurvey = {
+      ...baseSurvey,
+      questions: [],
+      endings: [],
+      welcomeCard: { enabled: false } as TSurvey["welcomeCard"],
+    };
+    const parseRecallInfoSpy = vi.spyOn(await import("@/lib/utils/recall"), "parseRecallInfo");
+
+    const result = replaceAttributeRecall(surveyEmpty, attributes);
+    expect(result).toEqual(surveyEmpty);
+    expect(parseRecallInfoSpy).not.toHaveBeenCalled();
+    parseRecallInfoSpy.mockRestore();
+  });
+});

apps/web/app/api/v1/client/[environmentId]/environment/lib/actionClass.test.ts

@@ -0,0 +1,86 @@
+import { cache } from "@/lib/cache";
+import { validateInputs } from "@/lib/utils/validate";
+import { describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { TActionClassNoCodeConfig } from "@formbricks/types/action-classes";
+import { DatabaseError } from "@formbricks/types/errors";
+import { TJsEnvironmentStateActionClass } from "@formbricks/types/js";
+import { getActionClassesForEnvironmentState } from "./actionClass";
+
+// Mock dependencies
+vi.mock("@/lib/cache");
+vi.mock("@/lib/utils/validate");
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    actionClass: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+const environmentId = "test-environment-id";
+const mockActionClasses: TJsEnvironmentStateActionClass[] = [
+  {
+    id: "action1",
+    type: "code",
+    name: "Code Action",
+    key: "code-action",
+    noCodeConfig: null,
+  },
+  {
+    id: "action2",
+    type: "noCode",
+    name: "No Code Action",
+    key: null,
+    noCodeConfig: { type: "click" } as TActionClassNoCodeConfig,
+  },
+];
+
+describe("getActionClassesForEnvironmentState", () => {
+  test("should return action classes successfully", async () => {
+    vi.mocked(prisma.actionClass.findMany).mockResolvedValue(mockActionClasses);
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+
+    const result = await getActionClassesForEnvironmentState(environmentId);
+
+    expect(result).toEqual(mockActionClasses);
+    expect(validateInputs).toHaveBeenCalledWith([environmentId, expect.any(Object)]); // ZId is an object
+    expect(prisma.actionClass.findMany).toHaveBeenCalledWith({
+      where: { environmentId },
+      select: {
+        id: true,
+        type: true,
+        name: true,
+        key: true,
+        noCodeConfig: true,
+      },
+    });
+    expect(cache).toHaveBeenCalledWith(
+      expect.any(Function),
+      [`getActionClassesForEnvironmentState-${environmentId}`],
+      { tags: [`environments-${environmentId}-actionClasses`] }
+    );
+  });
+
+  test("should throw DatabaseError on prisma error", async () => {
+    const mockError = new Error("Prisma error");
+    vi.mocked(prisma.actionClass.findMany).mockRejectedValue(mockError);
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+
+    await expect(getActionClassesForEnvironmentState(environmentId)).rejects.toThrow(DatabaseError);
+    await expect(getActionClassesForEnvironmentState(environmentId)).rejects.toThrow(
+      `Database error when fetching actions for environment ${environmentId}`
+    );
+    expect(validateInputs).toHaveBeenCalledWith([environmentId, expect.any(Object)]);
+    expect(prisma.actionClass.findMany).toHaveBeenCalled();
+    expect(cache).toHaveBeenCalledWith(
+      expect.any(Function),
+      [`getActionClassesForEnvironmentState-${environmentId}`],
+      { tags: [`environments-${environmentId}-actionClasses`] }
+    );
+  });
+});

apps/web/app/api/v1/client/[environmentId]/environment/lib/environmentState.test.ts

@@ -0,0 +1,372 @@
+import { cache } from "@/lib/cache";
+import { getEnvironment } from "@/lib/environment/service";
+import {
+  getMonthlyOrganizationResponseCount,
+  getOrganizationByEnvironmentId,
+} from "@/lib/organization/service";
+import {
+  capturePosthogEnvironmentEvent,
+  sendPlanLimitsReachedEventToPosthogWeekly,
+} from "@/lib/posthogServer";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { TActionClass } from "@formbricks/types/action-classes";
+import { TEnvironment } from "@formbricks/types/environment";
+import { ResourceNotFoundError } from "@formbricks/types/errors";
+import { TJsEnvironmentState } from "@formbricks/types/js";
+import { TOrganization } from "@formbricks/types/organizations";
+import { TProject } from "@formbricks/types/project";
+import { TSurvey } from "@formbricks/types/surveys/types";
+import { getActionClassesForEnvironmentState } from "./actionClass";
+import { getEnvironmentState } from "./environmentState";
+import { getProjectForEnvironmentState } from "./project";
+import { getSurveysForEnvironmentState } from "./survey";
+
+// Mock dependencies
+vi.mock("@/lib/cache");
+vi.mock("@/lib/environment/service");
+vi.mock("@/lib/organization/service");
+vi.mock("@/lib/posthogServer");
+vi.mock("@/modules/ee/license-check/lib/utils");
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    environment: {
+      update: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+vi.mock("./actionClass");
+vi.mock("./project");
+vi.mock("./survey");
+vi.mock("@/lib/constants", () => ({
+  IS_FORMBRICKS_CLOUD: true, // Default to false, override in specific tests
+  RECAPTCHA_SITE_KEY: "mock_recaptcha_site_key",
+  RECAPTCHA_SECRET_KEY: "mock_recaptcha_secret_key",
+  IS_RECAPTCHA_CONFIGURED: true,
+  IS_PRODUCTION: true,
+  IS_POSTHOG_CONFIGURED: false,
+  ENTERPRISE_LICENSE_KEY: "mock_enterprise_license_key",
+}));
+
+const environmentId = "test-environment-id";
+
+const mockEnvironment: TEnvironment = {
+  id: environmentId,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  projectId: "test-project-id",
+  type: "production",
+  appSetupCompleted: true, // Default to true
+};
+
+const mockOrganization: TOrganization = {
+  id: "test-org-id",
+  name: "Test Organization",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  billing: {
+    plan: "free",
+    stripeCustomerId: null,
+    period: "monthly",
+    limits: {
+      projects: 1,
+      monthly: {
+        responses: 100, // Default limit
+        miu: 1000,
+      },
+    },
+    periodStart: new Date(),
+  },
+  isAIEnabled: false,
+};
+
+const mockProject: TProject = {
+  id: "test-project-id",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  name: "Test Project",
+  config: {
+    channel: "link",
+    industry: "eCommerce",
+  },
+  organizationId: mockOrganization.id,
+  styling: {
+    allowStyleOverwrite: false,
+  },
+  recontactDays: 30,
+  inAppSurveyBranding: true,
+  linkSurveyBranding: true,
+  placement: "bottomRight",
+  clickOutsideClose: true,
+  darkOverlay: false,
+  environments: [],
+  languages: [],
+};
+
+const mockSurveys: TSurvey[] = [
+  {
+    id: "survey-app-inProgress",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    name: "App Survey In Progress",
+    environmentId: environmentId,
+    type: "app",
+    status: "inProgress",
+    displayLimit: null,
+    endings: [],
+    followUps: [],
+    isBackButtonHidden: false,
+    isSingleResponsePerEmailEnabled: false,
+    isVerifyEmailEnabled: false,
+    projectOverwrites: null,
+    runOnDate: null,
+    showLanguageSwitch: false,
+    questions: [],
+    displayOption: "displayOnce",
+    recontactDays: null,
+    autoClose: null,
+    closeOnDate: null,
+    delay: 0,
+    displayPercentage: null,
+    autoComplete: null,
+    singleUse: null,
+    triggers: [],
+    languages: [],
+    pin: null,
+    resultShareKey: null,
+    segment: null,
+    styling: null,
+    surveyClosedMessage: null,
+    hiddenFields: { enabled: false },
+    welcomeCard: { enabled: false, showResponseCount: false, timeToFinish: false },
+    variables: [],
+    createdBy: null,
+    recaptcha: { enabled: false, threshold: 0.5 },
+  },
+  {
+    id: "survey-app-paused",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    name: "App Survey Paused",
+    environmentId: environmentId,
+    displayLimit: null,
+    endings: [],
+    followUps: [],
+    isBackButtonHidden: false,
+    isSingleResponsePerEmailEnabled: false,
+    isVerifyEmailEnabled: false,
+    projectOverwrites: null,
+    runOnDate: null,
+    showLanguageSwitch: false,
+    type: "app",
+    status: "paused",
+    questions: [],
+    displayOption: "displayOnce",
+    recontactDays: null,
+    autoClose: null,
+    closeOnDate: null,
+    delay: 0,
+    displayPercentage: null,
+    autoComplete: null,
+    singleUse: null,
+    triggers: [],
+    languages: [],
+    pin: null,
+    resultShareKey: null,
+    segment: null,
+    styling: null,
+    surveyClosedMessage: null,
+    hiddenFields: { enabled: false },
+    welcomeCard: { enabled: false, showResponseCount: false, timeToFinish: false },
+    variables: [],
+    createdBy: null,
+    recaptcha: { enabled: false, threshold: 0.5 },
+  },
+  {
+    id: "survey-web-inProgress",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    name: "Web Survey In Progress",
+    environmentId: environmentId,
+    type: "link",
+    displayLimit: null,
+    endings: [],
+    followUps: [],
+    isBackButtonHidden: false,
+    isSingleResponsePerEmailEnabled: false,
+    isVerifyEmailEnabled: false,
+    projectOverwrites: null,
+    runOnDate: null,
+    showLanguageSwitch: false,
+    status: "inProgress",
+    questions: [],
+    displayOption: "displayOnce",
+    recontactDays: null,
+    autoClose: null,
+    closeOnDate: null,
+    delay: 0,
+    displayPercentage: null,
+    autoComplete: null,
+    singleUse: null,
+    triggers: [],
+    languages: [],
+    pin: null,
+    resultShareKey: null,
+    segment: null,
+    styling: null,
+    surveyClosedMessage: null,
+    hiddenFields: { enabled: false },
+    welcomeCard: { enabled: false, showResponseCount: false, timeToFinish: false },
+    variables: [],
+    createdBy: null,
+    recaptcha: { enabled: false, threshold: 0.5 },
+  },
+];
+
+const mockActionClasses: TActionClass[] = [
+  {
+    id: "action-1",
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    name: "Action 1",
+    description: null,
+    type: "code",
+    noCodeConfig: null,
+    environmentId: environmentId,
+    key: "action1",
+  },
+];
+
+describe("getEnvironmentState", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    // Mock the cache implementation
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+    // Default mocks for successful retrieval
+    vi.mocked(getEnvironment).mockResolvedValue(mockEnvironment);
+    vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrganization);
+    vi.mocked(getProjectForEnvironmentState).mockResolvedValue(mockProject);
+    vi.mocked(getSurveysForEnvironmentState).mockResolvedValue(mockSurveys);
+    vi.mocked(getActionClassesForEnvironmentState).mockResolvedValue(mockActionClasses);
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(50); // Default below limit
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should return the correct environment state", async () => {
+    const result = await getEnvironmentState(environmentId);
+
+    const expectedData: TJsEnvironmentState["data"] = {
+      recaptchaSiteKey: "mock_recaptcha_site_key",
+      surveys: [mockSurveys[0]], // Only app, inProgress survey
+      actionClasses: mockActionClasses,
+      project: mockProject,
+    };
+
+    expect(result.data).toEqual(expectedData);
+    expect(result.revalidateEnvironment).toBe(false);
+    expect(getEnvironment).toHaveBeenCalledWith(environmentId);
+    expect(getOrganizationByEnvironmentId).toHaveBeenCalledWith(environmentId);
+    expect(getProjectForEnvironmentState).toHaveBeenCalledWith(environmentId);
+    expect(getSurveysForEnvironmentState).toHaveBeenCalledWith(environmentId);
+    expect(getActionClassesForEnvironmentState).toHaveBeenCalledWith(environmentId);
+    expect(prisma.environment.update).not.toHaveBeenCalled();
+    expect(capturePosthogEnvironmentEvent).not.toHaveBeenCalled();
+    expect(getMonthlyOrganizationResponseCount).toHaveBeenCalled(); // Not cloud
+    expect(sendPlanLimitsReachedEventToPosthogWeekly).not.toHaveBeenCalled();
+  });
+
+  test("should throw ResourceNotFoundError if environment not found", async () => {
+    vi.mocked(getEnvironment).mockResolvedValue(null);
+    await expect(getEnvironmentState(environmentId)).rejects.toThrow(ResourceNotFoundError);
+  });
+
+  test("should throw ResourceNotFoundError if organization not found", async () => {
+    vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(null);
+    await expect(getEnvironmentState(environmentId)).rejects.toThrow(ResourceNotFoundError);
+  });
+
+  test("should throw ResourceNotFoundError if project not found", async () => {
+    vi.mocked(getProjectForEnvironmentState).mockResolvedValue(null);
+    await expect(getEnvironmentState(environmentId)).rejects.toThrow(ResourceNotFoundError);
+  });
+
+  test("should update environment and capture event if app setup not completed", async () => {
+    const incompleteEnv = { ...mockEnvironment, appSetupCompleted: false };
+    vi.mocked(getEnvironment).mockResolvedValue(incompleteEnv);
+
+    const result = await getEnvironmentState(environmentId);
+
+    expect(prisma.environment.update).toHaveBeenCalledWith({
+      where: { id: environmentId },
+      data: { appSetupCompleted: true },
+    });
+    expect(capturePosthogEnvironmentEvent).toHaveBeenCalledWith(environmentId, "app setup completed");
+    expect(result.revalidateEnvironment).toBe(true);
+  });
+
+  test("should return empty surveys if monthly response limit reached (Cloud)", async () => {
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(100); // Exactly at limit
+    vi.mocked(getSurveysForEnvironmentState).mockResolvedValue(mockSurveys);
+
+    const result = await getEnvironmentState(environmentId);
+    expect(result.data.surveys).toEqual([]);
+    expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(mockOrganization.id);
+    expect(sendPlanLimitsReachedEventToPosthogWeekly).toHaveBeenCalledWith(environmentId, {
+      plan: mockOrganization.billing.plan,
+      limits: {
+        projects: null,
+        monthly: {
+          miu: null,
+          responses: mockOrganization.billing.limits.monthly.responses,
+        },
+      },
+    });
+  });
+
+  test("should return surveys if monthly response limit not reached (Cloud)", async () => {
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(99); // Below limit
+
+    const result = await getEnvironmentState(environmentId);
+
+    expect(result.data.surveys).toEqual([mockSurveys[0]]);
+    expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(mockOrganization.id);
+    expect(sendPlanLimitsReachedEventToPosthogWeekly).not.toHaveBeenCalled();
+  });
+
+  test("should handle error when sending Posthog limit reached event", async () => {
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(100);
+    const posthogError = new Error("Posthog failed");
+    vi.mocked(sendPlanLimitsReachedEventToPosthogWeekly).mockRejectedValue(posthogError);
+
+    const result = await getEnvironmentState(environmentId);
+
+    expect(result.data.surveys).toEqual([]);
+    expect(logger.error).toHaveBeenCalledWith(
+      posthogError,
+      "Error sending plan limits reached event to Posthog"
+    );
+  });
+
+  test("should include recaptchaSiteKey if recaptcha variables are set", async () => {
+    const result = await getEnvironmentState(environmentId);
+
+    expect(result.data.recaptchaSiteKey).toBe("mock_recaptcha_site_key");
+  });
+
+  test("should filter surveys correctly (only app type and inProgress status)", async () => {
+    const result = await getEnvironmentState(environmentId);
+    expect(result.data.surveys).toHaveLength(1);
+    expect(result.data.surveys[0].id).toBe("survey-app-inProgress");
+  });
+});

apps/web/app/api/v1/client/[environmentId]/environment/lib/environmentState.ts

@@ -1,6 +1,6 @@
 import { actionClassCache } from "@/lib/actionClass/cache";
 import { cache } from "@/lib/cache";
-import { IS_FORMBRICKS_CLOUD } from "@/lib/constants";
+import { IS_FORMBRICKS_CLOUD, IS_RECAPTCHA_CONFIGURED, RECAPTCHA_SITE_KEY } from "@/lib/constants";
 import { environmentCache } from "@/lib/environment/cache";
 import { getEnvironment } from "@/lib/environment/service";
 import { organizationCache } from "@/lib/organization/cache";
@@ -107,6 +107,7 @@ export const getEnvironmentState = async (
         surveys: !isMonthlyResponsesLimitReached ? filteredSurveys : [],
         actionClasses,
         project: project,
+        ...(IS_RECAPTCHA_CONFIGURED ? { recaptchaSiteKey: RECAPTCHA_SITE_KEY } : {}),
       };
 
       return {

apps/web/app/api/v1/client/[environmentId]/environment/lib/project.test.ts

@@ -0,0 +1,120 @@
+import { cache } from "@/lib/cache";
+import { projectCache } from "@/lib/project/cache";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError } from "@formbricks/types/errors";
+import { TJsEnvironmentStateProject } from "@formbricks/types/js";
+import { getProjectForEnvironmentState } from "./project";
+
+// Mock dependencies
+vi.mock("@/lib/cache");
+vi.mock("@/lib/project/cache");
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    project: {
+      findFirst: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+vi.mock("@/lib/utils/validate"); // Mock validateInputs if needed, though it's often tested elsewhere
+
+const environmentId = "test-environment-id";
+const mockProject: TJsEnvironmentStateProject = {
+  id: "test-project-id",
+  recontactDays: 30,
+  clickOutsideClose: true,
+  darkOverlay: false,
+  placement: "bottomRight",
+  inAppSurveyBranding: true,
+  styling: { allowStyleOverwrite: false },
+};
+
+describe("getProjectForEnvironmentState", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+
+    // Mock cache implementation
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+
+    // Mock projectCache tags
+    vi.mocked(projectCache.tag.byEnvironmentId).mockReturnValue(`project-env-${environmentId}`);
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should return project state successfully", async () => {
+    vi.mocked(prisma.project.findFirst).mockResolvedValue(mockProject);
+
+    const result = await getProjectForEnvironmentState(environmentId);
+
+    expect(result).toEqual(mockProject);
+    expect(prisma.project.findFirst).toHaveBeenCalledWith({
+      where: {
+        environments: {
+          some: {
+            id: environmentId,
+          },
+        },
+      },
+      select: {
+        id: true,
+        recontactDays: true,
+        clickOutsideClose: true,
+        darkOverlay: true,
+        placement: true,
+        inAppSurveyBranding: true,
+        styling: true,
+      },
+    });
+    expect(cache).toHaveBeenCalledTimes(1);
+    expect(cache).toHaveBeenCalledWith(
+      expect.any(Function),
+      [`getProjectForEnvironmentState-${environmentId}`],
+      {
+        tags: [`project-env-${environmentId}`],
+      }
+    );
+  });
+
+  test("should return null if project not found", async () => {
+    vi.mocked(prisma.project.findFirst).mockResolvedValue(null);
+
+    const result = await getProjectForEnvironmentState(environmentId);
+
+    expect(result).toBeNull();
+    expect(prisma.project.findFirst).toHaveBeenCalledTimes(1);
+    expect(cache).toHaveBeenCalledTimes(1);
+  });
+
+  test("should throw DatabaseError on PrismaClientKnownRequestError", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Test error", {
+      code: "P2001",
+      clientVersion: "test",
+    });
+    vi.mocked(prisma.project.findFirst).mockRejectedValue(prismaError);
+
+    await expect(getProjectForEnvironmentState(environmentId)).rejects.toThrow(DatabaseError);
+    expect(logger.error).toHaveBeenCalledWith(prismaError, "Error getting project for environment state");
+    expect(cache).toHaveBeenCalledTimes(1);
+  });
+
+  test("should re-throw unknown errors", async () => {
+    const unknownError = new Error("Something went wrong");
+    vi.mocked(prisma.project.findFirst).mockRejectedValue(unknownError);
+
+    await expect(getProjectForEnvironmentState(environmentId)).rejects.toThrow(unknownError);
+    expect(logger.error).not.toHaveBeenCalled(); // Should not log unknown errors here
+    expect(cache).toHaveBeenCalledTimes(1);
+  });
+});

apps/web/app/api/v1/client/[environmentId]/environment/lib/survey.test.ts

@@ -0,0 +1,143 @@
+import { cache } from "@/lib/cache";
+import { validateInputs } from "@/lib/utils/validate";
+import { transformPrismaSurvey } from "@/modules/survey/lib/utils";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError } from "@formbricks/types/errors";
+import { TJsEnvironmentStateSurvey } from "@formbricks/types/js";
+import { getSurveysForEnvironmentState } from "./survey";
+
+// Mock dependencies
+vi.mock("@/lib/cache");
+vi.mock("@/lib/utils/validate");
+vi.mock("@/modules/survey/lib/utils");
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    survey: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+
+const environmentId = "test-environment-id";
+
+const mockPrismaSurvey = {
+  id: "survey-1",
+  welcomeCard: { enabled: false },
+  name: "Test Survey",
+  questions: [],
+  variables: [],
+  type: "app",
+  showLanguageSwitch: false,
+  languages: [],
+  endings: [],
+  autoClose: null,
+  styling: null,
+  status: "inProgress",
+  recaptcha: null,
+  segment: null,
+  recontactDays: null,
+  displayLimit: null,
+  displayOption: "displayOnce",
+  hiddenFields: { enabled: false },
+  isBackButtonHidden: false,
+  triggers: [],
+  displayPercentage: null,
+  delay: 0,
+  projectOverwrites: null,
+};
+
+const mockTransformedSurvey: TJsEnvironmentStateSurvey = {
+  id: "survey-1",
+  welcomeCard: { enabled: false } as TJsEnvironmentStateSurvey["welcomeCard"],
+  name: "Test Survey",
+  questions: [],
+  variables: [],
+  type: "app",
+  showLanguageSwitch: false,
+  languages: [],
+  endings: [],
+  autoClose: null,
+  styling: null,
+  status: "inProgress",
+  recaptcha: null,
+  segment: null,
+  recontactDays: null,
+  displayLimit: null,
+  displayOption: "displayOnce",
+  hiddenFields: { enabled: false },
+  isBackButtonHidden: false,
+  triggers: [],
+  displayPercentage: null,
+  delay: 0,
+  projectOverwrites: null,
+};
+
+describe("getSurveysForEnvironmentState", () => {
+  beforeEach(() => {
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+    vi.mocked(validateInputs).mockReturnValue([environmentId]); // Assume validation passes
+    vi.mocked(transformPrismaSurvey).mockReturnValue(mockTransformedSurvey);
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should return transformed surveys on successful fetch", async () => {
+    vi.mocked(prisma.survey.findMany).mockResolvedValue([mockPrismaSurvey]);
+
+    const result = await getSurveysForEnvironmentState(environmentId);
+
+    expect(validateInputs).toHaveBeenCalledWith([environmentId, expect.any(Object)]);
+    expect(prisma.survey.findMany).toHaveBeenCalledWith({
+      where: { environmentId },
+      select: expect.any(Object), // Check if select is called, specific fields are in the original code
+    });
+    expect(transformPrismaSurvey).toHaveBeenCalledWith(mockPrismaSurvey);
+    expect(result).toEqual([mockTransformedSurvey]);
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+
+  test("should return an empty array if no surveys are found", async () => {
+    vi.mocked(prisma.survey.findMany).mockResolvedValue([]);
+
+    const result = await getSurveysForEnvironmentState(environmentId);
+
+    expect(prisma.survey.findMany).toHaveBeenCalledWith({
+      where: { environmentId },
+      select: expect.any(Object),
+    });
+    expect(transformPrismaSurvey).not.toHaveBeenCalled();
+    expect(result).toEqual([]);
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+
+  test("should throw DatabaseError on Prisma known request error", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Test Prisma Error", {
+      code: "P2025",
+      clientVersion: "5.0.0",
+    });
+    vi.mocked(prisma.survey.findMany).mockRejectedValue(prismaError);
+
+    await expect(getSurveysForEnvironmentState(environmentId)).rejects.toThrow(DatabaseError);
+    expect(logger.error).toHaveBeenCalledWith(prismaError, "Error getting surveys for environment state");
+  });
+
+  test("should rethrow unknown errors", async () => {
+    const unknownError = new Error("Something went wrong");
+    vi.mocked(prisma.survey.findMany).mockRejectedValue(unknownError);
+
+    await expect(getSurveysForEnvironmentState(environmentId)).rejects.toThrow(unknownError);
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+});

apps/web/app/api/v1/client/[environmentId]/environment/lib/survey.ts

@@ -49,6 +49,7 @@ export const getSurveysForEnvironmentState = reactCache(
               autoClose: true,
               styling: true,
               status: true,
+              recaptcha: true,
               segment: {
                 include: {
                   surveys: {

apps/web/app/api/v1/client/[environmentId]/responses/[responseId]/route.ts

@@ -1,8 +1,10 @@
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
 import { sendToPipeline } from "@/app/lib/pipelines";
-import { updateResponse } from "@/lib/response/service";
+import { validateFileUploads } from "@/lib/fileValidation";
+import { getResponse, updateResponse } from "@/lib/response/service";
 import { getSurvey } from "@/lib/survey/service";
+import { validateOtherOptionLengthForMultipleChoice } from "@/modules/api/v2/lib/question";
 import { logger } from "@formbricks/logger";
 import { DatabaseError, InvalidInputError, ResourceNotFoundError } from "@formbricks/types/errors";
 import { ZResponseUpdateInput } from "@formbricks/types/responses";
@@ -11,6 +13,20 @@ export const OPTIONS = async (): Promise<Response> => {
   return responses.successResponse({}, true);
 };
 
+const handleDatabaseError = (error: Error, url: string, endpoint: string, responseId: string): Response => {
+  if (error instanceof ResourceNotFoundError) {
+    return responses.notFoundResponse("Response", responseId, true);
+  }
+  if (error instanceof InvalidInputError) {
+    return responses.badRequestResponse(error.message, undefined, true);
+  }
+  if (error instanceof DatabaseError) {
+    logger.error({ error, url }, `Error in ${endpoint}`);
+    return responses.internalServerErrorResponse(error.message, true);
+  }
+  return responses.internalServerErrorResponse("Unknown error occurred", true);
+};
+
 export const PUT = async (
   request: Request,
   props: { params: Promise<{ responseId: string }> }
@@ -23,7 +39,6 @@ export const PUT = async (
   }
 
   const responseUpdate = await request.json();
-
   const inputValidation = ZResponseUpdateInput.safeParse(responseUpdate);
 
   if (!inputValidation.success) {
@@ -34,24 +49,12 @@ export const PUT = async (
     );
   }
 
-  // update response
   let response;
   try {
-    response = await updateResponse(responseId, inputValidation.data);
+    response = await getResponse(responseId);
   } catch (error) {
-    if (error instanceof ResourceNotFoundError) {
-      return responses.notFoundResponse("Response", responseId, true);
-    }
-    if (error instanceof InvalidInputError) {
-      return responses.badRequestResponse(error.message);
-    }
-    if (error instanceof DatabaseError) {
-      logger.error(
-        { error, url: request.url },
-        "Error in PUT /api/v1/client/[environmentId]/responses/[responseId]"
-      );
-      return responses.internalServerErrorResponse(error.message);
-    }
+    const endpoint = "PUT /api/v1/client/[environmentId]/responses/[responseId]";
+    return handleDatabaseError(error, request.url, endpoint, responseId);
   }
 
   // get survey to get environmentId
@@ -59,6 +62,39 @@ export const PUT = async (
   try {
     survey = await getSurvey(response.surveyId);
   } catch (error) {
+    const endpoint = "PUT /api/v1/client/[environmentId]/responses/[responseId]";
+    return handleDatabaseError(error, request.url, endpoint, responseId);
+  }
+
+  if (!validateFileUploads(inputValidation.data.data, survey.questions)) {
+    return responses.badRequestResponse("Invalid file upload response", undefined, true);
+  }
+
+  // Validate response data for "other" options exceeding character limit
+  const otherResponseInvalidQuestionId = validateOtherOptionLengthForMultipleChoice({
+    responseData: inputValidation.data.data,
+    surveyQuestions: survey.questions,
+    responseLanguage: inputValidation.data.language,
+  });
+
+  if (otherResponseInvalidQuestionId) {
+    return responses.badRequestResponse(
+      `Response exceeds character limit`,
+      {
+        questionId: otherResponseInvalidQuestionId,
+      },
+      true
+    );
+  }
+
+  // update response
+  let updatedResponse;
+  try {
+    updatedResponse = await updateResponse(responseId, inputValidation.data);
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      return responses.notFoundResponse("Response", responseId, true);
+    }
     if (error instanceof InvalidInputError) {
       return responses.badRequestResponse(error.message);
     }
@@ -77,17 +113,17 @@ export const PUT = async (
     event: "responseUpdated",
     environmentId: survey.environmentId,
     surveyId: survey.id,
-    response,
+    response: updatedResponse,
   });
 
-  if (response.finished) {
+  if (updatedResponse.finished) {
     // send response to pipeline
     // don't await to not block the response
     sendToPipeline({
       event: "responseFinished",
       environmentId: survey.environmentId,
       surveyId: survey.id,
-      response: response,
+      response: updatedResponse,
     });
   }
   return responses.successResponse({}, true);

apps/web/app/api/v1/client/[environmentId]/responses/lib/contact.test.ts

@@ -0,0 +1,160 @@
+import { cache } from "@/lib/cache";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { DatabaseError } from "@formbricks/types/errors";
+import { getContact, getContactByUserId } from "./contact";
+
+// Mock prisma
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    contact: {
+      findUnique: vi.fn(),
+      findFirst: vi.fn(),
+    },
+  },
+}));
+
+// Mock cache module
+vi.mock("@/lib/cache");
+
+// Mock react cache
+vi.mock("react", async () => {
+  const actual = await vi.importActual("react");
+  return {
+    ...actual,
+    cache: vi.fn((fn) => fn), // Mock react's cache to just return the function
+  };
+});
+
+const mockContactId = "test-contact-id";
+const mockEnvironmentId = "test-env-id";
+const mockUserId = "test-user-id";
+
+describe("Contact API Lib", () => {
+  beforeEach(() => {
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  describe("getContact", () => {
+    test("should return contact if found", async () => {
+      const mockContactData = { id: mockContactId };
+      vi.mocked(prisma.contact.findUnique).mockResolvedValue(mockContactData);
+
+      const contact = await getContact(mockContactId);
+
+      expect(prisma.contact.findUnique).toHaveBeenCalledWith({
+        where: { id: mockContactId },
+        select: { id: true },
+      });
+      expect(contact).toEqual(mockContactData);
+    });
+
+    test("should return null if contact not found", async () => {
+      vi.mocked(prisma.contact.findUnique).mockResolvedValue(null);
+
+      const contact = await getContact(mockContactId);
+
+      expect(prisma.contact.findUnique).toHaveBeenCalledWith({
+        where: { id: mockContactId },
+        select: { id: true },
+      });
+      expect(contact).toBeNull();
+    });
+
+    test("should throw DatabaseError on Prisma error", async () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError("Test Prisma Error", {
+        code: "P2025",
+        clientVersion: "5.0.0",
+      });
+      vi.mocked(prisma.contact.findUnique).mockRejectedValue(prismaError);
+
+      await expect(getContact(mockContactId)).rejects.toThrow(DatabaseError);
+      expect(prisma.contact.findUnique).toHaveBeenCalledWith({
+        where: { id: mockContactId },
+        select: { id: true },
+      });
+    });
+  });
+
+  describe("getContactByUserId", () => {
+    test("should return contact with formatted attributes if found", async () => {
+      const mockContactData = {
+        id: mockContactId,
+        attributes: [
+          { attributeKey: { key: "userId" }, value: mockUserId },
+          { attributeKey: { key: "email" }, value: "test@example.com" },
+        ],
+      };
+      vi.mocked(prisma.contact.findFirst).mockResolvedValue(mockContactData);
+
+      const contact = await getContactByUserId(mockEnvironmentId, mockUserId);
+
+      expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+        where: {
+          attributes: {
+            some: {
+              attributeKey: {
+                key: "userId",
+                environmentId: mockEnvironmentId,
+              },
+              value: mockUserId,
+            },
+          },
+        },
+        select: {
+          id: true,
+          attributes: {
+            select: {
+              attributeKey: { select: { key: true } },
+              value: true,
+            },
+          },
+        },
+      });
+      expect(contact).toEqual({
+        id: mockContactId,
+        attributes: {
+          userId: mockUserId,
+          email: "test@example.com",
+        },
+      });
+    });
+
+    test("should return null if contact not found by userId", async () => {
+      vi.mocked(prisma.contact.findFirst).mockResolvedValue(null);
+
+      const contact = await getContactByUserId(mockEnvironmentId, mockUserId);
+
+      expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+        where: {
+          attributes: {
+            some: {
+              attributeKey: {
+                key: "userId",
+                environmentId: mockEnvironmentId,
+              },
+              value: mockUserId,
+            },
+          },
+        },
+        select: {
+          id: true,
+          attributes: {
+            select: {
+              attributeKey: { select: { key: true } },
+              value: true,
+            },
+          },
+        },
+      });
+      expect(contact).toBeNull();
+    });
+  });
+});

apps/web/app/api/v1/client/[environmentId]/responses/lib/response.test.ts

@@ -0,0 +1,201 @@
+import {
+  getMonthlyOrganizationResponseCount,
+  getOrganizationByEnvironmentId,
+} from "@/lib/organization/service";
+import { sendPlanLimitsReachedEventToPosthogWeekly } from "@/lib/posthogServer";
+import { calculateTtcTotal } from "@/lib/response/utils";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { TResponseInput } from "@formbricks/types/responses";
+import { createResponse } from "./response";
+
+let mockIsFormbricksCloud = false;
+
+vi.mock("@/lib/constants", () => ({
+  get IS_FORMBRICKS_CLOUD() {
+    return mockIsFormbricksCloud;
+  },
+}));
+
+vi.mock("@/lib/organization/service", () => ({
+  getMonthlyOrganizationResponseCount: vi.fn(),
+  getOrganizationByEnvironmentId: vi.fn(),
+}));
+
+vi.mock("@/lib/posthogServer", () => ({
+  sendPlanLimitsReachedEventToPosthogWeekly: vi.fn(),
+}));
+
+vi.mock("@/lib/response/cache", () => ({
+  responseCache: {
+    revalidate: vi.fn(),
+  },
+}));
+
+vi.mock("@/lib/response/utils", () => ({
+  calculateTtcTotal: vi.fn((ttc) => ttc),
+}));
+
+vi.mock("@/lib/responseNote/cache", () => ({
+  responseNoteCache: {
+    revalidate: vi.fn(),
+  },
+}));
+
+vi.mock("@/lib/telemetry", () => ({
+  captureTelemetry: vi.fn(),
+}));
+
+vi.mock("@/lib/utils/validate", () => ({
+  validateInputs: vi.fn(),
+}));
+
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    response: {
+      create: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+
+vi.mock("./contact", () => ({
+  getContactByUserId: vi.fn(),
+}));
+
+const environmentId = "test-environment-id";
+const surveyId = "test-survey-id";
+const organizationId = "test-organization-id";
+const responseId = "test-response-id";
+
+const mockOrganization = {
+  id: organizationId,
+  name: "Test Org",
+  billing: {
+    limits: { monthly: { responses: 100 } },
+    plan: "free",
+  },
+};
+
+const mockResponseInput: TResponseInput = {
+  environmentId,
+  surveyId,
+  userId: null,
+  finished: false,
+  data: { question1: "answer1" },
+  meta: { source: "web" },
+  ttc: { question1: 1000 },
+};
+
+const mockResponsePrisma = {
+  id: responseId,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  surveyId,
+  finished: false,
+  data: { question1: "answer1" },
+  meta: { source: "web" },
+  ttc: { question1: 1000 },
+  variables: {},
+  contactAttributes: {},
+  singleUseId: null,
+  language: null,
+  displayId: null,
+  tags: [],
+  notes: [],
+};
+
+describe("createResponse", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrganization as any);
+    vi.mocked(prisma.response.create).mockResolvedValue(mockResponsePrisma as any);
+    vi.mocked(calculateTtcTotal).mockImplementation((ttc) => ttc);
+  });
+
+  afterEach(() => {
+    mockIsFormbricksCloud = false;
+  });
+
+  test("should handle finished response and calculate TTC", async () => {
+    const finishedInput = { ...mockResponseInput, finished: true };
+    await createResponse(finishedInput);
+    expect(calculateTtcTotal).toHaveBeenCalledWith(mockResponseInput.ttc);
+    expect(prisma.response.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ finished: true }),
+      })
+    );
+  });
+
+  test("should check response limits if IS_FORMBRICKS_CLOUD is true", async () => {
+    mockIsFormbricksCloud = true;
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(50);
+
+    await createResponse(mockResponseInput);
+
+    expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(organizationId);
+    expect(sendPlanLimitsReachedEventToPosthogWeekly).not.toHaveBeenCalled();
+  });
+
+  test("should send limit reached event if IS_FORMBRICKS_CLOUD is true and limit reached", async () => {
+    mockIsFormbricksCloud = true;
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(100);
+
+    await createResponse(mockResponseInput);
+
+    expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(organizationId);
+    expect(sendPlanLimitsReachedEventToPosthogWeekly).toHaveBeenCalledWith(environmentId, {
+      plan: "free",
+      limits: {
+        projects: null,
+        monthly: {
+          responses: 100,
+          miu: null,
+        },
+      },
+    });
+  });
+
+  test("should throw ResourceNotFoundError if organization not found", async () => {
+    vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(null);
+    await expect(createResponse(mockResponseInput)).rejects.toThrow(ResourceNotFoundError);
+  });
+
+  test("should throw DatabaseError on Prisma known request error", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Test Prisma Error", {
+      code: "P2002",
+      clientVersion: "test",
+    });
+    vi.mocked(prisma.response.create).mockRejectedValue(prismaError);
+    await expect(createResponse(mockResponseInput)).rejects.toThrow(DatabaseError);
+  });
+
+  test("should throw original error on other Prisma errors", async () => {
+    const genericError = new Error("Generic database error");
+    vi.mocked(prisma.response.create).mockRejectedValue(genericError);
+    await expect(createResponse(mockResponseInput)).rejects.toThrow(genericError);
+  });
+
+  test("should log error but not throw if sendPlanLimitsReachedEventToPosthogWeekly fails", async () => {
+    mockIsFormbricksCloud = true;
+    vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(100);
+    const posthogError = new Error("PostHog error");
+    vi.mocked(sendPlanLimitsReachedEventToPosthogWeekly).mockRejectedValue(posthogError);
+
+    await createResponse(mockResponseInput);
+
+    expect(logger.error).toHaveBeenCalledWith(
+      posthogError,
+      "Error sending plan limits reached event to Posthog"
+    );
+  });
+});

apps/web/app/api/v1/client/[environmentId]/responses/route.ts

@@ -1,6 +1,7 @@
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
 import { sendToPipeline } from "@/app/lib/pipelines";
+import { validateFileUploads } from "@/lib/fileValidation";
 import { capturePosthogEnvironmentEvent } from "@/lib/posthogServer";
 import { getSurvey } from "@/lib/survey/service";
 import { getIsContactsEnabled } from "@/modules/ee/license-check/lib/utils";
@@ -86,6 +87,10 @@ export const POST = async (request: Request, context: Context): Promise<Response
     );
   }
 
+  if (!validateFileUploads(responseInputData.data, survey.questions)) {
+    return responses.badRequestResponse("Invalid file upload response");
+  }
+
   let response: TResponse;
   try {
     const meta: TResponseInput["meta"] = {

apps/web/app/api/v1/client/[environmentId]/storage/lib/uploadPrivateFile.test.ts

@@ -0,0 +1,103 @@
+import { getUploadSignedUrl } from "@/lib/storage/service";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { uploadPrivateFile } from "./uploadPrivateFile";
+
+vi.mock("@/lib/storage/service", () => ({
+  getUploadSignedUrl: vi.fn(),
+}));
+
+describe("uploadPrivateFile", () => {
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  test("should return a success response with signed URL details when getUploadSignedUrl successfully generates a signed URL", async () => {
+    const mockSignedUrlResponse = {
+      signedUrl: "mocked-signed-url",
+      presignedFields: { field1: "value1" },
+      fileUrl: "mocked-file-url",
+    };
+
+    vi.mocked(getUploadSignedUrl).mockResolvedValue(mockSignedUrlResponse);
+
+    const fileName = "test-file.txt";
+    const environmentId = "test-env-id";
+    const fileType = "text/plain";
+
+    const result = await uploadPrivateFile(fileName, environmentId, fileType);
+    const resultData = await result.json();
+
+    expect(getUploadSignedUrl).toHaveBeenCalledWith(fileName, environmentId, fileType, "private", false);
+
+    expect(resultData).toEqual({
+      data: mockSignedUrlResponse,
+    });
+  });
+
+  test("should return a success response when isBiggerFileUploadAllowed is true and getUploadSignedUrl successfully generates a signed URL", async () => {
+    const mockSignedUrlResponse = {
+      signedUrl: "mocked-signed-url",
+      presignedFields: { field1: "value1" },
+      fileUrl: "mocked-file-url",
+    };
+
+    vi.mocked(getUploadSignedUrl).mockResolvedValue(mockSignedUrlResponse);
+
+    const fileName = "test-file.txt";
+    const environmentId = "test-env-id";
+    const fileType = "text/plain";
+    const isBiggerFileUploadAllowed = true;
+
+    const result = await uploadPrivateFile(fileName, environmentId, fileType, isBiggerFileUploadAllowed);
+    const resultData = await result.json();
+
+    expect(getUploadSignedUrl).toHaveBeenCalledWith(
+      fileName,
+      environmentId,
+      fileType,
+      "private",
+      isBiggerFileUploadAllowed
+    );
+
+    expect(resultData).toEqual({
+      data: mockSignedUrlResponse,
+    });
+  });
+
+  test("should return an internal server error response when getUploadSignedUrl throws an error", async () => {
+    vi.mocked(getUploadSignedUrl).mockRejectedValue(new Error("S3 unavailable"));
+
+    const fileName = "test-file.txt";
+    const environmentId = "test-env-id";
+    const fileType = "text/plain";
+
+    const result = await uploadPrivateFile(fileName, environmentId, fileType);
+
+    expect(result.status).toBe(500);
+    const resultData = await result.json();
+    expect(resultData).toEqual({
+      code: "internal_server_error",
+      details: {},
+      message: "Internal server error",
+    });
+  });
+
+  test("should return an internal server error response when fileName has no extension", async () => {
+    vi.mocked(getUploadSignedUrl).mockRejectedValue(new Error("File extension not found"));
+
+    const fileName = "test-file";
+    const environmentId = "test-env-id";
+    const fileType = "text/plain";
+
+    const result = await uploadPrivateFile(fileName, environmentId, fileType);
+    const resultData = await result.json();
+
+    expect(getUploadSignedUrl).toHaveBeenCalledWith(fileName, environmentId, fileType, "private", false);
+    expect(result.status).toBe(500);
+    expect(resultData).toEqual({
+      code: "internal_server_error",
+      details: {},
+      message: "Internal server error",
+    });
+  });
+});

apps/web/app/api/v1/client/[environmentId]/storage/local/route.ts

@@ -4,6 +4,7 @@
 import { responses } from "@/app/lib/api/response";
 import { ENCRYPTION_KEY, UPLOADS_DIR } from "@/lib/constants";
 import { validateLocalSignedUrl } from "@/lib/crypto";
+import { validateFile } from "@/lib/fileValidation";
 import { getOrganizationByEnvironmentId } from "@/lib/organization/service";
 import { putFileToLocalStorage } from "@/lib/storage/service";
 import { getSurvey } from "@/lib/survey/service";
@@ -86,8 +87,14 @@ export const POST = async (req: NextRequest, context: Context): Promise<Response
 
   const fileName = decodeURIComponent(encodedFileName);
 
-  // validate signature
+  // Perform server-side file validation again
+  // This is crucial as attackers could bypass the initial validation and directly call this endpoint
+  const fileValidation = validateFile(fileName, fileType);
+  if (!fileValidation.valid) {
+    return responses.badRequestResponse(fileValidation.error ?? "Invalid file", { fileName, fileType });
+  }
 
+  // validate signature
   const validated = validateLocalSignedUrl(
     signedUuid,
     fileName,

apps/web/app/api/v1/client/[environmentId]/storage/route.ts

@@ -1,5 +1,6 @@
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
+import { validateFile } from "@/lib/fileValidation";
 import { getOrganizationByEnvironmentId } from "@/lib/organization/service";
 import { getSurvey } from "@/lib/survey/service";
 import { getBiggerUploadFileSizePermission } from "@/modules/ee/license-check/lib/utils";
@@ -28,7 +29,6 @@ export const POST = async (req: NextRequest, context: Context): Promise<Response
   const environmentId = params.environmentId;
 
   const jsonInput = await req.json();
-
   const inputValidation = ZUploadFileRequest.safeParse({
     ...jsonInput,
     environmentId,
@@ -44,6 +44,12 @@ export const POST = async (req: NextRequest, context: Context): Promise<Response
 
   const { fileName, fileType, surveyId } = inputValidation.data;
 
+  // Perform server-side file validation
+  const fileValidation = validateFile(fileName, fileType);
+  if (!fileValidation.valid) {
+    return responses.badRequestResponse(fileValidation.error ?? "Invalid file", { fileName, fileType }, true);
+  }
+
   const [survey, organization] = await Promise.all([
     getSurvey(surveyId),
     getOrganizationByEnvironmentId(environmentId),

apps/web/app/api/v1/management/me/lib/utils.test.ts

@@ -0,0 +1,62 @@
+import { getSessionUser } from "@/app/api/v1/management/me/lib/utils";
+import { authOptions } from "@/modules/auth/lib/authOptions";
+import { mockUser } from "@/modules/auth/lib/mock-data";
+import { cleanup } from "@testing-library/react";
+import { NextApiRequest, NextApiResponse } from "next";
+import { getServerSession } from "next-auth";
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+vi.mock("next-auth", () => ({
+  getServerSession: vi.fn(),
+}));
+
+vi.mock("@/modules/auth/lib/authOptions", () => ({
+  authOptions: {},
+}));
+
+describe("getSessionUser", () => {
+  afterEach(() => {
+    cleanup();
+  });
+
+  test("should return the user object when valid req and res are provided", async () => {
+    const mockReq = {} as NextApiRequest;
+    const mockRes = {} as NextApiResponse;
+
+    vi.mocked(getServerSession).mockResolvedValue({ user: mockUser });
+
+    const user = await getSessionUser(mockReq, mockRes);
+
+    expect(user).toEqual(mockUser);
+    expect(getServerSession).toHaveBeenCalledWith(mockReq, mockRes, authOptions);
+  });
+
+  test("should return the user object when neither req nor res are provided", async () => {
+    vi.mocked(getServerSession).mockResolvedValue({ user: mockUser });
+
+    const user = await getSessionUser();
+
+    expect(user).toEqual(mockUser);
+    expect(getServerSession).toHaveBeenCalledWith(authOptions);
+  });
+
+  test("should return undefined if no session exists", async () => {
+    vi.mocked(getServerSession).mockResolvedValue(null);
+
+    const user = await getSessionUser();
+
+    expect(user).toBeUndefined();
+  });
+
+  test("should return null when session exists and user property is null", async () => {
+    const mockReq = {} as NextApiRequest;
+    const mockRes = {} as NextApiResponse;
+
+    vi.mocked(getServerSession).mockResolvedValue({ user: null });
+
+    const user = await getSessionUser(mockReq, mockRes);
+
+    expect(user).toBeNull();
+    expect(getServerSession).toHaveBeenCalledWith(mockReq, mockRes, authOptions);
+  });
+});

apps/web/app/api/v1/management/responses/[responseId]/route.ts

@@ -1,6 +1,7 @@
 import { authenticateRequest, handleErrorResponse } from "@/app/api/v1/auth";
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
+import { validateFileUploads } from "@/lib/fileValidation";
 import { deleteResponse, getResponse, updateResponse } from "@/lib/response/service";
 import { getSurvey } from "@/lib/survey/service";
 import { hasPermission } from "@/modules/organization/settings/api-keys/lib/utils";
@@ -26,7 +27,7 @@ async function fetchAndAuthorizeResponse(
     return { error: responses.unauthorizedResponse() };
   }
 
-  return { response };
+  return { response, survey };
 }
 
 export const GET = async (
@@ -86,6 +87,10 @@ export const PUT = async (
       return responses.badRequestResponse("Malformed JSON input, please check your request body");
     }
 
+    if (!validateFileUploads(responseUpdate.data, result.survey.questions)) {
+      return responses.badRequestResponse("Invalid file upload response");
+    }
+
     const inputValidation = ZResponseUpdateInput.safeParse(responseUpdate);
     if (!inputValidation.success) {
       return responses.badRequestResponse(

apps/web/app/api/v1/management/responses/lib/contact.test.ts

@@ -0,0 +1,121 @@
+import { cache } from "@/lib/cache";
+import { contactCache } from "@/lib/cache/contact";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { TContactAttributes } from "@formbricks/types/contact-attribute";
+import { getContactByUserId } from "./contact";
+
+// Mock prisma
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    contact: {
+      findFirst: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@/lib/cache");
+
+const environmentId = "test-env-id";
+const userId = "test-user-id";
+const contactId = "test-contact-id";
+
+const mockContactDbData = {
+  id: contactId,
+  attributes: [
+    { attributeKey: { key: "userId" }, value: userId },
+    { attributeKey: { key: "email" }, value: "test@example.com" },
+    { attributeKey: { key: "plan" }, value: "premium" },
+  ],
+};
+
+const expectedContactAttributes: TContactAttributes = {
+  userId: userId,
+  email: "test@example.com",
+  plan: "premium",
+};
+
+describe("getContactByUserId", () => {
+  beforeEach(() => {
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+  });
+
+  test("should return contact with attributes when found", async () => {
+    vi.mocked(prisma.contact.findFirst).mockResolvedValue(mockContactDbData);
+
+    const contact = await getContactByUserId(environmentId, userId);
+
+    expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+      where: {
+        attributes: {
+          some: {
+            attributeKey: {
+              key: "userId",
+              environmentId,
+            },
+            value: userId,
+          },
+        },
+      },
+      select: {
+        id: true,
+        attributes: {
+          select: {
+            attributeKey: { select: { key: true } },
+            value: true,
+          },
+        },
+      },
+    });
+    expect(contact).toEqual({
+      id: contactId,
+      attributes: expectedContactAttributes,
+    });
+    expect(cache).toHaveBeenCalledWith(
+      expect.any(Function),
+      [`getContactByUserIdForResponsesApi-${environmentId}-${userId}`],
+      {
+        tags: [contactCache.tag.byEnvironmentIdAndUserId(environmentId, userId)],
+      }
+    );
+  });
+
+  test("should return null when contact is not found", async () => {
+    vi.mocked(prisma.contact.findFirst).mockResolvedValue(null);
+
+    const contact = await getContactByUserId(environmentId, userId);
+
+    expect(prisma.contact.findFirst).toHaveBeenCalledWith({
+      where: {
+        attributes: {
+          some: {
+            attributeKey: {
+              key: "userId",
+              environmentId,
+            },
+            value: userId,
+          },
+        },
+      },
+      select: {
+        id: true,
+        attributes: {
+          select: {
+            attributeKey: { select: { key: true } },
+            value: true,
+          },
+        },
+      },
+    });
+    expect(contact).toBeNull();
+    expect(cache).toHaveBeenCalledWith(
+      expect.any(Function),
+      [`getContactByUserIdForResponsesApi-${environmentId}-${userId}`],
+      {
+        tags: [contactCache.tag.byEnvironmentIdAndUserId(environmentId, userId)],
+      }
+    );
+  });
+});

apps/web/app/api/v1/management/responses/lib/response.test.ts

@@ -0,0 +1,347 @@
+import { cache } from "@/lib/cache";
+import {
+  getMonthlyOrganizationResponseCount,
+  getOrganizationByEnvironmentId,
+} from "@/lib/organization/service";
+import { sendPlanLimitsReachedEventToPosthogWeekly } from "@/lib/posthogServer";
+import { responseCache } from "@/lib/response/cache";
+import { getResponseContact } from "@/lib/response/service";
+import { calculateTtcTotal } from "@/lib/response/utils";
+import { responseNoteCache } from "@/lib/responseNote/cache";
+import { validateInputs } from "@/lib/utils/validate";
+import { Organization, Prisma, Response as ResponsePrisma } from "@prisma/client";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError, ResourceNotFoundError } from "@formbricks/types/errors";
+import { TResponse, TResponseInput } from "@formbricks/types/responses";
+import { getContactByUserId } from "./contact";
+import { createResponse, getResponsesByEnvironmentIds } from "./response";
+
+// Mock Data
+const environmentId = "test-environment-id";
+const organizationId = "test-organization-id";
+const mockUserId = "test-user-id";
+const surveyId = "test-survey-id";
+const displayId = "test-display-id";
+const responseId = "test-response-id";
+
+const mockOrganization = {
+  id: organizationId,
+  name: "Test Org",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  billing: { plan: "free", limits: { monthly: { responses: null } } } as any, // Default no limit
+} as unknown as Organization;
+
+const mockResponseInput: TResponseInput = {
+  environmentId,
+  surveyId,
+  displayId,
+  finished: true,
+  data: { q1: "answer1" },
+  meta: { userAgent: { browser: "test-browser" } },
+  ttc: { q1: 5 },
+  language: "en",
+};
+
+const mockResponseInputWithUserId: TResponseInput = {
+  ...mockResponseInput,
+  userId: mockUserId,
+};
+
+// Prisma response structure (simplified)
+const mockResponsePrisma = {
+  id: responseId,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  surveyId,
+  finished: true,
+  endingId: null,
+  data: { q1: "answer1" },
+  meta: { userAgent: { browser: "test-browser" } },
+  ttc: { q1: 5, total: 10 }, // Assume calculateTtcTotal adds 'total'
+  variables: {},
+  contactAttributes: {},
+  singleUseId: null,
+  language: "en",
+  displayId,
+  contact: null, // Prisma relation
+  tags: [], // Prisma relation
+  notes: [], // Prisma relation
+} as unknown as ResponsePrisma & { contact: any; tags: any[]; notes: any[] }; // Adjust type as needed
+
+const mockResponse: TResponse = {
+  id: responseId,
+  createdAt: mockResponsePrisma.createdAt,
+  updatedAt: mockResponsePrisma.updatedAt,
+  surveyId,
+  finished: true,
+  endingId: null,
+  data: { q1: "answer1" },
+  meta: { userAgent: { browser: "test-browser" } },
+  ttc: { q1: 5, total: 10 },
+  variables: {},
+  contactAttributes: {},
+  singleUseId: null,
+  language: "en",
+  displayId,
+  contact: null, // Transformed structure
+  tags: [], // Transformed structure
+  notes: [], // Transformed structure
+};
+
+const mockEnvironmentIds = [environmentId, "env-2"];
+const mockLimit = 10;
+const mockOffset = 5;
+
+const mockResponsesPrisma = [mockResponsePrisma, { ...mockResponsePrisma, id: "response-2" }];
+const mockTransformedResponses = [mockResponse, { ...mockResponse, id: "response-2" }];
+
+// Mock dependencies
+vi.mock("@/lib/cache");
+vi.mock("@/lib/constants", () => ({
+  IS_FORMBRICKS_CLOUD: true,
+  POSTHOG_API_KEY: "mock-posthog-api-key",
+  POSTHOG_HOST: "mock-posthog-host",
+  IS_POSTHOG_CONFIGURED: true,
+  ENCRYPTION_KEY: "mock-encryption-key",
+  ENTERPRISE_LICENSE_KEY: "mock-enterprise-license-key",
+  GITHUB_ID: "mock-github-id",
+  GITHUB_SECRET: "test-githubID",
+  GOOGLE_CLIENT_ID: "test-google-client-id",
+  GOOGLE_CLIENT_SECRET: "test-google-client-secret",
+  AZUREAD_CLIENT_ID: "test-azuread-client-id",
+  AZUREAD_CLIENT_SECRET: "test-azure",
+  AZUREAD_TENANT_ID: "test-azuread-tenant-id",
+  OIDC_DISPLAY_NAME: "test-oidc-display-name",
+  OIDC_CLIENT_ID: "test-oidc-client-id",
+  OIDC_ISSUER: "test-oidc-issuer",
+  OIDC_CLIENT_SECRET: "test-oidc-client-secret",
+  OIDC_SIGNING_ALGORITHM: "test-oidc-signing-algorithm",
+  WEBAPP_URL: "test-webapp-url",
+  IS_PRODUCTION: false,
+  SENTRY_DSN: "mock-sentry-dsn",
+}));
+vi.mock("@/lib/organization/service");
+vi.mock("@/lib/posthogServer");
+vi.mock("@/lib/response/cache");
+vi.mock("@/lib/response/service");
+vi.mock("@/lib/response/utils");
+vi.mock("@/lib/responseNote/cache");
+vi.mock("@/lib/telemetry");
+vi.mock("@/lib/utils/validate");
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    response: {
+      create: vi.fn(),
+      findMany: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger");
+vi.mock("./contact");
+
+describe("Response Lib Tests", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // No need to mock IS_FORMBRICKS_CLOUD here anymore unless specifically changing it from the default
+    vi.mocked(cache).mockImplementation((fn) => async () => {
+      return fn();
+    });
+  });
+
+  describe("createResponse", () => {
+    test("should create a response successfully with userId", async () => {
+      const mockContact = { id: "contact1", attributes: { userId: mockUserId } };
+      vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrganization);
+      vi.mocked(getContactByUserId).mockResolvedValue(mockContact);
+      vi.mocked(calculateTtcTotal).mockReturnValue({ total: 10 });
+      vi.mocked(prisma.response.create).mockResolvedValue({
+        ...mockResponsePrisma,
+      });
+      vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(50);
+
+      const response = await createResponse(mockResponseInputWithUserId);
+
+      expect(getOrganizationByEnvironmentId).toHaveBeenCalledWith(environmentId);
+      expect(getContactByUserId).toHaveBeenCalledWith(environmentId, mockUserId);
+      expect(prisma.response.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            contact: { connect: { id: mockContact.id } },
+            contactAttributes: mockContact.attributes,
+          }),
+        })
+      );
+      expect(responseCache.revalidate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          contactId: mockContact.id,
+          userId: mockUserId,
+        })
+      );
+      expect(responseNoteCache.revalidate).toHaveBeenCalled();
+      expect(response.contact).toEqual({ id: mockContact.id, userId: mockUserId });
+    });
+
+    test("should throw ResourceNotFoundError if organization not found", async () => {
+      vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(null);
+      await expect(createResponse(mockResponseInput)).rejects.toThrow(ResourceNotFoundError);
+      expect(getOrganizationByEnvironmentId).toHaveBeenCalledWith(environmentId);
+      expect(prisma.response.create).not.toHaveBeenCalled();
+    });
+
+    test("should handle PrismaClientKnownRequestError", async () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError("DB error", {
+        code: "P2002",
+        clientVersion: "2.0",
+      });
+      vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrganization);
+      vi.mocked(prisma.response.create).mockRejectedValue(prismaError);
+
+      await expect(createResponse(mockResponseInput)).rejects.toThrow(DatabaseError);
+      expect(logger.error).not.toHaveBeenCalled(); // Should be caught and re-thrown as DatabaseError
+    });
+
+    test("should handle generic errors", async () => {
+      const genericError = new Error("Something went wrong");
+      vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrganization);
+      vi.mocked(prisma.response.create).mockRejectedValue(genericError);
+
+      await expect(createResponse(mockResponseInput)).rejects.toThrow(genericError);
+    });
+
+    describe("Cloud specific tests", () => {
+      test("should check response limit and send event if limit reached", async () => {
+        // IS_FORMBRICKS_CLOUD is true by default from the top-level mock
+        const limit = 100;
+        const mockOrgWithBilling = {
+          ...mockOrganization,
+          billing: { limits: { monthly: { responses: limit } } },
+        } as any;
+        vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrgWithBilling);
+        vi.mocked(calculateTtcTotal).mockReturnValue({ total: 10 });
+        vi.mocked(prisma.response.create).mockResolvedValue(mockResponsePrisma);
+        vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(limit); // Limit reached
+
+        await createResponse(mockResponseInput);
+
+        expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(organizationId);
+        expect(sendPlanLimitsReachedEventToPosthogWeekly).toHaveBeenCalled();
+      });
+
+      test("should check response limit and not send event if limit not reached", async () => {
+        const limit = 100;
+        const mockOrgWithBilling = {
+          ...mockOrganization,
+          billing: { limits: { monthly: { responses: limit } } },
+        } as any;
+        vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrgWithBilling);
+        vi.mocked(calculateTtcTotal).mockReturnValue({ total: 10 });
+        vi.mocked(prisma.response.create).mockResolvedValue(mockResponsePrisma);
+        vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(limit - 1); // Limit not reached
+
+        await createResponse(mockResponseInput);
+
+        expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(organizationId);
+        expect(sendPlanLimitsReachedEventToPosthogWeekly).not.toHaveBeenCalled();
+      });
+
+      test("should log error if sendPlanLimitsReachedEventToPosthogWeekly fails", async () => {
+        const limit = 100;
+        const mockOrgWithBilling = {
+          ...mockOrganization,
+          billing: { limits: { monthly: { responses: limit } } },
+        } as any;
+        const posthogError = new Error("Posthog error");
+        vi.mocked(getOrganizationByEnvironmentId).mockResolvedValue(mockOrgWithBilling);
+        vi.mocked(calculateTtcTotal).mockReturnValue({ total: 10 });
+        vi.mocked(prisma.response.create).mockResolvedValue(mockResponsePrisma);
+        vi.mocked(getMonthlyOrganizationResponseCount).mockResolvedValue(limit); // Limit reached
+        vi.mocked(sendPlanLimitsReachedEventToPosthogWeekly).mockRejectedValue(posthogError);
+
+        // Expecting successful response creation despite PostHog error
+        const response = await createResponse(mockResponseInput);
+
+        expect(getMonthlyOrganizationResponseCount).toHaveBeenCalledWith(organizationId);
+        expect(sendPlanLimitsReachedEventToPosthogWeekly).toHaveBeenCalled();
+        expect(logger.error).toHaveBeenCalledWith(
+          posthogError,
+          "Error sending plan limits reached event to Posthog"
+        );
+        expect(response).toEqual(mockResponse); // Should still return the created response
+      });
+    });
+  });
+
+  describe("getResponsesByEnvironmentIds", () => {
+    test("should return responses successfully", async () => {
+      vi.mocked(prisma.response.findMany).mockResolvedValue(mockResponsesPrisma);
+      vi.mocked(getResponseContact).mockReturnValue(null); // Assume no contact for simplicity
+
+      const responses = await getResponsesByEnvironmentIds(mockEnvironmentIds);
+
+      expect(validateInputs).toHaveBeenCalledTimes(1);
+      expect(prisma.response.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: {
+            survey: {
+              environmentId: { in: mockEnvironmentIds },
+            },
+          },
+          orderBy: [{ createdAt: "desc" }],
+          take: undefined,
+          skip: undefined,
+        })
+      );
+      expect(getResponseContact).toHaveBeenCalledTimes(mockResponsesPrisma.length);
+      expect(responses).toEqual(mockTransformedResponses);
+      expect(cache).toHaveBeenCalled();
+    });
+
+    test("should return responses with limit and offset", async () => {
+      vi.mocked(prisma.response.findMany).mockResolvedValue(mockResponsesPrisma);
+      vi.mocked(getResponseContact).mockReturnValue(null);
+
+      await getResponsesByEnvironmentIds(mockEnvironmentIds, mockLimit, mockOffset);
+
+      expect(prisma.response.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          take: mockLimit,
+          skip: mockOffset,
+        })
+      );
+      expect(cache).toHaveBeenCalled();
+    });
+
+    test("should return empty array if no responses found", async () => {
+      vi.mocked(prisma.response.findMany).mockResolvedValue([]);
+
+      const responses = await getResponsesByEnvironmentIds(mockEnvironmentIds);
+
+      expect(responses).toEqual([]);
+      expect(prisma.response.findMany).toHaveBeenCalled();
+      expect(getResponseContact).not.toHaveBeenCalled();
+      expect(cache).toHaveBeenCalled();
+    });
+
+    test("should handle PrismaClientKnownRequestError", async () => {
+      const prismaError = new Prisma.PrismaClientKnownRequestError("DB error", {
+        code: "P2002",
+        clientVersion: "2.0",
+      });
+      vi.mocked(prisma.response.findMany).mockRejectedValue(prismaError);
+
+      await expect(getResponsesByEnvironmentIds(mockEnvironmentIds)).rejects.toThrow(DatabaseError);
+      expect(cache).toHaveBeenCalled();
+    });
+
+    test("should handle generic errors", async () => {
+      const genericError = new Error("Something went wrong");
+      vi.mocked(prisma.response.findMany).mockRejectedValue(genericError);
+
+      await expect(getResponsesByEnvironmentIds(mockEnvironmentIds)).rejects.toThrow(genericError);
+      expect(cache).toHaveBeenCalled();
+    });
+  });
+});

apps/web/app/api/v1/management/responses/route.ts

@@ -1,13 +1,14 @@
 import { authenticateRequest } from "@/app/api/v1/auth";
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
+import { validateFileUploads } from "@/lib/fileValidation";
 import { getResponses } from "@/lib/response/service";
 import { getSurvey } from "@/lib/survey/service";
 import { hasPermission } from "@/modules/organization/settings/api-keys/lib/utils";
 import { NextRequest } from "next/server";
 import { logger } from "@formbricks/logger";
 import { DatabaseError, InvalidInputError } from "@formbricks/types/errors";
-import { TResponse, ZResponseInput } from "@formbricks/types/responses";
+import { TResponse, TResponseInput, ZResponseInput } from "@formbricks/types/responses";
 import { createResponse, getResponsesByEnvironmentIds } from "./lib/response";
 
 export const GET = async (request: NextRequest) => {
@@ -47,72 +48,85 @@ export const GET = async (request: NextRequest) => {
   }
 };
 
-export const POST = async (request: Request): Promise<Response> => {
+const validateInput = async (request: Request) => {
+  let jsonInput;
   try {
-    const authentication = await authenticateRequest(request);
-    if (!authentication) return responses.notAuthenticatedResponse();
+    jsonInput = await request.json();
+  } catch (err) {
+    logger.error({ error: err, url: request.url }, "Error parsing JSON input");
+    return { error: responses.badRequestResponse("Malformed JSON input, please check your request body") };
+  }
 
-    let jsonInput;
-
-    try {
-      jsonInput = await request.json();
-    } catch (err) {
-      logger.error({ error: err, url: request.url }, "Error parsing JSON input");
-      return responses.badRequestResponse("Malformed JSON input, please check your request body");
-    }
-
-    const inputValidation = ZResponseInput.safeParse(jsonInput);
-
-    if (!inputValidation.success) {
-      return responses.badRequestResponse(
+  const inputValidation = ZResponseInput.safeParse(jsonInput);
+  if (!inputValidation.success) {
+    return {
+      error: responses.badRequestResponse(
         "Fields are missing or incorrectly formatted",
         transformErrorToDetails(inputValidation.error),
         true
-      );
-    }
+      ),
+    };
+  }
 
-    const responseInput = inputValidation.data;
+  return { data: inputValidation.data };
+};
 
-    const environmentId = responseInput.environmentId;
-
-    if (!hasPermission(authentication.environmentPermissions, environmentId, "POST")) {
-      return responses.unauthorizedResponse();
-    }
-
-    // get and check survey
-    const survey = await getSurvey(responseInput.surveyId);
-    if (!survey) {
-      return responses.notFoundResponse("Survey", responseInput.surveyId, true);
-    }
-    if (survey.environmentId !== environmentId) {
-      return responses.badRequestResponse(
+const validateSurvey = async (responseInput: TResponseInput, environmentId: string) => {
+  const survey = await getSurvey(responseInput.surveyId);
+  if (!survey) {
+    return { error: responses.notFoundResponse("Survey", responseInput.surveyId, true) };
+  }
+  if (survey.environmentId !== environmentId) {
+    return {
+      error: responses.badRequestResponse(
         "Survey is part of another environment",
         {
           "survey.environmentId": survey.environmentId,
           environmentId,
         },
         true
-      );
+      ),
+    };
+  }
+  return { survey };
+};
+
+export const POST = async (request: Request): Promise<Response> => {
+  try {
+    const authentication = await authenticateRequest(request);
+    if (!authentication) return responses.notAuthenticatedResponse();
+
+    const inputResult = await validateInput(request);
+    if (inputResult.error) return inputResult.error;
+
+    const responseInput = inputResult.data;
+    const environmentId = responseInput.environmentId;
+
+    if (!hasPermission(authentication.environmentPermissions, environmentId, "POST")) {
+      return responses.unauthorizedResponse();
+    }
+
+    const surveyResult = await validateSurvey(responseInput, environmentId);
+    if (surveyResult.error) return surveyResult.error;
+
+    if (!validateFileUploads(responseInput.data, surveyResult.survey.questions)) {
+      return responses.badRequestResponse("Invalid file upload response");
     }
 
-    // if there is a createdAt but no updatedAt, set updatedAt to createdAt
     if (responseInput.createdAt && !responseInput.updatedAt) {
       responseInput.updatedAt = responseInput.createdAt;
     }
 
-    let response: TResponse;
     try {
-      response = await createResponse(inputValidation.data);
+      const response = await createResponse(responseInput);
+      return responses.successResponse(response, true);
     } catch (error) {
       if (error instanceof InvalidInputError) {
         return responses.badRequestResponse(error.message);
-      } else {
-        logger.error({ error, url: request.url }, "Error in POST /api/v1/management/responses");
-        return responses.internalServerErrorResponse(error.message);
       }
+      logger.error({ error, url: request.url }, "Error in POST /api/v1/management/responses");
+      return responses.internalServerErrorResponse(error.message);
     }
-
-    return responses.successResponse(response, true);
   } catch (error) {
     if (error instanceof DatabaseError) {
       return responses.badRequestResponse(error.message);

apps/web/app/api/v1/management/storage/lib/getSignedUrl.test.ts

@@ -0,0 +1,58 @@
+import { responses } from "@/app/lib/api/response";
+import { getUploadSignedUrl } from "@/lib/storage/service";
+import { cleanup } from "@testing-library/react";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { getSignedUrlForPublicFile } from "./getSignedUrl";
+
+vi.mock("@/app/lib/api/response", () => ({
+  responses: {
+    successResponse: vi.fn((data) => ({ data })),
+    internalServerErrorResponse: vi.fn((message) => ({ message })),
+  },
+}));
+
+vi.mock("@/lib/storage/service", () => ({
+  getUploadSignedUrl: vi.fn(),
+}));
+
+describe("getSignedUrlForPublicFile", () => {
+  afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+  });
+
+  test("should return success response with signed URL data", async () => {
+    const mockFileName = "test.jpg";
+    const mockEnvironmentId = "env123";
+    const mockFileType = "image/jpeg";
+    const mockSignedUrlResponse = {
+      signedUrl: "http://example.com/signed-url",
+      signingData: { signature: "sig", timestamp: 123, uuid: "uuid" },
+      updatedFileName: "test--fid--uuid.jpg",
+      fileUrl: "http://example.com/file-url",
+    };
+
+    vi.mocked(getUploadSignedUrl).mockResolvedValue(mockSignedUrlResponse);
+
+    const result = await getSignedUrlForPublicFile(mockFileName, mockEnvironmentId, mockFileType);
+
+    expect(getUploadSignedUrl).toHaveBeenCalledWith(mockFileName, mockEnvironmentId, mockFileType, "public");
+    expect(responses.successResponse).toHaveBeenCalledWith(mockSignedUrlResponse);
+    expect(result).toEqual({ data: mockSignedUrlResponse });
+  });
+
+  test("should return internal server error response when getUploadSignedUrl throws an error", async () => {
+    const mockFileName = "test.png";
+    const mockEnvironmentId = "env456";
+    const mockFileType = "image/png";
+    const mockError = new Error("Failed to get signed URL");
+
+    vi.mocked(getUploadSignedUrl).mockRejectedValue(mockError);
+
+    const result = await getSignedUrlForPublicFile(mockFileName, mockEnvironmentId, mockFileType);
+
+    expect(getUploadSignedUrl).toHaveBeenCalledWith(mockFileName, mockEnvironmentId, mockFileType, "public");
+    expect(responses.internalServerErrorResponse).toHaveBeenCalledWith("Internal server error");
+    expect(result).toEqual({ message: "Internal server error" });
+  });
+});

apps/web/app/api/v1/management/storage/local/route.ts

@@ -5,6 +5,7 @@ import { responses } from "@/app/lib/api/response";
 import { ENCRYPTION_KEY, UPLOADS_DIR } from "@/lib/constants";
 import { validateLocalSignedUrl } from "@/lib/crypto";
 import { hasUserEnvironmentAccess } from "@/lib/environment/auth";
+import { validateFile } from "@/lib/fileValidation";
 import { putFileToLocalStorage } from "@/lib/storage/service";
 import { authOptions } from "@/modules/auth/lib/authOptions";
 import { getServerSession } from "next-auth";
@@ -65,6 +66,12 @@ export const POST = async (req: NextRequest): Promise<Response> => {
 
   const fileName = decodeURIComponent(encodedFileName);
 
+  // Perform server-side file validation
+  const fileValidation = validateFile(fileName, fileType);
+  if (!fileValidation.valid) {
+    return responses.badRequestResponse(fileValidation.error ?? "Invalid file");
+  }
+
   // validate signature
 
   const validated = validateLocalSignedUrl(

apps/web/app/api/v1/management/storage/route.ts

@@ -1,5 +1,6 @@
 import { responses } from "@/app/lib/api/response";
 import { hasUserEnvironmentAccess } from "@/lib/environment/auth";
+import { validateFile } from "@/lib/fileValidation";
 import { authOptions } from "@/modules/auth/lib/authOptions";
 import { getServerSession } from "next-auth";
 import { NextRequest } from "next/server";
@@ -36,8 +37,15 @@ export const POST = async (req: NextRequest): Promise<Response> => {
     return responses.badRequestResponse("environmentId is required");
   }
 
+  // Perform server-side file validation first to block dangerous file types
+  const fileValidation = validateFile(fileName, fileType);
+  if (!fileValidation.valid) {
+    return responses.badRequestResponse(fileValidation.error ?? "Invalid file type");
+  }
+
+  // Also perform client-specified allowed file extensions validation if provided
   if (allowedFileExtensions?.length) {
-    const fileExtension = fileName.split(".").pop();
+    const fileExtension = fileName.split(".").pop()?.toLowerCase();
     if (!fileExtension || !allowedFileExtensions.includes(fileExtension)) {
       return responses.badRequestResponse(
         `File extension is not allowed, allowed extensions are: ${allowedFileExtensions.join(", ")}`

apps/web/app/api/v1/management/surveys/[surveyId]/lib/surveys.test.ts

@@ -0,0 +1,153 @@
+import { segmentCache } from "@/lib/cache/segment";
+import { responseCache } from "@/lib/response/cache";
+import { surveyCache } from "@/lib/survey/cache";
+import { validateInputs } from "@/lib/utils/validate";
+import { Prisma } from "@prisma/client";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+import { DatabaseError } from "@formbricks/types/errors";
+import { deleteSurvey } from "./surveys";
+
+// Mock dependencies
+vi.mock("@/lib/cache/segment", () => ({
+  segmentCache: {
+    revalidate: vi.fn(),
+  },
+}));
+vi.mock("@/lib/response/cache", () => ({
+  responseCache: {
+    revalidate: vi.fn(),
+  },
+}));
+vi.mock("@/lib/survey/cache", () => ({
+  surveyCache: {
+    revalidate: vi.fn(),
+  },
+}));
+vi.mock("@/lib/utils/validate", () => ({
+  validateInputs: vi.fn(),
+}));
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    survey: {
+      delete: vi.fn(),
+    },
+    segment: {
+      delete: vi.fn(),
+    },
+  },
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+
+const surveyId = "clq5n7p1q0000m7z0h5p6g3r2";
+const environmentId = "clq5n7p1q0000m7z0h5p6g3r3";
+const segmentId = "clq5n7p1q0000m7z0h5p6g3r4";
+const actionClassId1 = "clq5n7p1q0000m7z0h5p6g3r5";
+const actionClassId2 = "clq5n7p1q0000m7z0h5p6g3r6";
+
+const mockDeletedSurveyAppPrivateSegment = {
+  id: surveyId,
+  environmentId,
+  type: "app",
+  segment: { id: segmentId, isPrivate: true },
+  triggers: [{ actionClass: { id: actionClassId1 } }, { actionClass: { id: actionClassId2 } }],
+  resultShareKey: "shareKey123",
+};
+
+const mockDeletedSurveyLink = {
+  id: surveyId,
+  environmentId,
+  type: "link",
+  segment: null,
+  triggers: [],
+  resultShareKey: null,
+};
+
+describe("deleteSurvey", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("should delete a link survey without a segment and revalidate caches", async () => {
+    vi.mocked(prisma.survey.delete).mockResolvedValue(mockDeletedSurveyLink as any);
+
+    const deletedSurvey = await deleteSurvey(surveyId);
+
+    expect(validateInputs).toHaveBeenCalledWith([surveyId, expect.any(Object)]);
+    expect(prisma.survey.delete).toHaveBeenCalledWith({
+      where: { id: surveyId },
+      include: {
+        segment: true,
+        triggers: { include: { actionClass: true } },
+      },
+    });
+    expect(prisma.segment.delete).not.toHaveBeenCalled();
+    expect(segmentCache.revalidate).not.toHaveBeenCalled(); // No segment to revalidate
+    expect(responseCache.revalidate).toHaveBeenCalledWith({ surveyId, environmentId });
+    expect(surveyCache.revalidate).toHaveBeenCalledTimes(1); // Only for surveyId
+    expect(surveyCache.revalidate).toHaveBeenCalledWith({
+      id: surveyId,
+      environmentId,
+      resultShareKey: undefined,
+    });
+    expect(deletedSurvey).toEqual(mockDeletedSurveyLink);
+  });
+
+  test("should handle PrismaClientKnownRequestError during survey deletion", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Record not found", {
+      code: "P2025",
+      clientVersion: "4.0.0",
+    });
+    vi.mocked(prisma.survey.delete).mockRejectedValue(prismaError);
+
+    await expect(deleteSurvey(surveyId)).rejects.toThrow(DatabaseError);
+    expect(logger.error).toHaveBeenCalledWith({ error: prismaError, surveyId }, "Error deleting survey");
+    expect(prisma.segment.delete).not.toHaveBeenCalled();
+    expect(segmentCache.revalidate).not.toHaveBeenCalled();
+    expect(responseCache.revalidate).not.toHaveBeenCalled();
+    expect(surveyCache.revalidate).not.toHaveBeenCalled();
+  });
+
+  test("should handle PrismaClientKnownRequestError during segment deletion", async () => {
+    const prismaError = new Prisma.PrismaClientKnownRequestError("Foreign key constraint failed", {
+      code: "P2003",
+      clientVersion: "4.0.0",
+    });
+    vi.mocked(prisma.survey.delete).mockResolvedValue(mockDeletedSurveyAppPrivateSegment as any);
+    vi.mocked(prisma.segment.delete).mockRejectedValue(prismaError);
+
+    await expect(deleteSurvey(surveyId)).rejects.toThrow(DatabaseError);
+    expect(logger.error).toHaveBeenCalledWith({ error: prismaError, surveyId }, "Error deleting survey");
+    expect(prisma.segment.delete).toHaveBeenCalledWith({ where: { id: segmentId } });
+    // Caches might have been partially revalidated before the error
+  });
+
+  test("should handle generic errors during deletion", async () => {
+    const genericError = new Error("Something went wrong");
+    vi.mocked(prisma.survey.delete).mockRejectedValue(genericError);
+
+    await expect(deleteSurvey(surveyId)).rejects.toThrow(genericError);
+    expect(logger.error).not.toHaveBeenCalled(); // Should not log generic errors here
+    expect(prisma.segment.delete).not.toHaveBeenCalled();
+  });
+
+  test("should throw validation error for invalid surveyId", async () => {
+    const invalidSurveyId = "invalid-id";
+    const validationError = new Error("Validation failed");
+    vi.mocked(validateInputs).mockImplementation(() => {
+      throw validationError;
+    });
+
+    await expect(deleteSurvey(invalidSurveyId)).rejects.toThrow(validationError);
+    expect(prisma.survey.delete).not.toHaveBeenCalled();
+  });
+});