Do not give everyone permission to read answers

[Natim]

Refs Kinto/kinto#828 (comment)
r? @almet
f? @enguerran

When we created the formbuilder it wasn't possible to let people read the schema without being able to read all the form answer.

This limitation was fixed in Kinto 4.3 and people with the record:create permission can now read the collection schema and their answer only.

This is the implementation of the fix for the formbuilder.

[Natim]

Could be "AUTHENTICATED" or "ANYONE" or a random uuid too.

[almet]

Just a small change needed, otherwise looks good.

[almet]

If you change the name of the function, you need to update the description for it as well (returns the unique identifier of the form, from the administrative token)

[Natim]

Note that this needs Kinto >= 4.3

[enguerran]

I test the new formbuilder with the https://kinto.dev.mozaws.net/v1/ backend.

The admin token is: 91ec309e9a3c463ca63fd8036d9e6d71
The form ID is: 91ec309e9a3c463c

As you can see in the admin console it looks ok! 👍

I suggest to update the README.md as it still refers to userToken instead of formID.

I find a bug too when you create a form without any required field, it fails publishing the form → 2502118#diff-d3be7b791c4d0d2548517ed3b5b9834bR81

[Natim]

I removed the PUBLICATION_FAILED so I should probably put it back.

[enguerran]

In fact, I cannot reproduce. I got an error in the console

TypeError: schema.required is undefined

[Natim]

Yes but the TypeError should change the form status as well.

[enguerran]

You can add something like that to forbid empty form publication:

    if(Object.keys(schema.properties).length === 0) {
      dispatch(addNotification("We cannot publish an empty form.", {type: "error"}));
      dispatch({ type: FORM_PUBLICATION_FAILED });
    }

[almet]

We should already have this somewhere. It rings a bell :)

[almet]

@Natim, how does this affects people with already in use forms? Does this continues to work for them or is this breaking compatibility? Thanks for the precision, and thanks for the code submission :-)

[almet]

This is now ready to be merged!